* Ludek Sulak <xsulak@fi.muni.cz>
*/
-/* ====================================================================
- * The Apache Software License, Version 1.1
- *
- * Copyright (c) 2000-2004 The Apache Software Foundation. All rights
- * reserved.
+/*
+ * Copyright (c) 2004 Masarykova universita
+ * (Masaryk University, Brno, Czech Republic)
+ * All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
+ * modification, are permitted provided that the following conditions are met:
*
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. The end-user documentation included with the redistribution,
- * if any, must include the following acknowledgment:
- * "This product includes software developed by the
- * Apache Software Foundation (http://www.apache.org/)."
- * Alternately, this acknowledgment may appear in the software itself,
- * if and wherever such third-party acknowledgments normally appear.
- *
- * 4. The names "Apache" and "Apache Software Foundation" must
- * not be used to endorse or promote products derived from this
- * software without prior written permission. For written
- * permission, please contact apache@apache.org.
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
*
- * 5. Products derived from this software may not be called "Apache",
- * nor may "Apache" appear in their name, without prior written
- * permission of the Apache Software Foundation.
+ * 3. Neither the name of the University nor the names of its contributors may
+ * be used to endorse or promote products derived from this software
+ * without specific prior written permission.
*
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
- * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * ====================================================================
- *
- * This software consists of voluntary contributions made by many
- * individuals on behalf of the Apache Software Foundation. For more
- * information on the Apache Software Foundation, please see
- * <http://www.apache.org/>.
- *
- * Portions of this software are based upon public domain software
- * originally written at the National Center for Supercomputing Applications,
- * University of Illinois, Urbana-Champaign.
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
*/
#ident "$Id$"
#endif
} kerb_auth_config;
+static void
+set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf,
+ int use_krb4, int use_krb5pwd, char *negotiate_ret_value);
+
static const char*
krb5_save_realms(cmd_parms *cmd, kerb_auth_config *sec, char *arg);
} gss_connection_t;
static gss_connection_t *gss_connection = NULL;
-
-static const char *EMPTY_STRING = "\0";
#endif
memset(&creds, 0, sizeof(creds));
ret = krb5_get_init_creds_password(context, &creds, principal,
- (char *)password, krb5_prompter_posix,
+ (char *)password, NULL,
NULL, 0, NULL, NULL);
if (ret) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
goto end;
}
-#ifdef HEIMDAL
- code = krb5_cc_gen_new(kcontext, &krb5_mcc_ops, &ccache);
-#else
code = krb5_cc_resolve(kcontext, "MEMORY:", &ccache);
-#endif
if (code) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"generating new memory ccache failed: %s",
OM_uint32 (*accept_sec_token)();
gss_OID_desc spnego_oid;
- *negotiate_ret_value = (char *)EMPTY_STRING;
+ *negotiate_ret_value = "\0";
spnego_oid.length = 6;
spnego_oid.elements = (void *)"\x2b\x06\x01\x05\x05\x02";
if (conf->krb_save_credentials && delegated_cred != GSS_C_NO_CREDENTIAL)
store_gss_creds(r, conf, (char *)output_token.value, delegated_cred);
+ if (*negotiate_ret_value)
+ set_kerb_auth_headers(r, conf, 0, 0, *negotiate_ret_value);
+
gss_release_buffer(&minor_status, &output_token);
ret = OK;
}
static void
-note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf,
- int use_krb4, int use_krb5, char *negotiate_ret_value)
+set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf,
+ int use_krb4, int use_krb5pwd, char *negotiate_ret_value)
{
const char *auth_name = NULL;
int set_basic = 0;
/* XXX should the WWW-Authenticate header be cleared first? */
#ifdef KRB5
- if (use_krb5 && conf->krb_method_gssapi && negotiate_ret_value != NULL) {
+ if (negotiate_ret_value != NULL && conf->krb_method_gssapi) {
negoauth_param = (*negotiate_ret_value == '\0') ? "Negotiate" :
ap_pstrcat(r->pool, "Negotiate ", negotiate_ret_value, NULL);
ap_table_add(r->err_headers_out, header_name, negoauth_param);
}
- if (use_krb5 && conf->krb_method_k5pass) {
+ if (use_krb5pwd && conf->krb_method_k5pass) {
ap_table_add(r->err_headers_out, header_name,
ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
set_basic = 1;
int use_krb5 = 0, use_krb4 = 0;
int ret;
static int last_return = HTTP_UNAUTHORIZED;
- char *negotiate_ret_value;
+ char *negotiate_ret_value = NULL;
/* get the type specified in .htaccess */
type = ap_auth_type(r);
if (!auth_line) {
auth_line = MK_TABLE_GET(r->headers_in, "Proxy-Authorization");
if (!auth_line) {
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5, "\0");
+ set_kerb_auth_headers(r, conf, use_krb4, use_krb5,
+ (use_krb5) ? "\0" : NULL);
return HTTP_UNAUTHORIZED;
}
}
#endif
if (ret == HTTP_UNAUTHORIZED)
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5, negotiate_ret_value);
+ set_kerb_auth_headers(r, conf, use_krb4, use_krb5, negotiate_ret_value);
last_return = ret;
return ret;
projects / mod_auth_kerb.cvs / .git / blobdiff