src/modules/rlm_krb5/rlm_krb5.c

   1 /*
   2  * rlm_krb5.c   module to authenticate against krb5
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  * Copyright 2000  The FreeRADIUS server project
  21  * Copyright 2000  Nathan Neulinger <nneul@umr.edu>
  22  * Copyright 2000  Alan DeKok <aland@ox.org>
  23  */
  24
  25
  26 static const char rcsid[] = "$Id$";
  27
  28 #include        "autoconf.h"
  29 #include        "libradius.h"
  30
  31 #include        <stdio.h>
  32 #include        <stdlib.h>
  33 #include        <string.h>
  34
  35 #include        "radiusd.h"
  36 #include        "modules.h"
  37
  38 /* krb5 includes */
  39 #include <krb5.h>
  40 #include <com_err.h>
  41
  42 /* instantiate */
  43 static int krb5_instantiate(CONF_SECTION *conf, void **instance)
  44 {
  45         int r;
  46         krb5_context *context;
  47
  48         context = rad_malloc(sizeof(*context));
  49
  50         if ((r = krb5_init_context(context)) ) {
  51                 radlog(L_AUTH, "rlm_krb5: krb5_init failed: %s",
  52                        error_message(r));
  53                 return -1;
  54         } else {
  55                 radlog(L_AUTH, "rlm_krb5: krb5_init ok");
  56         }
  57
  58         *instance = context;
  59         return 0;
  60 }
  61
  62 /* detach */
  63 static int krb5_detach(void *instance)
  64 {
  65         free(instance);
  66         return 0;
  67 }
  68
  69 /* validate userid/passwd */
  70 static int krb5_auth(void *instance, REQUEST *request)
  71 {
  72         int r;
  73         krb5_data tgtname = {
  74                 0,
  75                 KRB5_TGS_NAME_SIZE,
  76                 KRB5_TGS_NAME
  77         };
  78         krb5_creds kcreds;
  79         krb5_context context = *(krb5_context *) instance; /* copy data */
  80         const char *user, *pass;
  81
  82         /*
  83          *      We can only authenticate user requests which HAVE
  84          *      a User-Name attribute.
  85          */
  86         if (!request->username) {
  87                 radlog(L_AUTH, "rlm_krb5: Attribute \"User-Name\" is required for authentication.");
  88                 return RLM_MODULE_INVALID;
  89         }
  90
  91         /*
  92          *      We can only authenticate user requests which HAVE
  93          *      a User-Password attribute.
  94          */
  95         if (!request->password) {
  96                 radlog(L_AUTH, "rlm_krb5: Attribute \"User-Password\" is required for authentication.");
  97                 return RLM_MODULE_INVALID;
  98         }
  99
 100         /*
 101          *  Ensure that we're being passed a plain-text password,
 102          *  and not anything else.
 103          */
 104         if (request->password->attribute != PW_PASSWORD) {
 105                 radlog(L_AUTH, "rlm_krb5: Attribute \"User-Password\" is required for authentication.  Cannot use \"%s\".", request->password->name);
 106                 return RLM_MODULE_INVALID;
 107         }
 108
 109         /*
 110          *      shortcuts
 111          */
 112         user = request->username->strvalue;
 113         pass = request->password->strvalue;
 114
 115         /*
 116          *      Actually perform the authentication
 117          */
 118         memset((char *)&kcreds, 0, sizeof(kcreds));
 119
 120         if ( (r = krb5_parse_name(context, user, &kcreds.client)) ) {
 121                 radlog(L_AUTH, "rlm_krb5: [%s] krb5_parse_name failed: %s",
 122                        user, error_message(r));
 123                 return RLM_MODULE_REJECT;
 124         }
 125
 126         if ( (r = krb5_build_principal_ext(context, &kcreds.server,
 127                 krb5_princ_realm(context, kcreds.client)->length,
 128                 krb5_princ_realm(context, kcreds.client)->data,
 129                 tgtname.length,
 130                 tgtname.data,
 131                 krb5_princ_realm(context, kcreds.client)->length,
 132                 krb5_princ_realm(context, kcreds.client)->data,
 133                 0)) ) {
 134                 radlog(L_AUTH, "rlm_krb5: [%s] krb5_build_principal_ext failed: %s",
 135                         user, error_message(r));
 136                 return RLM_MODULE_REJECT;
 137         }
 138
 139         if ( (r = krb5_get_in_tkt_with_password(context,
 140                 0, NULL, NULL, NULL, pass, 0, &kcreds, 0)) ) {
 141                 radlog(L_AUTH, "rlm_krb5: [%s] krb5_g_i_t_w_p failed: %s",
 142                         user, error_message(r));
 143                 return RLM_MODULE_REJECT;
 144         } else {
 145                 return RLM_MODULE_OK;
 146         }
 147
 148         return RLM_MODULE_REJECT;
 149 }
 150
 151 module_t rlm_krb5 = {
 152   "Kerberos",
 153   RLM_TYPE_THREAD_UNSAFE,       /* type: not thread safe */
 154   NULL,                         /* initialize */
 155   krb5_instantiate,             /* instantiation */
 156   {
 157           krb5_auth,            /* authenticate */
 158           NULL,                 /* authorize */
 159           NULL,                 /* pre-accounting */
 160           NULL,                 /* accounting */
 161           NULL,                 /* checksimul */
 162           NULL,                 /* pre-proxy */
 163           NULL,                 /* post-proxy */
 164           NULL                  /* post-auth */
 165   },
 166   krb5_detach,                  /* detach */
 167   NULL,                         /* destroy */
 168 };