2 * Copyright (c) 2012, 2013, 2014 JANET(UK)
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of JANET(UK) nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
25 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
26 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
27 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
29 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
31 * OF THE POSSIBILITY OF SUCH DAMAGE.
33 * NOTE: Some code in this module was derived from code in
34 * mod_auth_gssapi.c which is copyrighted by CESNET. See that file
35 * for full copyright details.
37 * NOTE: Portions of the code in this file were derived from example
38 * code distributed under the Apache 2.0 license:
39 * http://www.apache.org/licenses/LICENSE-2.0
41 * This module implements the Apache server side of the GSSWeb
42 * authentiction type which allows Moonshot to be used for
43 * authentication in web applications. The module consists of two
44 * components: the hook function (gssweb_authenticate_user) that does
45 * most of the work, and an output filter (gssweb_authenticate_filter)
46 * that is registered by the hook function to send the output token
47 * back to the client in a json message that wraps the original
50 * This module uses a simple protocol between the client and server
51 * to exchange GSS tokens and nonce information. The protocol is
52 * described in the protocol.txt file included with module source.
56 #include "mod_auth_gssweb.h"
58 module AP_MODULE_DECLARE_DATA auth_gssweb_module;
60 #define command(name, func, var, type, usage) \
61 AP_INIT_ ## type (name, (void*) func, \
62 (void*)APR_OFFSETOF(gss_auth_config, var), \
63 OR_AUTHCFG | RSRC_CONF, usage)
65 static const command_rec gssweb_config_cmds[] = {
66 command("GSSServiceName", ap_set_string_slot, service_name,
67 TAKE1, "Service name used for Apache authentication."),
72 #define DEFAULT_ENCTYPE "application/x-www-form-urlencoded"
73 #define GSS_MAX_TOKEN_SIZE 4096 //TBD -- check this value
75 /* gssweb_read_req() -- reads the request data into a buffer
77 static int gssweb_read_req(request_rec *r, const char **rbuf, apr_off_t *size)
81 if((rc = ap_setup_client_block(r, REQUEST_CHUNKED_ERROR))) {
85 if(ap_should_client_block(r)) {
87 char argsbuffer[HUGE_STRING_LEN];
88 apr_off_t rsize, len_read, rpos = 0;
89 apr_off_t length = r->remaining;
91 *rbuf = (const char *) apr_pcalloc(r->pool, (apr_size_t) (length + 1));
93 while((len_read = ap_get_client_block(r, argsbuffer, sizeof(argsbuffer))) > 0) {
94 if((rpos + len_read) > length) {
95 rsize = length - rpos;
101 memcpy((char *) *rbuf + rpos, argsbuffer, (size_t) rsize);
108 /* gssweb_get_post_data() -- Gets the token and nonce from the request
111 static int gssweb_get_post_data(request_rec *r, int *nonce, gss_buffer_desc *input_token)
115 const char *key, *val, *type;
119 input_token->length = 0;
120 input_token->value = NULL;
122 if(r->method_number != M_POST) {
123 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: Request data is not a POST, declining.");
127 type = apr_table_get(r->headers_in, "Content-Type");
128 if(strcasecmp(type, DEFAULT_ENCTYPE) != 0) {
129 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: Unexpected content type, declining.");
133 if((rc = gssweb_read_req(r, &data, &datalen)) != OK) {
134 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: Data read error, rc = %d", rc);
138 while(*data && (val = ap_getword(r->pool, &data, '&'))) {
139 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: obtained val from ap_getword() (%s)", val);
140 key = ap_getword(r->pool, &val, '=');
141 ap_unescape_url((char*)key);
142 ap_unescape_url((char*)val);
143 if (0 == strcasecmp(key, "token")) {
144 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: found token (%s)", val);
145 input_token->value = malloc(strlen(val));
146 input_token->length = apr_base64_decode(input_token->value, val);
147 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: Token successfully decoded.");
149 else if (0 == strcasecmp(key, "nonce")) {
150 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: found nonce (%s)", val);
154 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: unknown key (%s)", key);
157 if ((0 == *nonce) || (0 == input_token->length)) {
158 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: nonce (%d) or token len (%d) is 0, declining", *nonce, input_token->length);
162 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_get_post_data: returning nonce (%d) and token (%d bytes)", *nonce, input_token->length);
167 /* gssweb_authenticate_filter() -- Output filter for gssweb authentication.
168 * Wraps original response in JSON -- adding JSON to the beginning of the
169 * response, escapes double quotes in the original response, and adds JSON
170 * to the end of the response. Handles responses that involve more than
171 * one filter call by maintaining state until an EOS bucket is received.
173 static apr_status_t gssweb_authenticate_filter (ap_filter_t *f,
174 apr_bucket_brigade *brig_in)
176 gss_log(APLOG_MARK, APLOG_DEBUG, 0, f->r, "Entering GSSWeb filter");
178 request_rec *r = f->r;
179 conn_rec *c = r->connection;
180 apr_bucket_brigade *brig_out;
181 apr_bucket *bkt_in = NULL;
182 apr_bucket *bkt_out = NULL;
183 apr_bucket *bkt_eos = NULL;
184 const char *data = NULL;
186 apr_size_t enc_len = 0;
190 gss_conn_ctx conn_ctx = NULL;
191 const char *c_type = NULL;
192 const char *c_len = NULL;
193 apr_status_t ret = 0;
195 /* get the context from the request */
196 conn_ctx = gss_get_conn_ctx(r);
197 if ((NULL == conn_ctx) ||
198 (GSS_C_NO_CONTEXT == conn_ctx->context) ||
199 (GSS_CTX_EMPTY == conn_ctx->state) ||
200 (0 == conn_ctx->output_token.length)) {
201 conn_ctx->filter_stat = GSS_FILT_ERROR;
202 gss_log(APLOG_MARK, APLOG_ERR, 0, r, "gssweb_authenticate_filter: Failed to find valid context.");
203 apr_brigade_cleanup(brig_in);
204 return HTTP_INTERNAL_SERVER_ERROR;
207 /* if this is the first call for a response, send opening JSON block */
209 if (GSS_FILT_NEW == conn_ctx->filter_stat) {
210 if (NULL == (brig_out = apr_brigade_create(r->pool, c->bucket_alloc))) {
211 conn_ctx->filter_stat = GSS_FILT_ERROR;
212 gss_log(APLOG_MARK, APLOG_ERR, 0, r, "gssweb_authenticate_filter: Unable to allocate output brigade (opening)");
213 apr_brigade_cleanup(brig_in);
214 return HTTP_INTERNAL_SERVER_ERROR;
217 len = apr_base64_encode_len(conn_ctx->output_token.length);
218 if (NULL == (data = apr_bucket_alloc(len+1024, c->bucket_alloc)) ||
219 NULL == (stoken = apr_bucket_alloc(len+1, c->bucket_alloc))) {
220 gss_log(APLOG_MARK, APLOG_ERR, 0, r, "gssweb_authenticate_filter: Unable to allocate space for opening json block");
221 apr_brigade_cleanup(brig_in);
222 apr_brigade_cleanup(brig_out);
223 return HTTP_INTERNAL_SERVER_ERROR;
226 apr_base64_encode_binary(stoken, conn_ctx->output_token.value, conn_ctx->output_token.length);
227 snprintf((char *)data, len+1024,
228 "{\"gssweb\": {\n\"token\": \"%s\",\n\"nonce\": \"%d\"},\n\"application\": {\n\"data\": \"",
229 stoken, conn_ctx->nonce);
230 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_filter: Sending: %s", data);
232 bkt_out = apr_bucket_heap_create(data, strlen(data), apr_bucket_free,
234 APR_BRIGADE_INSERT_TAIL(brig_out, bkt_out);
235 if (0 != (ret = ap_pass_brigade(f->next, brig_out))) {
236 apr_brigade_cleanup(brig_in);
237 apr_brigade_cleanup(brig_out);
241 conn_ctx->filter_stat = GSS_FILT_INPROGRESS;
244 /* loop through the app data buckets, escaping and sending each one */
245 for (bkt_in = APR_BRIGADE_FIRST(brig_in);
246 bkt_in != APR_BRIGADE_SENTINEL(brig_in);
247 bkt_in = APR_BUCKET_NEXT(bkt_in))
249 if (NULL == (brig_out = apr_brigade_create(r->pool, c->bucket_alloc))) {
250 gss_log(APLOG_MARK, APLOG_ERR, 0, r, "gssweb_authenticate_filter: Unable to allocate brigade (loop)");
251 conn_ctx->filter_stat = GSS_FILT_ERROR;
252 apr_brigade_cleanup(brig_in);
253 return HTTP_INTERNAL_SERVER_ERROR;
256 /* if this is an EOS, send the JSON closing block */
257 if(APR_BUCKET_IS_EOS(bkt_in))
259 /* create and add the JSON closing block */
261 if (NULL == (data = apr_bucket_alloc(1024, c->bucket_alloc))) {
262 gss_log(APLOG_MARK, APLOG_ERR, 0, r, "gssweb_authenticate_filter: Unable to allocate space for closing json block");
263 apr_brigade_cleanup(brig_in);
264 apr_brigade_cleanup(brig_out);
265 return HTTP_INTERNAL_SERVER_ERROR;
268 c_type = apr_table_get(r->headers_in, "Content-Type");
269 c_len = apr_table_get(r->headers_in, "Content-Length");
270 snprintf((char *)data, 1024, "\",\n\"content-type\": \"%s\",\n\"content-length\": \"%s\"\n}\n}", c_type, c_len);
271 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_filter: Sending (%d bytes) %s", strlen(data), data);
273 bkt_out = apr_bucket_heap_create(data, strlen(data), apr_bucket_free,
275 APR_BRIGADE_INSERT_TAIL(brig_out, bkt_out);
277 /* Indicate that the next filter call is a new response */
278 conn_ctx->filter_stat = GSS_FILT_NEW;
280 /* set EOS in the outbound brigade */
281 bkt_eos = apr_bucket_eos_create(c->bucket_alloc);
282 APR_BRIGADE_INSERT_TAIL (brig_out, bkt_eos);
284 /* pass the brigade */
285 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_filter: Sending: EOS");
286 if (0 != (ret = ap_pass_brigade(f->next, brig_out))) {
287 conn_ctx->filter_stat = GSS_FILT_ERROR;
288 apr_brigade_cleanup(brig_in);
289 apr_brigade_cleanup(brig_out);
295 /* Read application data from each input bucket */
296 apr_bucket_read(bkt_in, &data, &len, APR_BLOCK_READ);
297 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_filter: Application Data (%d bytes): %s", len, data);
299 /* Base64 encode the data */
300 enc_len = apr_base64_encode_len(len);
301 if (NULL == (buf = apr_bucket_alloc(enc_len, c->bucket_alloc))) {
302 gss_log(APLOG_MARK, APLOG_ERR, 0, r, "gssweb_authenticate_filter: Unable to allocate space for application data");
303 apr_brigade_cleanup(brig_in);
304 apr_brigade_cleanup(brig_out);
305 return HTTP_INTERNAL_SERVER_ERROR;
307 apr_base64_encode_binary(buf, data, len);
309 /* Put the data in a bucket and add it to the the output brigade */
310 bkt_out = apr_bucket_heap_create(buf, enc_len, NULL, c->bucket_alloc);
311 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_filter: Sending %d bytes", enc_len);
312 APR_BRIGADE_INSERT_TAIL(brig_out, bkt_out);
314 /* Send the output brigade */
315 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_filter: Passing the application data brigade");
316 if (OK != (ret = ap_pass_brigade(f->next, brig_out))) {
317 apr_brigade_cleanup(brig_in);
318 apr_brigade_cleanup(brig_out);
323 /* Make sure we don't see the same data again */
324 apr_brigade_cleanup(brig_in);
328 /* gssweb_add_filter() -- Hook to add our output filter to the request
329 * (r). Called for all error responses through the
330 * gssweb_insert_error_filter hook.
333 gssweb_add_filter(request_rec *r)
335 gss_conn_ctx conn_ctx = NULL;
337 /* Get the context for this request */
338 conn_ctx = gss_get_conn_ctx(r);
339 if (conn_ctx == NULL) {
340 gss_log(APLOG_MARK, APLOG_ERR, 0, r, "gssweb_add_filter: Failed to find or create internal context.");
344 /* Add the output filter */
345 ap_add_output_filter("gssweb_auth_filter", (void *)conn_ctx, r, r->connection);
349 /* gssweb_authenticate_user() -- Hook to perform actual user
350 * authentication. Will be called once for each round trip in the GSS
351 * authentication loop. Reads the tokend from the request, calls
352 * gss_accept_sec_context(), and stores the output token and context
353 * in the user data areas. Adds output filter to send the GSS
354 * output token back to the client.
357 gssweb_authenticate_user(request_rec *r)
359 gss_auth_config *conf =
360 (gss_auth_config *) ap_get_module_config(r->per_dir_config,
361 &auth_gssweb_module);
362 const char *auth_line = NULL;
363 char *auth_type = NULL;
364 char *negotiate_ret_value = NULL;
365 gss_conn_ctx conn_ctx = NULL;
367 OM_uint32 major_status, minor_status, minor_status2;
368 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
369 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
370 gss_name_t client_name = GSS_C_NO_NAME;
371 gss_cred_id_t delegated_cred = GSS_C_NO_CREDENTIAL;
372 gss_cred_id_t server_creds = GSS_C_NO_CREDENTIAL;
373 OM_uint32 ret_flags = 0;
376 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "Entering GSSWeb authentication");
378 /* Check if this is for our auth type */
379 auth_type = (char *)ap_auth_type(r);
380 if (auth_type == NULL || strcasecmp(auth_type, "GSSWeb") != 0) {
381 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r,
382 "gssweb_authenticate_user: AuthType '%s' is not GSSWeb, bailing out",
383 (auth_type) ? auth_type : "(NULL)");
388 /* Set up a GSS context for this request, if there isn't one already */
389 conn_ctx = gss_get_conn_ctx(r);
390 if (conn_ctx == NULL) {
391 gss_log(APLOG_MARK, APLOG_ERR, 0, r, "gssweb_authenticate_user: Failed to create internal context");
392 return HTTP_INTERNAL_SERVER_ERROR;
395 /* Read the token and nonce from the POST */
396 if (0 != gssweb_get_post_data(r, &nonce, &input_token)) {
397 ret = HTTP_UNAUTHORIZED;
398 gss_log(APLOG_MARK, APLOG_ERR, 0, r, "gssweb_authenticate_user: Unable to read nonce or input token.");
401 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_user: GSSWeb nonce value = %u.", nonce);
403 /* If the nonce is set and doesn't match, start over */
404 if ((0 != conn_ctx->nonce) && (conn_ctx->nonce != nonce)) {
405 if (GSS_C_NO_CONTEXT != conn_ctx->context) {
406 gss_delete_sec_context(&minor_status, &conn_ctx->context, GSS_C_NO_BUFFER);
408 conn_ctx->context = GSS_C_NO_CONTEXT;
409 conn_ctx->state = GSS_CTX_EMPTY;
410 conn_ctx->filter_stat = GSS_FILT_NEW;
411 conn_ctx->user = NULL;
412 if (0 != conn_ctx->output_token.length) {
413 gss_release_buffer(&minor_status, &(conn_ctx->output_token));
415 conn_ctx->output_token.length = 0;
418 /* If the output filter reported an internal server error, return it */
419 if (GSS_FILT_ERROR == conn_ctx->filter_stat) {
420 ret = HTTP_INTERNAL_SERVER_ERROR;
421 gss_log(APLOG_MARK, APLOG_ERR, 0, r,
422 "gssweb_authenticate_user: Output filter returned error, reporting.");
426 /* Add the output filter to this request. */
427 ap_add_output_filter("gssweb_auth_filter", (void *)conn_ctx, r, r->connection);
429 /* Acquire server credentials (TBD -- do this once?) */
430 ret = get_gss_creds(r, conf, &server_creds);
433 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_user: Server credentials acquired.");
435 /* Call gss_accept_sec_context */
436 major_status = gss_accept_sec_context(&minor_status,
440 GSS_C_NO_CHANNEL_BINDINGS,
447 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r,
448 "gssweb_authenticate_user: Client %s us their credential",
449 (ret_flags & GSS_C_DELEG_FLAG) ? "delegated" : "didn't delegate");
450 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_user: First four bytes of output token are: %.2x %.2x %.2x %.2x", ((char *)output_token.value)[0], ((char *)output_token.value)[1], ((char *)output_token.value)[2], ((char *)output_token.value)[3]);
452 if (GSS_ERROR(major_status)) {
453 gss_log(APLOG_MARK, APLOG_ERR, 0, r,
454 "%s", get_gss_error(r, major_status, minor_status,
455 "gssweb_authenticate_user: Failed to establish authentication"));
456 gss_delete_sec_context(&minor_status, &conn_ctx->context, GSS_C_NO_BUFFER);
457 conn_ctx->context = GSS_C_NO_CONTEXT;
458 conn_ctx->state = GSS_CTX_EMPTY;
459 ret = HTTP_UNAUTHORIZED;
461 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_user: Decoding ouput token.");
464 gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "gssweb_authenticate_user: Got sec context, storing nonce and output token.");
466 /* Store the nonce & ouput token in the stored context */
467 conn_ctx->nonce = nonce;
468 conn_ctx->output_token = output_token;
469 output_token.length = 0;
471 /* If we aren't done yet, go around again */
472 if (major_status & GSS_S_CONTINUE_NEEDED) {
473 conn_ctx->state = GSS_CTX_IN_PROGRESS;
474 ret = HTTP_UNAUTHORIZED;
478 conn_ctx->state = GSS_CTX_ESTABLISHED;
479 r->user = apr_pstrdup(r->pool, conn_ctx->user);
480 r->ap_auth_type = "GSSWeb";
485 gss_release_cred(&minor_status, &delegated_cred);
487 if (output_token.length)
488 gss_release_buffer(&minor_status, &output_token);
490 if (client_name != GSS_C_NO_NAME)
491 gss_release_name(&minor_status, &client_name);
493 if (server_creds != GSS_C_NO_CREDENTIAL)
494 gss_release_cred(&minor_status, &server_creds);
500 gssweb_register_hooks(apr_pool_t *p)
502 /* register the gssweb output filter */
503 ap_register_output_filter("gssweb_auth_filter", gssweb_authenticate_filter, NULL, AP_FTYPE_RESOURCE);
506 ap_hook_check_user_id(gssweb_authenticate_user, NULL, NULL, APR_HOOK_MIDDLE);
507 ap_hook_insert_error_filter(gssweb_add_filter, NULL, NULL, APR_HOOK_MIDDLE);
510 module AP_MODULE_DECLARE_DATA auth_gssweb_module = {
511 STANDARD20_MODULE_STUFF,
512 gss_config_dir_create,
517 gssweb_register_hooks