summaryrefslogtreecommitdiff
path: root/source4/libcli/auth/kerberos_verify.c
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2004-07-11 10:16:36 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 12:56:56 -0500
commitb0d61c8b42dff8cafa502c279acad5db43c0dea8 (patch)
treec6fe2c613024c12194e155341b214a513b5648db /source4/libcli/auth/kerberos_verify.c
parent74508c718bf726b549469077248b6c0f7d4099a4 (diff)
downloadsamba-b0d61c8b42dff8cafa502c279acad5db43c0dea8.tar.gz
samba-b0d61c8b42dff8cafa502c279acad5db43c0dea8.tar.bz2
samba-b0d61c8b42dff8cafa502c279acad5db43c0dea8.zip
r1437: Intermediate commit of krb5 for GENSEC.
The session key in the client is wrong, we don't do signing/sealing and we are sending raw Kerberos, not GSSAPI. But it's a start, and if we continue to have to call Krb5 directly, this will be the basis. I also intend to provide an alternate implementation, using just GSSAPI. Andrew Bartlett (This used to be commit eb0dd4a821dc3dbe370aea9a9c9fb05cf2592e4d)
Diffstat (limited to 'source4/libcli/auth/kerberos_verify.c')
-rw-r--r--source4/libcli/auth/kerberos_verify.c49
1 files changed, 9 insertions, 40 deletions
diff --git a/source4/libcli/auth/kerberos_verify.c b/source4/libcli/auth/kerberos_verify.c
index e93d3aa6e8..d24244e0d9 100644
--- a/source4/libcli/auth/kerberos_verify.c
+++ b/source4/libcli/auth/kerberos_verify.c
@@ -202,14 +202,14 @@ static BOOL ads_secrets_verify_ticket(krb5_context context, krb5_auth_context au
authorization_data if available.
***********************************************************************************/
-NTSTATUS ads_verify_ticket(const char *realm, const DATA_BLOB *ticket,
+NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
+ krb5_context context,
+ krb5_auth_context auth_context,
+ const char *realm, const DATA_BLOB *ticket,
char **principal, DATA_BLOB *auth_data,
- DATA_BLOB *ap_rep,
- DATA_BLOB *session_key)
+ DATA_BLOB *ap_rep)
{
NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
- krb5_context context = NULL;
- krb5_auth_context auth_context = NULL;
krb5_data packet;
krb5_ticket *tkt = NULL;
krb5_rcache rcache = NULL;
@@ -219,38 +219,18 @@ NTSTATUS ads_verify_ticket(const char *realm, const DATA_BLOB *ticket,
char *host_princ_s = NULL;
BOOL got_replay_mutex = False;
- fstring myname;
+ char *myname;
BOOL auth_ok = False;
ZERO_STRUCT(packet);
ZERO_STRUCTP(auth_data);
ZERO_STRUCTP(ap_rep);
- ZERO_STRUCTP(session_key);
-
- initialize_krb5_error_table();
- ret = krb5_init_context(&context);
- if (ret) {
- DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret)));
- return NT_STATUS_LOGON_FAILURE;
- }
-
- ret = krb5_set_default_realm(context, realm);
- if (ret) {
- DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret)));
- goto out;
- }
/* This whole process is far more complex than I would
like. We have to go through all this to allow us to store
the secret internally, instead of using /etc/krb5.keytab */
- ret = krb5_auth_con_init(context, &auth_context);
- if (ret) {
- DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret)));
- goto out;
- }
-
- name_to_fqdn(myname, global_myname());
+ myname = name_to_fqdn(mem_ctx, global_myname());
strlower_m(myname);
asprintf(&host_princ_s, "host/%s@%s", myname, lp_realm());
ret = krb5_parse_name(context, host_princ_s, &host_princ);
@@ -309,18 +289,15 @@ NTSTATUS ads_verify_ticket(const char *realm, const DATA_BLOB *ticket,
goto out;
}
- *ap_rep = data_blob(packet.data, packet.length);
+ *ap_rep = data_blob_talloc(mem_ctx, packet.data, packet.length);
SAFE_FREE(packet.data);
packet.length = 0;
- get_krb5_smb_session_key(context, auth_context, session_key, True);
- dump_data_pw("SMB session key (from ticket)\n", session_key->data, session_key->length);
-
#if 0
file_save("/tmp/ticket.dat", ticket->data, ticket->length);
#endif
- get_auth_data_from_tkt(auth_data, tkt);
+ get_auth_data_from_tkt(mem_ctx, auth_data, tkt);
#if 0
if (tkt->enc_part2) {
@@ -364,14 +341,6 @@ NTSTATUS ads_verify_ticket(const char *realm, const DATA_BLOB *ticket,
SAFE_FREE(host_princ_s);
- if (auth_context) {
- krb5_auth_con_free(context, auth_context);
- }
-
- if (context) {
- krb5_free_context(context);
- }
-
return sret;
}