Returned to single mod_auth_kerb.c file.

[mod_auth_kerb.cvs/.git] / apache1 / auth_user.c

diff --git a/apache1/auth_user.c b/apache1/auth_user.c
index 4205239..d46c6f9 100644 (file)
--- a/apache1/auth_user.c
+++ b/apache1/auth_user.c
@@ -3,29 +3,51 @@ int kerb_authenticate_user(request_rec *r) {
        const char *type;               /* AuthType specified */
        int KerberosV5 = 0;             /* Kerberos V5 check enabled */
        int KerberosV4 = 0;             /* Kerberos V4 check enabled */
+       int KerberosV4first = 0;        /* Kerberos V4 check first */
        const char *sent_pw;            /* Password sent by browser */
        int res;                        /* Response holder */
+       int retcode;                    /* Return code holder */
        const char *t;                  /* Decoded auth_line */
        const char *authtype;           /* AuthType to send back to browser */
        const char *auth_line = ap_table_get(r->headers_in,
                                        (r->proxyreq == STD_PROXY)
                                                ? "Proxy-Authorization"
                                                : "Authorization");
+       kerb_auth_config *conf =
+               (kerb_auth_config *)ap_get_module_config(r->per_dir_config,
+                                       &kerb_auth_module);
 
        type = ap_auth_type(r);
 
        if (type != NULL) {
 #ifdef KRB5
-               if (strncasecmp(type, "KerberosV5", 10) == 0) {
+               if ((strncasecmp(type, "KerberosV5", 10) == 0) ||
+                   (strncasecmp(conf->krb_auth_type, "KerberosV5", 10) == 0)) {
                        KerberosV5 = 1;
                }
 #endif /* KRB5 */
 
 #ifdef KRB4
-               if (strncasecmp(type, "KerberosV4", 10) == 0) {
+               if ((strncasecmp(type, "KerberosV4", 10) == 0) ||
+                   (strncasecmp(conf->krb_auth_type, "KerberosV4", 10) == 0)) {
                        KerberosV4 = 1;
                }
 #endif /* KRB4 */
+
+#if defined(KRB5) && defined(KRB4)
+               if ((strncasecmp(type, "KerberosDualV5V4", 15) == 0) ||
+                   (strncasecmp(conf->krb_auth_type, "KerberosDualV5V4", 15) == 0)) {
+                       KerberosV5 = 1;
+                       KerberosV4 = 1;
+               }
+
+               if ((strncasecmp(type, "KerberosDualV4V5", 15) == 0) ||
+                   (strncasecmp(conf->krb_auth_type, "KerberosDualV4V5", 15) == 0)) {
+                       KerberosV5 = 1;
+                       KerberosV4 = 1;
+                       KerberosV4first = 1;
+               }
+#endif /* KRB5 && KRB4 */
        }
 
        if (!KerberosV4 && !KerberosV5) {
@@ -51,26 +73,40 @@ int kerb_authenticate_user(request_rec *r) {
        r->connection->ap_auth_type = "Kerberos";
        sent_pw = ap_getword_white(r->pool, &t);
 
+       retcode = DECLINED;
+
 #ifdef KRB5
-       if (KerberosV5) {
+       if (KerberosV5 && !KerberosV4first && retcode != OK) {
                if (kerb5_password_validate(r->connection->user, sent_pw)) {
-                       return OK;
+                       retcode = OK;
                }
                else {
-                       return HTTP_UNAUTHORIZED;
+                       retcode = conf->krb_fail_status;
                }
        }
 #endif /* KRB5 */
+
 #ifdef KRB4
-       if (KerberosV4) {
+       if (KerberosV4 && retcode != OK) {
                if (kerb4_password_validate(r->connection->user, sent_pw)) {
-                       return OK;
+                       retcode = OK;
                }
                else {
-                       return HTTP_UNAUTHORIZED;
+                       retcode = conf->krb_fail_status;
                }
        }
 #endif /* KRB4 */
 
-       return DECLINED;
+#if defined(KRB5) && defined(KRB4)
+       if (KerberosV5 && KerberosV4first && retcode != OK) {
+               if (kerb5_password_validate(r->connection->user, sent_pw)) {
+                       retcode = OK;
+               }
+               else {
+                       retcode = conf->krb_fail_status;
+               }
+       }
+#endif /* KRB5 && KRB4 */
+
+       return retcode;
 }