krb5_auth.c revision c2caac87520c2f5a7db764d4827d1ad4cadcb696
/*
SSSD
Kerberos 5 Backend Module
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2009-2010 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <errno.h>
#include <pwd.h>
#include <security/pam_modules.h>
#include "util/find_uid.h"
#include "providers/child_common.h"
#include "providers/krb5/krb5_auth.h"
#include "providers/krb5/krb5_utils.h"
#ifndef SSSD_LIBEXEC_PATH
#error "SSSD_LIBEXEC_PATH not defined"
#else
#endif
const char *new_ccache_file)
{
int ret;
size_t old_offset = 0;
size_t new_offset = 0;
if (new_ccache_file == NULL) {
"old ccache file is not deleted.\n"));
return EINVAL;
}
if (old_ccache_file != NULL) {
old_offset = 5;
}
new_offset = 5;
}
new_ccache_file + new_offset) == 0) {
"no one will be deleted.\n"));
return EOK;
}
return EINVAL;
}
return ret;
}
}
return EOK;
}
bool *result)
{
int ret;
const char *filename;
bool active;
*result = false;
return EINVAL;
}
offset = 5;
}
if (filename[0] != '/') {
return EINVAL;
}
return errno;
return EINVAL;
}
filename));
return EINVAL;
}
}
return ret;
}
if (!active) {
} else {
*result = true;
}
return EOK;
}
struct sss_domain_info *domain,
const char *name,
const char *ccname)
{
struct sysdb_attrs *attrs;
int ret;
return EINVAL;
}
if (!tmpctx) {
return ENOMEM;
}
if (!attrs) {
goto done;
}
goto done;
}
goto done;
}
goto done;
}
}
done:
return ret;
}
{
const char *keytab;
return EINVAL;
}
return ENOMEM;
}
}
return ENOMEM;
}
rp = 0;
}
return EOK;
}
{
case SSS_PAM_AUTHENTICATE:
struct krb5_ctx);
break;
case SSS_PAM_CHAUTHTOK:
case SSS_PAM_CHAUTHTOK_PRELIM:
struct krb5_ctx);
break;
default:
return NULL;
}
}
static int krb5_cleanup(void *ptr)
{
return EOK;
}
struct krb5child_req **krb5_req)
{
return ENOMEM;
}
kr->is_offline = false;
kr->active_ccache_present = true;
return EOK;
}
struct handle_child_state {
struct tevent_context *ev;
struct krb5child_req *kr;
};
struct tevent_timer *te,
{
struct handle_child_state);
int ret;
return;
}
if (ret == -1) {
}
}
struct tevent_context *ev,
struct krb5child_req *kr)
{
struct handle_child_state);
tv = tevent_timeval_current();
0);
return ENOMEM;
}
return EOK;
}
struct krb5child_req *kr)
{
int pipefd_to_child[2];
int pipefd_from_child[2];
int ret;
if (ret == -1) {
return err;
}
if (ret == -1) {
return err;
}
if (pid == 0) { /* child */
/* We need to keep the root privileges to read the keytab file if
* validation is enabled, otherwise we can drop them here and run
* krb5_child with user privileges.
* If we are offline and want to create an empty ccache file. In this
* case we can drop the privileges, too. */
kr->is_offline) {
return ret;
}
}
return err;
}
} else if (pid > 0) { /* parent */
close(pipefd_to_child[0]);
return ret;
}
}
} else { /* error */
return err;
}
return EOK;
}
struct tevent_context *ev,
struct krb5child_req *kr)
{
struct handle_child_state *state;
int ret;
return NULL;
}
goto fail;
}
goto fail;
}
if (!subreq) {
goto fail;
}
return req;
fail:
return req;
}
{
struct tevent_req);
struct handle_child_state);
int ret;
return;
}
if (!subreq) {
return;
}
}
{
struct tevent_req);
struct handle_child_state);
int ret;
return;
}
return;
}
{
struct handle_child_state);
return EOK;
}
struct krb5_auth_state {
struct tevent_context *ev;
struct krb5child_req *kr;
int pam_status;
int dp_err;
};
{
return EOK;
}
struct tevent_context *ev,
{
const char **attrs;
struct krb5_auth_state *state;
struct ldb_result *res;
const char *ccache_file = NULL;
const char *realm;
struct tevent_req *req;
struct tevent_req *subreq;
int ret;
return NULL;
}
case SSS_PAM_AUTHENTICATE:
case SSS_PAM_CHAUTHTOK:
break;
case SSS_PAM_CHAUTHTOK_PRELIM:
goto done;
}
break;
case SSS_PAM_ACCT_MGMT:
case SSS_PAM_SETCRED:
case SSS_PAM_OPEN_SESSION:
case SSS_PAM_CLOSE_SESSION:
goto done;
break;
default:
goto done;
}
if (be_is_offline(be_ctx) &&
goto done;
}
goto done;
}
goto done;
}
if (ret) {
goto done;
}
goto done;
}
case 0:
goto done;
break;
case 1:
/* NOTE: this is a hack, works only in some environments */
goto done;
}
}
NULL);
}
goto done;
}
goto done;
}
NULL);
if (ccache_file != NULL) {
goto done;
}
&kr->valid_tgt_present);
if (kerr != 0) {
goto done;
}
} else {
kr->active_ccache_present = false;
kr->valid_tgt_present = false;
}
if (ccache_file != NULL) {
goto done;
}
} else {
}
break;
default:
goto done;
break;
}
goto done;
}
return req;
done:
} else {
}
return req;
}
{
int ret;
if (ret) {
/* all servers have been tried and none
* was found good, setting offline,
* but we still have to call the child to setup
* the ccache file. */
kr->is_offline = true;
} else {
goto failed;
}
return;
}
}
return;
}
{
int ret;
if (ret) {
/* all kpasswd servers have been tried and none was found good, but the
* kdc seems ok. Password changes are not possible but
* authentication. We return an PAM error here, but do not mark the
* backend offline. */
return;
}
}
{
int ret;
char *msg;
bool private_path = false;
if (!kr->is_offline) {
}
/* The ccache file should be (re)created if one of the following conditions
* is true:
* - it doesn't exist (kr->ccname == NULL)
* - the backend is online and the current ccache file is not used, i.e
* the related user is currently not logged in
* (!kr->is_offline && !kr->active_ccache_present)
* - the backend is offline and the current cache file not used and
* it does not contain a valid tgt
* (kr->is_offline &&
* !kr->active_ccache_present && !kr->valid_tgt_present)
*/
!kr->valid_tgt_present) ||
true, &private_path);
goto done;
}
goto done;
}
}
if (kr->is_offline) {
"ccache file is already in use.\n"));
} else {
}
}
return;
}
goto done;
}
}
goto done;
}
return;
done:
} else {
}
}
{
int ret;
size_t p;
}
} else {
}
return;
}
/* A buffer with the following structure is expected.
* int32_t status of the request (required)
* message (zero or more)
*
* A message consists of:
* int32_t type of the message
* int32_t length of the following data
* uint8_t[len] data
*/
goto done;
}
p=0;
while (p < len) {
msg_len));
goto done;
}
/* We need to save the name of the credential cache file. To find it
* we check if the data part of a message starts with
* CCACHE_ENV_NAME"=". pref_len also counts the trailing '=' because
* sizeof() counts the trailing '\0' of a string. */
pref_len = sizeof(CCACHE_ENV_NAME);
goto done;
}
}
/* This is not a fatal error */
}
p += msg_len;
goto done;
}
}
/* If the child request failed, but did not return an offline error code,
* return with the status */
goto done;
} else {
}
/* If the child request was successful and we run the first pass of the
* change password request just return success. */
goto done;
}
/* if using a dedicated kpasswd server.. */
/* ..which is unreachable by now.. */
if (msg_status == PAM_AUTHTOK_LOCK_BUSY) {
/* ..try to resolve next kpasswd server */
}
return;
} else {
}
}
/* if the KDC for auth (PAM_AUTHINFO_UNAVAIL) or
* chpass (PAM_AUTHTOK_LOCK_BUSY) was not available while using KDC
* also for chpass operation... */
if (msg_status == PAM_AUTHINFO_UNAVAIL ||
/* ..try to resolve next KDC */
}
return;
}
}
/* Now only a successful authentication or password change is left.
*
* We expect that one of the messages in the received buffer contains
* the name of the credential cache file. */
goto done;
}
}
}
struct sysdb_attrs *attrs;
goto done;
}
if (ret) {
goto done;
}
return;
done:
} else {
}
}
{
case SSS_PAM_AUTHENTICATE:
break;
case SSS_PAM_CHAUTHTOK:
case SSS_PAM_CHAUTHTOK_PRELIM:
break;
} else {
break;
}
default:
}
return next_req;
}
{
struct tevent_req *next_req;
return NULL;
}
return next_req;
}
{
struct tevent_req *next_req;
return NULL;
}
return next_req;
}
{
int ret;
if (kr->is_offline) {
return;
}
goto done;
}
/* password caching failures are not fatal errors */
case SSS_PAM_AUTHENTICATE:
case SSS_PAM_CHAUTHTOK_PRELIM:
}
break;
case SSS_PAM_CHAUTHTOK:
}
break;
default:
}
DEBUG(0, ("password not available, offline auth may not work.\n"));
goto done;
}
password);
if (ret) {
}
}
done:
} else {
}
}
{
int ret;
} else {
/* This error is not fatal */
}
}
}
{
}
{
struct tevent_req *req;
goto failed;
}
krb5_ctx);
goto failed;
}
return;
}
{
int ret;
int pam_status;
int dp_err;
if (ret) {
} else {
}
}