From aecaddfa1b2a55c9cc91c3644947c3686714ceb5 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 3 Mar 2010 13:24:52 +1100 Subject: s4:credentials Add the functions needed to do S4U2Self with cli_credentials A torture test to demonstrate will be added soon. Andrew Bartlett --- source4/auth/credentials/credentials.c | 2 + source4/auth/credentials/credentials.h | 7 ++ source4/auth/credentials/credentials_krb5.c | 38 +++++++++ source4/auth/kerberos/kerberos.c | 79 +++++++++++++++---- source4/auth/kerberos/kerberos.h | 15 +++- source4/auth/kerberos/kerberos_util.c | 117 ++++++++++++++++++++-------- 6 files changed, 208 insertions(+), 50 deletions(-) (limited to 'source4') diff --git a/source4/auth/credentials/credentials.c b/source4/auth/credentials/credentials.c index 358ee1b85e..5f2658d5bd 100644 --- a/source4/auth/credentials/credentials.c +++ b/source4/auth/credentials/credentials.c @@ -63,6 +63,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) cred->realm = NULL; cred->principal = NULL; cred->salt_principal = NULL; + cred->impersonate_principal = NULL; + cred->target_service = NULL; cred->bind_dn = NULL; diff --git a/source4/auth/credentials/credentials.h b/source4/auth/credentials/credentials.h index 33de8341c7..ab4ee2f217 100644 --- a/source4/auth/credentials/credentials.h +++ b/source4/auth/credentials/credentials.h @@ -77,6 +77,8 @@ struct cli_credentials { const char *realm; const char *principal; char *salt_principal; + char *impersonate_principal; + char *target_service; const char *bind_dn; @@ -268,6 +270,11 @@ bool cli_credentials_parse_password_fd(struct cli_credentials *credentials, void cli_credentials_invalidate_ccache(struct cli_credentials *cred, enum credentials_obtained obtained); void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal); +void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal); +void cli_credentials_set_target_service(struct cli_credentials *cred, const char *principal); +const char *cli_credentials_get_salt_principal(struct cli_credentials *cred); +const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred); +const char *cli_credentials_get_target_service(struct cli_credentials *cred); enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds); NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred, struct tevent_context *event_ctx, diff --git a/source4/auth/credentials/credentials_krb5.c b/source4/auth/credentials/credentials_krb5.c index d8ce0e58e2..1e0db3cb36 100644 --- a/source4/auth/credentials/credentials_krb5.c +++ b/source4/auth/credentials/credentials_krb5.c @@ -802,4 +802,42 @@ _PUBLIC_ void cli_credentials_set_salt_principal(struct cli_credentials *cred, c cred->salt_principal = talloc_strdup(cred, principal); } +/* The 'impersonate_principal' is used to allow on Kerberos principal + * (and it's associated keytab etc) to impersonate another. The + * ability to do this is controlled by the KDC, but it is generally + * permitted to impersonate anyone to yourself. This allows any + * member of the domain to get the groups of a user. This is also + * known as S4U2Self */ + +const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred) +{ + return cred->impersonate_principal; +} + +_PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal) +{ + talloc_free(cred->impersonate_principal); + cred->impersonate_principal = talloc_strdup(cred, principal); +} + +/* when impersonating for S4U2Self we need to set the target principal + * to ourself, as otherwise we would need additional rights. + * Similarly, we may only be authorized to do general impersonation to + * some particular services. + * + * Likewise, password changes typically require a ticket to kpasswd/realm directly, not via a TGT + * + * NULL means that tickets will be obtained for the krbtgt service. +*/ + +const char *cli_credentials_get_target_service(struct cli_credentials *cred) +{ + return cred->target_service; +} + +_PUBLIC_ void cli_credentials_set_target_service(struct cli_credentials *cred, const char *target_service) +{ + talloc_free(cred->target_service); + cred->target_service = talloc_strdup(cred, target_service); +} diff --git a/source4/auth/kerberos/kerberos.c b/source4/auth/kerberos/kerberos.c index d4549ee88a..42757640f2 100644 --- a/source4/auth/kerberos/kerberos.c +++ b/source4/auth/kerberos/kerberos.c @@ -33,10 +33,15 @@ This version is built to use a keyblock, rather than needing the original password. + + The impersonate_principal is the principal if NULL, or the principal to impersonate + + The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self) */ krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, - krb5_principal principal, krb5_keyblock *keyblock, - time_t *expire_time, time_t *kdc_time) + krb5_principal principal, krb5_keyblock *keyblock, + const char *target_service, + time_t *expire_time, time_t *kdc_time) { krb5_error_code code = 0; krb5_creds my_creds; @@ -49,7 +54,7 @@ krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options); if ((code = krb5_get_init_creds_keyblock(ctx, &my_creds, principal, keyblock, - 0, NULL, options))) { + 0, target_service, options))) { return code; } @@ -82,36 +87,49 @@ /* simulate a kinit, putting the tgt in the given credentials cache. Orignally by remus@snapserver.com + + The impersonate_principal is the principal if NULL, or the principal to impersonate + + The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self) + */ krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc, krb5_principal principal, const char *password, + krb5_principal impersonate_principal, const char *target_service, time_t *expire_time, time_t *kdc_time) { krb5_error_code code = 0; krb5_creds my_creds; - krb5_get_init_creds_opt *options; + krb5_creds *impersonate_creds; + krb5_get_init_creds_opt *init_options; + krb5_get_creds_opt options; - if ((code = krb5_get_init_creds_opt_alloc(ctx, &options))) { + if ((code = krb5_get_init_creds_opt_alloc(ctx, &init_options))) { return code; } - krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options); + krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, init_options); + /* If we are not impersonating, then get this ticket for the + * target service, otherwise a krbtgt, and get the next ticket + * for the target */ if ((code = krb5_get_init_creds_password(ctx, &my_creds, principal, password, - NULL, - NULL, 0, NULL, options))) { - krb5_get_init_creds_opt_free(ctx, options); + NULL, NULL, + 0, + impersonate_principal ? NULL : target_service, + init_options))) { + krb5_get_init_creds_opt_free(ctx, init_options); return code; } - + if ((code = krb5_cc_initialize(ctx, cc, principal))) { - krb5_get_init_creds_opt_free(ctx, options); + krb5_get_init_creds_opt_free(ctx, init_options); krb5_free_cred_contents(ctx, &my_creds); return code; } if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) { - krb5_get_init_creds_opt_free(ctx, options); + krb5_get_init_creds_opt_free(ctx, init_options); krb5_free_cred_contents(ctx, &my_creds); return code; } @@ -124,9 +142,44 @@ *kdc_time = (time_t) my_creds.times.starttime; } - krb5_get_init_creds_opt_free(ctx, options); + krb5_get_init_creds_opt_free(ctx, init_options); krb5_free_cred_contents(ctx, &my_creds); + if (code == 0 && impersonate_principal) { + krb5_principal target_princ; + if ((code = krb5_get_creds_opt_alloc(ctx, &options))) { + return code; + } + + if ((code = krb5_get_creds_opt_set_impersonate(ctx, options, impersonate_principal))) { + krb5_get_creds_opt_free(ctx, options); + return code; + } + + if ((code = krb5_parse_name(ctx, target_service, &target_princ))) { + krb5_get_creds_opt_free(ctx, options); + return code; + } + + if ((code = krb5_principal_set_realm(ctx, target_princ, krb5_principal_get_realm(ctx, principal)))) { + krb5_get_creds_opt_free(ctx, options); + krb5_free_principal(ctx, target_princ); + return code; + } + + if ((code = krb5_get_creds(ctx, options, cc, target_princ, &impersonate_creds))) { + krb5_free_principal(ctx, target_princ); + krb5_get_creds_opt_free(ctx, options); + return code; + } + + krb5_free_principal(ctx, target_princ); + + code = krb5_cc_store_cred(ctx, cc, impersonate_creds); + krb5_get_creds_opt_free(ctx, options); + krb5_free_creds(ctx, impersonate_creds); + } + return 0; } diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h index 498da0f9c2..992b509dbf 100644 --- a/source4/auth/kerberos/kerberos.h +++ b/source4/auth/kerberos/kerberos.h @@ -88,11 +88,13 @@ krb5_error_code ads_krb5_mk_req(krb5_context context, krb5_ccache ccache, krb5_data *outbuf); bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt); -int kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc, - krb5_principal principal, const char *password, - time_t *expire_time, time_t *kdc_time); -int kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, +krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc, + krb5_principal principal, const char *password, + krb5_principal impersonate_principal, const char *target_service, + time_t *expire_time, time_t *kdc_time); +krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, krb5_principal principal, krb5_keyblock *keyblock, + const char *target_service, time_t *expire_time, time_t *kdc_time); krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context, krb5_principal host_princ, @@ -107,6 +109,11 @@ char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TAL struct smb_krb5_context *smb_krb5_context, krb5_ccache ccache, const char **error_string); +krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx, + struct cli_credentials *credentials, + struct smb_krb5_context *smb_krb5_context, + krb5_principal *princ, + const char **error_string); krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx, struct cli_credentials *credentials, struct smb_krb5_context *smb_krb5_context, diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c index 494f36dec7..44d97b7f08 100644 --- a/source4/auth/kerberos/kerberos_util.c +++ b/source4/auth/kerberos/kerberos_util.c @@ -40,6 +40,42 @@ static krb5_error_code free_principal(struct principal_container *pc) return 0; } + +static krb5_error_code parse_principal(TALLOC_CTX *parent_ctx, + const char *princ_string, + struct smb_krb5_context *smb_krb5_context, + krb5_principal *princ, + const char **error_string) +{ + int ret; + struct principal_container *mem_ctx; + if (princ_string == NULL) { + *princ = NULL; + return 0; + } + + ret = krb5_parse_name(smb_krb5_context->krb5_context, + princ_string, princ); + + if (ret) { + (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx); + return ret; + } + + mem_ctx = talloc(parent_ctx, struct principal_container); + if (!mem_ctx) { + (*error_string) = error_message(ENOMEM); + return ENOMEM; + } + + /* This song-and-dance effectivly puts the principal + * into talloc, so we can't loose it. */ + mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context); + mem_ctx->principal = *princ; + talloc_set_destructor(mem_ctx, free_principal); + return 0; +} + static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, struct cli_credentials *machine_account, struct smb_krb5_context *smb_krb5_context, @@ -50,6 +86,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, char *salt_body; char *lower_realm; const char *salt_principal; + const char *error_string; struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container); if (!mem_ctx) { return ENOMEM; @@ -57,7 +94,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, salt_principal = cli_credentials_get_salt_principal(machine_account); if (salt_principal) { - ret = krb5_parse_name(smb_krb5_context->krb5_context, salt_principal, salt_princ); + ret = parse_principal(parent_ctx, salt_principal, smb_krb5_context, salt_princ, &error_string); } else { machine_username = talloc_strdup(mem_ctx, cli_credentials_get_username(machine_account)); @@ -85,15 +122,15 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ, cli_credentials_get_realm(machine_account), "host", salt_body, NULL); + if (ret == 0) { + /* This song-and-dance effectivly puts the principal + * into talloc, so we can't loose it. */ + mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context); + mem_ctx->principal = *salt_princ; + talloc_set_destructor(mem_ctx, free_principal); + } } - if (ret == 0) { - /* This song-and-dance effectivly puts the principal - * into talloc, so we can't loose it. */ - mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context); - mem_ctx->principal = *salt_princ; - talloc_set_destructor(mem_ctx, free_principal); - } return ret; } @@ -110,36 +147,36 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, { krb5_error_code ret; const char *princ_string; - struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container); + TALLOC_CTX *mem_ctx = talloc_new(parent_ctx); if (!mem_ctx) { (*error_string) = error_message(ENOMEM); return ENOMEM; } - princ_string = cli_credentials_get_principal(credentials, mem_ctx); - - /* A NULL here has meaning, as the gssapi server case will - * then use the principal from the client */ if (!princ_string) { - talloc_free(mem_ctx); - princ = NULL; - return 0; + (*error_string) = error_message(ENOMEM); + return ENOMEM; } - ret = krb5_parse_name(smb_krb5_context->krb5_context, - princ_string, princ); + ret = parse_principal(parent_ctx, princ_string, + smb_krb5_context, princ, error_string); + talloc_free(mem_ctx); + return ret; +} - if (ret) { - (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx); - return ret; - } +/* Obtain the principal set on this context. Requires a + * smb_krb5_context because we are doing krb5 principal parsing with + * the library routines. The returned princ is placed in the talloc + * system by means of a destructor (do *not* free). */ - /* This song-and-dance effectivly puts the principal - * into talloc, so we can't loose it. */ - mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context); - mem_ctx->principal = *princ; - talloc_set_destructor(mem_ctx, free_principal); - return 0; + krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx, + struct cli_credentials *credentials, + struct smb_krb5_context *smb_krb5_context, + krb5_principal *princ, + const char **error_string) +{ + return parse_principal(parent_ctx, cli_credentials_get_impersonate_principal(credentials), + smb_krb5_context, princ, error_string); } /** @@ -154,9 +191,10 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, const char **error_string) { krb5_error_code ret; - const char *password; + const char *password, *target_service; time_t kdc_time = 0; krb5_principal princ; + krb5_principal impersonate_principal; int tries; TALLOC_CTX *mem_ctx = talloc_new(parent_ctx); @@ -171,14 +209,26 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, return ret; } + ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string); + if (ret) { + talloc_free(mem_ctx); + return ret; + } + + target_service = cli_credentials_get_target_service(credentials); + password = cli_credentials_get_password(credentials); tries = 2; while (tries--) { if (password) { ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, ccache, - princ, - password, NULL, &kdc_time); + princ, password, + impersonate_principal, target_service, + NULL, &kdc_time); + } else if (impersonate_principal) { + (*error_string) = "INTERNAL error: Cannot impersonate principal with just a keyblock. A password must be specified in the credentials"; + return EINVAL; } else { /* No password available, try to use a keyblock instead */ @@ -197,8 +247,9 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, if (ret == 0) { ret = kerberos_kinit_keyblock_cc(smb_krb5_context->krb5_context, ccache, - princ, - &keyblock, NULL, &kdc_time); + princ, &keyblock, + target_service, + NULL, &kdc_time); krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &keyblock); } } -- cgit