Add krb5_lifetime option

9 files changed, 81 insertions, 7 deletions

diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index bb7e424e9..1286e54d9 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -105,6 +105,7 @@ option_strings = {
     'krb5_validate' : _("Enable credential validation"),
     'krb5_store_password_if_offline' : _("Store password if offline for later online authentication"),
     'krb5_renewable_lifetime' : _("Renewable lifetime of the TGT"),
+    'krb5_lifetime' : _("Lifetime of the TGT"),
 
     # [provider/krb5/chpass]
     'krb5_kpasswd' : _('Server where the change password service is running if not on the KDC'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index b63e40b57..3d57108a3 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -550,7 +550,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
              'krb5_validate',
              'krb5_store_password_if_offline',
              'krb5_auth_timeout',
-             'krb5_renewable_lifetime'])
+             'krb5_renewable_lifetime',
+             'krb5_lifetime'])
 
         options = domain.list_options()
 
@@ -725,7 +726,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
             'krb5_validate',
             'krb5_store_password_if_offline',
             'krb5_auth_timeout',
-            'krb5_renewable_lifetime']
+            'krb5_renewable_lifetime',
+            'krb5_lifetime']
 
         self.assertTrue(type(options) == dict,
                         "Options should be a dictionary")
@@ -874,7 +876,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
              'krb5_validate',
              'krb5_store_password_if_offline',
              'krb5_auth_timeout',
-             'krb5_renewable_lifetime'])
+             'krb5_renewable_lifetime',
+             'krb5_lifetime'])
 
         options = domain.list_options()
 
diff --git a/src/config/etc/sssd.api.d/sssd-krb5.conf b/src/config/etc/sssd.api.d/sssd-krb5.conf
index c3cc5bbf8..f824cfbed 100644
--- a/src/config/etc/sssd.api.d/sssd-krb5.conf
+++ b/src/config/etc/sssd.api.d/sssd-krb5.conf
@@ -12,6 +12,7 @@ krb5_keytab = str, None, false
 krb5_validate = bool, None, false
 krb5_store_password_if_offline = bool, None, false
 krb5_renewable_lifetime = str, None, false
+krb5_lifetime = str, None, false
 
 [provider/krb5/chpass]
 
diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
index 0f0c8a2c1..ff5d0a6ac 100644
--- a/src/man/sssd-krb5.5.xml
+++ b/src/man/sssd-krb5.5.xml
@@ -300,6 +300,38 @@
                     </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                    <term>krb5_lifetime (string)</term>
+                    <listitem>
+                        <para>
+                            Request ticket with a with a lifetime given by an
+                            integer immediately followed by one of the following
+                            delimiters:
+                        </para>
+                        <para>
+                            <emphasis>s</emphasis> seconds
+                        </para>
+                        <para>
+                            <emphasis>m</emphasis> minutes
+                        </para>
+                        <para>
+                            <emphasis>h</emphasis> hours
+                        </para>
+                        <para>
+                            <emphasis>d</emphasis> days.
+                        </para>
+                        <para>
+                            Please note that it is not possible to mix units.
+                            If you want to set the lifetime to one and a half
+                            hours please use '90m' instead of '1h30m'.
+                        </para>
+                        <para>
+                            Default: not set, i.e. the default ticket lifetime
+                            configured on the KDC.
+                        </para>
+                    </listitem>
+                </varlistentry>
+
             </variablelist>
         </para>
     </refsect1>
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 149a352fa..545ddc9e5 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -140,7 +140,8 @@ struct dp_option ipa_def_krb5_opts[] = {
     { "krb5_validate", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     { "krb5_kpasswd", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_store_password_if_offline", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
-    { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING }
+    { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING }
 };
 
 int ipa_get_options(TALLOC_CTX *memctx,
diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index 33b325c0b..be0f361a8 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -40,7 +40,7 @@ struct ipa_service {
 /* the following define is used to keep track of the options in the krb5
  * module, so that if they change and ipa is not updated correspondingly
  * this will trigger a runtime abort error */
-#define IPA_KRB5_OPTS_TEST 10
+#define IPA_KRB5_OPTS_TEST 11
 
 enum ipa_basic_opt {
     IPA_DOMAIN = 0,
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 2a2ed9b47..f29869bc2 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -1179,8 +1179,22 @@ static int krb5_child_setup(struct krb5_req *kr, uint32_t offline)
         krb5_get_init_creds_opt_set_renew_life(kr->options, lifetime);
     }
 
+    lifetime_str = getenv(SSSD_KRB5_LIFETIME);
+    if (lifetime_str == NULL) {
+        DEBUG(7, ("Cannot read [%s] from environment.\n",
+                  SSSD_KRB5_LIFETIME));
+    } else {
+        kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
+        if (kerr != 0) {
+            DEBUG(1, ("krb5_string_to_deltat failed for [%s].\n",
+                      lifetime_str));
+            KRB5_DEBUG(1, kerr);
+            goto failed;
+        }
+        krb5_get_init_creds_opt_set_tkt_life(kr->options, lifetime);
+    }
+
 /* TODO: set options, e.g.
- *  krb5_get_init_creds_opt_set_tkt_life
  *  krb5_get_init_creds_opt_set_forwardable
  *  krb5_get_init_creds_opt_set_proxiable
  *  krb5_get_init_creds_opt_set_etype_list
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index 1a62bbe32..7ee4d09f9 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -41,7 +41,8 @@ struct dp_option default_krb5_opts[] = {
     { "krb5_validate", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "krb5_kpasswd", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_store_password_if_offline", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
-    { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING }
+    { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING }
 };
 
 errno_t check_and_export_options(struct dp_option *opts,
@@ -88,6 +89,25 @@ errno_t check_and_export_options(struct dp_option *opts,
         }
     }
 
+    str = dp_opt_get_string(opts, KRB5_LIFETIME);
+    if (str == NULL) {
+        DEBUG(5, ("No TGT lifetime configured.\n"));
+    } else {
+        ret = krb5_string_to_deltat(str, &lifetime);
+        if (ret != 0) {
+            DEBUG(1, ("Invalid value [%s] for krb5_lifetime.\n",
+                      str));
+            return EINVAL;
+        }
+
+        ret = setenv(SSSD_KRB5_LIFETIME, str, 1);
+        if (ret != EOK) {
+            DEBUG(2, ("setenv [%s] failed.\n",
+                      SSSD_KRB5_LIFETIME));
+            return ret;
+        }
+    }
+
     dummy = dp_opt_get_cstring(opts, KRB5_KDC);
     if (dummy == NULL) {
         DEBUG(1, ("No KDC explicitly configured, using defaults.\n"));
diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h
index 15ef437ba..01d2dbfc0 100644
--- a/src/providers/krb5/krb5_common.h
+++ b/src/providers/krb5/krb5_common.h
@@ -36,6 +36,7 @@
 #define SSSD_KRB5_KDC "SSSD_KRB5_KDC"
 #define SSSD_KRB5_REALM "SSSD_KRB5_REALM"
 #define SSSD_KRB5_RENEWABLE_LIFETIME "SSSD_KRB5_RENEWABLE_LIFETIME"
+#define SSSD_KRB5_LIFETIME "SSSD_KRB5_LIFETIME"
 
 #define KDCINFO_TMPL PUBCONF_PATH"/kdcinfo.%s"
 #define KPASSWDINFO_TMPL PUBCONF_PATH"/kpasswdinfo.%s"
@@ -54,6 +55,7 @@ enum krb5_opts {
     KRB5_KPASSWD,
     KRB5_STORE_PASSWORD_IF_OFFLINE,
     KRB5_RENEWABLE_LIFETIME,
+    KRB5_LIFETIME,
 
     KRB5_OPTS
 };