s4:credentials Add the functions needed to do S4U2Self with cli_credentials

A torture test to demonstrate will be added soon.

Andrew Bartlett

6 files changed, 208 insertions, 50 deletions

diff --git a/source4/auth/credentials/credentials.c b/source4/auth/credentials/credentials.c
index 358ee1b85e..5f2658d5bd 100644
--- a/source4/auth/credentials/credentials.c
+++ b/source4/auth/credentials/credentials.c
@@ -63,6 +63,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
 	cred->realm = NULL;
 	cred->principal = NULL;
 	cred->salt_principal = NULL;
+	cred->impersonate_principal = NULL;
+	cred->target_service = NULL;
 
 	cred->bind_dn = NULL;
 
diff --git a/source4/auth/credentials/credentials.h b/source4/auth/credentials/credentials.h
index 33de8341c7..ab4ee2f217 100644
--- a/source4/auth/credentials/credentials.h
+++ b/source4/auth/credentials/credentials.h
@@ -77,6 +77,8 @@ struct cli_credentials {
 	const char *realm;
 	const char *principal;
 	char *salt_principal;
+	char *impersonate_principal;
+	char *target_service;
 
 	const char *bind_dn;
 
@@ -268,6 +270,11 @@ bool cli_credentials_parse_password_fd(struct cli_credentials *credentials,
 void cli_credentials_invalidate_ccache(struct cli_credentials *cred, 
 				       enum credentials_obtained obtained);
 void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal);
+void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal);
+void cli_credentials_set_target_service(struct cli_credentials *cred, const char *principal);
+const char *cli_credentials_get_salt_principal(struct cli_credentials *cred);
+const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred);
+const char *cli_credentials_get_target_service(struct cli_credentials *cred);
 enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds);
 NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred, 
 				     struct tevent_context *event_ctx,
diff --git a/source4/auth/credentials/credentials_krb5.c b/source4/auth/credentials/credentials_krb5.c
index d8ce0e58e2..1e0db3cb36 100644
--- a/source4/auth/credentials/credentials_krb5.c
+++ b/source4/auth/credentials/credentials_krb5.c
@@ -802,4 +802,42 @@ _PUBLIC_ void cli_credentials_set_salt_principal(struct cli_credentials *cred, c
 	cred->salt_principal = talloc_strdup(cred, principal);
 }
 
+/* The 'impersonate_principal' is used to allow on Kerberos principal
+ * (and it's associated keytab etc) to impersonate another.  The
+ * ability to do this is controlled by the KDC, but it is generally
+ * permitted to impersonate anyone to yourself.  This allows any
+ * member of the domain to get the groups of a user.  This is also
+ * known as S4U2Self */
+
+const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred)
+{
+	return cred->impersonate_principal;
+}
+
+_PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal)
+{
+	talloc_free(cred->impersonate_principal);
+	cred->impersonate_principal = talloc_strdup(cred, principal);
+}
+
+/* when impersonating for S4U2Self we need to set the target principal
+ * to ourself, as otherwise we would need additional rights.
+ * Similarly, we may only be authorized to do general impersonation to
+ * some particular services.
+ *
+ * Likewise, password changes typically require a ticket to kpasswd/realm directly, not via a TGT
+ *
+ * NULL means that tickets will be obtained for the krbtgt service.
+*/
+
+const char *cli_credentials_get_target_service(struct cli_credentials *cred)
+{
+	return cred->target_service;
+}
+
+_PUBLIC_ void cli_credentials_set_target_service(struct cli_credentials *cred, const char *target_service)
+{
+	talloc_free(cred->target_service);
+	cred->target_service = talloc_strdup(cred, target_service);
+}
 
diff --git a/source4/auth/kerberos/kerberos.c b/source4/auth/kerberos/kerberos.c
index d4549ee88a..42757640f2 100644
--- a/source4/auth/kerberos/kerberos.c
+++ b/source4/auth/kerberos/kerberos.c
@@ -33,10 +33,15 @@
  
   This version is built to use a keyblock, rather than needing the
   original password.
+
+  The impersonate_principal is the principal if NULL, or the principal to impersonate
+
+  The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self)
 */
  krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, 
-				krb5_principal principal, krb5_keyblock *keyblock,
-				time_t *expire_time, time_t *kdc_time)
+					    krb5_principal principal, krb5_keyblock *keyblock,
+					    const char *target_service,
+					    time_t *expire_time, time_t *kdc_time)
 {
 	krb5_error_code code = 0;
 	krb5_creds my_creds;
@@ -49,7 +54,7 @@
 	krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options);
 
 	if ((code = krb5_get_init_creds_keyblock(ctx, &my_creds, principal, keyblock,
-						 0, NULL, options))) {
+						 0, target_service, options))) {
 		return code;
 	}
 	
@@ -82,36 +87,49 @@
 /*
   simulate a kinit, putting the tgt in the given credentials cache. 
   Orignally by remus@snapserver.com
+
+  The impersonate_principal is the principal if NULL, or the principal to impersonate
+
+  The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self)
+
 */
  krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc, 
 					    krb5_principal principal, const char *password,
+					    krb5_principal impersonate_principal, const char *target_service,
 					    time_t *expire_time, time_t *kdc_time)
 {
 	krb5_error_code code = 0;
 	krb5_creds my_creds;
-	krb5_get_init_creds_opt *options;
+	krb5_creds *impersonate_creds;
+	krb5_get_init_creds_opt *init_options;
+	krb5_get_creds_opt options;
 
-	if ((code = krb5_get_init_creds_opt_alloc(ctx, &options))) {
+	if ((code = krb5_get_init_creds_opt_alloc(ctx, &init_options))) {
 		return code;
 	}
 
-	krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options);
+	krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, init_options);
 
+	/* If we are not impersonating, then get this ticket for the
+	 * target service, otherwise a krbtgt, and get the next ticket
+	 * for the target */
 	if ((code = krb5_get_init_creds_password(ctx, &my_creds, principal, password, 
-						 NULL, 
-						 NULL, 0, NULL, options))) {
-		krb5_get_init_creds_opt_free(ctx, options);
+						 NULL, NULL,
+						 0,
+						 impersonate_principal ? NULL : target_service,
+						 init_options))) {
+		krb5_get_init_creds_opt_free(ctx, init_options);
 		return code;
 	}
-	
+
 	if ((code = krb5_cc_initialize(ctx, cc, principal))) {
-		krb5_get_init_creds_opt_free(ctx, options);
+		krb5_get_init_creds_opt_free(ctx, init_options);
 		krb5_free_cred_contents(ctx, &my_creds);
 		return code;
 	}
 	
 	if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
-		krb5_get_init_creds_opt_free(ctx, options);
+		krb5_get_init_creds_opt_free(ctx, init_options);
 		krb5_free_cred_contents(ctx, &my_creds);
 		return code;
 	}
@@ -124,9 +142,44 @@
 		*kdc_time = (time_t) my_creds.times.starttime;
 	}
 
-	krb5_get_init_creds_opt_free(ctx, options);
+	krb5_get_init_creds_opt_free(ctx, init_options);
 	krb5_free_cred_contents(ctx, &my_creds);
 	
+	if (code == 0 && impersonate_principal) {
+		krb5_principal target_princ;
+		if ((code = krb5_get_creds_opt_alloc(ctx, &options))) {
+			return code;
+		}
+
+		if ((code = krb5_get_creds_opt_set_impersonate(ctx, options, impersonate_principal))) {
+			krb5_get_creds_opt_free(ctx, options);
+			return code;
+		}
+
+		if ((code = krb5_parse_name(ctx, target_service, &target_princ))) {
+			krb5_get_creds_opt_free(ctx, options);
+			return code;
+		}
+
+		if ((code = krb5_principal_set_realm(ctx, target_princ, krb5_principal_get_realm(ctx, principal)))) {
+			krb5_get_creds_opt_free(ctx, options);
+			krb5_free_principal(ctx, target_princ);
+			return code;
+		}
+
+		if ((code = krb5_get_creds(ctx, options, cc, target_princ, &impersonate_creds))) {
+			krb5_free_principal(ctx, target_princ);
+			krb5_get_creds_opt_free(ctx, options);
+			return code;
+		}
+
+		krb5_free_principal(ctx, target_princ);
+
+		code = krb5_cc_store_cred(ctx, cc, impersonate_creds);
+		krb5_get_creds_opt_free(ctx, options);
+		krb5_free_creds(ctx, impersonate_creds);
+	}
+
 	return 0;
 }
 
diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
index 498da0f9c2..992b509dbf 100644
--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
@@ -88,11 +88,13 @@ krb5_error_code ads_krb5_mk_req(krb5_context context,
 				krb5_ccache ccache, 
 				krb5_data *outbuf);
 bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
-int kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc, 
-			       krb5_principal principal, const char *password, 
-			       time_t *expire_time, time_t *kdc_time);
-int kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, 
+krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
+					   krb5_principal principal, const char *password,
+					   krb5_principal impersonate_principal, const char *target_service,
+					   time_t *expire_time, time_t *kdc_time);
+krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
 			       krb5_principal principal, krb5_keyblock *keyblock,
+			       const char *target_service,
 			       time_t *expire_time, time_t *kdc_time);
 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
 							krb5_principal host_princ,
@@ -107,6 +109,11 @@ char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TAL
 				 struct smb_krb5_context *smb_krb5_context,
 				 krb5_ccache ccache,
 				 const char **error_string);
+krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
+						       struct cli_credentials *credentials,
+						       struct smb_krb5_context *smb_krb5_context,
+						       krb5_principal *princ,
+						       const char **error_string);
 krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx, 
 					   struct cli_credentials *credentials, 
 					   struct smb_krb5_context *smb_krb5_context,
diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
index 494f36dec7..44d97b7f08 100644
--- a/source4/auth/kerberos/kerberos_util.c
+++ b/source4/auth/kerberos/kerberos_util.c
@@ -40,6 +40,42 @@ static krb5_error_code free_principal(struct principal_container *pc)
 	return 0;
 }
 
+
+static krb5_error_code parse_principal(TALLOC_CTX *parent_ctx,
+				       const char *princ_string,
+				       struct smb_krb5_context *smb_krb5_context,
+				       krb5_principal *princ,
+				       const char **error_string)
+{
+	int ret;
+	struct principal_container *mem_ctx;
+	if (princ_string == NULL) {
+		 *princ = NULL;
+		 return 0;
+	}
+
+	ret = krb5_parse_name(smb_krb5_context->krb5_context,
+			      princ_string, princ);
+
+	if (ret) {
+		(*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
+		return ret;
+	}
+
+	mem_ctx = talloc(parent_ctx, struct principal_container);
+	if (!mem_ctx) {
+		(*error_string) = error_message(ENOMEM);
+		return ENOMEM;
+	}
+
+	/* This song-and-dance effectivly puts the principal
+	 * into talloc, so we can't loose it. */
+	mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+	mem_ctx->principal = *princ;
+	talloc_set_destructor(mem_ctx, free_principal);
+	return 0;
+}
+
 static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, 
 						       struct cli_credentials *machine_account, 
 						       struct smb_krb5_context *smb_krb5_context,
@@ -50,6 +86,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
 	char *salt_body;
 	char *lower_realm;
 	const char *salt_principal;
+	const char *error_string;
 	struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
 	if (!mem_ctx) {
 		return ENOMEM;
@@ -57,7 +94,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
 
 	salt_principal = cli_credentials_get_salt_principal(machine_account);
 	if (salt_principal) {
-		ret = krb5_parse_name(smb_krb5_context->krb5_context, salt_principal, salt_princ); 
+		ret = parse_principal(parent_ctx, salt_principal, smb_krb5_context, salt_princ, &error_string);
 	} else {
 		machine_username = talloc_strdup(mem_ctx, cli_credentials_get_username(machine_account));
 		
@@ -85,15 +122,15 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
 		ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ, 
 					  cli_credentials_get_realm(machine_account), 
 					  "host", salt_body, NULL);
+		if (ret == 0) {
+			/* This song-and-dance effectivly puts the principal
+			 * into talloc, so we can't loose it. */
+			mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+			mem_ctx->principal = *salt_princ;
+			talloc_set_destructor(mem_ctx, free_principal);
+		}
 	} 
 
-	if (ret == 0) {
-		/* This song-and-dance effectivly puts the principal
-		 * into talloc, so we can't loose it. */
-		mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
-		mem_ctx->principal = *salt_princ;
-		talloc_set_destructor(mem_ctx, free_principal);
-	}
 	return ret;
 }
 
@@ -110,36 +147,36 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
 {
 	krb5_error_code ret;
 	const char *princ_string;
-	struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
+	TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 	if (!mem_ctx) {
 		(*error_string) = error_message(ENOMEM);
 		return ENOMEM;
 	}
-	
 	princ_string = cli_credentials_get_principal(credentials, mem_ctx);
-
-	/* A NULL here has meaning, as the gssapi server case will
-	 * then use the principal from the client */
 	if (!princ_string) {
-		talloc_free(mem_ctx);
-		princ = NULL;
-		return 0;
+		(*error_string) = error_message(ENOMEM);
+		return ENOMEM;
 	}
 
-	ret = krb5_parse_name(smb_krb5_context->krb5_context,
-			      princ_string, princ);
+	ret = parse_principal(parent_ctx, princ_string,
+			      smb_krb5_context, princ, error_string);
+	talloc_free(mem_ctx);
+	return ret;
+}
 
-	if (ret) {
-		(*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
-		return ret;
-	}
+/* Obtain the principal set on this context.  Requires a
+ * smb_krb5_context because we are doing krb5 principal parsing with
+ * the library routines.  The returned princ is placed in the talloc
+ * system by means of a destructor (do *not* free). */
 
-	/* This song-and-dance effectivly puts the principal
-	 * into talloc, so we can't loose it. */
-	mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
-	mem_ctx->principal = *princ;
-	talloc_set_destructor(mem_ctx, free_principal);
-	return 0;
+ krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
+							struct cli_credentials *credentials,
+							struct smb_krb5_context *smb_krb5_context,
+							krb5_principal *princ,
+							const char **error_string)
+{
+	return parse_principal(parent_ctx, cli_credentials_get_impersonate_principal(credentials),
+			       smb_krb5_context, princ, error_string);
 }
 
 /**
@@ -154,9 +191,10 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
 				 const char **error_string)
 {
 	krb5_error_code ret;
-	const char *password;
+	const char *password, *target_service;
 	time_t kdc_time = 0;
 	krb5_principal princ;
+	krb5_principal impersonate_principal;
 	int tries;
 	TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 
@@ -171,14 +209,26 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
 		return ret;
 	}
 
+	ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string);
+	if (ret) {
+		talloc_free(mem_ctx);
+		return ret;
+	}
+
+	target_service = cli_credentials_get_target_service(credentials);
+
 	password = cli_credentials_get_password(credentials);
 
 	tries = 2;
 	while (tries--) {
 		if (password) {
 			ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, ccache, 
-							 princ, 
-							 password, NULL, &kdc_time);
+							 princ, password,
+							 impersonate_principal, target_service,
+							 NULL, &kdc_time);
+		} else if (impersonate_principal) {
+			(*error_string) = "INTERNAL error: Cannot impersonate principal with just a keyblock.  A password must be specified in the credentials";
+			return EINVAL;
 		} else {
 			/* No password available, try to use a keyblock instead */
 			
@@ -197,8 +247,9 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
 			
 			if (ret == 0) {
 				ret = kerberos_kinit_keyblock_cc(smb_krb5_context->krb5_context, ccache, 
-								 princ,
-								 &keyblock, NULL, &kdc_time);
+								 princ, &keyblock,
+								 target_service,
+								 NULL, &kdc_time);
 				krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &keyblock);
 			}
 		}