* Ludek Sulak <xsulak@fi.muni.cz>
*/
-/* ====================================================================
- * The Apache Software License, Version 1.1
- *
- * Copyright (c) 2000-2004 The Apache Software Foundation. All rights
- * reserved.
+/*
+ * Copyright (c) 2004 Masarykova universita
+ * (Masaryk University, Brno, Czech Republic)
+ * All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
+ * modification, are permitted provided that the following conditions are met:
*
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. The end-user documentation included with the redistribution,
- * if any, must include the following acknowledgment:
- * "This product includes software developed by the
- * Apache Software Foundation (http://www.apache.org/)."
- * Alternately, this acknowledgment may appear in the software itself,
- * if and wherever such third-party acknowledgments normally appear.
- *
- * 4. The names "Apache" and "Apache Software Foundation" must
- * not be used to endorse or promote products derived from this
- * software without prior written permission. For written
- * permission, please contact apache@apache.org.
- *
- * 5. Products derived from this software may not be called "Apache",
- * nor may "Apache" appear in their name, without prior written
- * permission of the Apache Software Foundation.
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
*
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
- * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * ====================================================================
+ * 3. Neither the name of the University nor the names of its contributors may
+ * be used to endorse or promote products derived from this software
+ * without specific prior written permission.
*
- * This software consists of voluntary contributions made by many
- * individuals on behalf of the Apache Software Foundation. For more
- * information on the Apache Software Foundation, please see
- * <http://www.apache.org/>.
- *
- * Portions of this software are based upon public domain software
- * originally written at the National Center for Supercomputing Applications,
- * University of Illinois, Urbana-Champaign.
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
*/
#ident "$Id$"
#define MODAUTHKERB_VERSION "5.0-rc4"
-#ifndef APXS1
-#include "ap_compat.h"
-#include "apr_strings.h"
+#include <httpd.h>
+#include <http_config.h>
+#include <http_core.h>
+#include <http_log.h>
+#include <http_protocol.h>
+#include <http_request.h>
+
+#ifdef STANDARD20_MODULE_STUFF
+#include <ap_compat.h>
+#include <apr_strings.h>
#endif
-#include "httpd.h"
-#include "http_config.h"
-#include "http_core.h"
-#include "http_log.h"
-#include "http_protocol.h"
-#include "http_request.h"
+
#ifdef KRB5
#include <krb5.h>
#include <netdb.h> /* gethostbyname() */
#endif /* KRB4 */
-#ifdef APXS1
-module auth_kerb_module;
-#else
+#ifdef STANDARD20_MODULE_STUFF
module AP_MODULE_DECLARE_DATA auth_kerb_module;
+#else
+module auth_kerb_module;
#endif
/***************************************************************************
Macros To Ease Compatibility
***************************************************************************/
-#ifdef APXS1
+#ifdef STANDARD20_MODULE_STUFF
+#define MK_POOL apr_pool_t
+#define MK_TABLE_GET apr_table_get
+#define MK_USER r->user
+#define MK_AUTH_TYPE r->ap_auth_type
+#else
#define MK_POOL pool
#define MK_TABLE_GET ap_table_get
#define MK_USER r->connection->user
#define MK_AUTH_TYPE r->connection->ap_auth_type
#define PROXYREQ_PROXY STD_PROXY
-#else
-#define MK_POOL apr_pool_t
-#define MK_TABLE_GET apr_table_get
-#define MK_USER r->user
-#define MK_AUTH_TYPE r->ap_auth_type
-#endif /* APXS1 */
-
+#endif
/***************************************************************************
Auth Configuration Structure
#endif
} kerb_auth_config;
+static void
+set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf,
+ int use_krb4, int use_krb5pwd, char *negotiate_ret_value);
+
static const char*
krb5_save_realms(cmd_parms *cmd, kerb_auth_config *sec, char *arg);
-#ifdef APXS1
+#ifdef STANDARD20_MODULE_STUFF
+#define command(name, func, var, type, usage) \
+ AP_INIT_ ## type (name, func, \
+ (void*)APR_XtOffsetOf(kerb_auth_config, var), \
+ OR_AUTHCFG, usage)
+#else
#define command(name, func, var, type, usage) \
{ name, func, \
(void*)XtOffsetOf(kerb_auth_config, var), \
OR_AUTHCFG, type, usage }
-#else
-#define command(name, func, var, type, usage) \
- AP_INIT_ ## type (name, func, \
- (void*)APR_XtOffsetOf(kerb_auth_config, var), \
- OR_AUTHCFG, usage)
#endif
static const command_rec kerb_auth_cmds[] = {
{ NULL }
};
-#ifdef KRB5
-typedef struct {
- gss_ctx_id_t context;
- gss_cred_id_t server_creds;
-} gss_connection_t;
-
-static gss_connection_t *gss_connection = NULL;
-
-static const char *EMPTY_STRING = "\0";
-#endif
-
-
/***************************************************************************
Auth Configuration Initialization
***************************************************************************/
va_end(ap);
-#ifdef APXS1
- ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr);
-#else
+#ifdef STANDARD20_MODULE_STUFF
ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errstr);
+#else
+ ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr);
#endif
}
memset(&creds, 0, sizeof(creds));
ret = krb5_get_init_creds_password(context, &creds, principal,
- (char *)password, krb5_prompter_posix,
+ (char *)password, NULL,
NULL, 0, NULL, NULL);
if (ret) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
krb5_get_err_text(context, ret));
goto end;
}
+ /* XXX log_debug: lookig for <server_princ> in keytab */
+
+ /* XXX
+ {
+ char *realm;
+
+ krb5_get_default_realm(context, &realm);
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "trying to verify password using key for %s/%s@%s",
+ service, ap_get_server_name(r), realm);
+ }
+ */
krb5_verify_init_creds_opt_init(&opt);
krb5_verify_init_creds_opt_set_ap_req_nofail(&opt, krb_verify_kdc);
goto end;
}
-#ifdef HEIMDAL
- code = krb5_cc_gen_new(kcontext, &krb5_mcc_ops, &ccache);
-#else
code = krb5_cc_resolve(kcontext, "MEMORY:", &ccache);
-#endif
if (code) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"generating new memory ccache failed: %s",
}
static int
-cleanup_gss_connection(void *data)
-{
- OM_uint32 minor_status;
- gss_connection_t *gss_conn = (gss_connection_t *)data;
-
- if (data == NULL)
- return OK;
- if (gss_conn->context != GSS_C_NO_CONTEXT)
- gss_delete_sec_context(&minor_status, &gss_conn->context,
- GSS_C_NO_BUFFER);
- if (gss_conn->server_creds != GSS_C_NO_CREDENTIAL)
- gss_release_cred(&minor_status, &gss_conn->server_creds);
-
- gss_connection = NULL;
-
- return OK;
-}
-
-static int
store_gss_creds(request_rec *r, kerb_auth_config *conf, char *princ_name,
gss_cred_id_t delegated_cred)
{
if (token->length == 0)
return GSS_S_DEFECTIVE_TOKEN;
+ /* XXX if (token->value == NTLMSSP) log_debug("NTLM mechanism used"); */
+
p = token->value;
if (*p++ != 0x60)
return GSS_S_DEFECTIVE_TOKEN;
gss_cred_id_t delegated_cred = GSS_C_NO_CREDENTIAL;
OM_uint32 (*accept_sec_token)();
gss_OID_desc spnego_oid;
+ gss_ctx_id_t context = GSS_C_NO_CONTEXT;
+ gss_cred_id_t server_creds = GSS_C_NO_CREDENTIAL;
- *negotiate_ret_value = (char *)EMPTY_STRING;
+ *negotiate_ret_value = "\0";
spnego_oid.length = 6;
spnego_oid.elements = (void *)"\x2b\x06\x01\x05\x05\x02";
- if (gss_connection == NULL) {
- gss_connection = ap_pcalloc(r->connection->pool, sizeof(*gss_connection));
- if (gss_connection == NULL) {
- log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "ap_pcalloc() failed (not enough memory)");
- ret = HTTP_INTERNAL_SERVER_ERROR;
- goto end;
- }
- memset(gss_connection, 0, sizeof(*gss_connection));
- ap_register_cleanup(r->connection->pool, gss_connection, cleanup_gss_connection, ap_null_cleanup);
- }
-
if (conf->krb_5_keytab) {
char *ktname;
/* we don't use the ap_* calls here, since the string passed to putenv()
putenv(ktname);
}
- if (gss_connection->server_creds == GSS_C_NO_CREDENTIAL) {
- ret = get_gss_creds(r, conf, &gss_connection->server_creds);
- if (ret)
- goto end;
- }
+ ret = get_gss_creds(r, conf, &server_creds);
+ if (ret)
+ goto end;
/* ap_getword() shifts parameter */
auth_param = ap_getword_white(r->pool, &auth_line);
gss_accept_sec_context_spnego : gss_accept_sec_context;
major_status = accept_sec_token(&minor_status,
- &gss_connection->context,
- gss_connection->server_creds,
+ &context,
+ server_creds,
&input_token,
GSS_C_NO_CHANNEL_BINDINGS,
&client_name,
goto end;
}
+#if 0
+ /* This is a _Kerberos_ module so multiple authentication rounds aren't
+ * supported. If we wanted a generic GSS authentication we would have to do
+ * some magic with exporting context etc. */
if (major_status & GSS_S_CONTINUE_NEEDED) {
- /* Some GSSAPI mechanism (eg GSI from Globus) may require multiple
- * iterations to establish authentication */
ret = HTTP_UNAUTHORIZED;
goto end;
}
+#endif
major_status = gss_display_name(&minor_status, client_name, &output_token, NULL);
gss_release_name(&minor_status, &client_name);
if (conf->krb_save_credentials && delegated_cred != GSS_C_NO_CREDENTIAL)
store_gss_creds(r, conf, (char *)output_token.value, delegated_cred);
+ if (*negotiate_ret_value)
+ set_kerb_auth_headers(r, conf, 0, 0, *negotiate_ret_value);
+
gss_release_buffer(&minor_status, &output_token);
ret = OK;
if (client_name != GSS_C_NO_NAME)
gss_release_name(&minor_status, &client_name);
- if (! major_status & GSS_S_CONTINUE_NEEDED)
- cleanup_gss_connection(gss_connection);
+ if (server_creds != GSS_C_NO_CREDENTIAL)
+ gss_release_cred(&minor_status, &server_creds);
+
+ if (context != GSS_C_NO_CONTEXT)
+ gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
return ret;
}
}
static void
-note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf,
- int use_krb4, int use_krb5, char *negotiate_ret_value)
+set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf,
+ int use_krb4, int use_krb5pwd, char *negotiate_ret_value)
{
const char *auth_name = NULL;
int set_basic = 0;
/* XXX should the WWW-Authenticate header be cleared first? */
#ifdef KRB5
- if (use_krb5 && conf->krb_method_gssapi && negotiate_ret_value != NULL) {
+ if (negotiate_ret_value != NULL && conf->krb_method_gssapi) {
negoauth_param = (*negotiate_ret_value == '\0') ? "Negotiate" :
ap_pstrcat(r->pool, "Negotiate ", negotiate_ret_value, NULL);
ap_table_add(r->err_headers_out, header_name, negoauth_param);
}
- if (use_krb5 && conf->krb_method_k5pass) {
+ if (use_krb5pwd && conf->krb_method_k5pass) {
ap_table_add(r->err_headers_out, header_name,
ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
set_basic = 1;
int use_krb5 = 0, use_krb4 = 0;
int ret;
static int last_return = HTTP_UNAUTHORIZED;
- char *negotiate_ret_value;
+ char *negotiate_ret_value = NULL;
/* get the type specified in .htaccess */
type = ap_auth_type(r);
if (!auth_line) {
auth_line = MK_TABLE_GET(r->headers_in, "Proxy-Authorization");
if (!auth_line) {
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5, "\0");
+ set_kerb_auth_headers(r, conf, use_krb4, use_krb5,
+ (use_krb5) ? "\0" : NULL);
return HTTP_UNAUTHORIZED;
}
}
#endif
if (ret == HTTP_UNAUTHORIZED)
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5, negotiate_ret_value);
+ set_kerb_auth_headers(r, conf, use_krb4, use_krb5, negotiate_ret_value);
+
+ /* XXX log_debug: if ret==OK, log(user XY authenticated) */
last_return = ret;
return ret;
/***************************************************************************
Module Setup/Configuration
***************************************************************************/
-#ifdef APXS1
+#ifndef STANDARD20_MODULE_STUFF
module MODULE_VAR_EXPORT auth_kerb_module = {
STANDARD_MODULE_STUFF,
NULL, /* module initializer */
projects / mod_auth_kerb.cvs / .git / blobdiff