Remove Kerberos specific principal manipulation

[trust_router.git] / gsscon / gsscon_passive.c

diff --git a/gsscon/gsscon_passive.c b/gsscon/gsscon_passive.c
index 5fc7030..96d1417 100755 (executable)
--- a/gsscon/gsscon_passive.c
+++ b/gsscon/gsscon_passive.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, JANET(UK)
+ * Copyright (c) 2012, JANET(UK)
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -121,7 +121,7 @@ int gsscon_passive_authenticate (int           inSocket,
              * EOF, and the user wouldn't know what went wrong.
              */
             
-            printf ("Calling gss_accept_sec_context...\n");
+           // printf ("Calling gss_accept_sec_context...\n");
             majorStatus = gss_accept_sec_context (&minorStatus, 
                                                   &gssContext, 
                                                   GSS_C_NO_CREDENTIAL, 
@@ -207,20 +207,6 @@ static int ServicePrincipalIsValidForService (const char *inServicePrincipal)
 static int ClientPrincipalIsAuthorizedForService (const char *inClientPrincipal)
 {
     int err = 0;
-    krb5_context context = NULL;
-    krb5_principal principal = NULL;
-    
-    if (!inClientPrincipal) { err = EINVAL; }
-    
-    if (!err) {
-        err = krb5_init_context (&context);
-    }
-    
-    if (!err) {
-        err = krb5_parse_name (context, inClientPrincipal, &principal);
-    }
-    
-    if (!err) {
         /* 
          * Here is where the server checks to see if the client principal should 
          * be allowed to use your service. Typically it should check both the name 
@@ -228,10 +214,8 @@ static int ClientPrincipalIsAuthorizedForService (const char *inClientPrincipal)
          * realm may be trying to contact your service.  
          */
         err = 0;
-    }
+
     
-    if (principal) { krb5_free_principal (context, principal); }
-    if (context  ) { krb5_free_context (context); }
     
     return err;
 }
@@ -291,44 +275,47 @@ int gsscon_authorize (gss_ctx_id_t  inContext,
         if (nameToken.value) { gss_release_buffer (&minorStatus, &nameToken); }
     }
     
-    if (!err) {
-        /* Pull the service principal string out of the gss name */
-        gss_buffer_desc nameToken;
-        
-        majorStatus = gss_display_name (&minorStatus, 
-                                        serviceName, 
-                                        &nameToken, 
-                                        NULL);
-        if (majorStatus != GSS_S_COMPLETE) { 
-            err = minorStatus ? minorStatus : majorStatus; 
-        }
-        
-        if (!err) {
-            servicePrincipal = malloc (nameToken.length + 1);
-            if (servicePrincipal == NULL) { err = ENOMEM; }
-        }
-        
         if (!err) {
-            memcpy (servicePrincipal, nameToken.value, nameToken.length);
-            servicePrincipal[nameToken.length] = '\0';
-        }        
+    //    /* Pull the service principal string out of the gss name */
+    //    gss_buffer_desc nameToken;
+    //    
+    //    majorStatus = gss_display_name (&minorStatus, 
+    //                                    serviceName, 
+    //                                    &nameToken, 
+    //                                    NULL);
+    //    if (majorStatus != GSS_S_COMPLETE) { 
+    //        err = minorStatus ? minorStatus : majorStatus; 
+    //    }
+    //    
+    //    if (!err) {
+    //        servic7ePrincipal = malloc (nameToken.length + 1);
+    //        if (servicePrincipal == NULL) { err = ENOMEM; }
+    //    }
+    //    
+    //    if (!err) {
+    //        memcpy (servicePrincipal, nameToken.value, nameToken.length);
+    //        servicePrincipal[nameToken.length] = '\0';
+    //    }        
 
-        if (nameToken.value) { gss_release_buffer (&minorStatus, &nameToken); }
-    }
+    //    if (nameToken.value) { gss_release_buffer (&minorStatus, &nameToken); }
+    // }
     
-    if (!err) {
-        int authorizationErr = ServicePrincipalIsValidForService (servicePrincipal);
+//    if (!err) {
+//        int authorizationErr = ServicePrincipalIsValidForService (servicePr// incipal);
+//        
+//        if (!authorizationErr) {
+
+         int authorizationErr = 0;
+         authorizationErr = ClientPrincipalIsAuthorizedForService (clientPrincipal);
+
+//        }
         
-        if (!authorizationErr) {
-            authorizationErr = ClientPrincipalIsAuthorizedForService (clientPrincipal);
+//        printf ("'%s' is%s authorized for service '%s'\n", 
+//                clientPrincipal, authorizationErr ? " NOT" : "", servicePrincipal);            
+//        
+         *outAuthorized = !authorizationErr;
+         *outAuthorizationError = authorizationErr;
         }
-        
-        printf ("'%s' is%s authorized for service '%s'\n", 
-                clientPrincipal, authorizationErr ? " NOT" : "", servicePrincipal);            
-        
-        *outAuthorized = !authorizationErr;
-        *outAuthorizationError = authorizationErr;
-    }
     
     if (serviceName     ) { gss_release_name (&minorStatus, &serviceName); }
     if (clientName      ) { gss_release_name (&minorStatus, &clientName); }