X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=util_attr.cpp;h=d9c4614fa2537e9c509ae5bdb2fb63c11e6f773f;hb=f12a2be8e6409006eaf326c204ea5c99b78b3b2b;hp=56a0088df2c2a335fb5f928e3adde2ecf4a78182;hpb=646a981cdd5c439b4b4fa5dde8f742a1a2a05b43;p=mech_eap.orig

diff --git a/util_attr.cpp b/util_attr.cpp
index 56a0088..d9c4614 100644
--- a/util_attr.cpp
+++ b/util_attr.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, JANET(UK)
+ * Copyright (c) 2011, JANET(UK)
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,22 +30,79 @@
  * SUCH DAMAGE.
  */
 
+/*
+ * Attribute provider mechanism.
+ */
+
 #include "gssapiP_eap.h"
 
 #include <typeinfo>
 #include <string>
+#include <sstream>
 #include <exception>
+#include <stdexcept>
 #include <new>
 
+/* lazy initialisation */
+static GSSEAP_THREAD_ONCE gssEapAttrProvidersInitOnce = GSSEAP_ONCE_INITIALIZER;
+static OM_uint32 gssEapAttrProvidersInitStatus = GSS_S_UNAVAILABLE;
+
+static void
+gssEapAttrProvidersInitInternal(void)
+{
+    OM_uint32 major, minor;
+
+    assert(gssEapAttrProvidersInitStatus == GSS_S_UNAVAILABLE);
+
+    major = gssEapRadiusAttrProviderInit(&minor);
+    if (major == GSS_S_COMPLETE)
+        major = gssEapSamlAttrProvidersInit(&minor);
+    if (major == GSS_S_COMPLETE)
+        major = gssEapLocalAttrProviderInit(&minor);
+
+#ifdef GSSEAP_DEBUG
+    assert(major == GSS_S_COMPLETE);
+#endif
+
+    gssEapAttrProvidersInitStatus = major;
+}
+
+static OM_uint32
+gssEapAttrProvidersInit(OM_uint32 *minor)
+{
+    GSSEAP_ONCE(&gssEapAttrProvidersInitOnce, gssEapAttrProvidersInitInternal);
+
+    if (GSS_ERROR(gssEapAttrProvidersInitStatus))
+        *minor = GSSEAP_NO_ATTR_PROVIDERS;
+
+    return gssEapAttrProvidersInitStatus;
+}
+
+OM_uint32
+gssEapAttrProvidersFinalize(OM_uint32 *minor)
+{
+    OM_uint32 major = GSS_S_COMPLETE;
+
+    if (gssEapAttrProvidersInitStatus == GSS_S_COMPLETE) {
+        major = gssEapLocalAttrProviderFinalize(minor);
+        if (major == GSS_S_COMPLETE)
+            major = gssEapSamlAttrProvidersFinalize(minor);
+        if (major == GSS_S_COMPLETE)
+            major = gssEapRadiusAttrProviderFinalize(minor);
+
+        gssEapAttrProvidersInitStatus = GSS_S_UNAVAILABLE;
+    }
+
+    return major;
+}
+
 static gss_eap_attr_create_provider gssEapAttrFactories[ATTR_TYPE_MAX + 1];
-static gss_buffer_desc gssEapAttrPrefixes[ATTR_TYPE_MAX + 1];
 
 /*
  * Register a provider for a particular type and prefix
  */
 void
 gss_eap_attr_ctx::registerProvider(unsigned int type,
-                                   const char *prefix,
                                    gss_eap_attr_create_provider factory)
 {
     assert(type <= ATTR_TYPE_MAX);
@@ -53,13 +110,6 @@ gss_eap_attr_ctx::registerProvider(unsigned int type,
     assert(gssEapAttrFactories[type] == NULL);
 
     gssEapAttrFactories[type] = factory;
-    if (prefix != NULL) {
-        gssEapAttrPrefixes[type].value = (void *)prefix;
-        gssEapAttrPrefixes[type].length = strlen(prefix);
-    } else {
-        gssEapAttrPrefixes[type].value = NULL;
-        gssEapAttrPrefixes[type].length = 0;
-    }
 }
 
 /*
@@ -71,8 +121,6 @@ gss_eap_attr_ctx::unregisterProvider(unsigned int type)
     assert(type <= ATTR_TYPE_MAX);
 
     gssEapAttrFactories[type] = NULL;
-    gssEapAttrPrefixes[type].value = NULL;
-    gssEapAttrPrefixes[type].length = 0;
 }
 
 /*
@@ -99,12 +147,22 @@ gss_eap_attr_ctx::gss_eap_attr_ctx(void)
  * Convert an attribute prefix to a type
  */
 unsigned int
-gss_eap_attr_ctx::attributePrefixToType(const gss_buffer_t prefix)
+gss_eap_attr_ctx::attributePrefixToType(const gss_buffer_t prefix) const
 {
     unsigned int i;
 
     for (i = ATTR_TYPE_MIN; i < ATTR_TYPE_MAX; i++) {
-        if (bufferEqual(&gssEapAttrPrefixes[i], prefix))
+        const char *pprefix;
+
+        if (!providerEnabled(i))
+            continue;
+
+        pprefix = m_providers[i]->prefix();
+        if (pprefix == NULL)
+            continue;
+
+        if (strlen(pprefix) == prefix->length &&
+            memcmp(pprefix, prefix->value, prefix->length) == 0)
             return i;
     }
 
@@ -114,13 +172,22 @@ gss_eap_attr_ctx::attributePrefixToType(const gss_buffer_t prefix)
 /*
  * Convert a type to an attribute prefix
  */
-const gss_buffer_t
-gss_eap_attr_ctx::attributeTypeToPrefix(unsigned int type)
+gss_buffer_desc
+gss_eap_attr_ctx::attributeTypeToPrefix(unsigned int type) const
 {
+    gss_buffer_desc prefix = GSS_C_EMPTY_BUFFER;
+
     if (type < ATTR_TYPE_MIN || type >= ATTR_TYPE_MAX)
-        return GSS_C_NO_BUFFER;
+        return prefix;
+
+    if (!providerEnabled(type))
+        return prefix;
 
-    return &gssEapAttrPrefixes[type];
+    prefix.value = (void *)m_providers[type]->prefix();
+    if (prefix.value != NULL)
+        prefix.length = strlen((char *)prefix.value);
+
+    return prefix;
 }
 
 bool
@@ -208,49 +275,122 @@ gss_eap_attr_ctx::initFromGssContext(const gss_cred_id_t cred,
     return ret;
 }
 
-/*
- * Initialize a context from an exported context or name token
- */
 bool
-gss_eap_attr_ctx::initFromBuffer(const gss_buffer_t buffer)
+gss_eap_attr_ctx::initWithJsonObject(JSONObject &obj)
 {
-    bool ret;
-    gss_eap_attr_provider *primaryProvider = getPrimaryProvider();
-    gss_buffer_desc primaryBuf;
+    bool ret = false;
+    bool foundSource[ATTR_TYPE_MAX + 1];
+    unsigned int type;
 
-    if (buffer->length < 4)
-        return false;
+    for (type = ATTR_TYPE_MIN; type <= ATTR_TYPE_MAX; type++)
+        foundSource[type] = false;
 
-    m_flags = load_uint32_be(buffer->value);
+    if (obj["version"].integer() != 1)
+        return false;
 
-    primaryBuf.length = buffer->length - 4;
-    primaryBuf.value = (char *)buffer->value + 4;
+    m_flags = obj["flags"].integer();
 
-    ret = primaryProvider->initFromBuffer(this, &primaryBuf);
-    if (ret == false)
-        return ret;
+    JSONObject sources = obj["sources"];
 
-    for (unsigned int i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
+    /* Initialize providers from serialized state */
+    for (type = ATTR_TYPE_MIN; type <= ATTR_TYPE_MAX; type++) {
         gss_eap_attr_provider *provider;
+        const char *key;
 
-        if (!providerEnabled(i)) {
-            releaseProvider(i);
+        if (!providerEnabled(type)) {
+            releaseProvider(type);
             continue;
         }
 
-        provider = m_providers[i];
-        if (provider == primaryProvider)
+        provider = m_providers[type];
+        key = provider->name();
+        if (key == NULL)
             continue;
 
+        JSONObject source = sources.get(key);
+        if (!source.isnull() &&
+            !provider->initWithJsonObject(this, source)) {
+            releaseProvider(type);
+            return false;
+        }
+
+        foundSource[type] = true;
+    }
+
+    /* Initialize remaining providers from initialized providers */
+    for (type = ATTR_TYPE_MIN; type <= ATTR_TYPE_MAX; type++) {
+        gss_eap_attr_provider *provider;
+
+        if (foundSource[type] || !providerEnabled(type))
+            continue;
+
+        provider = m_providers[type];
+
         ret = provider->initFromGssContext(this,
                                            GSS_C_NO_CREDENTIAL,
                                            GSS_C_NO_CONTEXT);
         if (ret == false) {
-            releaseProvider(i);
-            break;
+            releaseProvider(type);
+            return false;
         }
     }
 
+    return true;
+}
+
+JSONObject
+gss_eap_attr_ctx::jsonRepresentation(void) const
+{
+    JSONObject obj, sources;
+    unsigned int i;
+
+    obj.set("version", 1);
+    obj.set("flags", m_flags);
+
+    for (i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
+        gss_eap_attr_provider *provider;
+        const char *key;
+
+        provider = m_providers[i];
+        if (provider == NULL)
+            continue; /* provider not initialised */
+
+        key = provider->name();
+        if (key == NULL)
+            continue; /* provider does not have state */
+
+        JSONObject source = provider->jsonRepresentation();
+        sources.set(key, source);
+    }
+
+    obj.set("sources", sources);
+
+    return obj;
+}
+
+/*
+ * Initialize a context from an exported context or name token
+ */
+bool
+gss_eap_attr_ctx::initFromBuffer(const gss_buffer_t buffer)
+{
+    OM_uint32 major, minor;
+    bool ret;
+    char *s;
+    json_error_t error;
+
+    major = bufferToString(&minor, buffer, &s);
+    if (GSS_ERROR(major))
+        return false;
+
+    JSONObject obj = JSONObject::load(s, 0, &error);
+    if (!obj.isnull()) {
+        ret = initWithJsonObject(obj);
+    } else
+        ret = false;
+
+    GSSEAP_FREE(s);
+
     return ret;
 }
 
@@ -271,19 +411,6 @@ gss_eap_attr_ctx::getProvider(unsigned int type) const
 }
 
 /*
- * Locate provider for a given prefix
- */
-gss_eap_attr_provider *
-gss_eap_attr_ctx::getProvider(const gss_buffer_t prefix) const
-{
-    unsigned int type;
-
-    type = attributePrefixToType(prefix);
-
-    return m_providers[type];
-}
-
-/*
  * Get primary provider. Only the primary provider is serialised when
  * gss_export_sec_context() or gss_export_name_composite() is called.
  */
@@ -296,7 +423,7 @@ gss_eap_attr_ctx::getPrimaryProvider(void) const
 /*
  * Set an attribute
  */
-void
+bool
 gss_eap_attr_ctx::setAttribute(int complete,
                                const gss_buffer_t attr,
                                const gss_buffer_t value)
@@ -304,34 +431,39 @@ gss_eap_attr_ctx::setAttribute(int complete,
     gss_buffer_desc suffix = GSS_C_EMPTY_BUFFER;
     unsigned int type;
     gss_eap_attr_provider *provider;
+    bool ret = false;
 
     decomposeAttributeName(attr, &type, &suffix);
 
     provider = m_providers[type];
     if (provider != NULL) {
-        provider->setAttribute(complete,
-                               (type == ATTR_TYPE_LOCAL) ? attr : &suffix,
-                               value);
-    } else {
-        /* XXX TODO throw exception */
+        ret = provider->setAttribute(complete,
+                                     (type == ATTR_TYPE_LOCAL) ? attr : &suffix,
+                                     value);
     }
+
+    return ret;
 }
 
 /*
  * Delete an attrbiute
  */
-void
+bool
 gss_eap_attr_ctx::deleteAttribute(const gss_buffer_t attr)
 {
     gss_buffer_desc suffix = GSS_C_EMPTY_BUFFER;
     unsigned int type;
     gss_eap_attr_provider *provider;
+    bool ret = false;
 
     decomposeAttributeName(attr, &type, &suffix);
 
     provider = m_providers[type];
-    if (provider != NULL)
-        provider->deleteAttribute(type == ATTR_TYPE_LOCAL ? attr : &suffix);
+    if (provider != NULL) {
+        ret = provider->deleteAttribute(type == ATTR_TYPE_LOCAL ? attr : &suffix);
+    }
+
+    return ret;
 }
 
 /*
@@ -363,7 +495,8 @@ struct eap_gss_get_attr_types_args {
 };
 
 static bool
-addAttribute(const gss_eap_attr_provider *provider,
+addAttribute(const gss_eap_attr_ctx *manager,
+             const gss_eap_attr_provider *provider GSSEAP_UNUSED,
              const gss_buffer_t attribute,
              void *data)
 {
@@ -372,7 +505,7 @@ addAttribute(const gss_eap_attr_provider *provider,
     OM_uint32 major, minor;
 
     if (args->type != ATTR_TYPE_LOCAL) {
-        gss_eap_attr_ctx::composeAttributeName(args->type, attribute, &qualified);
+        manager->composeAttributeName(args->type, attribute, &qualified);
         major = gss_add_buffer_set_member(&minor, &qualified, &args->attrs);
         gss_release_buffer(&minor, &qualified);
     } else {
@@ -394,10 +527,8 @@ gss_eap_attr_ctx::getAttributeTypes(gss_buffer_set_t *attrs)
     unsigned int i;
 
     major = gss_create_empty_buffer_set(&minor, attrs);
-    if (GSS_ERROR(major)) {
+    if (GSS_ERROR(major))
         throw new std::bad_alloc;
-        return false;
-    }
 
     args.attrs = *attrs;
 
@@ -493,23 +624,17 @@ gss_eap_attr_ctx::releaseAnyNameMapping(gss_buffer_t type_id,
 void
 gss_eap_attr_ctx::exportToBuffer(gss_buffer_t buffer) const
 {
-    const gss_eap_attr_provider *primaryProvider = getPrimaryProvider();
-    gss_buffer_desc tmp;
-    unsigned char *p;
-    OM_uint32 tmpMinor;
+    OM_uint32 minor;
+    char *s;
 
-    primaryProvider->exportToBuffer(&tmp);
+    JSONObject obj = jsonRepresentation();
 
-    buffer->length = 4 + tmp.length;
-    buffer->value = GSSEAP_MALLOC(buffer->length);
-    if (buffer->value == NULL)
-        throw new std::bad_alloc;
+    obj.dump(stdout, JSON_INDENT(3));
 
-    p = (unsigned char *)buffer->value;
-    store_uint32_be(m_flags, p);
-    memcpy(p + 4, tmp.value, tmp.length);
+    s = obj.dump(JSON_COMPACT);
 
-    gss_release_buffer(&tmpMinor, &tmp);
+    if (GSS_ERROR(makeStringBuffer(&minor, s, buffer)))
+        throw new std::bad_alloc;
 }
 
 /*
@@ -539,25 +664,47 @@ gss_eap_attr_ctx::getExpiryTime(void) const
     return expiryTime;
 }
 
-/*
- * Map C++ exception to GSS status
- */
-static OM_uint32
-mapException(OM_uint32 *minor, std::exception &e)
+OM_uint32
+gss_eap_attr_ctx::mapException(OM_uint32 *minor, std::exception &e) const
 {
-    OM_uint32 major = GSS_S_FAILURE;
+    unsigned int i;
+    OM_uint32 major;
 
-    /* XXX TODO implement other mappings */
-    if (typeid(e) == typeid(std::bad_alloc))
+    /* Errors we handle ourselves */
+    major = GSS_S_FAILURE;
+
+    if (typeid(e) == typeid(std::bad_alloc)) {
         *minor = ENOMEM;
-    else
-        *minor = 0;
+        goto cleanup;
+    }
 
-#ifdef GSSEAP_DEBUG
+    /* Errors we delegate to providers */
+    major = GSS_S_CONTINUE_NEEDED;
+
+    for (i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
+        gss_eap_attr_provider *provider = m_providers[i];
+
+        if (provider == NULL)
+            continue;
+
+        major = provider->mapException(minor, e);
+        if (major != GSS_S_CONTINUE_NEEDED)
+            break;
+    }
+
+    if (major == GSS_S_CONTINUE_NEEDED) {
+        *minor = GSSEAP_ATTR_CONTEXT_FAILURE;
+        major = GSS_S_FAILURE;
+    }
+
+cleanup:
+#if 0
     /* rethrow for now for debugging */
     throw e;
 #endif
 
+    assert(GSS_ERROR(major));
+
     return major;
 }
 
@@ -597,7 +744,7 @@ gss_eap_attr_ctx::decomposeAttributeName(const gss_buffer_t attribute,
 void
 gss_eap_attr_ctx::decomposeAttributeName(const gss_buffer_t attribute,
                                          unsigned int *type,
-                                         gss_buffer_t suffix)
+                                         gss_buffer_t suffix) const
 {
     gss_buffer_desc prefix = GSS_C_EMPTY_BUFFER;
 
@@ -634,9 +781,9 @@ std::string
 gss_eap_attr_ctx::composeAttributeName(unsigned int type,
                                        const gss_buffer_t suffix)
 {
-    const gss_buffer_t prefix = attributeTypeToPrefix(type);
+    gss_buffer_desc prefix = attributeTypeToPrefix(type);
 
-    return composeAttributeName(prefix, suffix);
+    return composeAttributeName(&prefix, suffix);
 }
 
 /*
@@ -663,11 +810,11 @@ gss_eap_attr_ctx::composeAttributeName(const gss_buffer_t prefix,
 void
 gss_eap_attr_ctx::composeAttributeName(unsigned int type,
                                        const gss_buffer_t suffix,
-                                       gss_buffer_t attribute)
+                                       gss_buffer_t attribute) const
 {
-    gss_buffer_t prefix = attributeTypeToPrefix(type);
+    gss_buffer_desc prefix = attributeTypeToPrefix(type);
 
-    return composeAttributeName(prefix, suffix, attribute);
+    return composeAttributeName(&prefix, suffix, attribute);
 }
 
 /*
@@ -680,14 +827,34 @@ gssEapInquireName(OM_uint32 *minor,
                   gss_OID *MN_mech,
                   gss_buffer_set_t *attrs)
 {
-    if (name->attrCtx == NULL)
+    OM_uint32 major;
+
+    if (name_is_MN != NULL)
+        *name_is_MN = (name->mechanismUsed != GSS_C_NULL_OID);
+
+    if (MN_mech != NULL) {
+        major = gssEapCanonicalizeOid(minor, name->mechanismUsed,
+                                      OID_FLAG_NULL_VALID, MN_mech);
+        if (GSS_ERROR(major))
+            return major;
+    }
+
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
         return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor))) {
+        return GSS_S_UNAVAILABLE;
+    }
 
     try {
-        if (!name->attrCtx->getAttributeTypes(attrs))
+        if (!name->attrCtx->getAttributeTypes(attrs)) {
+            *minor = GSSEAP_NO_ATTR_CONTEXT;
             return GSS_S_UNAVAILABLE;
+        }
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -716,15 +883,25 @@ gssEapGetNameAttribute(OM_uint32 *minor,
         display_value->value = NULL;
     }
 
-    if (name->attrCtx == NULL)
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
         return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor))) {
+        return GSS_S_UNAVAILABLE;
+    }
 
     try {
         if (!name->attrCtx->getAttribute(attr, authenticated, complete,
-                                         value, display_value, more))
+                                         value, display_value, more)) {
+            *minor = GSSEAP_NO_SUCH_ATTR;
+            gssEapSaveStatusInfo(*minor, "Unknown naming attribute %.*s",
+                                 (int)attr->length, (char *)attr->value);
             return GSS_S_UNAVAILABLE;
+        }
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -735,13 +912,23 @@ gssEapDeleteNameAttribute(OM_uint32 *minor,
                           gss_name_t name,
                           gss_buffer_t attr)
 {
-    if (name->attrCtx == NULL)
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
         return GSS_S_UNAVAILABLE;
 
     try {
-        name->attrCtx->deleteAttribute(attr);
-    } catch (std::exception &ex) {
-        return mapException(minor, ex);
+        if (!name->attrCtx->deleteAttribute(attr)) {
+            *minor = GSSEAP_NO_SUCH_ATTR;
+            gssEapSaveStatusInfo(*minor, "Unknown naming attribute %.*s",
+                                 (int)attr->length, (char *)attr->value);
+            return GSS_S_UNAVAILABLE;
+        }
+    } catch (std::exception &e) {
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -754,13 +941,23 @@ gssEapSetNameAttribute(OM_uint32 *minor,
                        gss_buffer_t attr,
                        gss_buffer_t value)
 {
-    if (name->attrCtx == NULL)
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
         return GSS_S_UNAVAILABLE;
 
     try {
-        name->attrCtx->setAttribute(complete, attr, value);
-    } catch (std::exception &ex) {
-        return mapException(minor, ex);
+        if (!name->attrCtx->setAttribute(complete, attr, value)) {
+             *minor = GSSEAP_NO_SUCH_ATTR;
+            gssEapSaveStatusInfo(*minor, "Unknown naming attribute %.*s",
+                                 (int)attr->length, (char *)attr->value);
+            return GSS_S_UNAVAILABLE;
+        }
+    } catch (std::exception &e) {
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -778,10 +975,13 @@ gssEapExportAttrContext(OM_uint32 *minor,
         return GSS_S_COMPLETE;
     }
 
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
+        return GSS_S_UNAVAILABLE;
+
     try {
         name->attrCtx->exportToBuffer(buffer);
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -796,18 +996,22 @@ gssEapImportAttrContext(OM_uint32 *minor,
 
     assert(name->attrCtx == NULL);
 
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
+        return GSS_S_UNAVAILABLE;
+
     if (buffer->length != 0) {
         try {
             ctx = new gss_eap_attr_ctx();
 
             if (!ctx->initFromBuffer(buffer)) {
                 delete ctx;
+                *minor = GSSEAP_BAD_ATTR_TOKEN;
                 return GSS_S_DEFECTIVE_TOKEN;
             }
             name->attrCtx = ctx;
         } catch (std::exception &e) {
             delete ctx;
-            return mapException(minor, e);
+            return name->attrCtx->mapException(minor, e);
         }
     }
 
@@ -823,18 +1027,22 @@ gssEapDuplicateAttrContext(OM_uint32 *minor,
 
     assert(out->attrCtx == NULL);
 
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
+        return GSS_S_UNAVAILABLE;
+
     try {
         if (in->attrCtx != NULL) {
             ctx = new gss_eap_attr_ctx();
             if (!ctx->initFromExistingContext(in->attrCtx)) {
                 delete ctx;
+                *minor = GSSEAP_ATTR_CONTEXT_FAILURE;
                 return GSS_S_FAILURE;
             }
             out->attrCtx = ctx;
         }
     } catch (std::exception &e) {
         delete ctx;
-        return mapException(minor, e);
+        return in->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -847,13 +1055,18 @@ gssEapMapNameToAny(OM_uint32 *minor,
                    gss_buffer_t type_id,
                    gss_any_t *output)
 {
-    if (name->attrCtx == NULL)
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
         return GSS_S_UNAVAILABLE;
 
     try {
         *output = name->attrCtx->mapToAny(authenticated, type_id);
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -865,7 +1078,12 @@ gssEapReleaseAnyNameMapping(OM_uint32 *minor,
                             gss_buffer_t type_id,
                             gss_any_t *input)
 {
-    if (name->attrCtx == NULL)
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
         return GSS_S_UNAVAILABLE;
 
     try {
@@ -873,7 +1091,7 @@ gssEapReleaseAnyNameMapping(OM_uint32 *minor,
             name->attrCtx->releaseAnyNameMapping(type_id, *input);
         *input = NULL;
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -886,6 +1104,7 @@ gssEapReleaseAttrContext(OM_uint32 *minor,
     if (name->attrCtx != NULL)
         delete name->attrCtx;
 
+    *minor = 0;
     return GSS_S_COMPLETE;
 }
 
@@ -893,21 +1112,42 @@ gssEapReleaseAttrContext(OM_uint32 *minor,
  * Public accessor for initialisng a context from a GSS context. Also
  * sets expiry time on GSS context as a side-effect.
  */
-struct gss_eap_attr_ctx *
-gssEapCreateAttrContext(gss_cred_id_t gssCred,
-                        gss_ctx_id_t gssCtx)
+OM_uint32
+gssEapCreateAttrContext(OM_uint32 *minor,
+                        gss_cred_id_t gssCred,
+                        gss_ctx_id_t gssCtx,
+                        struct gss_eap_attr_ctx **pAttrContext,
+                        time_t *pExpiryTime)
 {
-    gss_eap_attr_ctx *ctx;
+    gss_eap_attr_ctx *ctx = NULL;
+    OM_uint32 major;
 
     assert(gssCtx != GSS_C_NO_CONTEXT);
 
-    ctx = new gss_eap_attr_ctx();
-    if (!ctx->initFromGssContext(gssCred, gssCtx)) {
-        delete ctx;
-        return NULL;
+    major = gssEapAttrProvidersInit(minor);
+    if (GSS_ERROR(major))
+        return major;
+
+    *minor = GSSEAP_ATTR_CONTEXT_FAILURE;
+    major = GSS_S_FAILURE;
+
+    try {
+        ctx = new gss_eap_attr_ctx();
+        if (ctx->initFromGssContext(gssCred, gssCtx)) {
+            *minor = 0;
+            major = GSS_S_COMPLETE;
+        } else {
+            delete ctx;
+        }
+    } catch (std::exception &e) {
+        if (ctx != NULL)
+            major = ctx->mapException(minor, e);
     }
 
-    gssCtx->expiryTime = ctx->getExpiryTime();
+    if (major == GSS_S_COMPLETE) {
+        *pAttrContext = ctx;
+        *pExpiryTime = ctx->getExpiryTime();
+    }
 
-    return ctx;
+    return major;
 }