From c7d73cf51642c7f89c1f21e54b8ce1b262bef899 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 8 Nov 2010 18:25:56 +0100 Subject: Add krb5_lifetime option --- src/config/SSSDConfig.py | 1 + src/config/SSSDConfigTest.py | 9 ++++++--- src/config/etc/sssd.api.d/sssd-krb5.conf | 1 + src/man/sssd-krb5.5.xml | 32 ++++++++++++++++++++++++++++++++ src/providers/ipa/ipa_common.c | 3 ++- src/providers/ipa/ipa_common.h | 2 +- src/providers/krb5/krb5_child.c | 16 +++++++++++++++- src/providers/krb5/krb5_common.c | 22 +++++++++++++++++++++- src/providers/krb5/krb5_common.h | 2 ++ 9 files changed, 81 insertions(+), 7 deletions(-) diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py index bb7e424e..1286e54d 100644 --- a/src/config/SSSDConfig.py +++ b/src/config/SSSDConfig.py @@ -105,6 +105,7 @@ option_strings = { 'krb5_validate' : _("Enable credential validation"), 'krb5_store_password_if_offline' : _("Store password if offline for later online authentication"), 'krb5_renewable_lifetime' : _("Renewable lifetime of the TGT"), + 'krb5_lifetime' : _("Lifetime of the TGT"), # [provider/krb5/chpass] 'krb5_kpasswd' : _('Server where the change password service is running if not on the KDC'), diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py index b63e40b5..3d57108a 100755 --- a/src/config/SSSDConfigTest.py +++ b/src/config/SSSDConfigTest.py @@ -550,7 +550,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): 'krb5_validate', 'krb5_store_password_if_offline', 'krb5_auth_timeout', - 'krb5_renewable_lifetime']) + 'krb5_renewable_lifetime', + 'krb5_lifetime']) options = domain.list_options() @@ -725,7 +726,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): 'krb5_validate', 'krb5_store_password_if_offline', 'krb5_auth_timeout', - 'krb5_renewable_lifetime'] + 'krb5_renewable_lifetime', + 'krb5_lifetime'] self.assertTrue(type(options) == dict, "Options should be a dictionary") @@ -874,7 +876,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): 'krb5_validate', 'krb5_store_password_if_offline', 'krb5_auth_timeout', - 'krb5_renewable_lifetime']) + 'krb5_renewable_lifetime', + 'krb5_lifetime']) options = domain.list_options() diff --git a/src/config/etc/sssd.api.d/sssd-krb5.conf b/src/config/etc/sssd.api.d/sssd-krb5.conf index c3cc5bbf..f824cfbe 100644 --- a/src/config/etc/sssd.api.d/sssd-krb5.conf +++ b/src/config/etc/sssd.api.d/sssd-krb5.conf @@ -12,6 +12,7 @@ krb5_keytab = str, None, false krb5_validate = bool, None, false krb5_store_password_if_offline = bool, None, false krb5_renewable_lifetime = str, None, false +krb5_lifetime = str, None, false [provider/krb5/chpass] diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml index 0f0c8a2c..ff5d0a6a 100644 --- a/src/man/sssd-krb5.5.xml +++ b/src/man/sssd-krb5.5.xml @@ -300,6 +300,38 @@ + + krb5_lifetime (string) + + + Request ticket with a with a lifetime given by an + integer immediately followed by one of the following + delimiters: + + + s seconds + + + m minutes + + + h hours + + + d days. + + + Please note that it is not possible to mix units. + If you want to set the lifetime to one and a half + hours please use '90m' instead of '1h30m'. + + + Default: not set, i.e. the default ticket lifetime + configured on the KDC. + + + + diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c index 149a352f..545ddc9e 100644 --- a/src/providers/ipa/ipa_common.c +++ b/src/providers/ipa/ipa_common.c @@ -140,7 +140,8 @@ struct dp_option ipa_def_krb5_opts[] = { { "krb5_validate", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE }, { "krb5_kpasswd", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "krb5_store_password_if_offline", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, - { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING } + { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING }, + { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING } }; int ipa_get_options(TALLOC_CTX *memctx, diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h index 33b325c0..be0f361a 100644 --- a/src/providers/ipa/ipa_common.h +++ b/src/providers/ipa/ipa_common.h @@ -40,7 +40,7 @@ struct ipa_service { /* the following define is used to keep track of the options in the krb5 * module, so that if they change and ipa is not updated correspondingly * this will trigger a runtime abort error */ -#define IPA_KRB5_OPTS_TEST 10 +#define IPA_KRB5_OPTS_TEST 11 enum ipa_basic_opt { IPA_DOMAIN = 0, diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index 2a2ed9b4..f29869bc 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -1179,8 +1179,22 @@ static int krb5_child_setup(struct krb5_req *kr, uint32_t offline) krb5_get_init_creds_opt_set_renew_life(kr->options, lifetime); } + lifetime_str = getenv(SSSD_KRB5_LIFETIME); + if (lifetime_str == NULL) { + DEBUG(7, ("Cannot read [%s] from environment.\n", + SSSD_KRB5_LIFETIME)); + } else { + kerr = krb5_string_to_deltat(lifetime_str, &lifetime); + if (kerr != 0) { + DEBUG(1, ("krb5_string_to_deltat failed for [%s].\n", + lifetime_str)); + KRB5_DEBUG(1, kerr); + goto failed; + } + krb5_get_init_creds_opt_set_tkt_life(kr->options, lifetime); + } + /* TODO: set options, e.g. - * krb5_get_init_creds_opt_set_tkt_life * krb5_get_init_creds_opt_set_forwardable * krb5_get_init_creds_opt_set_proxiable * krb5_get_init_creds_opt_set_etype_list diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c index 1a62bbe3..7ee4d09f 100644 --- a/src/providers/krb5/krb5_common.c +++ b/src/providers/krb5/krb5_common.c @@ -41,7 +41,8 @@ struct dp_option default_krb5_opts[] = { { "krb5_validate", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "krb5_kpasswd", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "krb5_store_password_if_offline", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, - { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING } + { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING }, + { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING } }; errno_t check_and_export_options(struct dp_option *opts, @@ -88,6 +89,25 @@ errno_t check_and_export_options(struct dp_option *opts, } } + str = dp_opt_get_string(opts, KRB5_LIFETIME); + if (str == NULL) { + DEBUG(5, ("No TGT lifetime configured.\n")); + } else { + ret = krb5_string_to_deltat(str, &lifetime); + if (ret != 0) { + DEBUG(1, ("Invalid value [%s] for krb5_lifetime.\n", + str)); + return EINVAL; + } + + ret = setenv(SSSD_KRB5_LIFETIME, str, 1); + if (ret != EOK) { + DEBUG(2, ("setenv [%s] failed.\n", + SSSD_KRB5_LIFETIME)); + return ret; + } + } + dummy = dp_opt_get_cstring(opts, KRB5_KDC); if (dummy == NULL) { DEBUG(1, ("No KDC explicitly configured, using defaults.\n")); diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h index 15ef437b..01d2dbfc 100644 --- a/src/providers/krb5/krb5_common.h +++ b/src/providers/krb5/krb5_common.h @@ -36,6 +36,7 @@ #define SSSD_KRB5_KDC "SSSD_KRB5_KDC" #define SSSD_KRB5_REALM "SSSD_KRB5_REALM" #define SSSD_KRB5_RENEWABLE_LIFETIME "SSSD_KRB5_RENEWABLE_LIFETIME" +#define SSSD_KRB5_LIFETIME "SSSD_KRB5_LIFETIME" #define KDCINFO_TMPL PUBCONF_PATH"/kdcinfo.%s" #define KPASSWDINFO_TMPL PUBCONF_PATH"/kpasswdinfo.%s" @@ -54,6 +55,7 @@ enum krb5_opts { KRB5_KPASSWD, KRB5_STORE_PASSWORD_IF_OFFLINE, KRB5_RENEWABLE_LIFETIME, + KRB5_LIFETIME, KRB5_OPTS }; -- cgit