|
Lines 62-67
Link Here
|
| 62 |
#include <http_protocol.h> |
62 |
#include <http_protocol.h> |
| 63 |
#include <http_request.h> |
63 |
#include <http_request.h> |
| 64 |
|
64 |
|
|
|
65 |
#if AP_SERVER_MAJORVERSION_NUMBER == 2 && AP_SERVER_MINORVERSION_NUMBER== 2 |
| 66 |
#define APACHE22 |
| 67 |
#include "mod_auth.h" |
| 68 |
#endif |
| 69 |
|
| 65 |
#ifdef STANDARD20_MODULE_STUFF |
70 |
#ifdef STANDARD20_MODULE_STUFF |
| 66 |
#include <apr_strings.h> |
71 |
#include <apr_strings.h> |
| 67 |
#include <apr_base64.h> |
72 |
#include <apr_base64.h> |
|
Lines 1802-1812
Link Here
|
| 1802 |
return OK; |
1812 |
return OK; |
| 1803 |
} |
1813 |
} |
| 1804 |
|
1814 |
|
|
|
1815 |
#ifdef APACHE22 |
| 1816 |
static authn_status authenticate_user_krb5pwd22(request_rec *r, const char *sent_name, |
| 1817 |
const char *sent_pw) |
| 1818 |
{ |
| 1819 |
const char *realms = NULL; |
| 1820 |
const char *realm = NULL; |
| 1821 |
krb5_context kcontext = NULL; |
| 1822 |
krb5_error_code code; |
| 1823 |
krb5_principal client = NULL; |
| 1824 |
krb5_principal server = NULL; |
| 1825 |
krb5_ccache ccache = NULL; |
| 1826 |
krb5_keytab keytab = NULL; |
| 1827 |
int ret; |
| 1828 |
char *name = NULL; |
| 1829 |
int all_principals_unkown; |
| 1830 |
char *p = NULL; |
| 1831 |
|
| 1832 |
kerb_auth_config *conf = |
| 1833 |
(kerb_auth_config *) ap_get_module_config(r->per_dir_config, |
| 1834 |
&auth_kerb_module); |
| 1835 |
|
| 1836 |
|
| 1837 |
code = krb5_init_context(&kcontext); |
| 1838 |
if (code) { |
| 1839 |
log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
| 1840 |
"Cannot initialize Kerberos5 context (%d)", code); |
| 1841 |
return AUTH_GENERAL_ERROR; |
| 1842 |
} |
| 1843 |
|
| 1844 |
if (sent_pw == NULL || *sent_pw == '\0') { |
| 1845 |
log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
| 1846 |
"empty passwords are not accepted"); |
| 1847 |
ret = AUTH_DENIED; |
| 1848 |
goto end; |
| 1849 |
} |
| 1850 |
|
| 1851 |
if (conf->krb_5_keytab) |
| 1852 |
krb5_kt_resolve(kcontext, conf->krb_5_keytab, &keytab); |
| 1853 |
|
| 1854 |
if (conf->krb_service_name && strchr(conf->krb_service_name, '/') != NULL) |
| 1855 |
ret = krb5_parse_name (kcontext, conf->krb_service_name, &server); |
| 1856 |
else |
| 1857 |
ret = krb5_sname_to_principal(kcontext, ap_get_server_name(r), |
| 1858 |
(conf->krb_service_name) ? conf->krb_service_name : SERVICE_NAME, |
| 1859 |
KRB5_NT_SRV_HST, &server); |
| 1860 |
|
| 1861 |
if (ret) { |
| 1862 |
log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
| 1863 |
"Error parsing server name (%s): %s", |
| 1864 |
(conf->krb_service_name) ? conf->krb_service_name : SERVICE_NAME, |
| 1865 |
krb5_get_err_text(kcontext, ret)); |
| 1866 |
ret = AUTH_DENIED; |
| 1867 |
goto end; |
| 1868 |
} |
| 1869 |
|
| 1870 |
code = krb5_unparse_name(kcontext, server, &name); |
| 1871 |
if (code) { |
| 1872 |
log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
| 1873 |
"krb5_unparse_name() failed: %s", |
| 1874 |
krb5_get_err_text(kcontext, code)); |
| 1875 |
ret = AUTH_DENIED; |
| 1876 |
goto end; |
| 1877 |
} |
| 1878 |
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Using %s as server principal for password verification", name); |
| 1879 |
free(name); |
| 1880 |
name = NULL; |
| 1881 |
|
| 1882 |
p = strchr(sent_name, '@'); |
| 1883 |
if (p) { |
| 1884 |
*p++ = '\0'; |
| 1885 |
if (conf->krb_auth_realms && !ap_find_token(r->pool, conf->krb_auth_realms, p)) { |
| 1886 |
log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
| 1887 |
"Specified realm `%s' not allowed by configuration", p); |
| 1888 |
ret = AUTH_DENIED; |
| 1889 |
goto end; |
| 1890 |
} |
| 1891 |
} |
| 1892 |
|
| 1893 |
realms = (p) ? p : conf->krb_auth_realms; |
| 1894 |
all_principals_unkown = 1; |
| 1895 |
do { |
| 1896 |
name = (char *) sent_name; |
| 1897 |
if (realms && (realm = ap_getword_white(r->pool, &realms))) |
| 1898 |
name = apr_psprintf(r->pool, "%s@%s", sent_name, realm); |
| 1899 |
|
| 1900 |
if (client) { |
| 1901 |
krb5_free_principal(kcontext, client); |
| 1902 |
client = NULL; |
| 1903 |
} |
| 1904 |
|
| 1905 |
code = krb5_parse_name(kcontext, name, &client); |
| 1906 |
if (code) { |
| 1907 |
log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
| 1908 |
"krb5_parse_name() failed: %s", |
| 1909 |
krb5_get_err_text(kcontext, code)); |
| 1910 |
continue; |
| 1911 |
} |
| 1912 |
|
| 1913 |
code = verify_krb5_user(r, kcontext, client, sent_pw, |
| 1914 |
server, keytab, conf->krb_verify_kdc, conf->krb_service_name, &ccache); |
| 1915 |
if (code == 0) |
| 1916 |
break; |
| 1917 |
|
| 1918 |
/* ap_getword_white() used above shifts the parameter, so it's not |
| 1919 |
needed to touch the realms variable */ |
| 1920 |
} while (realms && *realms); |
| 1921 |
|
| 1922 |
memset((char *)sent_pw, 0, strlen(sent_pw)); |
| 1923 |
|
| 1924 |
if (code) { |
| 1925 |
if (all_principals_unkown == 1 && code == KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN) |
| 1926 |
ret = AUTH_USER_NOT_FOUND; |
| 1927 |
else |
| 1928 |
ret = AUTH_DENIED; |
| 1929 |
|
| 1930 |
goto end; |
| 1931 |
} |
| 1932 |
|
| 1933 |
code = krb5_unparse_name(kcontext, client, &name); |
| 1934 |
if (code) { |
| 1935 |
log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "krb5_unparse_name() failed: %s", |
| 1936 |
krb5_get_err_text(kcontext, code)); |
| 1937 |
ret = AUTH_DENIED; |
| 1938 |
goto end; |
| 1939 |
} |
| 1940 |
MK_USER = apr_pstrdup (r->pool, name); |
| 1941 |
MK_AUTH_TYPE = "Basic"; |
| 1942 |
free(name); |
| 1943 |
|
| 1944 |
if (conf->krb_save_credentials) |
| 1945 |
store_krb5_creds(kcontext, r, conf, ccache); |
| 1946 |
|
| 1947 |
ret = AUTH_GRANTED; |
| 1948 |
|
| 1949 |
end: |
| 1950 |
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, |
| 1951 |
"kerb_authenticate_user_krb5pwd22 ret=%d user=%s authtype=%s", |
| 1952 |
ret, (MK_USER)?MK_USER:"(NULL)", (MK_AUTH_TYPE)?MK_AUTH_TYPE:"(NULL)"); |
| 1953 |
if (client) |
| 1954 |
krb5_free_principal(kcontext, client); |
| 1955 |
if (server) |
| 1956 |
krb5_free_principal(kcontext, server); |
| 1957 |
if (ccache) |
| 1958 |
krb5_cc_destroy(kcontext, ccache); |
| 1959 |
if (keytab) |
| 1960 |
krb5_kt_close(kcontext, keytab); |
| 1961 |
krb5_free_context(kcontext); |
| 1962 |
|
| 1963 |
return ret; |
| 1964 |
|
| 1965 |
} |
| 1966 |
|
| 1967 |
static const authn_provider authn_kerberos_provider = |
| 1968 |
{ |
| 1969 |
&authenticate_user_krb5pwd22, |
| 1970 |
NULL |
| 1971 |
}; |
| 1972 |
|
| 1973 |
|
| 1974 |
#endif |
| 1975 |
|
| 1805 |
static void |
1976 |
static void |
| 1806 |
kerb_register_hooks(apr_pool_t *p) |
1977 |
kerb_register_hooks(apr_pool_t *p) |
| 1807 |
{ |
1978 |
{ |
| 1808 |
ap_hook_post_config(kerb_init_handler, NULL, NULL, APR_HOOK_MIDDLE); |
1979 |
ap_hook_post_config(kerb_init_handler, NULL, NULL, APR_HOOK_MIDDLE); |
| 1809 |
ap_hook_check_user_id(kerb_authenticate_user, NULL, NULL, APR_HOOK_MIDDLE); |
1980 |
ap_hook_check_user_id(kerb_authenticate_user, NULL, NULL, APR_HOOK_MIDDLE); |
|
|
1981 |
#ifdef APACHE22 |
| 1982 |
ap_register_provider(p, AUTHN_PROVIDER_GROUP, "kerberos", "0", |
| 1983 |
&authn_kerberos_provider); |
| 1984 |
#endif |
| 1810 |
} |
1985 |
} |
| 1811 |
|
1986 |
|
| 1812 |
module AP_MODULE_DECLARE_DATA auth_kerb_module = |
1987 |
module AP_MODULE_DECLARE_DATA auth_kerb_module = |
