krb5_common.h revision 45aeb924ec3ac448bb8d174a5cc061ed98b147c7
50c04f297d76a57ead2fa6b73845f7563b1fc788sf/*
50c04f297d76a57ead2fa6b73845f7563b1fc788sf SSSD
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sf Kerberos Backend, common header file
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sf Authors:
50c04f297d76a57ead2fa6b73845f7563b1fc788sf Sumit Bose <sbose@redhat.com>
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sf Copyright (C) 2009 Red Hat
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen This program is free software; you can redistribute it and/or modify
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen it under the terms of the GNU General Public License as published by
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen the Free Software Foundation; either version 3 of the License, or
50c04f297d76a57ead2fa6b73845f7563b1fc788sf (at your option) any later version.
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sf This program is distributed in the hope that it will be useful,
af33a4994ae2ff15bc67d19ff1a7feb906745bf8rbowen but WITHOUT ANY WARRANTY; without even the implied warranty of
3f08db06526d6901aa08c110b5bc7dde6bc39905nd MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
50c04f297d76a57ead2fa6b73845f7563b1fc788sf GNU General Public License for more details.
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sf You should have received a copy of the GNU General Public License
3f08db06526d6901aa08c110b5bc7dde6bc39905nd along with this program. If not, see <http://www.gnu.org/licenses/>.
50c04f297d76a57ead2fa6b73845f7563b1fc788sf*/
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#ifndef __KRB5_COMMON_H__
053bfa8a288528fafab2b7a032c15116bb5de711nd#define __KRB5_COMMON_H__
053bfa8a288528fafab2b7a032c15116bb5de711nd
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#include "config.h"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#include <stdbool.h>
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#include "providers/dp_backend.h"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#include "util/util.h"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#include "util/sss_krb5.h"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
1538dfa9300693372892a358260e1dcdbf1138eapoirier#define SSSD_KRB5_KDC "SSSD_KRB5_KDC"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#define SSSD_KRB5_REALM "SSSD_KRB5_REALM"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#define SSSD_KRB5_RENEWABLE_LIFETIME "SSSD_KRB5_RENEWABLE_LIFETIME"
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalic#define SSSD_KRB5_LIFETIME "SSSD_KRB5_LIFETIME"
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalic#define SSSD_KRB5_USE_FAST "SSSD_KRB5_USE_FAST"
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalic#define SSSD_KRB5_FAST_PRINCIPAL "SSSD_KRB5_FAST_PRINCIPAL"
bed3c2e56e8f3328e780200466b9d009093db468sf#define SSSD_KRB5_CANONICALIZE "SSSD_KRB5_CANONICALIZE"
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalic
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalic#define KDCINFO_TMPL PUBCONF_PATH"/kdcinfo.%s"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#define KPASSWDINFO_TMPL PUBCONF_PATH"/kpasswdinfo.%s"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#define SSS_KRB5KDC_FO_SRV "KERBEROS"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf#define SSS_KRB5KPASSWD_FO_SRV "KPASSWD"
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sfenum krb5_opts {
30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh KRB5_KDC = 0,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_BACKUP_KDC,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_REALM,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_CCACHEDIR,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_CCNAME_TMPL,
bed3c2e56e8f3328e780200466b9d009093db468sf KRB5_AUTH_TIMEOUT,
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf KRB5_KEYTAB,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_VALIDATE,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_KPASSWD,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_BACKUP_KPASSWD,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_STORE_PASSWORD_IF_OFFLINE,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_RENEWABLE_LIFETIME,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_LIFETIME,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_RENEW_INTERVAL,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_USE_FAST,
bed3c2e56e8f3328e780200466b9d009093db468sf KRB5_FAST_PRINCIPAL,
bed3c2e56e8f3328e780200466b9d009093db468sf KRB5_CANONICALIZE,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_USE_ENTERPRISE_PRINCIPAL,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf KRB5_USE_KDCINFO,
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalic
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalic KRB5_OPTS
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalic};
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalictypedef enum { INIT_PW, INIT_KT, RENEW, VALIDATE } action_type;
f0fa55ff14fa0bf8fd72d989f6625de6dc3260c8igalic
50c04f297d76a57ead2fa6b73845f7563b1fc788sfstruct krb5_service {
bed3c2e56e8f3328e780200466b9d009093db468sf char *name;
bed3c2e56e8f3328e780200466b9d009093db468sf char *realm;
bed3c2e56e8f3328e780200466b9d009093db468sf bool write_kdcinfo;
bed3c2e56e8f3328e780200466b9d009093db468sf};
bed3c2e56e8f3328e780200466b9d009093db468sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sfstruct fo_service;
50c04f297d76a57ead2fa6b73845f7563b1fc788sfstruct deferred_auth_ctx;
50c04f297d76a57ead2fa6b73845f7563b1fc788sfstruct renew_tgt_ctx;
50c04f297d76a57ead2fa6b73845f7563b1fc788sf
50c04f297d76a57ead2fa6b73845f7563b1fc788sfenum krb5_config_type {
50c04f297d76a57ead2fa6b73845f7563b1fc788sf K5C_GENERIC,
50c04f297d76a57ead2fa6b73845f7563b1fc788sf K5C_IPA_CLIENT,
053bfa8a288528fafab2b7a032c15116bb5de711nd K5C_IPA_SERVER
053bfa8a288528fafab2b7a032c15116bb5de711nd};
727872d18412fc021f03969b8641810d8896820bhumbedooh
0d0ba3a410038e179b695446bb149cce6264e0abndstruct krb5_ctx {
727872d18412fc021f03969b8641810d8896820bhumbedooh /* opts taken from kinit */
cc7e1025de9ac63bd4db6fe7f71c158b2cf09fe4humbedooh /* in seconds */
0d0ba3a410038e179b695446bb149cce6264e0abnd krb5_deltat starttime;
cc7e1025de9ac63bd4db6fe7f71c158b2cf09fe4humbedooh krb5_deltat lifetime;
727872d18412fc021f03969b8641810d8896820bhumbedooh krb5_deltat rlife;
0d0ba3a410038e179b695446bb149cce6264e0abnd
0d0ba3a410038e179b695446bb149cce6264e0abnd int forwardable;
0d0ba3a410038e179b695446bb149cce6264e0abnd int proxiable;
ac082aefa89416cbdc9a1836eaf3bed9698201c8humbedooh int addresses;
0d0ba3a410038e179b695446bb149cce6264e0abnd
0d0ba3a410038e179b695446bb149cce6264e0abnd int not_forwardable;
0d0ba3a410038e179b695446bb149cce6264e0abnd int not_proxiable;
727872d18412fc021f03969b8641810d8896820bhumbedooh int no_addresses;
0d0ba3a410038e179b695446bb149cce6264e0abnd
0d0ba3a410038e179b695446bb149cce6264e0abnd int verbose;
30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh
1a1356f375e36db7bee379ea0684ab389579f798rbowen char* principal_name;
af33a4994ae2ff15bc67d19ff1a7feb906745bf8rbowen char* service_name;
0d0ba3a410038e179b695446bb149cce6264e0abnd char* keytab_name;
7fec19672a491661b2fe4b29f685bc7f4efa64d4nd char* k5_cache_name;
7fec19672a491661b2fe4b29f685bc7f4efa64d4nd char* k4_cache_name;
7fec19672a491661b2fe4b29f685bc7f4efa64d4nd
50c04f297d76a57ead2fa6b73845f7563b1fc788sf action_type action;
struct dp_option *opts;
struct krb5_service *service;
struct krb5_service *kpasswd_service;
int child_debug_fd;
pcre *illegal_path_re;
struct deferred_auth_ctx *deferred_auth_ctx;
struct renew_tgt_ctx *renew_tgt_ctx;
bool use_fast;
hash_table_t *wait_queue_hash;
enum krb5_config_type config_type;
};
struct remove_info_files_ctx {
char *realm;
struct be_ctx *be_ctx;
const char *kdc_service_name;
const char *kpasswd_service_name;
};
errno_t check_and_export_options(struct dp_option *opts,
struct sss_domain_info *dom,
struct krb5_ctx *krb5_ctx);
errno_t krb5_try_kdcip(struct confdb_ctx *cdb, const char *conf_path,
struct dp_option *opts, int opt_id);
errno_t krb5_get_options(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
const char *conf_path, struct dp_option **_opts);
errno_t write_krb5info_file(const char *realm, const char *kdc,
const char *service);
int krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
const char *service_name,
const char *primary_servers,
const char *backup_servers,
const char *realm,
bool use_kdcinfo,
struct krb5_service **_service);
void remove_krb5_info_files_callback(void *pvt);
void krb5_finalize(struct tevent_context *ev,
struct tevent_signal *se,
int signum,
int count,
void *siginfo,
void *private_data);
errno_t krb5_install_offline_callback(struct be_ctx *be_ctx,
struct krb5_ctx *krb_ctx);
errno_t krb5_install_sigterm_handler(struct tevent_context *ev,
struct krb5_ctx *krb5_ctx);
errno_t write_krb5info_file(const char *realm, const char *kdc,
const char *service);
errno_t remove_krb5_info_files(TALLOC_CTX *mem_ctx, const char *realm);
errno_t krb5_get_simple_upn(TALLOC_CTX *mem_ctx, struct krb5_ctx *krb5_ctx,
struct sss_domain_info *dom, const char *username,
const char *user_dom, char **_upn);
errno_t compare_principal_realm(const char *upn, const char *realm,
bool *different_realm);
int sssm_krb5_auth_init(struct be_ctx *bectx,
struct bet_ops **ops,
void **pvt_auth_data);
#endif /* __KRB5_COMMON_H__ */