diff options
author | Sumit Bose <sbose@redhat.com> | 2012-10-23 21:30:17 +0200 |
---|---|---|
committer | Jakub Hrozek <jhrozek@redhat.com> | 2012-11-05 00:14:05 +0100 |
commit | ef3053bd244cb3b104b608b338c764c6a2e34f29 (patch) | |
tree | 6e3405f1da00c2f632a7433c0c606ad3c28ad0c0 /src/providers/krb5/krb5_child.c | |
parent | b3ea76f3c6d32b4fbf29caa2f4f6ec4138da5be1 (diff) | |
download | sssd-ef3053bd244cb3b104b608b338c764c6a2e34f29.tar.gz sssd-ef3053bd244cb3b104b608b338c764c6a2e34f29.tar.xz sssd-ef3053bd244cb3b104b608b338c764c6a2e34f29.zip |
krb5_child: send back the client principal
In general Kerberos is case sensitive but the KDC of Active Directory
typically handles request case in-sensitive. In the case where we guess
a user principal by combining the user name and the realm and are not
sure about the cases of the letters used in the user name we might get a
valid ticket from the AD KDC but are not able to access it with the
Kerberos client library because we assume a wrong case.
The client principal in the returned credentials will always have the
right cases. To be able to update the cache user principal name the
krb5_child will return the principal for further processing.
Diffstat (limited to 'src/providers/krb5/krb5_child.c')
-rw-r--r-- | src/providers/krb5/krb5_child.c | 29 |
1 files changed, 24 insertions, 5 deletions
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index 4bfbf4bf3..3e64a8652 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -785,10 +785,13 @@ static errno_t sendresponse(int fd, krb5_error_code kerr, int pam_status, return EOK; } -static errno_t add_ticket_times_to_response(struct krb5_req *kr) +static errno_t add_ticket_times_and_upn_to_response(struct krb5_req *kr) { int ret; int64_t t[4]; + krb5_error_code kerr; + char *upn = NULL; + unsigned int upn_len = 0; t[0] = (int64_t) kr->creds->times.authtime; t[1] = (int64_t) kr->creds->times.starttime; @@ -799,8 +802,24 @@ static errno_t add_ticket_times_to_response(struct krb5_req *kr) 4*sizeof(int64_t), (uint8_t *) t); if (ret != EOK) { DEBUG(1, ("pack_response_packet failed.\n")); + goto done; + } + + kerr = krb5_unparse_name_ext(kr->ctx, kr->creds->client, &upn, &upn_len); + if (kerr != 0) { + DEBUG(SSSDBG_OP_FAILURE, ("krb5_unparse_name failed.\n")); + goto done; + } + + ret = pam_add_response(kr->pd, SSS_KRB5_INFO_UPN, upn_len, + (uint8_t *) upn); + krb5_free_unparsed_name(kr->ctx, upn); + if (ret != EOK) { + DEBUG(1, ("pack_response_packet failed.\n")); + goto done; } +done: return ret; } @@ -1054,9 +1073,9 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr, goto done; } - ret = add_ticket_times_to_response(kr); + ret = add_ticket_times_and_upn_to_response(kr); if (ret != EOK) { - DEBUG(1, ("add_ticket_times_to_response failed.\n")); + DEBUG(1, ("add_ticket_times_and_upn_to_response failed.\n")); } kerr = 0; @@ -1447,9 +1466,9 @@ static errno_t renew_tgt_child(int fd, struct krb5_req *kr) goto done; } - ret = add_ticket_times_to_response(kr); + ret = add_ticket_times_and_upn_to_response(kr); if (ret != EOK) { - DEBUG(1, ("add_ticket_times_to_response failed.\n")); + DEBUG(1, ("add_ticket_times_and_upn_to_response failed.\n")); } status = PAM_SUCCESS; |