summaryrefslogtreecommitdiff
path: root/src/providers
diff options
context:
space:
mode:
Diffstat (limited to 'src/providers')
-rw-r--r--src/providers/ad/ad_opts.h1
-rw-r--r--src/providers/ipa/ipa_opts.h1
-rw-r--r--src/providers/krb5/krb5_child.c14
-rw-r--r--src/providers/krb5/krb5_child_handler.c6
-rw-r--r--src/providers/krb5/krb5_common.h1
-rw-r--r--src/providers/krb5/krb5_opts.h1
6 files changed, 20 insertions, 4 deletions
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index 09aee7e2..4b87e0c0 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -142,6 +142,7 @@ struct dp_option ad_def_krb5_opts[] = {
{ "krb5_use_fast", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "krb5_fast_principal", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "krb5_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+ { "krb5_use_enterprise_principal", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
DP_OPTION_TERMINATOR
};
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index a3d0210a..6adbdd96 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -264,6 +264,7 @@ struct dp_option ipa_def_krb5_opts[] = {
{ "krb5_use_fast", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "krb5_fast_principal", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "krb5_canonicalize", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
+ { "krb5_use_enterprise_principal", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
DP_OPTION_TERMINATOR
};
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index dd01e70b..831905af 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -54,6 +54,7 @@ struct krb5_req {
char *keytab;
bool validate;
bool upn_from_different_realm;
+ bool use_enterprise_princ;
char *fast_ccname;
const char *upn;
@@ -1549,6 +1550,7 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
uint32_t len;
uint32_t validate;
uint32_t different_realm;
+ uint32_t use_enterprise_princ;
struct pam_data *pd;
errno_t ret;
@@ -1571,6 +1573,8 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
SAFEALIGN_COPY_UINT32_CHECK(offline, buf + p, size, &p);
SAFEALIGN_COPY_UINT32_CHECK(&different_realm, buf + p, size, &p);
kr->upn_from_different_realm = (different_realm == 0) ? false : true;
+ SAFEALIGN_COPY_UINT32_CHECK(&use_enterprise_princ, buf + p, size, &p);
+ kr->use_enterprise_princ = (use_enterprise_princ == 0) ? false : true;
SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p);
if ((p + len ) > size) return EINVAL;
kr->upn = talloc_strndup(pd, (char *)(buf + p), len);
@@ -1578,9 +1582,11 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
p += len;
DEBUG(SSSDBG_CONF_SETTINGS,
- ("cmd [%d] uid [%llu] gid [%llu] validate [%s] offline [%s] "
- "UPN [%s]\n", pd->cmd, (unsigned long long) kr->uid,
+ ("cmd [%d] uid [%llu] gid [%llu] validate [%s] "
+ "enterprise principal [%s] offline [%s] UPN [%s]\n",
+ pd->cmd, (unsigned long long) kr->uid,
(unsigned long long) kr->gid, kr->validate ? "true" : "false",
+ kr->use_enterprise_princ ? "true" : "false",
*offline ? "true" : "false", kr->upn ? kr->upn : "none"));
if (pd->cmd == SSS_PAM_AUTHENTICATE ||
@@ -1912,6 +1918,7 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
char *lifetime_str;
char *use_fast_str;
krb5_deltat lifetime;
+ int parse_flags;
kr->realm = getenv(SSSD_KRB5_REALM);
if (kr->realm == NULL) {
@@ -1936,7 +1943,8 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
}
}
- kerr = krb5_parse_name(kr->ctx, kr->upn, &kr->princ);
+ parse_flags = kr->use_enterprise_princ ? KRB5_PRINCIPAL_PARSE_ENTERPRISE : 0;
+ kerr = sss_krb5_parse_name_flags(kr->ctx, kr->upn, parse_flags, &kr->princ);
if (kerr != 0) {
KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
return kerr;
diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
index 8ff65130..0b8cd6b2 100644
--- a/src/providers/krb5/krb5_child_handler.c
+++ b/src/providers/krb5/krb5_child_handler.c
@@ -130,6 +130,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
const char *keytab;
uint32_t validate;
uint32_t different_realm;
+ uint32_t use_enterprise_principal;
size_t username_len = 0;
errno_t ret;
@@ -141,6 +142,8 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
validate = dp_opt_get_bool(kr->krb5_ctx->opts, KRB5_VALIDATE) ? 1 : 0;
different_realm = kr->upn_from_different_realm ? 1 : 0;
+ use_enterprise_principal = dp_opt_get_bool(kr->krb5_ctx->opts,
+ KRB5_USE_ENTERPRISE_PRINCIPAL) ? 1 : 0;
buf = talloc(kr, struct io_buffer);
if (buf == NULL) {
@@ -148,7 +151,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
return ENOMEM;
}
- buf->size = 7*sizeof(uint32_t) + strlen(kr->upn);
+ buf->size = 8*sizeof(uint32_t) + strlen(kr->upn);
if (kr->pd->cmd == SSS_PAM_AUTHENTICATE ||
kr->pd->cmd == SSS_CMD_RENEW ||
@@ -182,6 +185,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
SAFEALIGN_COPY_UINT32(&buf->data[rp], &validate, &rp);
SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->is_offline, &rp);
SAFEALIGN_COPY_UINT32(&buf->data[rp], &different_realm, &rp);
+ SAFEALIGN_COPY_UINT32(&buf->data[rp], &use_enterprise_principal, &rp);
SAFEALIGN_SET_UINT32(&buf->data[rp], strlen(kr->upn), &rp);
safealign_memcpy(&buf->data[rp], kr->upn, strlen(kr->upn), &rp);
diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h
index 13035291..85049360 100644
--- a/src/providers/krb5/krb5_common.h
+++ b/src/providers/krb5/krb5_common.h
@@ -65,6 +65,7 @@ enum krb5_opts {
KRB5_USE_FAST,
KRB5_FAST_PRINCIPAL,
KRB5_CANONICALIZE,
+ KRB5_USE_ENTERPRISE_PRINCIPAL,
KRB5_OPTS
};
diff --git a/src/providers/krb5/krb5_opts.h b/src/providers/krb5/krb5_opts.h
index 8ac29532..c8e64782 100644
--- a/src/providers/krb5/krb5_opts.h
+++ b/src/providers/krb5/krb5_opts.h
@@ -43,6 +43,7 @@ struct dp_option default_krb5_opts[] = {
{ "krb5_use_fast", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "krb5_fast_principal", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "krb5_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+ { "krb5_use_enterprise_principal", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
DP_OPTION_TERMINATOR
};
generated by cgit (git 2.34.1) at 2024-06-10 14:56:55 +0000