summaryrefslogtreecommitdiff
path: root/src/providers/krb5
diff options
context:
space:
mode:
authorStephen Gallagher <sgallagh@redhat.com>2013-08-15 19:36:26 -0400
committerJakub Hrozek <jhrozek@redhat.com>2013-08-27 17:05:15 +0200
commitaeb1e654c337037b6bdb350e1ec8aaa065e86794 (patch)
tree080a1a2a7129006be55e61db158154f8a226432f /src/providers/krb5
parentfe1afaccc7c9a99df823a7c44cd89fc3c619715a (diff)
downloadsssd-aeb1e654c337037b6bdb350e1ec8aaa065e86794.tar.gz
sssd-aeb1e654c337037b6bdb350e1ec8aaa065e86794.tar.bz2
sssd-aeb1e654c337037b6bdb350e1ec8aaa065e86794.zip
KRB5: Add support for KEYRING cache type
https://fedorahosted.org/sssd/ticket/2036
Diffstat (limited to 'src/providers/krb5')
-rw-r--r--src/providers/krb5/krb5_child.c49
-rw-r--r--src/providers/krb5/krb5_common.c5
-rw-r--r--src/providers/krb5/krb5_utils.c156
-rw-r--r--src/providers/krb5/krb5_utils.h2
4 files changed, 212 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 3fd12fec..842b50e6 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -505,6 +505,19 @@ store_creds_in_ccache(krb5_context ctx, krb5_principal princ,
{
krb5_error_code kerr;
krb5_creds *l_cred;
+ char *ccname;
+
+ if (DEBUG_IS_SET(SSSDBG_TRACE_ALL)) {
+ kerr = krb5_cc_get_full_name(ctx, cc, &ccname);
+ if (kerr != 0) {
+ DEBUG(SSSDBG_TRACE_ALL,
+ ("Couldn't determine full name of ccache\n"));
+ } else {
+ DEBUG(SSSDBG_TRACE_ALL,
+ ("Storing credentials in [%s]\n", ccname));
+ krb5_free_string(ctx, ccname);
+ }
+ }
kerr = krb5_cc_initialize(ctx, cc, princ);
if (kerr != 0) {
@@ -775,6 +788,37 @@ done:
return kerr;
}
+static krb5_error_code
+create_ccache_keyring(krb5_context ctx,
+ krb5_principal princ,
+ char *ccname,
+ krb5_creds *creds)
+{
+ krb5_error_code kerr;
+ krb5_ccache tmp_cc = NULL;
+
+ DEBUG(SSSDBG_FUNC_DATA, ("Creating ccache at [%s]\n", ccname));
+
+ kerr = krb5_cc_resolve(ctx, ccname, &tmp_cc);
+ if (kerr != 0) {
+ KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
+ goto done;
+ }
+
+ kerr = store_creds_in_ccache(ctx, princ, tmp_cc, creds);
+ if (kerr != 0) {
+ KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
+ goto done;
+ }
+
+done:
+ if (kerr != 0 && tmp_cc != NULL) {
+ krb5_cc_destroy(ctx, tmp_cc);
+ }
+
+ return kerr;
+}
+
#endif /* HAVE_KRB5_CC_COLLECTION */
static krb5_error_code
@@ -787,10 +831,15 @@ create_ccache(uid_t uid, gid_t gid, krb5_context ctx,
switch (cctype) {
case SSS_KRB5_TYPE_FILE:
return create_ccache_file(ctx, princ, ccname, creds);
+
#ifdef HAVE_KRB5_CC_COLLECTION
case SSS_KRB5_TYPE_DIR:
return create_ccache_in_dir(uid, gid, ctx, princ, ccname, creds);
+
+ case SSS_KRB5_TYPE_KEYRING:
+ return create_ccache_keyring(ctx, princ, ccname, creds);
#endif /* HAVE_KRB5_CC_COLLECTION */
+
default:
DEBUG(SSSDBG_CRIT_FAILURE, ("Unknown cache type\n"));
return EINVAL;
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index e56dc624..86e72157 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -215,6 +215,11 @@ errno_t check_and_export_options(struct dp_option *opts,
DEBUG(SSSDBG_CONF_SETTINGS, ("ccache is of type DIR\n"));
krb5_ctx->cc_be = &dir_cc;
break;
+
+ case SSS_KRB5_TYPE_KEYRING:
+ DEBUG(SSSDBG_CONF_SETTINGS, ("ccache is of type KEYRING\n"));
+ krb5_ctx->cc_be = &keyring_cc;
+ break;
#endif /* HAVE_KRB5_CC_COLLECTION */
default:
diff --git a/src/providers/krb5/krb5_utils.c b/src/providers/krb5/krb5_utils.c
index 7a4d287a..d82ef47c 100644
--- a/src/providers/krb5/krb5_utils.c
+++ b/src/providers/krb5/krb5_utils.c
@@ -760,6 +760,8 @@ done:
return ret;
}
+
+
/*======== ccache back end utilities ========*/
struct sss_krb5_cc_be *
get_cc_be_ops(enum sss_krb5_cc_type type)
@@ -775,6 +777,10 @@ get_cc_be_ops(enum sss_krb5_cc_type type)
case SSS_KRB5_TYPE_DIR:
be = &dir_cc;
break;
+
+ case SSS_KRB5_TYPE_KEYRING:
+ be = &keyring_cc;
+ break;
#endif /* HAVE_KRB5_CC_COLLECTION */
case SSS_KRB5_TYPE_UNKNOWN:
@@ -1189,6 +1195,156 @@ struct sss_krb5_cc_be dir_cc = {
.remove = cc_dir_remove
};
+
+/*======== Operations on the KEYRING: back end ========*/
+
+errno_t
+cc_keyring_create(const char *location, pcre *illegal_re,
+ uid_t uid, gid_t gid, bool private_path)
+{
+ const char *residual;
+
+ residual = sss_krb5_residual_check_type(location, SSS_KRB5_TYPE_KEYRING);
+ if (residual == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Bad ccache type %s\n", location));
+ return EINVAL;
+ }
+
+ /* No special steps are needed to create a kernel keyring.
+ * Everything is handled in libkrb5.
+ */
+ return EOK;
+}
+
+errno_t
+cc_keyring_check_existing(const char *location, uid_t uid,
+ const char *realm, const char *princ,
+ const char *cc_template, bool *_active,
+ bool *_valid)
+{
+ errno_t ret;
+ bool active;
+ bool valid;
+ const char *residual;
+
+ residual = sss_krb5_residual_check_type(location, SSS_KRB5_TYPE_KEYRING);
+ if (!residual) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ ("%s is not of type KEYRING:\n", location));
+ return EINVAL;
+ }
+
+ /* The keyring cache is always active */
+ active = true;
+
+ /* Check if any user is actively using this cache */
+ ret = check_cc_validity(location, realm, princ, &valid);
+ if (ret != EOK) {
+ return ret;
+ }
+
+ *_active = active;
+ *_valid = valid;
+ return EOK;
+}
+
+const char *
+cc_keyring_cache_for_princ(TALLOC_CTX *mem_ctx, const char *location,
+ const char *princ)
+{
+ krb5_context context = NULL;
+ krb5_error_code krberr;
+ char *name = NULL;
+ const char *residual;
+ size_t i;
+ size_t count;
+ krb5_principal client_principal = NULL;
+
+ residual = sss_krb5_residual_check_type(location, SSS_KRB5_TYPE_KEYRING);
+ if (!residual) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Cannot get residual from %s\n",
+ location));
+ return NULL;
+ }
+
+ /* residual already points to a subsidiary cache if it of the
+ * form "KEYRING:<type>:<UID>:krb5_cc_XXXXXXX"
+ * For simplicity, we'll count the colons, up to three.
+ */
+ i = count = 0;
+ while (residual[i] && count < 3) {
+ if (residual[i] == ':') {
+ count ++;
+ }
+ i++;
+ }
+
+ if (count >= 3) {
+ return talloc_strdup(mem_ctx, location);
+ }
+
+ krberr = krb5_init_context(&context);
+ if (krberr) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Failed to init kerberos context\n"));
+ return NULL;
+ }
+
+ krberr = krb5_parse_name(context, princ, &client_principal);
+ if (krberr != 0) {
+ KRB5_DEBUG(SSSDBG_OP_FAILURE, context, krberr);
+ DEBUG(SSSDBG_CRIT_FAILURE, ("krb5_parse_name failed.\n"));
+ goto done;
+ }
+
+ name = sss_get_ccache_name_for_principal(mem_ctx, context,
+ client_principal, location);
+ if (name == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Could not get full name of ccache\n"));
+ goto done;
+ }
+
+ talloc_zfree(name);
+
+ /* Always return the master name here.
+ * We do the above only to ensure that the
+ * principal-specific name exists and can
+ * be found.
+ */
+ name = talloc_strdup(mem_ctx, location);
+
+done:
+ krb5_free_principal(context, client_principal);
+ krb5_free_context(context);
+
+ return name;
+}
+
+errno_t
+cc_keyring_remove(const char *location)
+{
+ const char *residual;
+
+ residual = sss_krb5_residual_check_type(location, SSS_KRB5_TYPE_KEYRING);
+ if (!residual) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ ("%s is not of type KEYRING:\n", location));
+ return EINVAL;
+ }
+
+ /* No special steps are needed to create a kernel keyring.
+ * Everything is handled in libkrb5.
+ */
+ return EOK;
+}
+
+struct sss_krb5_cc_be keyring_cc = {
+ .type = SSS_KRB5_TYPE_KEYRING,
+ .create = cc_keyring_create,
+ .check_existing = cc_keyring_check_existing,
+ .ccache_for_princ = cc_keyring_cache_for_princ,
+ .remove = cc_keyring_remove
+};
+
#endif /* HAVE_KRB5_CC_COLLECTION */
errno_t get_domain_or_subdomain(TALLOC_CTX *mem_ctx, struct be_ctx *be_ctx,
diff --git a/src/providers/krb5/krb5_utils.h b/src/providers/krb5/krb5_utils.h
index 4a5904cd..cdc9f236 100644
--- a/src/providers/krb5/krb5_utils.h
+++ b/src/providers/krb5/krb5_utils.h
@@ -87,12 +87,14 @@ errno_t get_ccache_file_data(const char *ccache_file, const char *client_name,
#ifdef HAVE_KRB5_CC_COLLECTION
extern struct sss_krb5_cc_be dir_cc;
+extern struct sss_krb5_cc_be keyring_cc;
errno_t cc_dir_create(const char *location, pcre *illegal_re,
uid_t uid, gid_t gid, bool private_path);
#endif /* HAVE_KRB5_CC_COLLECTION */
+
errno_t get_domain_or_subdomain(TALLOC_CTX *mem_ctx, struct be_ctx *be_ctx,
char *domain_name,
struct sss_domain_info **dom);