gss-proxy.git/proxy/src, branch master-cred_store_config

Remove iniparser configuration backend.

2013-04-12T14:12:42+00:00

Use mutivalued "cred_store" parameter, deprecate unused parameters.

2013-04-12T14:12:42+00:00

The krb5_{ccache,keytab,client_keytab} parameters are replaced with a
multivalued "cred_store" parameter instead.

krb5_keytab = /etc/krb5.keytab

becomes:

cred_store = krb5_keytab:/etc/krb5.keytab

Likewise for the "krb5_ccache" and "krb5_client_keytab" parameters.

Add gp_config_get_string_array() and an implementation in dinglibs backend.

2013-04-12T14:12:42+00:00

This call returns an allocated array of strings. It allows to return multiple
values for a single parameter like:

param = value1
param = value2

This cannot be supported with iniparser, so we have to remove iniparser support.

Fix potential double-frees in load_services().

2013-04-12T14:12:42+00:00

Fix memory leak in gp_service_free().

2013-04-11T14:56:11+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Special case client_keytab for root user

2013-04-10T14:16:44+00:00

Use /etc/krb5.keytab when nfsd service tries to acquire creds and
no id is specified in desired_name.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Use new GSSAPI Credential Store API

2013-04-10T14:15:53+00:00

This is the only thread safe way to pass in aribitrary values for all the bits
of environment we want to use when doing impersonation within gss-proxy.

Requires MIT version 1.12 for the client_keytab part to be operational.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Add generic function to get creds defaults

2013-04-10T14:06:56+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Move string formatting in a separate function

2013-04-10T13:10:17+00:00

This way it can be reused for keytab path names too

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Carefully process desired name based on service

2013-04-10T13:09:52+00:00

In case the name type is GSS_C_NT_STRING_UID_NAME or GSS_NT_MACHINE_UID_NAME
we want to be able to impersonate the user referenced by the uid.

This is allowed exclusively for trusted services otherwise a generic
unprivileged application would be allowed to impersonate any user if there are
credentials available on the system or client keytabs installed.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner