#endif /* KRB5 */
#ifdef KRB4
-/*Prevent warning about closesocket redefinition (Apache's ap_config.h and
+/* Prevent warning about closesocket redefinition (Apache's ap_config.h and
* MIT Kerberos' port-sockets.h both define it as close) */
#ifdef closesocket
# undef closesocket
{ NULL }
};
-#ifdef KRB5
-typedef struct {
- gss_ctx_id_t context;
- gss_cred_id_t server_creds;
-} gss_connection_t;
+#if defined(KRB5) && !defined(HEIMDAL)
+/* Needed to work around problems with replay caches */
+#include "mit-internals.h"
+
+/* This is our replacement krb5_rc_store function */
+static krb5_error_code
+mod_auth_kerb_rc_store(krb5_context context, krb5_rcache rcache,
+ krb5_donot_replay *donot_replay)
+{
+ return 0;
+}
-static gss_connection_t *gss_connection = NULL;
+/* And this is the operations vector for our replay cache */
+const krb5_rc_ops mod_auth_kerb_rc_ops = {
+ 0,
+ "dfl",
+ krb5_rc_dfl_init,
+ krb5_rc_dfl_recover,
+ krb5_rc_dfl_destroy,
+ krb5_rc_dfl_close,
+ mod_auth_kerb_rc_store,
+ krb5_rc_dfl_expunge,
+ krb5_rc_dfl_get_span,
+ krb5_rc_dfl_get_name,
+ krb5_rc_dfl_resolve
+};
#endif
/***************************************************************************
Username/Password Validation for Krb5
***************************************************************************/
+static krb5_error_code
+verify_krb5_init_creds(krb5_context context, krb5_creds *creds,
+ krb5_principal ap_req_server, krb5_keytab ap_req_keytab)
+{
+ krb5_error_code ret;
+ krb5_data req;
+ krb5_ccache local_ccache = NULL;
+ krb5_creds *new_creds = NULL;
+ krb5_auth_context auth_context = NULL;
+ krb5_keytab keytab = NULL;
+
+ krb5_data_zero (&req);
+
+ if (ap_req_keytab == NULL) {
+ ret = krb5_kt_default (context, &keytab);
+ if (ret)
+ return ret;
+ } else
+ keytab = ap_req_keytab;
+
+ ret = krb5_cc_resolve(context, "MEMORY:", &local_ccache);
+ if (ret)
+ return ret;
+
+ ret = krb5_cc_initialize(context, local_ccache, creds->client);
+ if (ret)
+ goto end;
+
+ ret = krb5_cc_store_cred (context, local_ccache, creds);
+ if (ret)
+ goto end;
+
+ if (!krb5_principal_compare (context, ap_req_server, creds->server)) {
+ krb5_creds match_cred;
+
+ memset (&match_cred, 0, sizeof(match_cred));
+
+ match_cred.client = creds->client;
+ match_cred.server = ap_req_server;
+
+ ret = krb5_get_credentials (context, 0, local_ccache,
+ &match_cred, &new_creds);
+ if (ret)
+ goto end;
+ creds = new_creds;
+ }
+
+ ret = krb5_mk_req_extended (context, &auth_context, 0, NULL, creds, &req);
+ if (ret)
+ goto end;
+
+ krb5_auth_con_free (context, auth_context);
+ ret = krb5_auth_con_init(context, &auth_context);
+ if (ret)
+ goto end;
+ krb5_auth_con_setflags(context, auth_context, KRB5_AUTH_CONTEXT_DO_SEQUENCE);
+
+ ret = krb5_rd_req (context, &auth_context, &req, ap_req_server,
+ keytab, 0, NULL);
+
+end:
+ krb5_free_data_contents(context, &req);
+ if (auth_context)
+ krb5_auth_con_free (context, auth_context);
+ if (new_creds)
+ krb5_free_creds (context, new_creds);
+ if (ap_req_keytab == NULL && keytab)
+ krb5_kt_close (context, keytab);
+ if (local_ccache)
+ krb5_cc_destroy (context, local_ccache);
+
+ return ret;
+}
+
/* Inspired by krb5_verify_user from Heimdal */
static krb5_error_code
verify_krb5_user(request_rec *r, krb5_context context, krb5_principal principal,
krb5_creds creds;
krb5_principal server = NULL;
krb5_error_code ret;
- krb5_verify_init_creds_opt opt;
/* XXX error messages shouldn't be logged here (and in the while() loop in
* authenticate_user_krb5pwd() as weell), in order to avoid confusing log
krb5_get_err_text(context, ret));
goto end;
}
+ /* XXX log_debug: lookig for <server_princ> in keytab */
/* XXX
{
}
*/
- krb5_verify_init_creds_opt_init(&opt);
- krb5_verify_init_creds_opt_set_ap_req_nofail(&opt, krb_verify_kdc);
-
- ret = krb5_verify_init_creds(context, &creds, server, keytab, NULL, &opt);
- if (ret) {
- log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "krb5_verify_init_creds() failed: %s",
- krb5_get_err_text(context, ret));
- goto end;
+ if (krb_verify_kdc &&
+ (ret = verify_krb5_init_creds(context, &creds, server, keytab))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "failed to verify krb5 credentials: %s",
+ krb5_get_err_text(context, ret));
+ goto end;
}
-
+
if (ccache) {
ret = krb5_cc_initialize(context, ccache, principal);
if (ret) {
krb5_free_cred_contents(context, &creds);
if (server)
krb5_free_principal(context, server);
+
return ret;
}
}
static int
-cleanup_gss_connection(void *data)
-{
- OM_uint32 minor_status;
- gss_connection_t *gss_conn = (gss_connection_t *)data;
-
- if (data == NULL)
- return OK;
- if (gss_conn->context != GSS_C_NO_CONTEXT)
- gss_delete_sec_context(&minor_status, &gss_conn->context,
- GSS_C_NO_BUFFER);
- if (gss_conn->server_creds != GSS_C_NO_CREDENTIAL)
- gss_release_cred(&minor_status, &gss_conn->server_creds);
-
- gss_connection = NULL;
-
- return OK;
-}
-
-static int
store_gss_creds(request_rec *r, kerb_auth_config *conf, char *princ_name,
gss_cred_id_t delegated_cred)
{
gss_name_t server_name = GSS_C_NO_NAME;
char buf[1024];
-#if 0
- /* Don't specify service name. This makes MIT 1.3 not to use replay caches,
- * which causes large problems with the Microsoft krb5 implementation. MS
- * obviously uses a format of the krb5 authenticator that is considered by
- * the MIT as replay (Two valid MS authenticators may contain the same time
- * and utime fields and only differ in the sequential numbers).
- */
snprintf(buf, sizeof(buf), "%s@%s", conf->krb_service_name,
ap_get_server_name(r));
"gss_import_name() failed"));
return HTTP_INTERNAL_SERVER_ERROR;
}
-#endif
major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
GSS_C_NO_OID_SET, GSS_C_ACCEPT,
"gss_acquire_cred() failed"));
return HTTP_INTERNAL_SERVER_ERROR;
}
+
+#ifndef HEIMDAL
+ /*
+ * With MIT Kerberos 5 1.3.x the gss_cred_id_t is the same as
+ * krb5_gss_cred_id_t and krb5_gss_cred_id_rec contains a pointer to
+ * the replay cache.
+ * This allows us to override the replay cache function vector with
+ * our own one.
+ * Note that this is a dirty hack to get things working and there may
+ * well be unknown side-effects.
+ */
+ if (memcmp(((krb5_gss_cred_id_t) *server_creds)->rcache->ops->type, "dfl", 3) == 0)
+ /* Override the rcache operations */
+ ((krb5_gss_cred_id_t) *server_creds)->rcache->ops = &mod_auth_kerb_rc_ops;
+#if 0
+ else
+ /* rcache did not point to default rcache structure, return error */
+ return HTTP_INTERNAL_SERVER_ERROR;
+#endif
+#endif
return 0;
}
gss_cred_id_t delegated_cred = GSS_C_NO_CREDENTIAL;
OM_uint32 (*accept_sec_token)();
gss_OID_desc spnego_oid;
+ gss_ctx_id_t context = GSS_C_NO_CONTEXT;
+ gss_cred_id_t server_creds = GSS_C_NO_CREDENTIAL;
*negotiate_ret_value = "\0";
spnego_oid.length = 6;
spnego_oid.elements = (void *)"\x2b\x06\x01\x05\x05\x02";
- if (gss_connection == NULL) {
- gss_connection = ap_pcalloc(r->connection->pool, sizeof(*gss_connection));
- if (gss_connection == NULL) {
- log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "ap_pcalloc() failed (not enough memory)");
- ret = HTTP_INTERNAL_SERVER_ERROR;
- goto end;
- }
- memset(gss_connection, 0, sizeof(*gss_connection));
- ap_register_cleanup(r->connection->pool, gss_connection, cleanup_gss_connection, ap_null_cleanup);
- }
-
if (conf->krb_5_keytab) {
char *ktname;
/* we don't use the ap_* calls here, since the string passed to putenv()
putenv(ktname);
}
- if (gss_connection->server_creds == GSS_C_NO_CREDENTIAL) {
- ret = get_gss_creds(r, conf, &gss_connection->server_creds);
- if (ret)
- goto end;
- }
+ ret = get_gss_creds(r, conf, &server_creds);
+ if (ret)
+ goto end;
/* ap_getword() shifts parameter */
auth_param = ap_getword_white(r->pool, &auth_line);
gss_accept_sec_context_spnego : gss_accept_sec_context;
major_status = accept_sec_token(&minor_status,
- &gss_connection->context,
- gss_connection->server_creds,
+ &context,
+ server_creds,
&input_token,
GSS_C_NO_CHANNEL_BINDINGS,
&client_name,
goto end;
}
+#if 0
+ /* This is a _Kerberos_ module so multiple authentication rounds aren't
+ * supported. If we wanted a generic GSS authentication we would have to do
+ * some magic with exporting context etc. */
if (major_status & GSS_S_CONTINUE_NEEDED) {
- /* Some GSSAPI mechanism (eg GSI from Globus) may require multiple
- * iterations to establish authentication */
ret = HTTP_UNAUTHORIZED;
goto end;
}
+#endif
major_status = gss_display_name(&minor_status, client_name, &output_token, NULL);
gss_release_name(&minor_status, &client_name);
if (client_name != GSS_C_NO_NAME)
gss_release_name(&minor_status, &client_name);
- if (! major_status & GSS_S_CONTINUE_NEEDED)
- cleanup_gss_connection(gss_connection);
+ if (server_creds != GSS_C_NO_CREDENTIAL)
+ gss_release_cred(&minor_status, &server_creds);
+
+ if (context != GSS_C_NO_CONTEXT)
+ gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
return ret;
}
if (ret == HTTP_UNAUTHORIZED)
set_kerb_auth_headers(r, conf, use_krb4, use_krb5, negotiate_ret_value);
+ /* XXX log_debug: if ret==OK, log(user XY authenticated) */
+
last_return = ret;
return ret;
}
projects / mod_auth_kerb.git / blobdiff