fixed threading issues as described in ticket [ 1971514 ]

[mod_auth_kerb.git] / src / mod_auth_kerb.c

diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c
index 826d104..1f2cbae 100644 (file)
--- a/src/mod_auth_kerb.c
+++ b/src/mod_auth_kerb.c
@@ -50,7 +50,7 @@
 #include <stdio.h>
 #include <stdarg.h>
 
-#define MODAUTHKERB_VERSION "5.2"
+#define MODAUTHKERB_VERSION "5.3"
 
 #define MECH_NEGOTIATE "Negotiate"
 #define SERVICE_NAME "HTTP"
@@ -165,6 +165,7 @@ typedef struct {
        char *krb_5_keytab;
        int krb_method_gssapi;
        int krb_method_k5pass;
+       int krb5_do_auth_to_local;
 #endif
 #ifdef KRB4
        char *krb_4_srvtab;
@@ -227,6 +228,9 @@ static const command_rec kerb_auth_cmds[] = {
 
    command("KrbMethodK5Passwd", ap_set_flag_slot, krb_method_k5pass,
      FLAG, "Enable Kerberos V5 password authentication."),
+
+   command("KrbLocalUserMapping", ap_set_flag_slot, krb5_do_auth_to_local,
+     FLAG, "Set to 'on' to have Kerberos do auth_to_local mapping of principal names to system user names."),
 #endif 
 
 #ifdef KRB4
@@ -303,7 +307,6 @@ const krb5_rc_ops_internal mod_auth_kerb_rc_ops = {
 };
 #endif
 
-
 /*************************************************************************** 
  Auth Configuration Initialization
  ***************************************************************************/
@@ -320,6 +323,7 @@ static void *kerb_dir_create_config(MK_POOL *p, char *d)
        ((kerb_auth_config *)rec)->krb_ssl_preauthentication = 0;
 #endif
 #ifdef KRB5
+  ((kerb_auth_config *)rec)->krb5_do_auth_to_local = 0;
        ((kerb_auth_config *)rec)->krb_method_k5pass = 1;
        ((kerb_auth_config *)rec)->krb_method_gssapi = 1;
 #endif
@@ -450,7 +454,7 @@ authenticate_user_krb4pwd(request_rec *r,
    int all_principals_unkown;
 
    sent_pw = ap_pbase64decode(r->pool, auth_line);
-   sent_name = ap_getword (r->pool, &sent_pw, ':');
+   sent_name = ap_getword_nulls_nc (r->pool, (char **) &sent_pw, ':');
 
    sent_instance = strchr(sent_name, '.');
    if (sent_instance)
@@ -564,7 +568,12 @@ verify_krb5_init_creds(request_rec *r, krb5_context context, krb5_creds *creds,
    } else
       keytab = ap_req_keytab;
 
+#ifdef HAVE_KRB5_CC_NEW_UNIQUE
+   ret = krb5_cc_new_unique(context, "MEMORY", NULL, &local_ccache);
+#else
    ret = krb5_cc_resolve(context, "MEMORY:", &local_ccache);
+#endif
+
    if (ret) {
       log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
                 "krb5_cc_resolve() failed when verifying KDC");
@@ -711,7 +720,12 @@ verify_krb5_user(request_rec *r, krb5_context context, krb5_principal principal,
        goto end;
    }
 
+#ifdef HAVE_KRB5_CC_NEW_UNIQUE
+   ret = krb5_cc_new_unique(context, "MEMORY", NULL, &ret_ccache);
+#else
    ret = krb5_cc_resolve(context, "MEMORY:", &ret_ccache);
+#endif
+
    if (ret) {
       log_rerror(APLOG_MARK, APLOG_ERR, 0, r, 
                 "generating new memory ccache failed: %s",
@@ -893,6 +907,10 @@ authenticate_user_krb5pwd(request_rec *r,
    int             all_principals_unkown;
    char            *p = NULL;
 
+   //temporary fix for KrbServiceName Any, use default SERVICE_NAME
+   if (conf->krb_service_name && strcmp(conf->krb_service_name,"Any") == 0)
+      snprintf(conf->krb_service_name, 5,"%s",SERVICE_NAME);
+
    code = krb5_init_context(&kcontext);
    if (code) {
       log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
@@ -901,7 +919,7 @@ authenticate_user_krb5pwd(request_rec *r,
    }
 
    sent_pw = ap_pbase64decode(r->pool, auth_line);
-   sent_name = ap_getword (r->pool, &sent_pw, ':');
+   sent_name = ap_getword_nulls_nc (r->pool, (char **) &sent_pw, ':');
 
    if (sent_pw == NULL || *sent_pw == '\0') {
       log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
@@ -1150,6 +1168,10 @@ get_gss_creds(request_rec *r,
    have_server_princ = conf->krb_service_name && strchr(conf->krb_service_name, '/') != NULL;
    if (have_server_princ)
       strncpy(buf, conf->krb_service_name, sizeof(buf));
+   else if (conf->krb_service_name && strcmp(conf->krb_service_name,"Any") == 0) {      
+      *server_creds = GSS_C_NO_CREDENTIAL;
+      return 0;
+   }
    else
       snprintf(buf, sizeof(buf), "%s@%s",
               (conf->krb_service_name) ? conf->krb_service_name : SERVICE_NAME,
@@ -1268,6 +1290,7 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf,
   gss_OID_desc spnego_oid;
   gss_ctx_id_t context = GSS_C_NO_CONTEXT;
   gss_cred_id_t server_creds = GSS_C_NO_CREDENTIAL;
+  OM_uint32 ret_flags = 0;
 
   *negotiate_ret_value = "\0";
 
@@ -1336,11 +1359,12 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf,
                                  &client_name,
                                  NULL,
                                  &output_token,
-                                 NULL,
+                                 &ret_flags,
                                  NULL,
                                  &delegated_cred);
   log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
-            "Verification returned code %d", major_status);
+            "Client %s us their credential",
+            (ret_flags & GSS_C_DELEG_FLAG) ? "sent" : "didn't send");
   if (output_token.length) {
      char *token = NULL;
      size_t len;
@@ -1403,7 +1427,7 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf,
 
   if (conf->krb_save_credentials && delegated_cred != GSS_C_NO_CREDENTIAL)
      store_gss_creds(r, conf, (char *)output_token.value, delegated_cred);
-
+  
   gss_release_buffer(&minor_status, &output_token);
 
   ret = OK;
@@ -1426,6 +1450,66 @@ end:
 
   return ret;
 }
+
+static int
+do_krb5_an_to_ln(request_rec *r) {
+  krb5_error_code code;
+  int ret = HTTP_INTERNAL_SERVER_ERROR;
+  char *MK_USER_LNAME = NULL;
+  krb5_context    kcontext = NULL;
+  krb5_principal client = NULL;
+  
+  code = krb5_init_context(&kcontext);
+   if (code) {
+      log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+                "Cannot initialize Kerberos5 context (%d)", code);
+      goto end;
+   }
+  
+  code = krb5_parse_name(kcontext, MK_USER, &client);
+      if (code) {
+        log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+                   "krb5_parse_name() failed: %s",
+                   krb5_get_err_text(kcontext, code));
+          goto end;
+  }
+  MK_USER_LNAME = apr_pcalloc(r->pool, strlen(MK_USER)+1);
+  if (MK_USER_LNAME == NULL) {
+     log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+               "ap_pcalloc() failed (not enough memory)");
+     goto end;
+  }
+    code = krb5_aname_to_localname(kcontext, client, strlen(MK_USER), MK_USER_LNAME);
+    if (code) {
+                 if (code != KRB5_LNAME_NOTRANS) {
+                       log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+                                  "krb5_aname_to_localname() failed: %s",
+                                  krb5_get_err_text(kcontext, code));
+
+                 }
+                 else {
+                       log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r,
+                                  "krb5_aname_to_localname() found no "
+                                  "mapping for principal %s",
+                                  MK_USER);
+                 }
+         }
+    else {
+    log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+             "kerb_authenticate_a_name_to_local_name %s -> %s",
+             (MK_USER)?MK_USER:"(NULL)", (MK_USER_LNAME)?MK_USER_LNAME:"(NULL)");
+         MK_USER = apr_pstrdup(r->pool, MK_USER_LNAME);
+         ret = OK;
+         }
+       end:
+         if (client)
+            krb5_free_principal(kcontext, client);
+         if (kcontext)
+            krb5_free_context(kcontext);
+         return ret;
+}
+
+
 #endif /* KRB5 */
 
 static int
@@ -1550,6 +1634,8 @@ kerb_authenticate_user(request_rec *r)
              strcasecmp(auth_type, "Basic") == 0) {
        ret = authenticate_user_krb5pwd(r, conf, auth_line);
    }
+   if (ret == OK && conf->krb5_do_auth_to_local)
+    ret = do_krb5_an_to_ln(r);
 #endif
 
 #ifdef KRB4