From 80a874555d8b2737827bb150133ba70a83c65bb7 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Thu, 27 Jun 2013 12:02:34 +0200
Subject: KRB5: guess UPN for subdomain users

---
 src/providers/krb5/krb5_common.c | 47 ++++++++++++++++++++++++++++++----------
 1 file changed, 36 insertions(+), 11 deletions(-)

(limited to 'src/providers/krb5/krb5_common.c')

diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index 9db14b8a..4bf071ee 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -884,41 +884,66 @@ errno_t krb5_install_sigterm_handler(struct tevent_context *ev,
 }
 
 errno_t krb5_get_simple_upn(TALLOC_CTX *mem_ctx, struct krb5_ctx *krb5_ctx,
-                            const char *domain_name, const char *username,
+                            struct sss_domain_info *dom, const char *username,
                             const char *user_dom, char **_upn)
 {
     const char *realm = NULL;
     char *uc_dom = NULL;
     char *upn;
+    char *name;
+    char *domname;
+    TALLOC_CTX *tmp_ctx = NULL;
+    errno_t ret;
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_new failed.\n"));
+        return ENOMEM;
+    }
 
-    if (user_dom != NULL && domain_name != NULL &&
-        strcasecmp(domain_name,user_dom) != 0) {
-        uc_dom = get_uppercase_realm(mem_ctx, user_dom);
+    if (user_dom != NULL && dom->name != NULL &&
+        strcasecmp(dom->name, user_dom) != 0) {
+        uc_dom = get_uppercase_realm(tmp_ctx, user_dom);
         if (uc_dom == NULL) {
             DEBUG(SSSDBG_OP_FAILURE, ("get_uppercase_realm failed.\n"));
-            return ENOMEM;
+            ret = ENOMEM;
+            goto done;
         }
     } else {
         realm = dp_opt_get_cstring(krb5_ctx->opts, KRB5_REALM);
         if (realm == NULL) {
             DEBUG(SSSDBG_OP_FAILURE, ("Missing Kerberos realm.\n"));
-            return ENOENT;
+            ret = ENOMEM;
+            goto done;
         }
     }
 
+    /* Subdomains already have a fully qualified name, which contains
+     * the domain name. We need to replace it with the realm name
+     */
+    ret = sss_parse_name(tmp_ctx, dom->names, username, &domname, &name);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Could not parse %s into name and " \
+                                  "domain components, login might fail\n"));
+        name = username;
+    }
+
     /* NOTE: this is a hack, works only in some environments */
-    upn = talloc_asprintf(mem_ctx, "%s@%s",  username,
+    upn = talloc_asprintf(tmp_ctx, "%s@%s",  name,
                                              realm != NULL ? realm : uc_dom);
-    talloc_free(uc_dom);
     if (upn == NULL) {
         DEBUG(1, ("talloc_asprintf failed.\n"));
-        return ENOMEM;
+        ret = ENOMEM;
+        goto done;
     }
 
     DEBUG(9, ("Using simple UPN [%s].\n", upn));
 
-    *_upn = upn;
-    return EOK;
+    *_upn = talloc_steal(mem_ctx, upn);
+    ret = EOK;
+done:
+    talloc_free(tmp_ctx);
+    return ret;
 }
 
 errno_t compare_principal_realm(const char *upn, const char *realm,
-- 
cgit