dovecot/original-hg/dovecot-1.2: src/auth/mech-gssapi.c annotate

annotate src/auth/mech-gssapi.c @ 8826:ff6378d7b209 HEAD

gssapi: Cross-realm authentication fix. Patch by Bryan Jacobs.

author	Timo Sirainen <tss@iki.fi>
date	Fri, 13 Mar 2009 17:42:05 -0400
parents	84eea1977632
children	601e0382b442

rev	line source
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	1 /*
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	2 * GSSAPI Module
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	3 *
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	4 * Copyright (c) 2005 Jelmer Vernooij <jelmer@samba.org>
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	5 *
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	6 * Related standards:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	7 * - draft-ietf-sasl-gssapi-03
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	8 * - RFC2222
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	9 *
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	10 * Some parts inspired by an older patch from Colin Walters
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	11 *
4382 f8d37e26a2b3 Relicensed dovecot-auth to MIT. Timo Sirainen <tss@iki.fi> parents: 4004 diff changeset	12 * This software is released under the MIT license.
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	13 */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	14
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	15 #include "common.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	16 #include "mech.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	17 #include "passdb.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	18 #include "str.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	19 #include "str-sanitize.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	20 #include "buffer.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	21 #include "hex-binary.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	22 #include "safe-memset.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	23
8191 f14e68845b6b GSSAPI: stdlib.h wasn't included with all OSes, causing crash at startup with 64bit systems. Timo Sirainen <tss@iki.fi> parents: 8095 diff changeset	24 #include <stdlib.h>
f14e68845b6b GSSAPI: stdlib.h wasn't included with all OSes, causing crash at startup with 64bit systems. Timo Sirainen <tss@iki.fi> parents: 8095 diff changeset	25
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	26 #ifdef HAVE_GSSAPI
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	27
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	28 #ifndef HAVE___GSS_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	29 # define USE_KRB5_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	30 # include <krb5.h>
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	31 #endif
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	32
4862 bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	33 #ifdef HAVE_GSSAPI_GSSAPI_H
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	34 # include <gssapi/gssapi.h>
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	35 #elif defined (HAVE_GSSAPI_H)
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	36 # include <gssapi.h>
7610 280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	37 #endif
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	38
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	39 #ifdef HAVE_GSSAPI_GSSAPI_KRB5_H
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	40 # include <gssapi/gssapi_krb5.h>
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	41 #elif defined (HAVE_GSSAPI_KRB5_H)
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	42 # include <gssapi_krb5.h>
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	43 #else
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	44 # undef USE_KRB5_USEROK
4862 bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	45 #endif
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	46
5859 dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	47 #ifdef HAVE_GSSAPI_GSSAPI_EXT_H
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	48 # include <gssapi/gssapi_ext.h>
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	49 #endif
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	50
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	51 /* Non-zero flags defined in RFC 2222 */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	52 enum sasl_gssapi_qop {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	53 SASL_GSSAPI_QOP_UNSPECIFIED = 0x00,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	54 SASL_GSSAPI_QOP_AUTH_ONLY = 0x01,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	55 SASL_GSSAPI_QOP_AUTH_INT = 0x02,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	56 SASL_GSSAPI_QOP_AUTH_CONF = 0x04
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	57 };
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	58
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	59 struct gssapi_auth_request {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	60 struct auth_request auth_request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	61 gss_ctx_id_t gss_ctx;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	62 gss_cred_id_t service_cred;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	63
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	64 enum {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	65 GSS_STATE_SEC_CONTEXT,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	66 GSS_STATE_WRAP,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	67 GSS_STATE_UNWRAP
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	68 } sasl_gssapi_state;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	69
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	70 gss_name_t authn_name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	71 gss_name_t authz_name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	72
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	73 pool_t pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	74 };
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	75
8068 9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	76 static bool gssapi_initialized = FALSE;
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	77
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	78 static void auth_request_log_gss_error(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	79 OM_uint32 status_value, int status_type,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	80 const char *description)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	81 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	82 OM_uint32 message_context = 0;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	83 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	84 gss_buffer_desc status_string;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	85
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	86 do {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	87 major_status = gss_display_status(&minor_status, status_value,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	88 status_type, GSS_C_NO_OID,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	89 &message_context,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	90 &status_string);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	91
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	92 auth_request_log_error(request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	93 "While %s: %s", description,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	94 str_sanitize(status_string.value, (size_t)-1));
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	95
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	96 major_status = gss_release_buffer(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	97 &status_string);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	98 } while (message_context != 0);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	99 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	100
8068 9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	101 static void mech_gssapi_initialize(void)
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	102 {
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	103 const char *path;
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	104
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	105 path = getenv("KRB5_KTNAME");
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	106 if (path != NULL) {
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	107 #ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	108 gsskrb5_register_acceptor_identity(path);
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	109 #elif defined (HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY)
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	110 krb5_gss_register_acceptor_identity(path);
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	111 #endif
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	112 }
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	113 }
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	114
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	115 static struct auth_request *mech_gssapi_auth_new(void)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	116 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	117 struct gssapi_auth_request *request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	118 pool_t pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	119
8068 9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	120 if (!gssapi_initialized) {
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	121 gssapi_initialized = TRUE;
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	122 mech_gssapi_initialize();
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	123 }
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	124
3695 4f8598b0ca62 Use a bit larger initial pool sizes Timo Sirainen <tss@iki.fi> parents: 3683 diff changeset	125 pool = pool_alloconly_create("gssapi_auth_request", 1024);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	126 request = p_new(pool, struct gssapi_auth_request, 1);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	127 request->pool = pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	128
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	129 request->gss_ctx = GSS_C_NO_CONTEXT;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	130
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	131 request->auth_request.pool = pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	132 return &request->auth_request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	133 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	134
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	135 static OM_uint32 obtain_service_credentials(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	136 gss_cred_id_t *ret)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	137 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	138 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	139 string_t *principal_name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	140 gss_buffer_desc inbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	141 gss_name_t gss_principal;
4628 fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	142 const char *service_name;
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	143
8093 9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts. Timo Sirainen <tss@iki.fi> parents: 8068 diff changeset	144 if (strcmp(request->auth->gssapi_hostname, "$ALL") == 0) {
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts. Timo Sirainen <tss@iki.fi> parents: 8068 diff changeset	145 auth_request_log_info(request, "gssapi",
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts. Timo Sirainen <tss@iki.fi> parents: 8068 diff changeset	146 "Using all keytab entries");
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts. Timo Sirainen <tss@iki.fi> parents: 8068 diff changeset	147 *ret = GSS_C_NO_CREDENTIAL;
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts. Timo Sirainen <tss@iki.fi> parents: 8068 diff changeset	148 return GSS_S_COMPLETE;
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts. Timo Sirainen <tss@iki.fi> parents: 8068 diff changeset	149 }
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts. Timo Sirainen <tss@iki.fi> parents: 8068 diff changeset	150
4628 fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	151 if (strcasecmp(request->service, "POP3") == 0) {
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	152 /* The standard POP3 service name with GSSAPI is called
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	153 just "pop". */
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	154 service_name = "pop";
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	155 } else {
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	156 service_name = t_str_lcase(request->service);
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	157 }
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	158
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	159 principal_name = t_str_new(128);
4628 fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	160 str_append(principal_name, service_name);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	161 str_append_c(principal_name, '@');
5439 c5401a8f4679 Added auth_gssapi_hostname setting. Timo Sirainen <tss@iki.fi> parents: 5259 diff changeset	162 str_append(principal_name, request->auth->gssapi_hostname);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	163
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	164 auth_request_log_info(request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	165 "Obtaining credentials for %s", str_c(principal_name));
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	166
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	167 inbuf.length = str_len(principal_name);
4451 1a35d53c18fc Array API redesigned to work using unions. It now provides type safety Timo Sirainen <tss@iki.fi> parents: 4382 diff changeset	168 inbuf.value = str_c_modifiable(principal_name);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	169
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	170 major_status = gss_import_name(&minor_status, &inbuf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	171 GSS_C_NT_HOSTBASED_SERVICE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	172 &gss_principal);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	173
3879 928229f8b3e6 deinit, unref, destroy, close, free, etc. functions now take a pointer to Timo Sirainen <tss@iki.fi> parents: 3766 diff changeset	174 str_free(&principal_name);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	175
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	176 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	177 auth_request_log_gss_error(request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	178 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	179 "importing principal name");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	180 return major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	181 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	182
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	183 major_status = gss_acquire_cred(&minor_status, gss_principal, 0,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	184 GSS_C_NULL_OID_SET, GSS_C_ACCEPT,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	185 ret, NULL, NULL);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	186
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	187 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	188 auth_request_log_gss_error(request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	189 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	190 "acquiring service credentials");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	191 auth_request_log_gss_error(request, minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	192 GSS_C_MECH_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	193 "acquiring service credentials");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	194 return major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	195 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	196
4004 10d1c3301b87 Crashfix. Patch by Mark Davies Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	197 gss_release_name(&minor_status, &gss_principal);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	198
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	199 return major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	200 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	201
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	202 #ifndef HAVE___GSS_USEROK
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	203 static gss_name_t
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	204 import_name(struct auth_request request, void str, size_t len)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	205 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	206 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	207 gss_buffer_desc name_buf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	208 gss_name_t name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	209
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	210 name_buf.value = str;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	211 name_buf.length = len;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	212 major_status = gss_import_name(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	213 &name_buf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	214 GSS_C_NO_OID,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	215 &name);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	216 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	217 auth_request_log_gss_error(request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	218 GSS_C_GSS_CODE, "gss_import_name");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	219 return GSS_C_NO_NAME;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	220 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	221
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	222 return name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	223 }
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	224 #endif
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	225
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	226 static void gssapi_sec_context(struct gssapi_auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	227 gss_buffer_desc inbuf)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	228 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	229 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	230 gss_buffer_desc outbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	231
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	232 major_status = gss_accept_sec_context (
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	233 &minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	234 &request->gss_ctx,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	235 request->service_cred,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	236 &inbuf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	237 GSS_C_NO_CHANNEL_BINDINGS,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	238 &request->authn_name,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	239 NULL, /* mech_type */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	240 &outbuf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	241 NULL, /* ret_flags */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	242 NULL, /* time_rec */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	243 NULL /* delegated_cred_handle */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	244 );
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	245
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	246 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	247 auth_request_log_gss_error(&request->auth_request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	248 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	249 "processing incoming data");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	250 auth_request_log_gss_error(&request->auth_request, minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	251 GSS_C_MECH_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	252 "processing incoming data");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	253
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	254 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	255 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	256 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	257
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	258 if (major_status == GSS_S_COMPLETE) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	259 request->sasl_gssapi_state = GSS_STATE_WRAP;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	260 auth_request_log_info(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	261 "security context state completed.");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	262 } else {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	263 auth_request_log_info(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	264 "Processed incoming packet correctly, "
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	265 "waiting for another.");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	266 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	267
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	268 request->auth_request.callback(&request->auth_request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	269 AUTH_CLIENT_RESULT_CONTINUE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	270 outbuf.value, outbuf.length);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	271
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	272 major_status = gss_release_buffer(&minor_status, &outbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	273 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	274
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	275 static void gssapi_wrap(struct gssapi_auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	276 gss_buffer_desc inbuf)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	277 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	278 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	279 gss_buffer_desc outbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	280 unsigned char ret[4];
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	281
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	282 /* The clients return data should be empty here */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	283
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	284 /* Only authentication, no integrity or confidentiality
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	285 protection (yet?) */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	286 ret[0] = (SASL_GSSAPI_QOP_UNSPECIFIED \|
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	287 SASL_GSSAPI_QOP_AUTH_ONLY);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	288 ret[1] = 0xFF;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	289 ret[2] = 0xFF;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	290 ret[3] = 0xFF;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	291
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	292 inbuf.length = 4;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	293 inbuf.value = ret;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	294
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	295 major_status = gss_wrap(&minor_status, request->gss_ctx, 0,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	296 GSS_C_QOP_DEFAULT, &inbuf, NULL, &outbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	297
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	298 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	299 auth_request_log_gss_error(&request->auth_request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	300 GSS_C_GSS_CODE, "sending security layer negotiation");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	301 auth_request_log_gss_error(&request->auth_request, minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	302 GSS_C_MECH_CODE, "sending security layer negotiation");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	303 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	304 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	305 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	306
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	307 auth_request_log_info(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	308 "Negotiated security layer");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	309
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	310 request->auth_request.callback(&request->auth_request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	311 AUTH_CLIENT_RESULT_CONTINUE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	312 outbuf.value, outbuf.length);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	313
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	314 major_status = gss_release_buffer(&minor_status, &outbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	315
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	316 request->sasl_gssapi_state = GSS_STATE_UNWRAP;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	317 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	318
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	319 #ifdef USE_KRB5_USEROK
8826 ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	320 static bool
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	321 gssapi_krb5_userok(struct gssapi_auth_request *request, gss_name_t name,
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	322 bool check_name_type)
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	323 {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	324 krb5_context ctx;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	325 krb5_principal princ;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	326 krb5_error_code krb5_err;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	327 OM_uint32 major_status, minor_status;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	328 gss_buffer_desc princ_name;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	329 gss_OID name_type;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	330 const char *princ_display_name;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	331 bool ret = FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	332
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	333 /* Parse out the principal's username */
8826 ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	334 major_status = gss_display_name(&minor_status, name,
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	335 &princ_name, &name_type);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	336 if (major_status != GSS_S_COMPLETE) {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	337 auth_request_log_gss_error(&request->auth_request, major_status,
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	338 GSS_C_GSS_CODE,
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	339 "gssapi_krb5_userok");
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	340 return FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	341 }
8826 ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	342 if (name_type != GSS_KRB5_NT_PRINCIPAL_NAME && check_name_type) {
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	343 auth_request_log_error(&request->auth_request, "gssapi",
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	344 "OID not kerberos principal name");
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	345 return FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	346 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	347 princ_display_name = t_strndup(princ_name.value, princ_name.length);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	348 gss_release_buffer(&minor_status, &princ_name);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	349
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	350 /* Init a krb5 context and parse the principal username */
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	351 krb5_err = krb5_init_context(&ctx);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	352 if (krb5_err != 0) {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	353 auth_request_log_error(&request->auth_request, "gssapi",
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	354 "krb5_init_context() failed: %d", (int)krb5_err);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	355 return FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	356 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	357 krb5_err = krb5_parse_name(ctx, princ_display_name, &princ);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	358 if (krb5_err != 0) {
7480 ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	359 /* writing the error string would be better, but we probably
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	360 rarely get here and there doesn't seem to be a standard
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	361 way of getting it */
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	362 auth_request_log_error(&request->auth_request, "gssapi",
7480 ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	363 "krb5_parse_name() failed: %d",
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	364 (int)krb5_err);
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	365 } else {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	366 /* See if the principal is authorized to act as the
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	367 specified user */
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	368 ret = krb5_kuserok(ctx, princ, request->auth_request.user);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	369 krb5_free_principal(ctx, princ);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	370 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	371 krb5_free_context(ctx);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	372 return ret;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	373 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	374 #endif
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	375
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	376 static void gssapi_unwrap(struct gssapi_auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	377 gss_buffer_desc inbuf)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	378 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	379 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	380 gss_buffer_desc outbuf;
8826 ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	381 #if defined(HAVE___GSS_USEROK) \|\| !defined(USE_KRB5_USEROK)
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	382 int equal_authn_authz = 0;
8826 ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	383 #endif
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	384 major_status = gss_unwrap(&minor_status, request->gss_ctx,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	385 &inbuf, &outbuf, NULL, NULL);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	386
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	387 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	388 auth_request_log_gss_error(&request->auth_request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	389 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	390 "final negotiation: gss_unwrap");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	391 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	392 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	393 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	394
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	395 if (outbuf.length <= 4) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	396 auth_request_log_error(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	397 "Invalid response length");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	398 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	399 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	400 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	401
5859 dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	402 #ifdef HAVE___GSS_USEROK
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	403 /* Solaris __gss_userok() correctly handles cross-realm
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	404 authentication. */
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	405 request->auth_request.user =
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	406 p_strndup(request->auth_request.pool,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	407 (unsigned char *)outbuf.value + 4,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	408 outbuf.length - 4);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	409
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	410 major_status = __gss_userok(&minor_status, request->authn_name,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	411 request->auth_request.user,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	412 &equal_authn_authz);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	413 if (GSS_ERROR(major_status)) {
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	414 auth_request_log_gss_error(&request->auth_request, major_status,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	415 GSS_C_GSS_CODE,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	416 "__gss_userok failed");
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	417 auth_request_fail(&request->auth_request);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	418 return;
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	419 }
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	420
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	421 if (equal_authn_authz == 0) {
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	422 auth_request_log_error(&request->auth_request, "gssapi",
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	423 "credentials not valid");
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	424
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	425 auth_request_fail(&request->auth_request);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	426 return;
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	427 }
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	428 #else
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	429 request->authz_name = import_name(&request->auth_request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	430 (unsigned char *)outbuf.value + 4,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	431 outbuf.length - 4);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	432 if ((request->authn_name == GSS_C_NO_NAME) \|\|
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	433 (request->authz_name == GSS_C_NO_NAME)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	434 /* XXX (pod): is this check necessary? */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	435 auth_request_log_error(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	436 "one of authn_name or authz_name not determined");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	437 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	438 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	439 }
7451 4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	440
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	441 request->auth_request.user =
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	442 p_strndup(request->auth_request.pool,
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	443 (unsigned char *)outbuf.value + 4,
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	444 outbuf.length - 4);
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	445
8826 ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	446 #ifdef USE_KRB5_USEROK
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	447 if (!gssapi_krb5_userok(request, request->authn_name, TRUE)) {
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	448 auth_request_log_error(&request->auth_request, "gssapi",
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	449 "authn_name not authorized");
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	450 auth_request_fail(&request->auth_request);
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	451 return;
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	452 }
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	453
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	454 if (!gssapi_krb5_userok(request, request->authz_name, FALSE)) {
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	455 auth_request_log_error(&request->auth_request, "gssapi",
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	456 "authz_name not authorized");
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	457 auth_request_fail(&request->auth_request);
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	458 return;
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	459 }
ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	460 #else
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	461 major_status = gss_compare_name(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	462 request->authn_name,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	463 request->authz_name,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	464 &equal_authn_authz);
8826 ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	465 if (equal_authn_authz != 0) {
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	466 auth_request_log_error(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	467 "authn_name and authz_name differ: not supported");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	468 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	469 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	470 }
5859 dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	471 #endif
8826 ff6378d7b209 gssapi: Cross-realm authentication fix. Timo Sirainen <tss@iki.fi> parents: 8605 diff changeset	472 #endif
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	473 auth_request_success(&request->auth_request, NULL, 0);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	474 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	475
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	476 static void
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	477 mech_gssapi_auth_continue(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	478 const unsigned char *data, size_t data_size)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	479 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	480 struct gssapi_auth_request *gssapi_request =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	481 (struct gssapi_auth_request *)request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	482 gss_buffer_desc inbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	483
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	484 inbuf.value = (void *)data;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	485 inbuf.length = data_size;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	486
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	487 switch (gssapi_request->sasl_gssapi_state) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	488 case GSS_STATE_SEC_CONTEXT:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	489 gssapi_sec_context(gssapi_request, inbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	490 break;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	491 case GSS_STATE_WRAP:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	492 gssapi_wrap(gssapi_request, inbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	493 break;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	494 case GSS_STATE_UNWRAP:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	495 gssapi_unwrap(gssapi_request, inbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	496 break;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	497 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	498 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	499
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	500 static void
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	501 mech_gssapi_auth_initial(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	502 const unsigned char *data, size_t data_size)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	503 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	504 OM_uint32 major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	505 struct gssapi_auth_request *gssapi_request =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	506 (struct gssapi_auth_request *)request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	507
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	508 major_status =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	509 obtain_service_credentials(request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	510 &gssapi_request->service_cred);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	511
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	512 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	513 auth_request_internal_failure(request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	514 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	515 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	516 gssapi_request->authn_name = GSS_C_NO_NAME;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	517 gssapi_request->authz_name = GSS_C_NO_NAME;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	518
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	519 gssapi_request->sasl_gssapi_state = GSS_STATE_SEC_CONTEXT;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	520
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	521 if (data_size == 0) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	522 /* The client should go first */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	523 request->callback(request, AUTH_CLIENT_RESULT_CONTINUE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	524 NULL, 0);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	525 } else {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	526 mech_gssapi_auth_continue(request, data, data_size);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	527 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	528 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	529
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	530
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	531 static void
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	532 mech_gssapi_auth_free(struct auth_request *request)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	533 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	534 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	535 struct gssapi_auth_request *gssapi_request =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	536 (struct gssapi_auth_request *)request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	537
6242 40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	538 if (gssapi_request->gss_ctx != GSS_C_NO_CONTEXT) {
40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	539 major_status = gss_delete_sec_context(&minor_status,
40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	540 &gssapi_request->gss_ctx,
40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	541 GSS_C_NO_BUFFER);
40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	542 }
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	543
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	544 major_status = gss_release_cred(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	545 &gssapi_request->service_cred);
5259 228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	546 if (gssapi_request->authn_name != GSS_C_NO_NAME) {
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	547 major_status = gss_release_name(&minor_status,
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	548 &gssapi_request->authn_name);
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	549 }
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	550 if (gssapi_request->authz_name != GSS_C_NO_NAME) {
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	551 major_status = gss_release_name(&minor_status,
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	552 &gssapi_request->authz_name);
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	553 }
6428 7cad076906eb pool_unref() now takes ** pointer. Timo Sirainen <tss@iki.fi> parents: 6242 diff changeset	554 pool_unref(&request->pool);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	555 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	556
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	557 const struct mech_module mech_gssapi = {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	558 "GSSAPI",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	559
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	560 MEMBER(flags) 0,
8605 84eea1977632 auth: Code cleanup for specifying what passdb features auth mechanisms need. Timo Sirainen <tss@iki.fi> parents: 8191 diff changeset	561 MEMBER(passdb_need) MECH_PASSDB_NEED_NOTHING,
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	562
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	563 mech_gssapi_auth_new,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	564 mech_gssapi_auth_initial,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	565 mech_gssapi_auth_continue,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	566 mech_gssapi_auth_free
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	567 };
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	568
8094 641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	569 /* MTI Kerberos v1.5+ and Heimdal v0.7+ supports SPNEGO for Kerberos tickets
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	570 internally. Nothing else needs to be done here. Note however that this does
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	571 not support SPNEGO when the only available credential is NTLM.. */
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	572 const struct mech_module mech_gssapi_spnego = {
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	573 "GSS-SPNEGO",
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	574
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	575 MEMBER(flags) 0,
8605 84eea1977632 auth: Code cleanup for specifying what passdb features auth mechanisms need. Timo Sirainen <tss@iki.fi> parents: 8191 diff changeset	576 MEMBER(passdb_need) MECH_PASSDB_NEED_NOTHING,
8094 641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	577
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	578 mech_gssapi_auth_new,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	579 mech_gssapi_auth_initial,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	580 mech_gssapi_auth_continue,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	581 mech_gssapi_auth_free
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	582 };
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	583
6199 c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	584 #ifndef BUILTIN_GSSAPI
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	585 void mech_gssapi_init(void);
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	586 void mech_gssapi_deinit(void);
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	587
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	588 void mech_gssapi_init(void)
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	589 {
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	590 mech_register_module(&mech_gssapi);
8094 641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	591 #ifdef HAVE_GSSAPI_SPNEGO
8095 1f948670f274 Renamed auth_ntlm_use_winbind to auth_use_winbind, Timo Sirainen <tss@iki.fi> parents: 8094 diff changeset	592 if (getenv("NTLM_USE_WINBIND") == NULL)
1f948670f274 Renamed auth_ntlm_use_winbind to auth_use_winbind, Timo Sirainen <tss@iki.fi> parents: 8094 diff changeset	593 mech_register_module(&mech_gssapi_spnego);
8094 641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	594 #endif
6199 c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	595 }
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	596
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	597 void mech_gssapi_deinit(void)
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	598 {
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	599 mech_unregister_module(&mech_gssapi);
8094 641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	600 #ifdef HAVE_GSSAPI_SPNEGO
8095 1f948670f274 Renamed auth_ntlm_use_winbind to auth_use_winbind, Timo Sirainen <tss@iki.fi> parents: 8094 diff changeset	601 if (getenv("NTLM_USE_WINBIND") == NULL)
1f948670f274 Renamed auth_ntlm_use_winbind to auth_use_winbind, Timo Sirainen <tss@iki.fi> parents: 8094 diff changeset	602 mech_unregister_module(&mech_gssapi_spnego);
8094 641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it. Timo Sirainen <tss@iki.fi> parents: 8093 diff changeset	603 #endif
6199 c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	604 }
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	605 #endif
6199 c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	606
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	607 #endif

Mercurial > dovecot > original-hg > dovecot-1.2

annotate src/auth/mech-gssapi.c @ 8826:ff6378d7b209 HEAD