3bcd9d942601d59dd55a6069d8b2d1c33d7ced0eChristian Maeder

3bcd9d942601d59dd55a6069d8b2d1c33d7ced0eChristian Maeder#include <sys/types.h>

3bcd9d942601d59dd55a6069d8b2d1c33d7ced0eChristian Maeder#include <unistd.h>

3bcd9d942601d59dd55a6069d8b2d1c33d7ced0eChristian Maeder#include <sys/stat.h>

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers#include <popt.h>

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder#include <security/pam_modules.h>

c64d33a7fbeae730cbe65193fe3cc24e7aa1ddd6Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder#include "util/util.h"

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers#include "util/sss_krb5.h"

ad270004874ce1d0697fb30d7309f180553bb315Christian Maeder#include "util/user_info_msg.h"

ef9e8535c168d3f774d9e74368a2317a9eda5826Christian Maeder#include "util/child_common.h"

ef9e8535c168d3f774d9e74368a2317a9eda5826Christian Maeder#include "util/find_uid.h"

ef9e8535c168d3f774d9e74368a2317a9eda5826Christian Maeder#include "src/util/util_errors.h"

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers#include "providers/dp_backend.h"

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers#include "providers/krb5/krb5_auth.h"

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers#include "providers/krb5/krb5_utils.h"

697e63e30aa3c309a1ef1f9357745111f8dfc5a9Christian Maeder#include "sss_cli.h"

1544471d4ce2b4a5d9622e975f17e4081140e596Christian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers#define SSSD_KRB5_CHANGEPW_PRINCIPAL "kadmin/changepw"

0ce46d5315b16108b74d20b86aeff37c48f48828Christian Maeder

ea8e98e298f33f9362293f392c8fb192722b8904Eugen Kuksaenum k5c_fast_opt {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers K5C_FAST_NEVER,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers K5C_FAST_TRY,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers K5C_FAST_DEMAND,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers};

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckersstruct krb5_req {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_context ctx;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_principal princ;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers char* name;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_creds *creds;

35db0960aa2e2a13652381c756fae5fb2b27213bChristian Maeder bool otp;

bccea164bdfc2ddc3d1e20749bb5477a46eab3a6Christian Maeder char *otp_vendor;

bccea164bdfc2ddc3d1e20749bb5477a46eab3a6Christian Maeder char *otp_token_id;

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder char *otp_challenge;

12cb8453ba3b8c36acaf9547549ce6d792cca58dChristian Maeder krb5_get_init_creds_opt *options;

1544471d4ce2b4a5d9622e975f17e4081140e596Christian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers struct pam_data *pd;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers char *realm;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder char *ccname;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers char *keytab;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers bool validate;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder bool send_pac;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers bool use_enterprise_princ;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers char *fast_ccname;

c64d33a7fbeae730cbe65193fe3cc24e7aa1ddd6Christian Maeder

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder const char *upn;

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder uid_t uid;

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder gid_t gid;

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder char *old_ccname;

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder bool old_cc_valid;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers bool old_cc_active;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers enum k5c_fast_opt fast_val;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers uid_t fast_uid;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers gid_t fast_gid;

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder};

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maederstatic krb5_context krb5_error_ctx;

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder#define KRB5_CHILD_DEBUG(level, error) KRB5_DEBUG(level, krb5_error_ctx, error)

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maederstatic krb5_error_code set_lifetime_options(krb5_get_init_creds_opt *options)

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder{

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers char *lifetime_str;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_error_code kerr;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_deltat lifetime;

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder lifetime_str = getenv(SSSD_KRB5_RENEWABLE_LIFETIME);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (lifetime_str == NULL) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CONF_SETTINGS, "Cannot read [%s] from environment.\n",

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers SSSD_KRB5_RENEWABLE_LIFETIME);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers /* Unset option flag to make sure defaults from krb5.conf are used. */

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder } else {

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder kerr = krb5_string_to_deltat(lifetime_str, &lifetime);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr != 0) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_CRIT_FAILURE,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers "krb5_string_to_deltat failed for [%s].\n",

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder lifetime_str);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return kerr;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder DEBUG(SSSDBG_CONF_SETTINGS, "%s is set to [%s]\n",

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder SSSD_KRB5_RENEWABLE_LIFETIME, lifetime_str);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder krb5_get_init_creds_opt_set_renew_life(options, lifetime);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder lifetime_str = getenv(SSSD_KRB5_LIFETIME);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (lifetime_str == NULL) {

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder DEBUG(SSSDBG_CONF_SETTINGS, "Cannot read [%s] from environment.\n",

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder SSSD_KRB5_LIFETIME);

c64d33a7fbeae730cbe65193fe3cc24e7aa1ddd6Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder /* Unset option flag to make sure defaults from krb5.conf are used. */

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_TKT_LIFE);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers } else {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = krb5_string_to_deltat(lifetime_str, &lifetime);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (kerr != 0) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "krb5_string_to_deltat failed for [%s].\n",

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder lifetime_str);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder return kerr;

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CONF_SETTINGS,

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder "%s is set to [%s]\n", SSSD_KRB5_LIFETIME, lifetime_str);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_get_init_creds_opt_set_tkt_life(options, lifetime);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder return 0;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder}

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maederstatic void set_canonicalize_option(krb5_get_init_creds_opt *opts)

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder{

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder int canonicalize = 0;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder char *tmp_str;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder tmp_str = getenv(SSSD_KRB5_CANONICALIZE);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder if (tmp_str != NULL && strcasecmp(tmp_str, "true") == 0) {

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder canonicalize = 1;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder DEBUG(SSSDBG_CONF_SETTINGS, "%s is set to [%s]\n",

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder SSSD_KRB5_CANONICALIZE, tmp_str ? tmp_str : "not set");

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder sss_krb5_get_init_creds_opt_set_canonicalize(opts, canonicalize);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder}

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederstatic void set_changepw_options(krb5_get_init_creds_opt *options)

fea14169cb07365fe4d12fea734d7b761ea8b287Christian Maeder{

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers sss_krb5_get_init_creds_opt_set_canonicalize(options, 0);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_get_init_creds_opt_set_forwardable(options, 0);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_get_init_creds_opt_set_proxiable(options, 0);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_get_init_creds_opt_set_renew_life(options, 0);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_get_init_creds_opt_set_tkt_life(options, 5*60);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers}

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

fea14169cb07365fe4d12fea734d7b761ea8b287Christian Maederstatic void revert_changepw_options(krb5_get_init_creds_opt *options)

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder{

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_error_code kerr;

fea14169cb07365fe4d12fea734d7b761ea8b287Christian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers set_canonicalize_option(options);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers /* Currently we do not set forwardable and proxiable explicitly, the flags

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_FORWARDABLE);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_PROXIABLE);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers kerr = set_lifetime_options(options);

42c01284bba8d7c8d995c8dfb96ace57d28ed1bcTill Mossakowski if (kerr != 0) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder DEBUG(SSSDBG_OP_FAILURE, ("set_lifetime_options failed.\n"));

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

42c01284bba8d7c8d995c8dfb96ace57d28ed1bcTill Mossakowskistatic errno_t sss_send_pac(krb5_authdata **pac_authdata)

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder{

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder struct sss_cli_req_data sss_data;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers int ret;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers int errnop;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers sss_data.len = pac_authdata[0]->length;

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder sss_data.data = pac_authdata[0]->contents;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder ret = sss_pac_make_request(SSS_PAC_ADD_PAC_USER, &sss_data,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder NULL, NULL, &errnop);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ret != NSS_STATUS_SUCCESS || errnop != 0) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_OP_FAILURE, "sss_pac_make_request failed [%d][%d].\n",

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers ret, errnop);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return EIO;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return EOK;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder}

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maederstatic void sss_krb5_expire_callback_func(krb5_context context, void *data,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_timestamp password_expiration,

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder krb5_timestamp account_expiration,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_boolean is_last_req)

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers{

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers int ret;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers uint32_t *blob;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder long exp_time;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder struct krb5_req *kr = talloc_get_type(data, struct krb5_req);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (password_expiration == 0) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers exp_time = password_expiration - time(NULL);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (exp_time < 0 || exp_time > UINT32_MAX) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder DEBUG(SSSDBG_CRIT_FAILURE, "Time to expire out of range.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_TRACE_INTERNAL, "exp_time: [%ld]\n", exp_time);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers blob = talloc_array(kr->pd, uint32_t, 2);

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (blob == NULL) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "talloc_size failed.\n");

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder blob[0] = SSS_PAM_USER_INFO_EXPIRE_WARN;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers blob[1] = (uint32_t) exp_time;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers ret = pam_add_response(kr->pd, SSS_PAM_USER_INFO, 2 * sizeof(uint32_t),

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers (uint8_t *) blob);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (ret != EOK) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_CRIT_FAILURE, "pam_add_response failed.\n");

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers}

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_RESPONDER

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroedertypedef int (*checker)(int c);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckersstatic inline checker pick_checker(int format)

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers{

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers switch (format) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers case KRB5_RESPONDER_OTP_FORMAT_DECIMAL:

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return isdigit;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder case KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL:

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder return isxdigit;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder case KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC:

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return isalnum;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder return NULL;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder}

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckersstatic int token_pin_destructor(char *mem)

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers{

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder safezero(mem, strlen(mem));

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return 0;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers}

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maederstatic krb5_error_code tokeninfo_matches_2fa(TALLOC_CTX *mem_ctx,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers const krb5_responder_otp_tokeninfo *ti,

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder const char *fa1, size_t fa1_len,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder const char *fa2, size_t fa2_len,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers char **out_token, char **out_pin)

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers{

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder char *token = NULL, *pin = NULL;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder checker check = NULL;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers int i;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (ti->flags & KRB5_RESPONDER_OTP_FLAGS_NEXTOTP) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return ENOTSUP;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (ti->challenge != NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ENOTSUP;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers /* This is a non-sensical value. */

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (ti->length == 0) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return EPROTO;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ti->flags & KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ti->length > 0 && ti->length != fa2_len) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_CRIT_FAILURE,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "Expected [%d] and given [%zu] token size "

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "do not match.\n", ti->length, fa2_len);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return EMSGSIZE;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (ti->flags & KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ti->flags & KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder pin = talloc_strndup(mem_ctx, fa1, fa1_len);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder if (pin == NULL) {

42c01284bba8d7c8d995c8dfb96ace57d28ed1bcTill Mossakowski talloc_free(token);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder return ENOMEM;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder talloc_set_destructor(pin, token_pin_destructor);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

42c01284bba8d7c8d995c8dfb96ace57d28ed1bcTill Mossakowski token = talloc_strndup(mem_ctx, fa2, fa2_len);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (token == NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ENOMEM;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_set_destructor(token, token_pin_destructor);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers check = pick_checker(ti->format);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder } else {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder token = talloc_asprintf(mem_ctx, "%s%s", fa1, fa2);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (token == NULL) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return ENOMEM;

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_set_destructor(token, token_pin_destructor);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers check = pick_checker(ti->format);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder } else {

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder /* Assuming PIN only required */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder pin = talloc_strndup(mem_ctx, fa1, fa1_len);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (pin == NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ENOMEM;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_set_destructor(pin, token_pin_destructor);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* If check is set, we need to verify the contents of the token. */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder for (i = 0; check != NULL && token[i] != '\0'; i++) {

fea14169cb07365fe4d12fea734d7b761ea8b287Christian Maeder if (!check(token[i])) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers talloc_free(token);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_free(pin);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return EBADMSG;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers *out_token = token;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers *out_pin = pin;

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder return 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederstatic krb5_error_code tokeninfo_matches_pwd(TALLOC_CTX *mem_ctx,

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder const krb5_responder_otp_tokeninfo *ti,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers const char *pwd, size_t len,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers char **out_token, char **out_pin)

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers{

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers char *token = NULL, *pin = NULL;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers checker check = NULL;

42c01284bba8d7c8d995c8dfb96ace57d28ed1bcTill Mossakowski int i;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

bccea164bdfc2ddc3d1e20749bb5477a46eab3a6Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ti->flags & KRB5_RESPONDER_OTP_FLAGS_NEXTOTP) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return ENOTSUP;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

42c01284bba8d7c8d995c8dfb96ace57d28ed1bcTill Mossakowski if (ti->challenge != NULL) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return ENOTSUP;

bccea164bdfc2ddc3d1e20749bb5477a46eab3a6Christian Maeder }

9271474a25bfadbf6d91b82ec60f614fb0dff492Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder /* This is a non-sensical value. */

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ti->length == 0) {

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder return EPROTO;

9271474a25bfadbf6d91b82ec60f614fb0dff492Christian Maeder }

9271474a25bfadbf6d91b82ec60f614fb0dff492Christian Maeder

9271474a25bfadbf6d91b82ec60f614fb0dff492Christian Maeder if (ti->flags & KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN) {

9271474a25bfadbf6d91b82ec60f614fb0dff492Christian Maeder /* ASSUMPTION: authtok has one of the following formats:

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers token = talloc_strndup(mem_ctx, pwd, len);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (token == NULL) {

e07538a3c4dbc690e57f61aded6db89d876b2374Christian Maeder return ENOMEM;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder talloc_set_destructor(token, token_pin_destructor);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ti->flags & KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* If the server desires a separate pin, we will split it.

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ti->flags & KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ti->length < 1) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder talloc_free(token);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ENOTSUP;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ti->length >= len) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_free(token);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return EMSGSIZE;

e07538a3c4dbc690e57f61aded6db89d876b2374Christian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Copy the PIN from the front of the value. */

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder pin = talloc_strndup(NULL, pwd, len - ti->length);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (pin == NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder talloc_free(token);

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder return ENOMEM;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder talloc_set_destructor(pin, token_pin_destructor);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Remove the PIN from the front of the token value. */

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder memmove(token, token + len - ti->length, ti->length + 1);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder check = pick_checker(ti->format);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder } else {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ti->length > 0 && ti->length > len) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder talloc_free(token);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return EMSGSIZE;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder } else {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (ti->length > 0 && ti->length != len) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_free(token);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return EMSGSIZE;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder check = pick_checker(ti->format);

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder } else {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder pin = talloc_strndup(mem_ctx, pwd, len);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (pin == NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ENOMEM;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder talloc_set_destructor(pin, token_pin_destructor);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder /* If check is set, we need to verify the contents of the token. */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder for (i = 0; check != NULL && token[i] != '\0'; i++) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (!check(token[i])) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_free(token);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_free(pin);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return EBADMSG;

e07538a3c4dbc690e57f61aded6db89d876b2374Christian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder *out_token = token;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder *out_pin = pin;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return 0;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder}

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederstatic krb5_error_code tokeninfo_matches(TALLOC_CTX *mem_ctx,

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder const krb5_responder_otp_tokeninfo *ti,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder struct sss_auth_token *auth_tok,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder char **out_token, char **out_pin)

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder{

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder int ret;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder const char *pwd;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder size_t len;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder const char *fa2;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder size_t fa2_len;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder switch (sss_authtok_get_type(auth_tok)) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder case SSS_AUTHTOK_TYPE_PASSWORD:

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder ret = sss_authtok_get_password(auth_tok, &pwd, &len);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ret != EOK) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder DEBUG(SSSDBG_OP_FAILURE, "sss_authtok_get_password failed.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return ret;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return tokeninfo_matches_pwd(mem_ctx, ti, pwd, len, out_token, out_pin);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder break;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder case SSS_AUTHTOK_TYPE_2FA:

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder ret = sss_authtok_get_2fa(auth_tok, &pwd, &len, &fa2, &fa2_len);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ret != EOK) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_OP_FAILURE, "sss_authtok_get_2fa failed.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ret;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return tokeninfo_matches_2fa(mem_ctx, ti, pwd, len, fa2, fa2_len,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder out_token, out_pin);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder break;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers default:

e07538a3c4dbc690e57f61aded6db89d876b2374Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported authtok type.\n");

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return EINVAL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederstatic krb5_error_code answer_otp(krb5_context ctx,

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder struct krb5_req *kr,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_responder_context rctx)

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder{

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_responder_otp_challenge *chl;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder char *token = NULL, *pin = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_error_code ret;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder size_t i;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ret = krb5_responder_otp_get_challenge(ctx, rctx, &chl);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ret != EOK || chl == NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Either an error, or nothing to do. */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ret;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (chl->tokeninfo == NULL || chl->tokeninfo[0] == NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* No tokeninfos? Absurd! */

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder ret = EINVAL;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kr->otp = true;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kr->pd->cmd == SSS_PAM_PREAUTH) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder for (i = 0; chl->tokeninfo[i] != NULL; i++) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "[%zu] Vendor [%s].\n",

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder i, chl->tokeninfo[i]->vendor);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "[%zu] Token-ID [%s].\n",

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder i, chl->tokeninfo[i]->token_id);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_TRACE_ALL, "[%zu] Challenge [%s].\n",

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder i, chl->tokeninfo[i]->challenge);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_TRACE_ALL, "[%zu] Flags [%d].\n",

e07538a3c4dbc690e57f61aded6db89d876b2374Christian Maeder i, chl->tokeninfo[i]->flags);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (chl->tokeninfo[0]->vendor != NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kr->otp_vendor = talloc_strdup(kr, chl->tokeninfo[0]->vendor);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (chl->tokeninfo[0]->token_id != NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kr->otp_token_id = talloc_strdup(kr, chl->tokeninfo[0]->token_id);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (chl->tokeninfo[0]->challenge != NULL) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kr->otp_challenge = talloc_strdup(kr, chl->tokeninfo[0]->challenge);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Allocation errors are ignored on purpose */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_INTERNAL, "Exit answer_otp during pre-auth.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return EAGAIN;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder /* Find the first supported tokeninfo which matches our authtoken. */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder for (i = 0; chl->tokeninfo[i] != NULL; i++) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ret = tokeninfo_matches(kr, chl->tokeninfo[i], kr->pd->authtok,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder &token, &pin);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ret == EOK) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder break;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder switch (ret) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers case EBADMSG:

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers case EMSGSIZE:

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers case ENOTSUP:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder case EPROTO:

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder break;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder default:

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (chl->tokeninfo[i] == NULL) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "No tokeninfos found which match our credentials.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder ret = EOK;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (chl->tokeninfo[i]->flags & KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Don't let SSSD cache the OTP authtok since it is single-use. */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ret = pam_add_response(kr->pd, SSS_OTP, 0, NULL);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ret != EOK) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "pam_add_response failed.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder /* Respond with the appropriate answer. */

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder ret = krb5_responder_otp_set_answer(ctx, rctx, i, token, pin);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maederdone:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder talloc_free(token);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_free(pin);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_responder_otp_challenge_free(ctx, rctx, chl);

42c01284bba8d7c8d995c8dfb96ace57d28ed1bcTill Mossakowski return ret;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maederstatic krb5_error_code sss_krb5_responder(krb5_context ctx,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder void *data,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_responder_context rctx)

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder{

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder struct krb5_req *kr = talloc_get_type(data, struct krb5_req);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (kr == NULL) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return EINVAL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return answer_otp(ctx, kr, rctx);

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder}

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder#endif

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederstatic krb5_error_code sss_krb5_prompter(krb5_context context, void *data,

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder const char *name, const char *banner,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder int num_prompts, krb5_prompt prompts[])

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder{

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder int ret;

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder struct krb5_req *kr = talloc_get_type(data, struct krb5_req);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (num_prompts != 0) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder DEBUG(SSSDBG_CRIT_FAILURE, "Cannot handle password prompts.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return KRB5_LIBOS_CANTREADPWD;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (banner == NULL || *banner == '\0') {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_FUNC_DATA,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "Prompter called with empty banner, nothing to do.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return EOK;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder DEBUG(SSSDBG_FUNC_DATA, "Prompter called with [%s].\n", banner);

6c4ee04931dded62728f3a9954b2799beed536e9Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ret = pam_add_response(kr->pd, SSS_PAM_TEXT_MSG, strlen(banner)+1,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder (const uint8_t *) banner);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ret != EOK) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "pam_add_response failed.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return EOK;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder}

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckersstatic krb5_error_code create_empty_cred(krb5_context ctx, krb5_principal princ,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_creds **_cred)

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder{

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_error_code kerr;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_creds *cred = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_data *krb5_realm;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder cred = calloc(sizeof(krb5_creds), 1);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (cred == NULL) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_CRIT_FAILURE, "calloc failed.\n");

e07538a3c4dbc690e57f61aded6db89d876b2374Christian Maeder return ENOMEM;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = krb5_copy_principal(ctx, princ, &cred->client);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "krb5_copy_principal failed.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_realm = krb5_princ_realm(ctx, princ);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_build_principal_ext(ctx, &cred->server,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_realm->length, krb5_realm->data,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_realm->length, krb5_realm->data, 0);

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "krb5_build_principal_ext failed.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_INTERNAL, "Created empty krb5_creds.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederdone:

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr != 0) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_free_cred_contents(ctx, cred);

e07538a3c4dbc690e57f61aded6db89d876b2374Christian Maeder free(cred);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers } else {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder *_cred = cred;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return kerr;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maederstatic errno_t handle_randomized(char *in)

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder{

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder size_t ccname_len;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder char *ccname = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder int ret;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder /* We only treat the FILE type case in a special way due to the history

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (in[0] == '/') {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ccname = in;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder } else if (strncmp(in, "FILE:", 5) == 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ccname = in + 5;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder } else {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return EOK;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers ccname_len = strlen(ccname);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (ccname_len >= 6 && strcmp(ccname + (ccname_len - 6), "XXXXXX") == 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* NOTE: this call is only used to create a unique name, as later

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ret = sss_unique_filename(NULL, ccname);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (ret != EOK) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "mkstemp(\"%s\") failed [%d]: %s!\n",

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder ccname, ret, strerror(ret));

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return ret;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return EOK;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederstatic krb5_error_code create_ccache(char *ccname, krb5_creds *creds)

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder{

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_context kctx = NULL;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_ccache kcc = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder const char *type;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_error_code kerr;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder#ifdef HAVE_KRB5_CC_COLLECTION

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_ccache cckcc;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers bool switch_to_cc = false;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers#endif

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Set a restrictive umask, just in case we end up creating any file */

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder umask(077);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* we create a new context here as the main process one may have been

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = krb5_init_context(&kctx);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ERR_INTERNAL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = handle_randomized(ccname);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "handle_randomized failed: %d\n", kerr);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers kerr = krb5_cc_resolve(kctx, ccname, &kcc);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (kerr) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder type = krb5_cc_get_type(kctx, kcc);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "Initializing ccache of type [%s]\n", type);

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder#ifdef HAVE_KRB5_CC_COLLECTION

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (krb5_cc_support_switch(kctx, type)) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "CC supports switch\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_cc_set_default_name(kctx, ccname);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder DEBUG(SSSDBG_TRACE_ALL, "Cannot set default name!\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder kerr = krb5_cc_cache_match(kctx, creds->client, &cckcc);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr == KRB5_CC_NOTFOUND) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "Match not found\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_cc_new_unique(kctx, type, NULL, &cckcc);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder switch_to_cc = true;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_TRACE_ALL, "krb5_cc_cache_match failed\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers goto done;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_cc_close(kctx, kcc);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kcc = cckcc;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder#endif

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_cc_initialize(kctx, kcc, creds->client);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder DEBUG(SSSDBG_TRACE_ALL, "krb5_cc_initialize failed\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_cc_store_cred(kctx, kcc, creds);

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (kerr) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_TRACE_ALL, "krb5_cc_store_cred failed\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder#ifdef HAVE_KRB5_CC_COLLECTION

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (switch_to_cc) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_TRACE_ALL, "switch_to_cc\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_cc_switch(kctx, kcc);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_TRACE_ALL, "krb5_cc_switch\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers goto done;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder#endif

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "returning: %d\n", kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederdone:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kcc) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder /* FIXME: should we krb5_cc_destroy in case of error ? */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_cc_close(kctx, kcc);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return kerr;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers}

e07538a3c4dbc690e57f61aded6db89d876b2374Christian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckersstatic errno_t pack_response_packet(TALLOC_CTX *mem_ctx, errno_t error,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder struct response_data *resp_list,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder uint8_t **_buf, size_t *_len)

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder{

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder uint8_t *buf;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder size_t size = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder size_t p = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder struct response_data *pdr;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder /* A buffer with the following structure must be created:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder size = sizeof(int32_t);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder for (pdr = resp_list; pdr != NULL; pdr = pdr->next) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder size += 2*sizeof(int32_t) + pdr->len;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder buf = talloc_array(mem_ctx, uint8_t, size);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (!buf) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "Insufficient memory to create message.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ENOMEM;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder SAFEALIGN_SET_INT32(&buf[p], error, &p);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder for (pdr = resp_list; pdr != NULL; pdr = pdr->next) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder SAFEALIGN_SET_INT32(&buf[p], pdr->type, &p);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder SAFEALIGN_SET_INT32(&buf[p], pdr->len, &p);

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder safealign_memcpy(&buf[p], pdr->data, pdr->len, &p);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder }

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder DEBUG(SSSDBG_TRACE_INTERNAL, "response packet size: [%zu]\n", p);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder *_buf = buf;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder *_len = p;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder return EOK;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederstatic errno_t k5c_attach_otp_info_msg(struct krb5_req *kr)

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder{

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder uint8_t *msg = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder size_t msg_len;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder int ret;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder size_t vendor_len = 0;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder size_t token_id_len = 0;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder size_t challenge_len = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder size_t idx = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder msg_len = 3;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kr->otp_vendor != NULL) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder vendor_len = strlen(kr->otp_vendor);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder msg_len += vendor_len;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kr->otp_token_id != NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder token_id_len = strlen(kr->otp_token_id);

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder msg_len += token_id_len;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kr->otp_challenge != NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder challenge_len = strlen(kr->otp_challenge);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder msg_len += challenge_len;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder msg = talloc_zero_size(kr, msg_len);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (msg == NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_OP_FAILURE, "talloc_size failed.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ENOMEM;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kr->otp_vendor != NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder memcpy(msg, kr->otp_vendor, vendor_len);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder idx += vendor_len +1;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kr->otp_token_id != NULL) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder memcpy(msg + idx, kr->otp_token_id, token_id_len);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers idx += token_id_len +1;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kr->otp_challenge != NULL) {

42c01284bba8d7c8d995c8dfb96ace57d28ed1bcTill Mossakowski memcpy(msg + idx, kr->otp_challenge, challenge_len);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ret = pam_add_response(kr->pd, SSS_PAM_OTP_INFO, msg_len, msg);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_zfree(msg);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return ret;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers}

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckersstatic errno_t k5c_attach_ccname_msg(struct krb5_req *kr)

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers{

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder char *msg = NULL;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers int ret;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kr->ccname == NULL) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_CRIT_FAILURE, "Error obtaining ccname.\n");

fea14169cb07365fe4d12fea734d7b761ea8b287Christian Maeder return ERR_INTERNAL;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers msg = talloc_asprintf(kr, "%s=%s",CCACHE_ENV_NAME, kr->ccname);

ea8e98e298f33f9362293f392c8fb192722b8904Eugen Kuksa if (msg == NULL) {

ea8e98e298f33f9362293f392c8fb192722b8904Eugen Kuksa DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");

ea8e98e298f33f9362293f392c8fb192722b8904Eugen Kuksa return ENOMEM;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

ea8e98e298f33f9362293f392c8fb192722b8904Eugen Kuksa ret = pam_add_response(kr->pd, SSS_PAM_ENV_ITEM,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder strlen(msg) + 1, (uint8_t *)msg);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder talloc_zfree(msg);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

ea8e98e298f33f9362293f392c8fb192722b8904Eugen Kuksa return ret;

ea8e98e298f33f9362293f392c8fb192722b8904Eugen Kuksa}

ea8e98e298f33f9362293f392c8fb192722b8904Eugen Kuksa

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maederstatic errno_t k5c_send_data(struct krb5_req *kr, int fd, errno_t error)

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers{

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers ssize_t written;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers uint8_t *buf;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder size_t len;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder int ret;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_FUNC_DATA, "Received error code %d\n", error);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers ret = pack_response_packet(kr, error, kr->pd->resp_list, &buf, &len);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ret != EOK) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "pack_response_packet failed.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ret;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder errno = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder written = sss_atomic_write_s(fd, buf, len);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (written == -1) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ret = errno;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "write failed [%d][%s].\n", ret, strerror(ret));

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ret;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (written != len) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "Write error, wrote [%zu] bytes, expected [%zu]\n",

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder written, len);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return EOK;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "Response sent.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return EOK;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maederstatic errno_t add_ticket_times_and_upn_to_response(struct krb5_req *kr)

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder{

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder int ret;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder int64_t t[4];

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder krb5_error_code kerr;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder char *upn = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder unsigned int upn_len = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder t[0] = (int64_t) kr->creds->times.authtime;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder t[1] = (int64_t) kr->creds->times.starttime;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder t[2] = (int64_t) kr->creds->times.endtime;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder t[3] = (int64_t) kr->creds->times.renew_till;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder ret = pam_add_response(kr->pd, SSS_KRB5_INFO_TGT_LIFETIME,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers 4*sizeof(int64_t), (uint8_t *) t);

e07538a3c4dbc690e57f61aded6db89d876b2374Christian Maeder if (ret != EOK) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_CRIT_FAILURE, "pack_response_packet failed.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_unparse_name_ext(kr->ctx, kr->creds->client, &upn, &upn_len);

9bfdf40cbc2c61dd8281904a03ac598d51e0a872Christian Maeder if (kerr != 0) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_OP_FAILURE, "krb5_unparse_name failed.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder ret = pam_add_response(kr->pd, SSS_KRB5_INFO_UPN, upn_len,

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder (uint8_t *) upn);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_free_unparsed_name(kr->ctx, upn);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (ret != EOK) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "pack_response_packet failed.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maederdone:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ret;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederstatic krb5_error_code validate_tgt(struct krb5_req *kr)

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder{

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_error_code kerr;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_error_code kt_err;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder char *principal = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_keytab keytab;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_kt_cursor cursor;

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder krb5_keytab_entry entry;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_verify_init_creds_opt opt;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_principal validation_princ = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder bool realm_entry_found = false;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_ccache validation_ccache = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_authdata **pac_authdata = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder memset(&keytab, 0, sizeof(keytab));

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_kt_resolve(kr->ctx, kr->keytab, &keytab);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "error resolving keytab [%s], " \

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "not verifying TGT.\n", kr->keytab);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return kerr;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder memset(&cursor, 0, sizeof(cursor));

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = krb5_kt_start_seq_get(kr->ctx, keytab, &cursor);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "error reading keytab [%s], " \

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "not verifying TGT.\n", kr->keytab);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return kerr;

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* We look for the first entry from our realm or take the last one */

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder memset(&entry, 0, sizeof(entry));

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder while ((kt_err = krb5_kt_next_entry(kr->ctx, keytab, &entry, &cursor)) == 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (validation_princ != NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_free_principal(kr->ctx, validation_princ);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder validation_princ = NULL;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_copy_principal(kr->ctx, entry.principal,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder &validation_princ);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr != 0) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "krb5_copy_principal failed.\n");

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers goto done;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = sss_krb5_free_keytab_entry_contents(kr->ctx, &entry);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_MINOR_FAILURE, "Failed to free keytab entry.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder memset(&entry, 0, sizeof(entry));

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (krb5_realm_compare(kr->ctx, validation_princ, kr->creds->client)) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_INTERNAL,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "Found keytab entry with the realm of the credential.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder realm_entry_found = true;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder break;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (!realm_entry_found) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_TRACE_INTERNAL,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers "Keytab entry with the realm of the credential not found "

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers "in keytab. Using the last entry.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Close the keytab here. Even though we're using cursors, the file

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder kerr = krb5_kt_end_seq_get(kr->ctx, keytab, &cursor);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "krb5_kt_end_seq_get failed, " \

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "not verifying TGT.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder /* check if we got any errors from krb5_kt_next_entry */

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kt_err != 0 && kt_err != KRB5_KT_END) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_CRIT_FAILURE, "error reading keytab [%s], " \

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers "not verifying TGT.\n", kr->keytab);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Get the principal to which the key belongs, for logging purposes. */

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder principal = NULL;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_unparse_name(kr->ctx, validation_princ, &principal);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "internal error parsing principal name, "

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "not verifying TGT.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_verify_init_creds_opt_init(&opt);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = krb5_verify_init_creds(kr->ctx, kr->creds, validation_princ, keytab,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder &validation_ccache, &opt);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (kerr == 0) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_TRACE_FUNC, "TGT verified using key for [%s].\n",

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers principal);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder } else {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE ,"TGT failed verification using key " \

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "for [%s].\n", principal);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder goto done;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder /* Try to find and send the PAC to the PAC responder.

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kr->send_pac) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = sss_extract_pac(kr->ctx, validation_ccache, validation_princ,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kr->creds->client, keytab, &pac_authdata);

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_OP_FAILURE, "sss_extract_and_send_pac failed, group " \

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "membership for user with principal [%s] " \

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "might not be correct.\n", kr->name);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = sss_send_pac(pac_authdata);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_free_authdata(kr->ctx, pac_authdata);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (kerr != 0) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_OP_FAILURE, "sss_send_pac failed, group " \

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "membership for user with principal [%s] " \

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "might not be correct.\n", kr->name);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederdone:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (validation_ccache != NULL) {

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder krb5_cc_destroy(kr->ctx, validation_ccache);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (krb5_kt_close(kr->ctx, keytab) != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_MINOR_FAILURE, "krb5_kt_close failed\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (validation_princ != NULL) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_free_principal(kr->ctx, validation_princ);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (principal != NULL) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers sss_krb5_free_unparsed_name(kr->ctx, principal);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return kerr;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder}

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maederstatic krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_principal princ,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_keytab keytab,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder char *ccname)

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder{

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_error_code kerr = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_creds creds;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder krb5_get_init_creds_opt options;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder memset(&creds, 0, sizeof(creds));

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder memset(&options, 0, sizeof(options));

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_get_init_creds_opt_set_address_list(&options, NULL);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_get_init_creds_opt_set_forwardable(&options, 0);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_get_init_creds_opt_set_proxiable(&options, 0);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers set_canonicalize_option(&options);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers kerr = krb5_get_init_creds_keytab(ctx, &creds, princ, keytab, 0, NULL,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder &options);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return kerr;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Use the updated principal in the creds in case canonicalized */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = create_ccache(ccname, &creds);

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maederdone:

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers krb5_free_cred_contents(ctx, &creds);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return kerr;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder}

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederstatic krb5_error_code get_and_save_tgt(struct krb5_req *kr,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder const char *password)

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder{

97f7ac06b3cbf4fc22c0a9eef523b68ee34fc164Christian Maeder const char *realm_name;

97f7ac06b3cbf4fc22c0a9eef523b68ee34fc164Christian Maeder int realm_length;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder krb5_error_code kerr;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder char *cc_name;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = sss_krb5_get_init_creds_opt_set_expire_callback(kr->ctx, kr->options,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder sss_krb5_expire_callback_func,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "Failed to set expire callback, continue without.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder sss_krb5_princ_realm(kr->ctx, kr->princ, &realm_name, &realm_length);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (realm_length == 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "sss_krb5_princ_realm failed.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return KRB5KRB_ERR_GENERIC;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder DEBUG(SSSDBG_TRACE_FUNC,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "Attempting kinit for realm [%s]\n",realm_name);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = krb5_get_init_creds_password(kr->ctx, kr->creds, kr->princ,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder discard_const(password),

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder sss_krb5_prompter, kr, 0,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder NULL, kr->options);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kr->pd->cmd == SSS_PAM_PREAUTH) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder /* Any errors are ignored during pre-auth, only data is collected to

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_TRACE_FUNC,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "krb5_get_init_creds_password returned [%d} during pre-auth.\n",

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return 0;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder } else {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return kerr;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kr->validate) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = validate_tgt(kr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr != 0) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return kerr;

ea8e98e298f33f9362293f392c8fb192722b8904Eugen Kuksa }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder } else {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CONF_SETTINGS, "TGT validation is disabled.\n");

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder /* If kr->ccname is cache collection (DIR:/...), we want to work

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder cc_name = sss_get_ccache_name_for_principal(kr->pd, kr->ctx,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers kr->creds->client,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kr->ccname);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (cc_name == NULL) {

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder cc_name = kr->ccname;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers /* Use the updated principal in the creds in case canonicalized */

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = create_ccache(cc_name, kr->creds);

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr != 0) {

0e9494f7ac18b504a9dab7e9f001d8a94bd3baaaChristian Maeder goto done;

0e9494f7ac18b504a9dab7e9f001d8a94bd3baaaChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Successfull authentication! Check if ccache contains the

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = sss_krb5_check_ccache_princ(kr->ctx, kr->ccname, kr->creds->client);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder if (kerr) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE,

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "No ccache for %s in %s?\n", kr->upn, kr->ccname);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder goto done;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder kerr = safe_remove_old_ccache_file(kr->old_ccname, kr->ccname,

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers kr->uid, kr->gid);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers if (kerr != EOK) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers DEBUG(SSSDBG_MINOR_FAILURE,

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder "Failed to remove old ccache file [%s], "

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder "please remove it manually.\n", kr->old_ccname);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder }

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

9c84ea0239ba21e070e7d76d47d30713a3610327Christian Maeder kerr = add_ticket_times_and_upn_to_response(kr);

0e9494f7ac18b504a9dab7e9f001d8a94bd3baaaChristian Maeder if (kerr != 0) {

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE,

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder "add_ticket_times_and_upn_to_response failed.\n");

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder }

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder kerr = 0;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maederdone:

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder krb5_free_cred_contents(kr->ctx, kr->creds);

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return kerr;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder}

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maederstatic errno_t map_krb5_error(krb5_error_code kerr)

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder{

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder if (kerr != 0) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers }

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers switch (kerr) {

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers case 0:

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return ERR_OK;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder case KRB5_LIBOS_CANTREADPWD:

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return ERR_NO_CREDS;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder case KRB5_KDCREP_SKEW:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder case KRB5KRB_AP_ERR_SKEW:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder case KRB5_KDC_UNREACH:

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder case KRB5_REALM_CANT_RESOLVE:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ERR_NETWORK_IO;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder case KRB5KDC_ERR_CLIENT_REVOKED:

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return ERR_ACCOUNT_EXPIRED;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder case KRB5KDC_ERR_KEY_EXP:

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder return ERR_CREDS_EXPIRED;

94e112d16f89130a688db8b03ad3224903f5e97eChristian Maeder

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers case KRB5KRB_AP_ERR_BAD_INTEGRITY:

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers return ERR_AUTH_FAILED;

c1c5a93b6f5bf18be1f4a0a9da6c0e32ff00266cFelix Reckers

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* ERR_CREDS_INVALID is used to indicate to the IPA provider that trying

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder case KRB5_PROG_ETYPE_NOSUPP:

3d3889e0cefcdce9b3f43c53aaa201943ac2e895Jonathan von Schroeder case KRB5_PREAUTH_FAILED:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder case KRB5KDC_ERR_PREAUTH_FAILED:

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder return ERR_CREDS_INVALID;

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder

0cb5f9c8582ad87ceef1c16b5d92347ae0878019Christian Maeder /* Please do not remove KRB5KRB_ERR_GENERIC here, it is a _generic_ error