#include "config.h"
-#define MODAUTHKERB_VERSION "5.0-rc3"
+#define MODAUTHKERB_VERSION "5.0-rc4"
#ifndef APXS1
#include "ap_compat.h"
command("KrbMethodNegotiate", ap_set_flag_slot, krb_method_gssapi,
FLAG, "Enable Negotiate authentication method."),
- command("KrbMethodK5Pass", ap_set_flag_slot, krb_method_k5pass,
+ command("KrbMethodK5Passwd", ap_set_flag_slot, krb_method_k5pass,
FLAG, "Enable Kerberos V5 password authentication."),
#endif
command("Krb4Srvtab", ap_set_file_slot, krb_4_srvtab,
TAKE1, "Location of Kerberos V4 srvtab file."),
- command("KrbMethodK4Pass", ap_set_flag_slot, krb_method_k4pass,
+ command("KrbMethodK4Passwd", ap_set_flag_slot, krb_method_k4pass,
FLAG, "Enable Kerberos V4 password authentication."),
#endif
} gss_connection_t;
static gss_connection_t *gss_connection = NULL;
+
+static const char *EMPTY_STRING = "\0";
#endif
rec = (kerb_auth_config *) ap_pcalloc(p, sizeof(kerb_auth_config));
((kerb_auth_config *)rec)->krb_verify_kdc = 1;
- ((kerb_auth_config *)rec)->krb_service_name = "khttp";
+ ((kerb_auth_config *)rec)->krb_service_name = "HTTP";
((kerb_auth_config *)rec)->krb_authoritative = 1;
#ifdef KRB5
((kerb_auth_config *)rec)->krb_method_k5pass = 1;
const request_rec *r, const char *fmt, ...)
{
char errstr[1024];
- char errnostr[1024];
va_list ap;
va_start(ap, fmt);
vsnprintf(errstr, sizeof(errstr), fmt, ap);
va_end(ap);
- errnostr[0] = '\0';
- if (errno)
- snprintf(errnostr, sizeof(errnostr), "%s: (%s)", errstr, strerror(errno));
- else
- snprintf(errnostr, sizeof(errnostr), "%s", errstr);
#ifdef APXS1
- ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errnostr);
+ ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr);
#else
- ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errnostr);
+ ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errstr);
#endif
}
********************************************************************/
static const char *
-get_gss_error(MK_POOL *p, OM_uint32 error_status, char *prefix)
+get_gss_error(MK_POOL *p, OM_uint32 err_maj, OM_uint32 err_min, char *prefix)
{
- OM_uint32 maj_stat, min_stat;
+ OM_uint32 maj_stat, min_stat;
OM_uint32 msg_ctx = 0;
gss_buffer_desc status_string;
- char buf[1024];
+ char *err_msg;
size_t len;
- snprintf(buf, sizeof(buf), "%s", prefix);
- len = strlen(buf);
+ err_msg = ap_pstrdup(p, prefix);
do {
maj_stat = gss_display_status (&min_stat,
- error_status,
- GSS_C_MECH_CODE,
+ err_maj,
+ GSS_C_GSS_CODE,
GSS_C_NO_OID,
&msg_ctx,
&status_string);
- if (sizeof(buf) > len + status_string.length + 1) {
- sprintf(buf+len, ": %s", (char*) status_string.value);
- len += status_string.length;
- }
+ if (GSS_ERROR(maj_stat))
+ break;
+ err_msg = ap_pstrcat(p, err_msg, ": ", (char*) status_string.value, NULL);
gss_release_buffer(&min_stat, &status_string);
+
+ maj_stat = gss_display_status (&min_stat,
+ err_min,
+ GSS_C_MECH_CODE,
+ GSS_C_NULL_OID,
+ &msg_ctx,
+ &status_string);
+ if (!GSS_ERROR(maj_stat)) {
+ err_msg = ap_pstrcat(p, err_msg,
+ " (", (char*) status_string.value, ")", NULL);
+ gss_release_buffer(&min_stat, &status_string);
+ }
} while (!GSS_ERROR(maj_stat) && msg_ctx != 0);
- return (ap_pstrdup(p, buf));
+ return err_msg;
}
static int
if (GSS_ERROR(maj_stat)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"Cannot store delegated credential (%s)",
- get_gss_error(r->pool, min_stat, "gss_krb5_copy_ccache"));
+ get_gss_error(r->pool, maj_stat, min_stat, "gss_krb5_copy_ccache"));
goto end;
}
&server_name);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "%s", get_gss_error(r->pool, minor_status,
+ "%s", get_gss_error(r->pool, major_status, minor_status,
"gss_import_name() failed"));
return HTTP_INTERNAL_SERVER_ERROR;
}
gss_release_name(&minor_status2, &server_name);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "%s", get_gss_error(r->pool, minor_status,
+ "%s", get_gss_error(r->pool, major_status, minor_status,
"gss_acquire_cred() failed"));
return HTTP_INTERNAL_SERVER_ERROR;
}
}
static int
-authenticate_user_gss(request_rec *r,
- kerb_auth_config *conf,
- const char *auth_line)
+authenticate_user_gss(request_rec *r, kerb_auth_config *conf,
+ const char *auth_line, char **negotiate_ret_value)
{
OM_uint32 major_status, minor_status, minor_status2;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
OM_uint32 (*accept_sec_token)();
gss_OID_desc spnego_oid;
+ *negotiate_ret_value = (char *)EMPTY_STRING;
+
spnego_oid.length = 6;
spnego_oid.elements = (void *)"\x2b\x06\x01\x05\x05\x02";
}
ap_base64encode(token, output_token.value, output_token.length);
token[len] = '\0';
- ap_table_set(r->err_headers_out, "WWW-Authenticate",
- ap_pstrcat(r->pool, "Negotiate ", token, NULL));
+ *negotiate_ret_value = token;
gss_release_buffer(&minor_status2, &output_token);
}
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "%s", get_gss_error(r->pool, minor_status,
+ "%s", get_gss_error(r->pool, major_status, minor_status,
"gss_accept_sec_context() failed"));
+ /* Don't offer the Negotiate method again if call to GSS layer failed */
+ *negotiate_ret_value = NULL;
ret = HTTP_UNAUTHORIZED;
goto end;
}
gss_release_name(&minor_status, &client_name);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
- "%s", get_gss_error(r->pool, minor_status,
+ "%s", get_gss_error(r->pool, major_status, minor_status,
"gss_export_name() failed"));
ret = HTTP_INTERNAL_SERVER_ERROR;
goto end;
static void
note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf,
- int use_krb4, int use_krb5)
+ int use_krb4, int use_krb5, char *negotiate_ret_value)
{
const char *auth_name = NULL;
int set_basic = 0;
+ char *negoauth_param;
/* get the user realm specified in .htaccess */
auth_name = ap_auth_name(r);
/* XXX should the WWW-Authenticate header be cleared first? */
#ifdef KRB5
- if (use_krb5 && conf->krb_method_gssapi)
- ap_table_add(r->err_headers_out, "WWW-Authenticate", "Negotiate");
+ if (use_krb5 && conf->krb_method_gssapi && negotiate_ret_value != NULL) {
+ negoauth_param = (*negotiate_ret_value == '\0') ? "Negotiate" :
+ ap_pstrcat(r->pool, "Negotiate ", negotiate_ret_value, NULL);
+ ap_table_add(r->err_headers_out, "WWW-Authenticate", negoauth_param);
+ }
if (use_krb5 && conf->krb_method_k5pass) {
ap_table_add(r->err_headers_out, "WWW-Authenticate",
ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
int use_krb5 = 0, use_krb4 = 0;
int ret;
static int last_return = HTTP_UNAUTHORIZED;
+ char *negotiate_ret_value;
/* get the type specified in .htaccess */
type = ap_auth_type(r);
/* get what the user sent us in the HTTP header */
auth_line = MK_TABLE_GET(r->headers_in, "Authorization");
if (!auth_line) {
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5);
+ note_kerb_auth_failure(r, conf, use_krb4, use_krb5, "\0");
return HTTP_UNAUTHORIZED;
}
auth_type = ap_getword_white(r->pool, &auth_line);
#ifdef KRB5
if (use_krb5 && conf->krb_method_gssapi &&
strcasecmp(auth_type, "Negotiate") == 0) {
- ret = authenticate_user_gss(r, conf, auth_line);
+ ret = authenticate_user_gss(r, conf, auth_line, &negotiate_ret_value);
} else if (use_krb5 && conf->krb_method_k5pass &&
strcasecmp(auth_type, "Basic") == 0) {
ret = authenticate_user_krb5pwd(r, conf, auth_line);
#endif
if (ret == HTTP_UNAUTHORIZED)
- note_kerb_auth_failure(r, conf, use_krb4, use_krb5);
+ note_kerb_auth_failure(r, conf, use_krb4, use_krb5, negotiate_ret_value);
last_return = ret;
return ret;
projects / mod_auth_kerb.git / blobdiff