diff options
| author | Jan Zeleny <jzeleny@redhat.com> | 2011-03-28 06:45:35 -0400 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2011-04-25 08:06:34 -0400 |
| commit | 8cf1b4183577237d965068d70cd06bd0716aea84 (patch) | |
| tree | 29e815914029e6ab886d784256c5af2280f1199a /src/providers/krb5/krb5_child.c | |
| parent | cfd79b92d3813ed53ef51ae2cf93be6287e73a27 (diff) | |
| download | sssd-8cf1b4183577237d965068d70cd06bd0716aea84.tar.gz sssd-8cf1b4183577237d965068d70cd06bd0716aea84.tar.xz sssd-8cf1b4183577237d965068d70cd06bd0716aea84.zip | |
Allow new option to specify principal for FAST
https://fedorahosted.org/sssd/ticket/700
Diffstat (limited to 'src/providers/krb5/krb5_child.c')
| -rw-r--r-- | src/providers/krb5/krb5_child.c | 45 |
1 files changed, 42 insertions, 3 deletions
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index 1ed63f6b2..fcd108aac 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -1221,7 +1221,8 @@ done: return krberr; } -static krb5_error_code check_fast_ccache(krb5_context ctx, const char *realm, +static krb5_error_code check_fast_ccache(krb5_context ctx, const char *primary, + const char *realm, const char *keytab_name, TALLOC_CTX *mem_ctx, char **fast_ccname) @@ -1260,7 +1261,7 @@ static krb5_error_code check_fast_ccache(krb5_context ctx, const char *realm, goto done; } - kerr = find_principal_in_keytab(ctx, keytab, NULL, realm, &client_princ); + kerr = find_principal_in_keytab(ctx, keytab, primary, realm, &client_princ); if (kerr != 0) { DEBUG(1, ("find_principal_in_keytab failed.\n")); goto done; @@ -1322,6 +1323,11 @@ static int krb5_child_setup(struct krb5_req *kr, uint32_t offline) krb5_error_code kerr = 0; char *lifetime_str; char *use_fast_str; + char *tmp_str; + krb5_data *realm_data; + krb5_principal fast_princ_struct; + char *fast_principal = NULL; + const char *fast_principal_realm = NULL; krb5_deltat lifetime; kr->krb5_ctx = talloc_zero(kr, struct krb5_child_ctx); @@ -1443,7 +1449,40 @@ static int krb5_child_setup(struct krb5_req *kr, uint32_t offline) DEBUG(9, ("Not using FAST.\n")); } else if (strcasecmp(use_fast_str, "try") == 0 || strcasecmp(use_fast_str, "demand") == 0) { - kerr = check_fast_ccache(kr->ctx, kr->krb5_ctx->realm, kr->keytab, + + tmp_str = getenv(SSSD_KRB5_FAST_PRINCIPAL); + if (!tmp_str) { + fast_principal = NULL; + fast_principal_realm = kr->krb5_ctx->realm; + } else { + kerr = krb5_parse_name(kr->ctx, tmp_str, &fast_princ_struct); + if (kerr) { + DEBUG(1, ("krb5_parse_name failed.\n")); + goto failed; + } + kerr = krb5_unparse_name_flags(kr->ctx, fast_princ_struct, + KRB5_PRINCIPAL_UNPARSE_NO_REALM, + &tmp_str); + if (kerr) { + DEBUG(1, ("krb5_unparse_name_flags failed.\n")); + goto failed; + } + fast_principal = talloc_strdup(kr, tmp_str); + if (!fast_principal) { + DEBUG(1, ("talloc_strdup failed.\n")); + kerr = KRB5KRB_ERR_GENERIC; + goto failed; + } + free(tmp_str); + realm_data = krb5_princ_realm(kr->ctx, fast_princ_struct); + fast_principal_realm = talloc_asprintf(kr, "%.*s", realm_data->length, realm_data->data); + if (!fast_principal_realm) { + DEBUG(1, ("talloc_asprintf failed.\n")); + goto failed; + } + } + + kerr = check_fast_ccache(kr->ctx, fast_principal, fast_principal_realm, kr->keytab, kr, &kr->fast_ccname); if (kerr != 0) { DEBUG(1, ("check_fast_ccache failed.\n")); |