4 Copyright (C) 2014 Simo Sorce <simo@redhat.com>
6 Permission is hereby granted, free of charge, to any person obtaining a
7 copy of this software and associated documentation files (the "Software"),
8 to deal in the Software without restriction, including without limitation
9 the rights to use, copy, modify, merge, publish, distribute, sublicense,
10 and/or sell copies of the Software, and to permit persons to whom the
11 Software is furnished to do so, subject to the following conditions:
13 The above copyright notice and this permission notice shall be included in
14 all copies or substantial portions of the Software.
16 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
21 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22 DEALINGS IN THE SOFTWARE.
27 #include <gssapi/gssapi.h>
28 #include <gssapi/gssapi_ext.h>
31 #include <http_core.h>
33 #include <http_request.h>
34 #include <apr_strings.h>
35 #include <apr_base64.h>
37 module AP_MODULE_DECLARE_DATA mag_module;
41 gss_key_value_set_desc cred_store;
44 static char *mag_status(request_rec *req, int type, uint32_t err)
46 uint32_t maj_ret, min_ret;
55 maj_ret = gss_display_status(&min_ret, err, type,
56 GSS_C_NO_OID, &msg_ctx, &text);
57 if (maj_ret != GSS_S_COMPLETE) {
63 msg_ret = apr_psprintf(req->pool, "%s, %*s",
64 msg_ret, len, (char *)text.value);
66 msg_ret = apr_psprintf(req->pool, "%*s", len, (char *)text.value);
68 gss_release_buffer(&min_ret, &text);
69 } while (msg_ctx != 0);
74 static char *mag_error(request_rec *req, const char *msg,
75 uint32_t maj, uint32_t min)
80 msg_maj = mag_status(req, GSS_C_GSS_CODE, maj);
81 msg_min = mag_status(req, GSS_C_MECH_CODE, min);
82 return apr_psprintf(req->pool, "%s: [%s (%s)]", msg, msg_maj, msg_min);
85 static int mag_auth(request_rec *req)
88 struct mag_config *cfg;
89 const char *auth_header;
90 char *auth_header_type;
91 char *auth_header_value;
92 int ret = HTTP_UNAUTHORIZED;
93 gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
94 gss_buffer_desc input = GSS_C_EMPTY_BUFFER;
95 gss_buffer_desc output = GSS_C_EMPTY_BUFFER;
96 gss_buffer_desc name = GSS_C_EMPTY_BUFFER;
97 gss_name_t client = GSS_C_NO_NAME;
98 gss_cred_id_t delegated_cred = GSS_C_NO_CREDENTIAL;
104 type = ap_auth_type(req);
105 if ((type == NULL) || (strcasecmp(type, "GSSAPI") != 0)) {
109 cfg = ap_get_module_config(req->per_dir_config, &mag_module);
112 ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req,
113 "FIXME: check for ssl!");
116 auth_header = apr_table_get(req->headers_in, "Authorization");
117 if (!auth_header) goto done;
119 auth_header_type = ap_getword_white(req->pool, &auth_header);
120 if (!auth_header_type) goto done;
122 if (strcasecmp(auth_header_type, "Negotiate") != 0) goto done;
124 auth_header_value = ap_getword_white(req->pool, &auth_header);
125 if (!auth_header_value) goto done;
126 input.length = apr_base64_decode_len(auth_header_value) + 1;
127 input.value = apr_pcalloc(req->pool, input.length);
128 if (!input.value) goto done;
129 input.length = apr_base64_decode(input.value, auth_header_value);
131 /* FIXME: this works only with "one-roundtrip" gssapi auth for now,
132 * should work with Krb, will fail with NTLMSSP */
133 maj = gss_accept_sec_context(&min, &ctx, GSS_C_NO_CREDENTIAL,
134 &input, GSS_C_NO_CHANNEL_BINDINGS,
135 &client, NULL, &output, &flags, NULL,
137 if (GSS_ERROR(maj)) {
138 ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req,
139 mag_error(req, "gss_accept_sec_context() failed",
145 replen = apr_base64_encode_len(output.length) + 1;
146 reply = apr_pcalloc(req->pool, 10 + replen);
147 if (!reply) goto done;
148 memcpy(reply, "Negotiate ", 10);
149 apr_base64_encode(&reply[10], output.value, output.length);
150 reply[replen] = '\0';
151 apr_table_add(req->err_headers_out, "WWW-Authenticate", reply);
154 maj = gss_display_name(&min, client, &name, NULL);
155 if (GSS_ERROR(maj)) {
156 ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req,
157 mag_error(req, "gss_accept_sec_context() failed",
162 #ifdef HAVE_GSS_STORE_CRED_INTO
163 if (cfg->cred_store && delegated_cred != GSS_C_NO_CREDENTIAL) {
164 gss_key_value_set_desc store = {0, NULL};
165 /* FIXME: run substtutions */
167 maj = gss_store_cred_into(&min, delegated_cred, GSS_C_INITIATE,
168 GSS_C_NULL_OID, 1, 1, &store, NULL, NULL);
172 req->ap_auth_type = apr_pstrdup(req->pool, "Negotiate");
173 req->user = apr_pstrndup(req->pool, name.value, name.length);
177 if (ret == HTTP_UNAUTHORIZED) {
178 apr_table_add(req->err_headers_out, "WWW-Authenticate", "Negotiate");
180 gss_release_cred(&min, &delegated_cred);
181 gss_release_buffer(&min, &output);
182 gss_release_name(&min, &client);
183 gss_release_buffer(&min, &name);
184 gss_delete_sec_context(&min, &ctx, GSS_C_NO_BUFFER);
189 static void *mag_create_dir_config(apr_pool_t *p, char *dir)
191 struct mag_config *cfg;
193 cfg = (struct mag_config *)apr_pcalloc(p, sizeof(struct mag_config));
194 if (!cfg) return NULL;
199 static const char *mag_ssl_only(cmd_parms *parms, void *mconfig, int on)
201 struct mag_config *cfg = (struct mag_config *)mconfig;
202 cfg->ssl_only = on ? true : false;
206 static const char *mag_cred_store(cmd_parms *parms, void *mconfig,
209 struct mag_config *cfg = (struct mag_config *)mconfig;
210 gss_key_value_element_desc *elements;
219 ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, parms->server,
220 "%s [%s]", "Invalid syntax for GSSCredStore option", w);
224 key = apr_pstrndup(parms->pool, w, (p-w));
225 value = apr_pstrdup(parms->pool, p + 1);
226 if (!key || !value) {
227 ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, parms->server,
228 "%s", "OOM handling GSSCredStore option");
232 size = sizeof(gss_key_value_element_desc) * cfg->cred_store.count + 1;
233 elements = apr_palloc(parms->pool, size);
235 ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, parms->server,
236 "%s", "OOM handling GSSCredStore option");
240 for (count = 0; count < cfg->cred_store.count; count++) {
241 elements[count] = cfg->cred_store.elements[count];
243 elements[count].key = key;
244 elements[count].value = value;
246 cfg->cred_store.elements = elements;
247 cfg->cred_store.count = count;
252 static const command_rec mag_commands[] = {
253 AP_INIT_FLAG("GSSSSLOnly", mag_ssl_only, NULL, OR_AUTHCFG,
254 "Work only if connection is SSL Secured"),
255 AP_INIT_ITERATE("GSSCredStore", mag_cred_store, NULL, OR_AUTHCFG,
261 mag_register_hooks(apr_pool_t *p)
263 ap_hook_check_user_id(mag_auth, NULL, NULL, APR_HOOK_MIDDLE);
266 module AP_MODULE_DECLARE_DATA auth_gssapi_module =
268 STANDARD20_MODULE_STUFF,
269 mag_create_dir_config,