* Ludek Sulak <xsulak@fi.muni.cz>
*/
-/* ====================================================================
- * The Apache Software License, Version 1.1
- *
- * Copyright (c) 2000-2003 The Apache Software Foundation. All rights
- * reserved.
+/*
+ * Copyright (c) 2004 Masarykova universita
+ * (Masaryk University, Brno, Czech Republic)
+ * All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
+ * modification, are permitted provided that the following conditions are met:
*
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. The end-user documentation included with the redistribution,
- * if any, must include the following acknowledgment:
- * "This product includes software developed by the
- * Apache Software Foundation (http://www.apache.org/)."
- * Alternately, this acknowledgment may appear in the software itself,
- * if and wherever such third-party acknowledgments normally appear.
- *
- * 4. The names "Apache" and "Apache Software Foundation" must
- * not be used to endorse or promote products derived from this
- * software without prior written permission. For written
- * permission, please contact apache@apache.org.
- *
- * 5. Products derived from this software may not be called "Apache",
- * nor may "Apache" appear in their name, without prior written
- * permission of the Apache Software Foundation.
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
*
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
- * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * ====================================================================
+ * 3. Neither the name of the University nor the names of its contributors may
+ * be used to endorse or promote products derived from this software
+ * without specific prior written permission.
*
- * This software consists of voluntary contributions made by many
- * individuals on behalf of the Apache Software Foundation. For more
- * information on the Apache Software Foundation, please see
- * <http://www.apache.org/>.
- *
- * Portions of this software are based upon public domain software
- * originally written at the National Center for Supercomputing Applications,
- * University of Illinois, Urbana-Champaign.
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
*/
#ident "$Id$"
#include "config.h"
-#define MODAUTHKERB_VERSION "5.0-rc2"
+#define MODAUTHKERB_VERSION "5.0-rc4"
#ifndef APXS1
#include "ap_compat.h"
#define MK_TABLE_GET ap_table_get
#define MK_USER r->connection->user
#define MK_AUTH_TYPE r->connection->ap_auth_type
+#define PROXYREQ_PROXY STD_PROXY
#else
#define MK_POOL apr_pool_t
#define MK_TABLE_GET apr_table_get
char *krb_auth_realms;
int krb_save_credentials;
int krb_verify_kdc;
+ char *krb_service_name;
+ int krb_authoritative;
#ifdef KRB5
char *krb_5_keytab;
int krb_method_gssapi;
#endif
} kerb_auth_config;
+static void
+set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf,
+ int use_krb4, int use_krb5pwd, char *negotiate_ret_value);
+
static const char*
krb5_save_realms(cmd_parms *cmd, kerb_auth_config *sec, char *arg);
command("KrbVerifyKDC", ap_set_flag_slot, krb_verify_kdc,
FLAG, "Verify tickets against keytab to prevent KDC spoofing attacks."),
+ command("KrbServiceName", ap_set_string_slot, krb_service_name,
+ TAKE1, "Service name to be used by Apache for authentication."),
+
+ command("KrbAuthoritative", ap_set_flag_slot, krb_authoritative,
+ FLAG, "Set to 'off' to allow access control to be passed along to lower modules if the UserID is not known to this module."),
+
#ifdef KRB5
command("Krb5Keytab", ap_set_file_slot, krb_5_keytab,
TAKE1, "Location of Kerberos V5 keytab file."),
command("KrbMethodNegotiate", ap_set_flag_slot, krb_method_gssapi,
FLAG, "Enable Negotiate authentication method."),
- command("KrbMethodK5Pass", ap_set_flag_slot, krb_method_k5pass,
+ command("KrbMethodK5Passwd", ap_set_flag_slot, krb_method_k5pass,
FLAG, "Enable Kerberos V5 password authentication."),
#endif
command("Krb4Srvtab", ap_set_file_slot, krb_4_srvtab,
TAKE1, "Location of Kerberos V4 srvtab file."),
- command("KrbMethodK4Pass", ap_set_flag_slot, krb_method_k4pass,
+ command("KrbMethodK4Passwd", ap_set_flag_slot, krb_method_k4pass,
FLAG, "Enable Kerberos V4 password authentication."),
#endif
rec = (kerb_auth_config *) ap_pcalloc(p, sizeof(kerb_auth_config));
((kerb_auth_config *)rec)->krb_verify_kdc = 1;
+ ((kerb_auth_config *)rec)->krb_service_name = "HTTP";
+ ((kerb_auth_config *)rec)->krb_authoritative = 1;
#ifdef KRB5
((kerb_auth_config *)rec)->krb_method_k5pass = 1;
((kerb_auth_config *)rec)->krb_method_gssapi = 1;
const request_rec *r, const char *fmt, ...)
{
char errstr[1024];
- char errnostr[1024];
va_list ap;
va_start(ap, fmt);
vsnprintf(errstr, sizeof(errstr), fmt, ap);
va_end(ap);
- errnostr[0] = '\0';
- if (errno)
- snprintf(errnostr, sizeof(errnostr), "%s: (%s)", errstr, strerror(errno));
- else
- snprintf(errnostr, sizeof(errnostr), "%s", errstr);
#ifdef APXS1
- ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errnostr);
+ ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr);
#else
- ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errnostr);
+ ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errstr);
#endif
}
const char *realm;
char *user;
char lrealm[REALM_SZ];
+ int all_principals_unkown;
sent_pw = ap_pbase64decode(r->pool, auth_line);
sent_name = ap_getword (r->pool, &sent_pw, ':');
krb_set_tkt_string(tkt_file);
+ all_principals_unkown = 1;
realms = conf->krb_auth_realms;
do {
memset(lrealm, 0, sizeof(lrealm));
if (realm == NULL) {
ret = krb_get_lrealm(lrealm, 1);
+ if (ret)
+ break;
realm = lrealm;
}
- if (realm == NULL || *realm == '\0')
- break;
ret = verify_krb4_user(r, (char *)sent_name,
(sent_instance) ? sent_instance : "",
- (char *)realm, (char *)sent_pw, "khttp",
+ (char *)realm, (char *)sent_pw,
+ conf->krb_service_name,
conf->krb_4_srvtab, conf->krb_verify_kdc);
+ if (!conf->krb_authoritative && ret) {
+ /* if we're not authoritative, we allow authentication to pass on
+ * to another modules if (and only if) the user is not known to us */
+ if (all_principals_unkown && ret != KDC_PR_UNKNOWN)
+ all_principals_unkown = 0;
+ }
+
if (ret == 0)
break;
} while (realms && *realms);
if (ret) {
+ /* XXX log only in the verify_krb4_user() call */
log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "Verifying krb4 password failed");
- ret = HTTP_UNAUTHORIZED;
+ ret = (!conf->krb_authoritative && all_principals_unkown == 1 && ret == KDC_PR_UNKNOWN) ?
+ DECLINED : HTTP_UNAUTHORIZED;
goto end;
}
krb5_error_code ret;
krb5_verify_init_creds_opt opt;
+ /* XXX error messages shouldn't be logged here (and in the while() loop in
+ * authenticate_user_krb5pwd() as weell), in order to avoid confusing log
+ * entries when using multiple realms */
+
memset(&creds, 0, sizeof(creds));
ret = krb5_get_init_creds_password(context, &creds, principal,
- (char *)password, krb5_prompter_posix,
+ (char *)password, NULL,
NULL, 0, NULL, NULL);
- if (ret)
+ if (ret) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "krb5_get_init_creds_password() failed: %s",
+ krb5_get_err_text(context, ret));
return ret;
+ }
ret = krb5_sname_to_principal(context, ap_get_server_name(r), service,
- KRB5_NT_SRV_HST, &server);
- if (ret)
+ KRB5_NT_UNKNOWN, &server);
+ if (ret) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "krb5_sname_to_principal() failed: %s",
+ krb5_get_err_text(context, ret));
goto end;
+ }
krb5_verify_init_creds_opt_init(&opt);
krb5_verify_init_creds_opt_set_ap_req_nofail(&opt, krb_verify_kdc);
ret = krb5_verify_init_creds(context, &creds, server, keytab, NULL, &opt);
- if (ret)
+ if (ret) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "krb5_verify_init_creds() failed: %s",
+ krb5_get_err_text(context, ret));
goto end;
-
+ }
+
if (ccache) {
ret = krb5_cc_initialize(context, ccache, principal);
- if (ret == 0)
- ret = krb5_cc_store_cred(context, ccache, &creds);
+ if (ret) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "krb5_cc_initialize() failed: %s",
+ krb5_get_err_text(context, ret));
+ goto end;
+ }
+
+ ret = krb5_cc_store_cred(context, ccache, &creds);
+ if (ret) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "krb5_cc_store_cred() failed: %s",
+ krb5_get_err_text(context, ret));
+ goto end;
+ }
}
end:
krb5_ccache *ccache)
{
char *ccname;
+ int fd;
krb5_error_code problem;
int ret;
krb5_ccache tmp_ccache = NULL;
-#ifdef HAVE_KRB5_CC_GEN_NEW
- problem = krb5_cc_gen_new(kcontext, &krb5_fcc_ops, &tmp_ccache);
-#else
- /* only older MIT seem to not have the krb5_cc_gen_new() call, so we use
- * MIT specific call here */
- problem = krb5_fcc_generate_new(kcontext, &tmp_ccache);
- /* krb5_fcc_generate_new() doesn't set KRB5_TC_OPENCLOSE, which makes
- krb5_cc_initialize() fail */
- krb5_fcc_set_flags(kcontext, tmp_ccache, KRB5_TC_OPENCLOSE);
-#endif
- if (problem) {
+ ccname = ap_psprintf(r->pool, "FILE:%s/krb5cc_apache_XXXXXX", P_tmpdir);
+ fd = mkstemp(ccname + strlen("FILE:"));
+ if (fd < 0) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "Cannot create file for new krb5 ccache: %s",
- krb5_get_err_text(kcontext, problem));
+ "mkstemp() failed: %s", strerror(errno));
ret = HTTP_INTERNAL_SERVER_ERROR;
goto end;
}
+ close(fd);
- ccname = ap_pstrdup(r->pool, krb5_cc_get_name(kcontext, tmp_ccache));
+ problem = krb5_cc_resolve(kcontext, ccname, &tmp_ccache);
+ if (problem) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "krb5_cc_resolve() failed: %s",
+ krb5_get_err_text(kcontext, problem));
+ ret = HTTP_INTERNAL_SERVER_ERROR;
+ unlink(ccname);
+ goto end;
+ }
problem = krb5_cc_initialize(kcontext, tmp_ccache, princ);
if (problem) {
krb5_ccache ccache = NULL;
krb5_keytab keytab = NULL;
int ret;
- char *name = NULL;
+ char *name = NULL;
+ int all_principals_unkown;
+ char *ccname = NULL;
+ int fd;
code = krb5_init_context(&kcontext);
if (code) {
"specifying realm in user name is prohibited");
ret = HTTP_UNAUTHORIZED;
goto end;
- }
+ }
-#ifdef HAVE_KRB5_CC_GEN_NEW
- code = krb5_cc_gen_new(kcontext, &krb5_mcc_ops, &ccache);
-#else
- /* only older MIT seem to not have the krb5_cc_gen_new() call, so we use
- * MIT specific call here */
- code = krb5_mcc_generate_new(kcontext, &ccache);
-#endif
+ if (sent_pw == NULL || *sent_pw == '\0') {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "empty passwords are not accepted");
+ ret = HTTP_UNAUTHORIZED;
+ goto end;
+ }
+
+ code = krb5_cc_resolve(kcontext, "MEMORY:", &ccache);
if (code) {
- log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "Cannot generate new ccache: %s",
- krb5_get_err_text(kcontext, code));
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "generating new memory ccache failed: %s",
+ krb5_get_err_text(kcontext, code));
ret = HTTP_INTERNAL_SERVER_ERROR;
+ unlink(ccname);
goto end;
}
if (conf->krb_5_keytab)
krb5_kt_resolve(kcontext, conf->krb_5_keytab, &keytab);
+ all_principals_unkown = 1;
realms = conf->krb_auth_realms;
do {
if (realms && (code = krb5_set_default_realm(kcontext,
- ap_getword_white(r->pool, &realms))))
+ ap_getword_white(r->pool, &realms)))){
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "krb5_set_default_realm() failed: %s",
+ krb5_get_err_text(kcontext, code));
continue;
+ }
if (client) {
krb5_free_principal(kcontext, client);
client = NULL;
}
code = krb5_parse_name(kcontext, sent_name, &client);
- if (code)
+ if (code) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "krb5_parse_name() failed: %s",
+ krb5_get_err_text(kcontext, code));
continue;
+ }
- code = verify_krb5_user(r, kcontext, client, ccache, sent_pw, "khttp",
+ code = verify_krb5_user(r, kcontext, client, ccache, sent_pw,
+ conf->krb_service_name,
keytab, conf->krb_verify_kdc);
+ if (!conf->krb_authoritative && code) {
+ /* if we're not authoritative, we allow authentication to pass on
+ * to another modules if (and only if) the user is not known to us */
+ if (all_principals_unkown && code != KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN)
+ all_principals_unkown = 0;
+ }
+
if (code == 0)
break;
memset((char *)sent_pw, 0, strlen(sent_pw));
if (code) {
- log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "Verifying krb5 password failed: %s",
- krb5_get_err_text(kcontext, code));
- ret = HTTP_UNAUTHORIZED;
+ if (!conf->krb_authoritative && all_principals_unkown == 1 && code == KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN)
+ ret = DECLINED;
+ else
+ ret = HTTP_UNAUTHORIZED;
+
goto end;
}
********************************************************************/
static const char *
-get_gss_error(MK_POOL *p, OM_uint32 error_status, char *prefix)
+get_gss_error(MK_POOL *p, OM_uint32 err_maj, OM_uint32 err_min, char *prefix)
{
- OM_uint32 maj_stat, min_stat;
+ OM_uint32 maj_stat, min_stat;
OM_uint32 msg_ctx = 0;
gss_buffer_desc status_string;
- char buf[1024];
+ char *err_msg;
size_t len;
- snprintf(buf, sizeof(buf), "%s", prefix);
- len = strlen(buf);
+ err_msg = ap_pstrdup(p, prefix);
do {
maj_stat = gss_display_status (&min_stat,
- error_status,
- GSS_C_MECH_CODE,
+ err_maj,
+ GSS_C_GSS_CODE,
GSS_C_NO_OID,
&msg_ctx,
&status_string);
- if (sizeof(buf) > len + status_string.length + 1) {
- sprintf(buf+len, ": %s", (char*) status_string.value);
- len += status_string.length;
- }
+ if (GSS_ERROR(maj_stat))
+ break;
+ err_msg = ap_pstrcat(p, err_msg, ": ", (char*) status_string.value, NULL);
gss_release_buffer(&min_stat, &status_string);
+
+ maj_stat = gss_display_status (&min_stat,
+ err_min,
+ GSS_C_MECH_CODE,
+ GSS_C_NULL_OID,
+ &msg_ctx,
+ &status_string);
+ if (!GSS_ERROR(maj_stat)) {
+ err_msg = ap_pstrcat(p, err_msg,
+ " (", (char*) status_string.value, ")", NULL);
+ gss_release_buffer(&min_stat, &status_string);
+ }
} while (!GSS_ERROR(maj_stat) && msg_ctx != 0);
- return (ap_pstrdup(p, buf));
+ return err_msg;
}
static int
if (GSS_ERROR(maj_stat)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"Cannot store delegated credential (%s)",
- get_gss_error(r->pool, min_stat, "gss_krb5_copy_ccache"));
+ get_gss_error(r->pool, maj_stat, min_stat, "gss_krb5_copy_ccache"));
goto end;
}
gss_name_t server_name = GSS_C_NO_NAME;
char buf[1024];
- snprintf(buf, sizeof(buf), "%s/%s", "khttp", ap_get_server_name(r));
+#if 0
+ /* Don't specify service name. This makes MIT 1.3 not to use replay caches,
+ * which causes large problems with the Microsoft krb5 implementation. MS
+ * obviously uses a format of the krb5 authenticator that is considered by
+ * the MIT as replay (Two valid MS authenticators may contain the same time
+ * and utime fields and only differ in the sequential numbers).
+ */
+ snprintf(buf, sizeof(buf), "%s@%s", conf->krb_service_name,
+ ap_get_server_name(r));
input_token.value = buf;
input_token.length = strlen(buf) + 1;
major_status = gss_import_name(&minor_status, &input_token,
- GSS_C_NT_USER_NAME,
+ GSS_C_NT_HOSTBASED_SERVICE,
&server_name);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "%s", get_gss_error(r->pool, minor_status,
+ "%s", get_gss_error(r->pool, major_status, minor_status,
"gss_import_name() failed"));
return HTTP_INTERNAL_SERVER_ERROR;
}
+#endif
major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
GSS_C_NO_OID_SET, GSS_C_ACCEPT,
gss_release_name(&minor_status2, &server_name);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "%s", get_gss_error(r->pool, minor_status,
+ "%s", get_gss_error(r->pool, major_status, minor_status,
"gss_acquire_cred() failed"));
return HTTP_INTERNAL_SERVER_ERROR;
}
}
static int
-authenticate_user_gss(request_rec *r,
- kerb_auth_config *conf,
- const char *auth_line)
+authenticate_user_gss(request_rec *r, kerb_auth_config *conf,
+ const char *auth_line, char **negotiate_ret_value)
{
OM_uint32 major_status, minor_status, minor_status2;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
OM_uint32 (*accept_sec_token)();
gss_OID_desc spnego_oid;
+ *negotiate_ret_value = "\0";
+
spnego_oid.length = 6;
spnego_oid.elements = (void *)"\x2b\x06\x01\x05\x05\x02";
}
ap_base64encode(token, output_token.value, output_token.length);
token[len] = '\0';
- ap_table_set(r->err_headers_out, "WWW-Authenticate",
- ap_pstrcat(r->pool, "Negotiate ", token, NULL));
+ *negotiate_ret_value = token;
gss_release_buffer(&minor_status2, &output_token);
}
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "%s", get_gss_error(r->pool, minor_status,
+ "%s", get_gss_error(r->pool, major_status, minor_status,
"gss_accept_sec_context() failed"));
+ /* Don't offer the Negotiate method again if call to GSS layer failed */
+ *negotiate_ret_value = NULL;
ret = HTTP_UNAUTHORIZED;
goto end;
}
gss_release_name(&minor_status, &client_name);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "%s", get_gss_error(r->pool, minor_status,
+ "%s", get_gss_error(r->pool, major_status, minor_status,
"gss_export_name() failed"));
ret = HTTP_INTERNAL_SERVER_ERROR;
goto end;
if (conf->krb_save_credentials && delegated_cred != GSS_C_NO_CREDENTIAL)
store_gss_creds(r, conf, (char *)output_token.value, delegated_cred);
+ if (*negotiate_ret_value)
+ set_kerb_auth_headers(r, conf, 0, 0, *negotiate_ret_value);
+
gss_release_buffer(&minor_status, &output_token);
ret = OK;
if (client_name != GSS_C_NO_NAME)
gss_release_name(&minor_status, &client_name);
- cleanup_gss_connection(gss_connection);
+ if (! major_status & GSS_S_CONTINUE_NEEDED)
+ cleanup_gss_connection(gss_connection);
return ret;
}
}
static void
-note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf,
- int use_krb4, int use_krb5)
+set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf,
+ int use_krb4, int use_krb5pwd, char *negotiate_ret_value)
{
const char *auth_name = NULL;
int set_basic = 0;
+ char *negoauth_param;
+ const char *header_name =
+ (r->proxyreq == PROXYREQ_PROXY) ? "Proxy-Authenticate" : "WWW-Authenticate";
/* get the user realm specified in .htaccess */
auth_name = ap_auth_name(r);
/* XXX should the WWW-Authenticate header be cleared first? */
#ifdef KRB5
- if (use_krb5 && conf->krb_method_gssapi)
- ap_table_add(r->err_headers_out, "WWW-Authenticate", "Negotiate");
- if (use_krb5 && conf->krb_method_k5pass) {
- ap_table_add(r->err_headers_out, "WWW-Authenticate",
- ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
+ if (negotiate_ret_value != NULL && conf->krb_method_gssapi) {
+ negoauth_param = (*negotiate_ret_value == '\0') ? "Negotiate" :
+ ap_pstrcat(r->pool, "Negotiate ", negotiate_ret_value, NULL);
+ ap_table_add(r->err_headers_out, header_name, negoauth_param);
+ }
+ if (use_krb5pwd && conf->krb_method_k5pass) {
+ ap_table_add(r->err_headers_out, header_name,
+ ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
set_basic = 1;
}
#endif
#ifdef KRB4
if (use_krb4 && conf->krb_method_k4pass && !set_basic)
- ap_table_add(r->err_headers_out, "WWW-Authenticate",
- ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
+ ap_table_add(r->err_headers_out, header_name,
+ ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
#endif
}
int use_krb5 = 0, use_krb4 = 0;
int ret;
static int last_return = HTTP_UNAUTHORIZED;
+ char *negotiate_ret_value = NULL;
/* get the type specified in .htaccess */
type = ap_auth_type(r);
/* get what the user sent us in the HTTP header */
auth_line = MK_TABLE_GET(r->headers_in, "Authorization");
if (!auth_line) {
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5);
- return HTTP_UNAUTHORIZED;
+ auth_line = MK_TABLE_GET(r->headers_in, "Proxy-Authorization");
+ if (!auth_line) {
+ set_kerb_auth_headers(r, conf, use_krb4, use_krb5,
+ (use_krb5) ? "\0" : NULL);
+ return HTTP_UNAUTHORIZED;
+ }
}
auth_type = ap_getword_white(r->pool, &auth_line);
#ifdef KRB5
if (use_krb5 && conf->krb_method_gssapi &&
strcasecmp(auth_type, "Negotiate") == 0) {
- ret = authenticate_user_gss(r, conf, auth_line);
+ ret = authenticate_user_gss(r, conf, auth_line, &negotiate_ret_value);
} else if (use_krb5 && conf->krb_method_k5pass &&
strcasecmp(auth_type, "Basic") == 0) {
ret = authenticate_user_krb5pwd(r, conf, auth_line);
#endif
if (ret == HTTP_UNAUTHORIZED)
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5);
+ set_kerb_auth_headers(r, conf, use_krb4, use_krb5, negotiate_ret_value);
last_return = ret;
return ret;
projects / mod_auth_kerb.cvs / .git / blobdiff