#include "config.h"
-#define MODAUTHKERB_VERSION "5.0-rc5"
+#define MODAUTHKERB_VERSION "5.0-rc6"
#include <httpd.h>
#include <http_config.h>
#define command(name, func, var, type, usage) \
AP_INIT_ ## type (name, func, \
(void*)APR_XtOffsetOf(kerb_auth_config, var), \
- OR_AUTHCFG, usage)
+ OR_AUTHCFG | RSRC_CONF, usage)
#else
#define command(name, func, var, type, usage) \
{ name, func, \
(void*)XtOffsetOf(kerb_auth_config, var), \
- OR_AUTHCFG, type, usage }
+ OR_AUTHCFG | RSRC_CONF, type, usage }
#endif
static const command_rec kerb_auth_cmds[] = {
keytab, 0, NULL);
end:
+#ifdef HEIMDAL
+ /* XXX Do I ever want to support Heimdal 0.4 ??? */
+ krb5_data_free(&req);
+#else
krb5_free_data_contents(context, &req);
+#endif
if (auth_context)
krb5_auth_con_free (context, auth_context);
if (new_creds)
}
ret = krb5_sname_to_principal(context, ap_get_server_name(r), service,
- KRB5_NT_UNKNOWN, &server);
+ KRB5_NT_SRV_HST, &server);
if (ret) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"krb5_sname_to_principal() failed: %s",
kerb_auth_config *conf,
gss_cred_id_t *server_creds)
{
- gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
OM_uint32 major_status, minor_status, minor_status2;
gss_name_t server_name = GSS_C_NO_NAME;
char buf[1024];
snprintf(buf, sizeof(buf), "%s@%s", conf->krb_service_name,
- ap_get_server_name(r));
+ ap_get_server_name(r));
- input_token.value = buf;
- input_token.length = strlen(buf) + 1;
+ token.value = buf;
+ token.length = strlen(buf) + 1;
- major_status = gss_import_name(&minor_status, &input_token,
+ major_status = gss_import_name(&minor_status, &token,
GSS_C_NT_HOSTBASED_SERVICE,
&server_name);
+ memset(&token, 0, sizeof(token));
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"%s", get_gss_error(r->pool, major_status, minor_status,
return HTTP_INTERNAL_SERVER_ERROR;
}
- log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Acquiring creds for %s", buf);
+ major_status = gss_display_name(&minor_status, server_name, &token, NULL);
+ if (GSS_ERROR(major_status)) {
+ /* Perhaps we could just ignore this error but it's safer to give up now,
+ I think */
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "%s", get_gss_error(r->pool, major_status, minor_status,
+ "gss_display_name() failed"));
+ return HTTP_INTERNAL_SERVER_ERROR;
+ }
+
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Acquiring creds for %s",
+ token.value);
+ gss_release_buffer(&minor_status, &token);
major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
GSS_C_NO_OID_SET, GSS_C_ACCEPT,
if (token->length == 0)
return GSS_S_DEFECTIVE_TOKEN;
- /* XXX if (token->value == NTLMSSP) log_debug("NTLM mechanism used"); */
-
p = token->value;
if (*p++ != 0x60)
return GSS_S_DEFECTIVE_TOKEN;
accept_sec_token = (cmp_gss_type(&input_token, &spnego_oid) == 0) ?
gss_accept_sec_context_spnego : gss_accept_sec_context;
+ /* pridat: Read client Negotiate data of length XXX, prefix YYY */
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Verifying client data using %s",
(accept_sec_token == gss_accept_sec_context)
? "KRB5 GSS-API"
}
if (GSS_ERROR(major_status)) {
+ if (input_token.length > 7 && memcmp(input_token.value, "NTLMSSP", 7) == 0)
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "Warning: received token seems to be NTLM, which isn't supported by the Kerberos module. Check your IE configuration.");
+
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"%s", get_gss_error(r->pool, major_status, minor_status,
"gss_accept_sec_context() failed"));