const char *user_ccache = NULL;
const char *orig_ccache = NULL;
#endif
+ uint32_t init_flags = 0;
type = ap_auth_type(req);
if ((type == NULL) || (strcasecmp(type, "GSSAPI") != 0)) {
return DECLINED;
}
- /* ignore auth for subrequests */
+ cfg = ap_get_module_config(req->per_dir_config, &auth_gssapi_module);
+
+ /* implicit auth for subrequests if main auth already happened */
if (!ap_is_initial_req(req)) {
- return OK;
+ type = ap_auth_type(req->main);
+ if ((type != NULL) && (strcasecmp(type, "GSSAPI") == 0)) {
+ /* warn if the subrequest location and the main request
+ * location have different configs */
+ if (cfg != ap_get_module_config(req->main->per_dir_config,
+ &auth_gssapi_module)) {
+ ap_log_rerror(APLOG_MARK, APLOG_WARNING||APLOG_NOERRNO, 0,
+ req, "Subrequest authentication bypass on "
+ "location with different configuration!");
+ }
+ if (req->main->user) {
+ req->user = apr_pstrdup(req->pool, req->main->user);
+ return OK;
+ } else {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req,
+ "The main request is tasked to establish the "
+ "security context, can't proceed!");
+ return HTTP_UNAUTHORIZED;
+ }
+ } else {
+ ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, req,
+ "Subrequest GSSAPI auth with no auth on the main "
+ "request. This operation may fail if other "
+ "subrequests already established a context or the "
+ "mechanism requires multiple roundtrips.");
+ }
}
- cfg = ap_get_module_config(req->per_dir_config, &auth_gssapi_module);
-
if (cfg->ssl_only) {
if (!mag_conn_is_https(req->connection)) {
ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req,
"failed", maj, min));
goto done;
}
+
+ if (cfg->deleg_ccache_dir) {
+ /* delegate ourselves credentials so we store them as requested */
+ init_flags |= GSS_C_DELEG_FLAG;
+ }
+
/* output and input are inverted here, this is intentional */
maj = gss_init_sec_context(&min, user_cred, &user_ctx, server,
- GSS_C_NO_OID, 0, 300,
+ GSS_C_NO_OID, init_flags, 300,
GSS_C_NO_CHANNEL_BINDINGS, &output,
NULL, &input, NULL, NULL);
if (GSS_ERROR(maj)) {
gss_release_buffer(&min, &input);
/* output and input are inverted here, this is intentional */
maj = gss_init_sec_context(&min, user_cred, &user_ctx, server,
- GSS_C_NO_OID, 0, 300,
+ GSS_C_NO_OID, init_flags, 300,
GSS_C_NO_CHANNEL_BINDINGS, &output,
NULL, &input, NULL, NULL);
if (GSS_ERROR(maj)) {