krb5_auth.c revision 87c07559af5cfcd2752295ef7c425bd3205f426f
/*
SSSD
Kerberos 5 Backend Module
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2009-2010 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <errno.h>
#include <pwd.h>
#include <security/pam_modules.h>
#include "util/find_uid.h"
#include "util/child_common.h"
#include "providers/krb5/krb5_auth.h"
#include "providers/krb5/krb5_utils.h"
#define TIME_T_MAX LONG_MAX
const char *new_ccache_file)
{
int ret;
size_t old_offset = 0;
size_t new_offset = 0;
if (new_ccache_file == NULL) {
"old ccache file is not deleted.\n"));
return EINVAL;
}
if (old_ccache_file != NULL) {
old_offset = 5;
}
new_offset = 5;
}
new_ccache_file + new_offset) == 0) {
"no one will be deleted.\n"));
return EOK;
}
return EINVAL;
}
return ret;
}
}
return EOK;
}
bool *result)
{
int ret;
const char *filename;
bool active;
*result = false;
return EINVAL;
}
offset = 5;
}
if (filename[0] != '/') {
return EINVAL;
}
return errno;
return EINVAL;
}
filename));
return EINVAL;
}
}
return ret;
}
if (!active) {
} else {
*result = true;
}
return EOK;
}
const char *name,
const char *ccname,
int mod_op)
{
struct sysdb_attrs *attrs;
int ret;
return EINVAL;
}
return EINVAL;
}
if (!tmpctx) {
return ENOMEM;
}
if (!attrs) {
goto done;
}
goto done;
}
goto done;
}
goto done;
}
}
done:
return ret;
}
const char *name,
const char *ccname)
{
}
const char *name,
const char *ccname)
{
}
{
case SSS_PAM_AUTHENTICATE:
case SSS_CMD_RENEW:
struct krb5_ctx);
break;
case SSS_PAM_ACCT_MGMT:
struct krb5_ctx);
break;
case SSS_PAM_CHAUTHTOK:
case SSS_PAM_CHAUTHTOK_PRELIM:
struct krb5_ctx);
break;
default:
return NULL;
}
}
static int krb5_cleanup(void *ptr)
{
return EOK;
}
{
return ENOMEM;
}
kr->is_offline = false;
kr->active_ccache_present = true;
kr->run_as_user = true;
return EOK;
}
struct krb5_auth_state {
struct tevent_context *ev;
struct krb5child_req *kr;
int pam_status;
int dp_err;
};
{
return EOK;
}
struct tevent_context *ev,
{
const char **attrs;
struct krb5_auth_state *state;
struct ldb_result *res;
const char *ccache_file = NULL;
const char *realm;
struct tevent_req *req;
struct tevent_req *subreq;
int ret;
return NULL;
}
case SSS_PAM_AUTHENTICATE:
case SSS_CMD_RENEW:
case SSS_PAM_CHAUTHTOK:
break;
case SSS_PAM_CHAUTHTOK_PRELIM:
goto done;
}
break;
default:
goto done;
}
if (be_is_offline(be_ctx) &&
"while offline.\n"));
goto done;
}
goto done;
}
goto done;
}
&res);
if (ret) {
goto done;
}
goto done;
}
case 0:
goto done;
break;
case 1:
goto done;
}
}
NULL);
}
goto done;
}
goto done;
}
NULL);
if (ccache_file != NULL) {
goto done;
}
&kr->valid_tgt_present);
if (kerr != 0) {
goto done;
}
} else {
kr->active_ccache_present = false;
kr->valid_tgt_present = false;
}
if (ccache_file != NULL) {
goto done;
}
} else {
}
break;
default:
goto done;
break;
}
goto done;
}
return req;
done:
} else {
}
return req;
}
{
int ret;
if (ret) {
/* all servers have been tried and none
* was found good, setting offline,
* but we still have to call the child to setup
* the ccache file. */
kr->is_offline = true;
} else {
goto failed;
}
return;
}
}
return;
}
{
int ret;
if (ret) {
/* all kpasswd servers have been tried and none was found good, but the
* kdc seems ok. Password changes are not possible but
* authentication. We return an PAM error here, but do not mark the
* backend offline. */
return;
}
}
{
int ret;
char *msg;
bool private_path = false;
if (!kr->is_offline) {
}
/* The ccache file should be (re)created if one of the following conditions
* is true:
* - it doesn't exist (kr->ccname == NULL)
* - the backend is online and the current ccache file is not used, i.e
* the related user is currently not logged in and it is not a renewal
* request
* (!kr->is_offline && !kr->active_ccache_present &&
* pd->cmd != SSS_CMD_RENEW)
* - the backend is offline and the current cache file not used and
* it does not contain a valid tgt
* (kr->is_offline &&
* !kr->active_ccache_present && !kr->valid_tgt_present)
*/
!kr->valid_tgt_present) ||
true, &private_path);
goto done;
}
goto done;
}
}
if (kr->is_offline) {
"ccache file is already in use.\n"));
} else {
}
}
return;
}
goto done;
}
}
/* We need to keep the root privileges to read the keytab file if
* validation or FAST is enabled, otherwise we can drop them and run
* krb5_child with user privileges.
* If we are offline we want to create an empty ccache file. In this
* case we can drop the privileges, too. */
!kr->is_offline) {
kr->run_as_user = false;
} else {
kr->run_as_user = true;
}
goto done;
}
return;
done:
} else {
}
}
{
int ret;
size_t p;
}
} else {
}
return;
}
/* A buffer with the following structure is expected.
* int32_t status of the request (required)
* message (zero or more)
*
* A message consists of:
* int32_t type of the message
* int32_t length of the following data
* uint8_t[len] data
*/
goto done;
}
p=0;
while (p < len) {
msg_len));
goto done;
}
/* We need to save the name of the credential cache file. To find it
* we check if the data part of a message starts with
* CCACHE_ENV_NAME"=". pref_len also counts the trailing '=' because
* sizeof() counts the trailing '\0' of a string. */
pref_len = sizeof(CCACHE_ENV_NAME);
goto done;
}
}
if (msg_type == SSS_KRB5_INFO_TGT_LIFETIME &&
}
/* This is not a fatal error */
}
p += msg_len;
goto done;
}
}
/* If the child request failed, but did not return an offline error code,
* return with the status */
goto done;
} else {
}
/* If the password is expired we can safely remove the ccache from the
* cache and disk if it is not actively used anymore. This will allow to
* create a new random ccache if sshd with privilege separation is used. */
if (msg_status == PAM_NEW_AUTHTOK_REQD) {
}
}
}
}
goto done;
}
/* If the child request was successful and we run the first pass of the
* change password request just return success. */
goto done;
}
/* if using a dedicated kpasswd server.. */
/* ..which is unreachable by now.. */
if (msg_status == PAM_AUTHTOK_LOCK_BUSY) {
/* ..try to resolve next kpasswd server */
}
return;
} else {
}
}
/* if the KDC for auth (PAM_AUTHINFO_UNAVAIL) or
* chpass (PAM_AUTHTOK_LOCK_BUSY) was not available while using KDC
* also for chpass operation... */
if (msg_status == PAM_AUTHINFO_UNAVAIL ||
/* ..try to resolve next KDC */
}
return;
}
}
/* Now only a successful authentication or password change is left.
*
* We expect that one of the messages in the received buffer contains
* the name of the credential cache file. */
goto done;
}
}
}
if (ret) {
goto done;
}
if (msg_status == PAM_SUCCESS &&
"automatic renewal not possible.\n"));
}
}
return;
done:
} else {
}
}
{
case SSS_PAM_AUTHENTICATE:
case SSS_CMD_RENEW:
break;
case SSS_PAM_CHAUTHTOK:
case SSS_PAM_CHAUTHTOK_PRELIM:
break;
} else {
break;
}
default:
}
return next_req;
}
{
struct tevent_req *next_req;
return NULL;
}
return next_req;
}
{
struct tevent_req *next_req;
return NULL;
}
return next_req;
}
{
int ret;
if (kr->is_offline) {
return;
}
goto done;
}
/* password caching failures are not fatal errors */
case SSS_CMD_RENEW:
/* The authtok is set to the credential cache
* during renewal. We don't want to save this
* as the cached password.
*/
break;
case SSS_PAM_AUTHENTICATE:
case SSS_PAM_CHAUTHTOK_PRELIM:
}
break;
case SSS_PAM_CHAUTHTOK:
}
break;
default:
}
DEBUG(0, ("password not available, offline auth may not work.\n"));
/* password caching failures are not fatal errors */
}
goto done;
}
if (ret) {
/* password caching failures are not fatal errors */
}
}
done:
} else {
}
}
{
int ret;
NULL);
} else {
/* This error is not fatal */
}
}
}
{
}
{
struct tevent_req *req;
int dp_err = DP_ERR_FATAL;
int ret;
goto done;
}
case SSS_PAM_AUTHENTICATE:
case SSS_CMD_RENEW:
case SSS_PAM_CHAUTHTOK_PRELIM:
case SSS_PAM_CHAUTHTOK:
return;
} else {
}
krb5_ctx);
goto done;
}
break;
case SSS_PAM_ACCT_MGMT:
goto done;
}
break;
case SSS_PAM_SETCRED:
case SSS_PAM_OPEN_SESSION:
case SSS_PAM_CLOSE_SESSION:
goto done;
break;
default:
goto done;
}
return;
done:
}
{
int ret;
int pam_status;
int dp_err;
if (ret) {
} else {
}
} else {
}
}
{
int ret;
bool access_allowed;
goto done;
}
done:
}