summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--source4/auth/credentials/credentials.c2
-rw-r--r--source4/auth/credentials/credentials.h7
-rw-r--r--source4/auth/credentials/credentials_krb5.c38
-rw-r--r--source4/auth/kerberos/kerberos.c79
-rw-r--r--source4/auth/kerberos/kerberos.h15
-rw-r--r--source4/auth/kerberos/kerberos_util.c117
6 files changed, 208 insertions, 50 deletions
diff --git a/source4/auth/credentials/credentials.c b/source4/auth/credentials/credentials.c
index 358ee1b85e..5f2658d5bd 100644
--- a/source4/auth/credentials/credentials.c
+++ b/source4/auth/credentials/credentials.c
@@ -63,6 +63,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
cred->realm = NULL;
cred->principal = NULL;
cred->salt_principal = NULL;
+ cred->impersonate_principal = NULL;
+ cred->target_service = NULL;
cred->bind_dn = NULL;
diff --git a/source4/auth/credentials/credentials.h b/source4/auth/credentials/credentials.h
index 33de8341c7..ab4ee2f217 100644
--- a/source4/auth/credentials/credentials.h
+++ b/source4/auth/credentials/credentials.h
@@ -77,6 +77,8 @@ struct cli_credentials {
const char *realm;
const char *principal;
char *salt_principal;
+ char *impersonate_principal;
+ char *target_service;
const char *bind_dn;
@@ -268,6 +270,11 @@ bool cli_credentials_parse_password_fd(struct cli_credentials *credentials,
void cli_credentials_invalidate_ccache(struct cli_credentials *cred,
enum credentials_obtained obtained);
void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal);
+void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal);
+void cli_credentials_set_target_service(struct cli_credentials *cred, const char *principal);
+const char *cli_credentials_get_salt_principal(struct cli_credentials *cred);
+const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred);
+const char *cli_credentials_get_target_service(struct cli_credentials *cred);
enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds);
NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred,
struct tevent_context *event_ctx,
diff --git a/source4/auth/credentials/credentials_krb5.c b/source4/auth/credentials/credentials_krb5.c
index d8ce0e58e2..1e0db3cb36 100644
--- a/source4/auth/credentials/credentials_krb5.c
+++ b/source4/auth/credentials/credentials_krb5.c
@@ -802,4 +802,42 @@ _PUBLIC_ void cli_credentials_set_salt_principal(struct cli_credentials *cred, c
cred->salt_principal = talloc_strdup(cred, principal);
}
+/* The 'impersonate_principal' is used to allow on Kerberos principal
+ * (and it's associated keytab etc) to impersonate another. The
+ * ability to do this is controlled by the KDC, but it is generally
+ * permitted to impersonate anyone to yourself. This allows any
+ * member of the domain to get the groups of a user. This is also
+ * known as S4U2Self */
+
+const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred)
+{
+ return cred->impersonate_principal;
+}
+
+_PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal)
+{
+ talloc_free(cred->impersonate_principal);
+ cred->impersonate_principal = talloc_strdup(cred, principal);
+}
+
+/* when impersonating for S4U2Self we need to set the target principal
+ * to ourself, as otherwise we would need additional rights.
+ * Similarly, we may only be authorized to do general impersonation to
+ * some particular services.
+ *
+ * Likewise, password changes typically require a ticket to kpasswd/realm directly, not via a TGT
+ *
+ * NULL means that tickets will be obtained for the krbtgt service.
+*/
+
+const char *cli_credentials_get_target_service(struct cli_credentials *cred)
+{
+ return cred->target_service;
+}
+
+_PUBLIC_ void cli_credentials_set_target_service(struct cli_credentials *cred, const char *target_service)
+{
+ talloc_free(cred->target_service);
+ cred->target_service = talloc_strdup(cred, target_service);
+}
diff --git a/source4/auth/kerberos/kerberos.c b/source4/auth/kerberos/kerberos.c
index d4549ee88a..42757640f2 100644
--- a/source4/auth/kerberos/kerberos.c
+++ b/source4/auth/kerberos/kerberos.c
@@ -33,10 +33,15 @@
This version is built to use a keyblock, rather than needing the
original password.
+
+ The impersonate_principal is the principal if NULL, or the principal to impersonate
+
+ The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self)
*/
krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
- krb5_principal principal, krb5_keyblock *keyblock,
- time_t *expire_time, time_t *kdc_time)
+ krb5_principal principal, krb5_keyblock *keyblock,
+ const char *target_service,
+ time_t *expire_time, time_t *kdc_time)
{
krb5_error_code code = 0;
krb5_creds my_creds;
@@ -49,7 +54,7 @@
krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options);
if ((code = krb5_get_init_creds_keyblock(ctx, &my_creds, principal, keyblock,
- 0, NULL, options))) {
+ 0, target_service, options))) {
return code;
}
@@ -82,36 +87,49 @@
/*
simulate a kinit, putting the tgt in the given credentials cache.
Orignally by remus@snapserver.com
+
+ The impersonate_principal is the principal if NULL, or the principal to impersonate
+
+ The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self)
+
*/
krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
krb5_principal principal, const char *password,
+ krb5_principal impersonate_principal, const char *target_service,
time_t *expire_time, time_t *kdc_time)
{
krb5_error_code code = 0;
krb5_creds my_creds;
- krb5_get_init_creds_opt *options;
+ krb5_creds *impersonate_creds;
+ krb5_get_init_creds_opt *init_options;
+ krb5_get_creds_opt options;
- if ((code = krb5_get_init_creds_opt_alloc(ctx, &options))) {
+ if ((code = krb5_get_init_creds_opt_alloc(ctx, &init_options))) {
return code;
}
- krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options);
+ krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, init_options);
+ /* If we are not impersonating, then get this ticket for the
+ * target service, otherwise a krbtgt, and get the next ticket
+ * for the target */
if ((code = krb5_get_init_creds_password(ctx, &my_creds, principal, password,
- NULL,
- NULL, 0, NULL, options))) {
- krb5_get_init_creds_opt_free(ctx, options);
+ NULL, NULL,
+ 0,
+ impersonate_principal ? NULL : target_service,
+ init_options))) {
+ krb5_get_init_creds_opt_free(ctx, init_options);
return code;
}
-
+
if ((code = krb5_cc_initialize(ctx, cc, principal))) {
- krb5_get_init_creds_opt_free(ctx, options);
+ krb5_get_init_creds_opt_free(ctx, init_options);
krb5_free_cred_contents(ctx, &my_creds);
return code;
}
if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
- krb5_get_init_creds_opt_free(ctx, options);
+ krb5_get_init_creds_opt_free(ctx, init_options);
krb5_free_cred_contents(ctx, &my_creds);
return code;
}
@@ -124,9 +142,44 @@
*kdc_time = (time_t) my_creds.times.starttime;
}
- krb5_get_init_creds_opt_free(ctx, options);
+ krb5_get_init_creds_opt_free(ctx, init_options);
krb5_free_cred_contents(ctx, &my_creds);
+ if (code == 0 && impersonate_principal) {
+ krb5_principal target_princ;
+ if ((code = krb5_get_creds_opt_alloc(ctx, &options))) {
+ return code;
+ }
+
+ if ((code = krb5_get_creds_opt_set_impersonate(ctx, options, impersonate_principal))) {
+ krb5_get_creds_opt_free(ctx, options);
+ return code;
+ }
+
+ if ((code = krb5_parse_name(ctx, target_service, &target_princ))) {
+ krb5_get_creds_opt_free(ctx, options);
+ return code;
+ }
+
+ if ((code = krb5_principal_set_realm(ctx, target_princ, krb5_principal_get_realm(ctx, principal)))) {
+ krb5_get_creds_opt_free(ctx, options);
+ krb5_free_principal(ctx, target_princ);
+ return code;
+ }
+
+ if ((code = krb5_get_creds(ctx, options, cc, target_princ, &impersonate_creds))) {
+ krb5_free_principal(ctx, target_princ);
+ krb5_get_creds_opt_free(ctx, options);
+ return code;
+ }
+
+ krb5_free_principal(ctx, target_princ);
+
+ code = krb5_cc_store_cred(ctx, cc, impersonate_creds);
+ krb5_get_creds_opt_free(ctx, options);
+ krb5_free_creds(ctx, impersonate_creds);
+ }
+
return 0;
}
diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
index 498da0f9c2..992b509dbf 100644
--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
@@ -88,11 +88,13 @@ krb5_error_code ads_krb5_mk_req(krb5_context context,
krb5_ccache ccache,
krb5_data *outbuf);
bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
-int kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
- krb5_principal principal, const char *password,
- time_t *expire_time, time_t *kdc_time);
-int kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
+krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
+ krb5_principal principal, const char *password,
+ krb5_principal impersonate_principal, const char *target_service,
+ time_t *expire_time, time_t *kdc_time);
+krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
krb5_principal principal, krb5_keyblock *keyblock,
+ const char *target_service,
time_t *expire_time, time_t *kdc_time);
krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
krb5_principal host_princ,
@@ -107,6 +109,11 @@ char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TAL
struct smb_krb5_context *smb_krb5_context,
krb5_ccache ccache,
const char **error_string);
+krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
+ struct cli_credentials *credentials,
+ struct smb_krb5_context *smb_krb5_context,
+ krb5_principal *princ,
+ const char **error_string);
krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
struct cli_credentials *credentials,
struct smb_krb5_context *smb_krb5_context,
diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
index 494f36dec7..44d97b7f08 100644
--- a/source4/auth/kerberos/kerberos_util.c
+++ b/source4/auth/kerberos/kerberos_util.c
@@ -40,6 +40,42 @@ static krb5_error_code free_principal(struct principal_container *pc)
return 0;
}
+
+static krb5_error_code parse_principal(TALLOC_CTX *parent_ctx,
+ const char *princ_string,
+ struct smb_krb5_context *smb_krb5_context,
+ krb5_principal *princ,
+ const char **error_string)
+{
+ int ret;
+ struct principal_container *mem_ctx;
+ if (princ_string == NULL) {
+ *princ = NULL;
+ return 0;
+ }
+
+ ret = krb5_parse_name(smb_krb5_context->krb5_context,
+ princ_string, princ);
+
+ if (ret) {
+ (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
+ return ret;
+ }
+
+ mem_ctx = talloc(parent_ctx, struct principal_container);
+ if (!mem_ctx) {
+ (*error_string) = error_message(ENOMEM);
+ return ENOMEM;
+ }
+
+ /* This song-and-dance effectivly puts the principal
+ * into talloc, so we can't loose it. */
+ mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+ mem_ctx->principal = *princ;
+ talloc_set_destructor(mem_ctx, free_principal);
+ return 0;
+}
+
static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
struct cli_credentials *machine_account,
struct smb_krb5_context *smb_krb5_context,
@@ -50,6 +86,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
char *salt_body;
char *lower_realm;
const char *salt_principal;
+ const char *error_string;
struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
if (!mem_ctx) {
return ENOMEM;
@@ -57,7 +94,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
salt_principal = cli_credentials_get_salt_principal(machine_account);
if (salt_principal) {
- ret = krb5_parse_name(smb_krb5_context->krb5_context, salt_principal, salt_princ);
+ ret = parse_principal(parent_ctx, salt_principal, smb_krb5_context, salt_princ, &error_string);
} else {
machine_username = talloc_strdup(mem_ctx, cli_credentials_get_username(machine_account));
@@ -85,15 +122,15 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ,
cli_credentials_get_realm(machine_account),
"host", salt_body, NULL);
+ if (ret == 0) {
+ /* This song-and-dance effectivly puts the principal
+ * into talloc, so we can't loose it. */
+ mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+ mem_ctx->principal = *salt_princ;
+ talloc_set_destructor(mem_ctx, free_principal);
+ }
}
- if (ret == 0) {
- /* This song-and-dance effectivly puts the principal
- * into talloc, so we can't loose it. */
- mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
- mem_ctx->principal = *salt_princ;
- talloc_set_destructor(mem_ctx, free_principal);
- }
return ret;
}
@@ -110,36 +147,36 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
{
krb5_error_code ret;
const char *princ_string;
- struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
+ TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
if (!mem_ctx) {
(*error_string) = error_message(ENOMEM);
return ENOMEM;
}
-
princ_string = cli_credentials_get_principal(credentials, mem_ctx);
-
- /* A NULL here has meaning, as the gssapi server case will
- * then use the principal from the client */
if (!princ_string) {
- talloc_free(mem_ctx);
- princ = NULL;
- return 0;
+ (*error_string) = error_message(ENOMEM);
+ return ENOMEM;
}
- ret = krb5_parse_name(smb_krb5_context->krb5_context,
- princ_string, princ);
+ ret = parse_principal(parent_ctx, princ_string,
+ smb_krb5_context, princ, error_string);
+ talloc_free(mem_ctx);
+ return ret;
+}
- if (ret) {
- (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
- return ret;
- }
+/* Obtain the principal set on this context. Requires a
+ * smb_krb5_context because we are doing krb5 principal parsing with
+ * the library routines. The returned princ is placed in the talloc
+ * system by means of a destructor (do *not* free). */
- /* This song-and-dance effectivly puts the principal
- * into talloc, so we can't loose it. */
- mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
- mem_ctx->principal = *princ;
- talloc_set_destructor(mem_ctx, free_principal);
- return 0;
+ krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
+ struct cli_credentials *credentials,
+ struct smb_krb5_context *smb_krb5_context,
+ krb5_principal *princ,
+ const char **error_string)
+{
+ return parse_principal(parent_ctx, cli_credentials_get_impersonate_principal(credentials),
+ smb_krb5_context, princ, error_string);
}
/**
@@ -154,9 +191,10 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
const char **error_string)
{
krb5_error_code ret;
- const char *password;
+ const char *password, *target_service;
time_t kdc_time = 0;
krb5_principal princ;
+ krb5_principal impersonate_principal;
int tries;
TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
@@ -171,14 +209,26 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
return ret;
}
+ ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string);
+ if (ret) {
+ talloc_free(mem_ctx);
+ return ret;
+ }
+
+ target_service = cli_credentials_get_target_service(credentials);
+
password = cli_credentials_get_password(credentials);
tries = 2;
while (tries--) {
if (password) {
ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, ccache,
- princ,
- password, NULL, &kdc_time);
+ princ, password,
+ impersonate_principal, target_service,
+ NULL, &kdc_time);
+ } else if (impersonate_principal) {
+ (*error_string) = "INTERNAL error: Cannot impersonate principal with just a keyblock. A password must be specified in the credentials";
+ return EINVAL;
} else {
/* No password available, try to use a keyblock instead */
@@ -197,8 +247,9 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
if (ret == 0) {
ret = kerberos_kinit_keyblock_cc(smb_krb5_context->krb5_context, ccache,
- princ,
- &keyblock, NULL, &kdc_time);
+ princ, &keyblock,
+ target_service,
+ NULL, &kdc_time);
krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &keyblock);
}
}
generated by cgit (git 2.34.1) at 2024-11-23 19:57:27 +0000