krb5_auth.c revision 83f24636ef8d3d2b9c5be46272781ed5e0497ca7
/*
SSSD
Kerberos 5 Backend Module
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2009-2010 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <errno.h>
#include <pwd.h>
#include <security/pam_modules.h>
#include "util/find_uid.h"
#include "util/child_common.h"
#include "providers/krb5/krb5_auth.h"
#include "providers/krb5/krb5_utils.h"
const char *princ,
const char *old_ccache,
const char *new_ccache)
{
int ret;
enum sss_krb5_cc_type old_type;
struct sss_krb5_cc_be *old_cc_ops;
if (old_ccache == NULL) {
return EOK;
}
if (new_ccache == NULL) {
("Missing new ccache file, old ccache file is not deleted.\n"));
return EINVAL;
}
if (!old_cc_ops) {
return EINVAL;
}
"no one will be deleted.\n"));
return EOK;
}
("Cannot remove ccache [%s]\n", old_ccache));
return EIO;
}
return EOK;
}
static errno_t
{
struct sss_krb5_cc_be *old_cc_ops;
const char *cc_template;
/* ccache file might be of a different type if the user changed
* configuration
*/
if (old_cc_ops == NULL) {
("Cannot get operations on saved ccache %s\n", old_ccache));
return EINVAL;
}
("Cannot check if saved ccache %s is active and valid\n",
old_ccache));
return ret;
}
return EOK;
}
const char *name,
const char *ccname,
int mod_op)
{
struct sysdb_attrs *attrs;
int ret;
bool in_transaction = false;
return EINVAL;
}
return EINVAL;
}
if (!tmpctx) {
return ENOMEM;
}
if (!attrs) {
goto done;
}
goto done;
}
goto done;
}
in_transaction = true;
goto done;
}
goto done;
}
in_transaction = false;
done:
if (in_transaction) {
}
}
return ret;
}
const char *name,
const char *ccname)
{
}
const char *name,
const char *ccname)
{
}
{
case SSS_PAM_AUTHENTICATE:
case SSS_CMD_RENEW:
struct krb5_ctx);
break;
case SSS_PAM_ACCT_MGMT:
struct krb5_ctx);
break;
case SSS_PAM_CHAUTHTOK:
case SSS_PAM_CHAUTHTOK_PRELIM:
struct krb5_ctx);
break;
default:
return NULL;
}
}
static int krb5_cleanup(void *ptr)
{
return EOK;
}
{
return ENOMEM;
}
kr->is_offline = false;
kr->active_ccache_present = true;
kr->run_as_user = true;
return EOK;
}
struct krb5_auth_state {
struct tevent_context *ev;
struct krb5child_req *kr;
int pam_status;
int dp_err;
};
{
return EOK;
}
struct tevent_context *ev,
{
const char **attrs;
struct krb5_auth_state *state;
struct ldb_result *res;
const char *ccache_file = NULL;
const char *realm;
struct tevent_req *req;
struct tevent_req *subreq;
int ret;
struct sss_domain_info *dom;
return NULL;
}
goto done;
}
case SSS_PAM_AUTHENTICATE:
case SSS_CMD_RENEW:
case SSS_PAM_CHAUTHTOK:
break;
case SSS_PAM_CHAUTHTOK_PRELIM:
goto done;
}
break;
default:
goto done;
}
if (be_is_offline(be_ctx) &&
"while offline.\n"));
goto done;
}
goto done;
}
goto done;
}
&res);
if (ret) {
goto done;
}
goto done;
}
case 0:
goto done;
break;
case 1:
goto done;
}
} else {
if (ret != 0) {
goto done;
}
}
NULL);
}
goto done;
}
goto done;
}
/* The type of the ccache might change during the request if we
* end up reusing an old ccache */
NULL);
if (ccache_file != NULL) {
&kr->valid_tgt_present);
("check_if_ccache_file_is_used failed.\n"));
goto done;
}
} else {
kr->active_ccache_present = false;
kr->valid_tgt_present = false;
}
if (ccache_file != NULL) {
goto done;
}
} else {
}
break;
default:
goto done;
break;
}
if (!subreq) {
goto done;
}
return req;
done:
} else {
}
return req;
}
{
int ret;
if (ret) {
/* all servers have been tried and none
* was found good, setting offline,
* but we still have to call the child to setup
* the ccache file if we are performing auth */
kr->is_offline = true;
("No KDC suitable for password change is available\n"));
return;
}
} else {
goto failed;
}
return;
}
}
return;
}
{
int ret;
/* all kpasswd servers have been tried and none was found good, but the
* kdc seems ok. Password changes are not possible but
* authentication is. We return an PAM error here, but do not mark the
* backend offline. */
return;
}
}
{
int ret;
char *msg;
bool private_path = false;
if (!kr->is_offline) {
}
/* The ccache file should be (re)created if one of the following conditions
* is true:
* - it doesn't exist (kr->ccname == NULL)
* - the backend is online and the current ccache file is not used, i.e
* the related user is currently not logged in and it is not a renewal
* request
* (!kr->is_offline && !kr->active_ccache_present &&
* pd->cmd != SSS_CMD_RENEW)
* - the backend is offline and the current cache file not used and
* it does not contain a valid tgt
* (kr->is_offline &&
* !kr->active_ccache_present && !kr->valid_tgt_present)
*/
!kr->valid_tgt_present) ||
true,
&private_path);
goto done;
}
("Cannot get operations on new ccache %s\n",
goto done;
}
}
goto done;
}
} else {
("Saved ccache %s if of different type than ccache in "
"configuration file, reusing the old ccache\n",
kr->old_ccname));
("Cannot get operations on saved ccache %s\n",
kr->old_ccname));
goto done;
}
}
if (kr->is_offline) {
"ccache file is already in use.\n"));
} else {
}
}
return;
}
goto done;
}
}
/* We need to keep the root privileges to read the keytab file if
* validation or FAST is enabled, otherwise we can drop them and run
* krb5_child with user privileges.
* If we are offline we want to create an empty ccache file. In this
* case we can drop the privileges, too. */
!kr->is_offline) {
kr->run_as_user = false;
} else {
kr->run_as_user = true;
}
goto done;
}
return;
done:
} else {
}
}
{
int ret;
struct krb5_child_response *res;
const char *store_ccname;
}
} else {
}
return;
}
&res);
if (ret) {
goto done;
}
goto done;
}
}
/* If the child request failed, but did not return an offline error code,
* return with the status */
goto done;
} else {
}
/* If the password is expired we can safely remove the ccache from the
* cache and disk if it is not actively used anymore. This will allow to
* create a new random ccache if sshd with privilege separation is used. */
}
}
}
}
goto done;
}
/* If the child request was successful and we run the first pass of the
* change password request just return success. */
goto done;
}
/* if using a dedicated kpasswd server for a chpass operation... */
/* ..which is unreachable by now.. */
/* ..try to resolve next kpasswd server */
}
return;
} else {
}
}
/* if the KDC for auth (PAM_AUTHINFO_UNAVAIL) or
* chpass (PAM_AUTHTOK_LOCK_BUSY) was not available while using KDC
* also for chpass operation... */
/* ..try to resolve next KDC */
}
return;
}
}
/* Now only a successful authentication or password change is left.
*
* We expect that one of the messages in the received buffer contains
* the name of the credential cache file. */
goto done;
}
if (store_ccname == NULL) {
goto done;
}
("Failed to remove old ccache file [%s], "
}
if (ret) {
goto done;
}
"automatic renewal not possible.\n"));
}
}
return;
done:
} else {
}
}
{
case SSS_PAM_AUTHENTICATE:
case SSS_CMD_RENEW:
break;
case SSS_PAM_CHAUTHTOK:
case SSS_PAM_CHAUTHTOK_PRELIM:
break;
} else {
break;
}
default:
}
return next_req;
}
{
struct tevent_req *next_req;
return NULL;
}
return next_req;
}
{
struct tevent_req *next_req;
return NULL;
}
return next_req;
}
{
int ret;
if (kr->is_offline) {
return;
}
goto done;
}
/* password caching failures are not fatal errors */
case SSS_CMD_RENEW:
/* The authtok is set to the credential cache
* during renewal. We don't want to save this
* as the cached password.
*/
break;
case SSS_PAM_AUTHENTICATE:
case SSS_PAM_CHAUTHTOK_PRELIM:
}
break;
case SSS_PAM_CHAUTHTOK:
}
break;
default:
}
DEBUG(0, ("password not available, offline auth may not work.\n"));
/* password caching failures are not fatal errors */
}
goto done;
}
if (ret) {
/* password caching failures are not fatal errors */
}
}
done:
} else {
}
}
{
int ret;
NULL);
} else {
/* This error is not fatal */
}
}
}
{
}
{
struct tevent_req *req;
int dp_err = DP_ERR_FATAL;
int ret;
goto done;
}
case SSS_PAM_AUTHENTICATE:
case SSS_CMD_RENEW:
case SSS_PAM_CHAUTHTOK_PRELIM:
case SSS_PAM_CHAUTHTOK:
return;
} else {
}
krb5_ctx);
goto done;
}
break;
case SSS_PAM_ACCT_MGMT:
goto done;
}
break;
case SSS_PAM_SETCRED:
case SSS_PAM_OPEN_SESSION:
case SSS_PAM_CLOSE_SESSION:
goto done;
break;
default:
goto done;
}
return;
done:
}
{
int ret;
int pam_status;
int dp_err;
if (ret) {
} else {
}
} else {
}
}
{
int ret;
bool access_allowed;
goto done;
}
done:
}