#define MODAUTHKERB_VERSION "5.0-rc4"
-#ifndef APXS1
-#include "ap_compat.h"
-#include "apr_strings.h"
+#include <httpd.h>
+#include <http_config.h>
+#include <http_core.h>
+#include <http_log.h>
+#include <http_protocol.h>
+#include <http_request.h>
+
+#ifdef STANDARD20_MODULE_STUFF
+#include <ap_compat.h>
+#include <apr_strings.h>
#endif
-#include "httpd.h"
-#include "http_config.h"
-#include "http_core.h"
-#include "http_log.h"
-#include "http_protocol.h"
-#include "http_request.h"
+
#ifdef KRB5
#include <krb5.h>
#include <netdb.h> /* gethostbyname() */
#endif /* KRB4 */
-#ifdef APXS1
-module auth_kerb_module;
-#else
+#ifdef STANDARD20_MODULE_STUFF
module AP_MODULE_DECLARE_DATA auth_kerb_module;
+#else
+module auth_kerb_module;
#endif
/***************************************************************************
Macros To Ease Compatibility
***************************************************************************/
-#ifdef APXS1
+#ifdef STANDARD20_MODULE_STUFF
+#define MK_POOL apr_pool_t
+#define MK_TABLE_GET apr_table_get
+#define MK_USER r->user
+#define MK_AUTH_TYPE r->ap_auth_type
+#else
#define MK_POOL pool
#define MK_TABLE_GET ap_table_get
#define MK_USER r->connection->user
#define MK_AUTH_TYPE r->connection->ap_auth_type
#define PROXYREQ_PROXY STD_PROXY
-#else
-#define MK_POOL apr_pool_t
-#define MK_TABLE_GET apr_table_get
-#define MK_USER r->user
-#define MK_AUTH_TYPE r->ap_auth_type
-#endif /* APXS1 */
-
+#endif
/***************************************************************************
Auth Configuration Structure
#endif
} kerb_auth_config;
+static void
+set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf,
+ int use_krb4, int use_krb5pwd, char *negotiate_ret_value);
+
static const char*
krb5_save_realms(cmd_parms *cmd, kerb_auth_config *sec, char *arg);
-#ifdef APXS1
+#ifdef STANDARD20_MODULE_STUFF
+#define command(name, func, var, type, usage) \
+ AP_INIT_ ## type (name, func, \
+ (void*)APR_XtOffsetOf(kerb_auth_config, var), \
+ OR_AUTHCFG, usage)
+#else
#define command(name, func, var, type, usage) \
{ name, func, \
(void*)XtOffsetOf(kerb_auth_config, var), \
OR_AUTHCFG, type, usage }
-#else
-#define command(name, func, var, type, usage) \
- AP_INIT_ ## type (name, func, \
- (void*)APR_XtOffsetOf(kerb_auth_config, var), \
- OR_AUTHCFG, usage)
#endif
static const command_rec kerb_auth_cmds[] = {
{ NULL }
};
-#ifdef KRB5
-typedef struct {
- gss_ctx_id_t context;
- gss_cred_id_t server_creds;
-} gss_connection_t;
-
-static gss_connection_t *gss_connection = NULL;
-
-static const char *EMPTY_STRING = "\0";
-#endif
-
-
/***************************************************************************
Auth Configuration Initialization
***************************************************************************/
va_end(ap);
-#ifdef APXS1
- ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr);
-#else
+#ifdef STANDARD20_MODULE_STUFF
ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errstr);
+#else
+ ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr);
#endif
}
krb5_get_err_text(context, ret));
goto end;
}
+ /* XXX log_debug: lookig for <server_princ> in keytab */
+
+ /* XXX
+ {
+ char *realm;
+
+ krb5_get_default_realm(context, &realm);
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "trying to verify password using key for %s/%s@%s",
+ service, ap_get_server_name(r), realm);
+ }
+ */
krb5_verify_init_creds_opt_init(&opt);
krb5_verify_init_creds_opt_set_ap_req_nofail(&opt, krb_verify_kdc);
}
static int
-cleanup_gss_connection(void *data)
-{
- OM_uint32 minor_status;
- gss_connection_t *gss_conn = (gss_connection_t *)data;
-
- if (data == NULL)
- return OK;
- if (gss_conn->context != GSS_C_NO_CONTEXT)
- gss_delete_sec_context(&minor_status, &gss_conn->context,
- GSS_C_NO_BUFFER);
- if (gss_conn->server_creds != GSS_C_NO_CREDENTIAL)
- gss_release_cred(&minor_status, &gss_conn->server_creds);
-
- gss_connection = NULL;
-
- return OK;
-}
-
-static int
store_gss_creds(request_rec *r, kerb_auth_config *conf, char *princ_name,
gss_cred_id_t delegated_cred)
{
if (token->length == 0)
return GSS_S_DEFECTIVE_TOKEN;
+ /* XXX if (token->value == NTLMSSP) log_debug("NTLM mechanism used"); */
+
p = token->value;
if (*p++ != 0x60)
return GSS_S_DEFECTIVE_TOKEN;
gss_cred_id_t delegated_cred = GSS_C_NO_CREDENTIAL;
OM_uint32 (*accept_sec_token)();
gss_OID_desc spnego_oid;
+ gss_ctx_id_t context = GSS_C_NO_CONTEXT;
+ gss_cred_id_t server_creds = GSS_C_NO_CREDENTIAL;
- *negotiate_ret_value = (char *)EMPTY_STRING;
+ *negotiate_ret_value = "\0";
spnego_oid.length = 6;
spnego_oid.elements = (void *)"\x2b\x06\x01\x05\x05\x02";
- if (gss_connection == NULL) {
- gss_connection = ap_pcalloc(r->connection->pool, sizeof(*gss_connection));
- if (gss_connection == NULL) {
- log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "ap_pcalloc() failed (not enough memory)");
- ret = HTTP_INTERNAL_SERVER_ERROR;
- goto end;
- }
- memset(gss_connection, 0, sizeof(*gss_connection));
- ap_register_cleanup(r->connection->pool, gss_connection, cleanup_gss_connection, ap_null_cleanup);
- }
-
if (conf->krb_5_keytab) {
char *ktname;
/* we don't use the ap_* calls here, since the string passed to putenv()
putenv(ktname);
}
- if (gss_connection->server_creds == GSS_C_NO_CREDENTIAL) {
- ret = get_gss_creds(r, conf, &gss_connection->server_creds);
- if (ret)
- goto end;
- }
+ ret = get_gss_creds(r, conf, &server_creds);
+ if (ret)
+ goto end;
/* ap_getword() shifts parameter */
auth_param = ap_getword_white(r->pool, &auth_line);
gss_accept_sec_context_spnego : gss_accept_sec_context;
major_status = accept_sec_token(&minor_status,
- &gss_connection->context,
- gss_connection->server_creds,
+ &context,
+ server_creds,
&input_token,
GSS_C_NO_CHANNEL_BINDINGS,
&client_name,
goto end;
}
+#if 0
+ /* This is a _Kerberos_ module so multiple authentication rounds aren't
+ * supported. If we wanted a generic GSS authentication we would have to do
+ * some magic with exporting context etc. */
if (major_status & GSS_S_CONTINUE_NEEDED) {
- /* Some GSSAPI mechanism (eg GSI from Globus) may require multiple
- * iterations to establish authentication */
ret = HTTP_UNAUTHORIZED;
goto end;
}
+#endif
major_status = gss_display_name(&minor_status, client_name, &output_token, NULL);
gss_release_name(&minor_status, &client_name);
if (conf->krb_save_credentials && delegated_cred != GSS_C_NO_CREDENTIAL)
store_gss_creds(r, conf, (char *)output_token.value, delegated_cred);
+ if (*negotiate_ret_value)
+ set_kerb_auth_headers(r, conf, 0, 0, *negotiate_ret_value);
+
gss_release_buffer(&minor_status, &output_token);
ret = OK;
if (client_name != GSS_C_NO_NAME)
gss_release_name(&minor_status, &client_name);
- if (! major_status & GSS_S_CONTINUE_NEEDED)
- cleanup_gss_connection(gss_connection);
+ if (server_creds != GSS_C_NO_CREDENTIAL)
+ gss_release_cred(&minor_status, &server_creds);
+
+ if (context != GSS_C_NO_CONTEXT)
+ gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
return ret;
}
}
static void
-note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf,
- int use_krb4, int use_krb5, char *negotiate_ret_value)
+set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf,
+ int use_krb4, int use_krb5pwd, char *negotiate_ret_value)
{
const char *auth_name = NULL;
int set_basic = 0;
/* XXX should the WWW-Authenticate header be cleared first? */
#ifdef KRB5
- if (use_krb5 && conf->krb_method_gssapi && negotiate_ret_value != NULL) {
+ if (negotiate_ret_value != NULL && conf->krb_method_gssapi) {
negoauth_param = (*negotiate_ret_value == '\0') ? "Negotiate" :
ap_pstrcat(r->pool, "Negotiate ", negotiate_ret_value, NULL);
ap_table_add(r->err_headers_out, header_name, negoauth_param);
}
- if (use_krb5 && conf->krb_method_k5pass) {
+ if (use_krb5pwd && conf->krb_method_k5pass) {
ap_table_add(r->err_headers_out, header_name,
ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
set_basic = 1;
int use_krb5 = 0, use_krb4 = 0;
int ret;
static int last_return = HTTP_UNAUTHORIZED;
- char *negotiate_ret_value;
+ char *negotiate_ret_value = NULL;
/* get the type specified in .htaccess */
type = ap_auth_type(r);
if (!auth_line) {
auth_line = MK_TABLE_GET(r->headers_in, "Proxy-Authorization");
if (!auth_line) {
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5, "\0");
+ set_kerb_auth_headers(r, conf, use_krb4, use_krb5,
+ (use_krb5) ? "\0" : NULL);
return HTTP_UNAUTHORIZED;
}
}
#endif
if (ret == HTTP_UNAUTHORIZED)
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5, negotiate_ret_value);
+ set_kerb_auth_headers(r, conf, use_krb4, use_krb5, negotiate_ret_value);
+
+ /* XXX log_debug: if ret==OK, log(user XY authenticated) */
last_return = ret;
return ret;
/***************************************************************************
Module Setup/Configuration
***************************************************************************/
-#ifdef APXS1
+#ifndef STANDARD20_MODULE_STUFF
module MODULE_VAR_EXPORT auth_kerb_module = {
STANDARD_MODULE_STUFF,
NULL, /* module initializer */
projects / mod_auth_kerb.cvs / .git / blobdiff