summaryrefslogtreecommitdiffstats
path: root/src/providers/krb5/krb5_auth.c
Commit message (Collapse)AuthorAgeFilesLines
* KRB5: Do not attempt to get a TGT after a password change using OTPJakub Hrozek2014-03-261-3/+18
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2271 The current krb5_child code attempts to get a TGT for the convenience of the user using the new password after a password change operation. However, an OTP should never be used twice, which means we can't perform the kinit operation after chpass is finished. Instead, we only print a PAM information instructing the user to log out and back in manually. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* KRB5: Handle ERR_CHPASS_FAILEDJakub Hrozek2013-10-291-0/+6
| | | | | | | The Kerberos provider didn't handle ERR_CHPASS_FAILED at all, which resulted in the default return code (System Error) to be returned if password change failed for pretty much any reason, including password too recent etc.
* KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD userJakub Hrozek2013-10-171-0/+6
| | | | | | | If an expired AD user logs in, the SSSD receives KRB5KDC_ERR_CLIENT_REVOKED from the KDC. This error code was not handled by the SSSD which resulted in System Error being returned to the PAM stack.
* krb5: Remove ability to create public directoriesSimo Sorce2013-10-071-4/+2
| | | | | | | | | Setting up public directories is the job of the admin, and current sssd syntax can't express the actual intention of the admin with regrads to which parts of the path should be public or private. Resolves: https://fedorahosted.org/sssd/ticket/2071
* KRB5: Use the correct domain when authenticating with cached passwordJakub Hrozek2013-09-271-4/+4
|
* krb5: Be more lenient on failures for old ccacheSimo Sorce2013-09-251-1/+1
| | | | | | | | | | | Fix a check for an error return code that can be returned when the ccache is not found. Even in case of other errors still do not fail authentication but allow it to proceed using a new ccache file if necessary. Related: https://fedorahosted.org/sssd/ticket/2053
* krb5: save canonical upn to sysdbSumit Bose2013-09-231-2/+3
| | | | | | | | | | | | | If the returned TGT contains a different user principal name (upn) than used in the request, i.e. the upn was canonicalized, we currently save it to sysdb into the same attribute where the upn coming from an LDAP server is stored as well. This means the canonical upn might be overwritten when the user data is re-read from the LDAP server. To avoid this this patch add a new attribute to sysdb where the canonical upn is stored and makes sure it is used when available. Fixes https://fedorahosted.org/sssd/ticket/2060
* KRB: Remove unused function parametersLukas Slebodnik2013-09-121-4/+2
| | | | | Parameter "int *dp_err" and parameter "int *pam_status" were unused in static function krb5_auth_prepare_ccache_name.
* KRB: Remove unused memory contextLukas Slebodnik2013-09-121-1/+1
| | | | mem_ctx was unused in function get_domain_or_subdomain
* krb5: Add file/dir path precheckSimo Sorce2013-09-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Add a precheck on the actual existence at all of the file/dir ccname targeted (for FILE/DIR types), and bail early if nothing is available. While testing I found out that without this check, the krb5_cc_resolve() function we call as user to check old paths would try to create the directory if it didn't exist. With a ccname of DIR:/tmp/ccdir_1000 saved in the user entry this would cause two undesirable side effects: First it would actually create a directory with the old name, when it should not. Second, because for some reason the umask is set to 0127 in sssd_be, it would create the directory with permission 600 (missing the 'x' traverse bit on the directory. If the new ccache has the same name it would cause the krb5_child process to fal to store the credential cache in it. Related: https://fedorahosted.org/sssd/ticket/2061
* krb5: Remove unused ccache backend infrastructureSimo Sorce2013-09-091-26/+0
| | | | | | | | Remove struct sss_krb5_cc_be and the remaining functions that reference it as they are all unused now. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Unify function to create ccache filesSimo Sorce2013-09-091-3/+3
| | | | | | | | | | | Only 2 types (FILE and DIR) need to precreate files or directories on the file system, and the 2 functions were basically identical. Consolidate all in one common function and use that function directly where needed instead of using indirection. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Use new function to validate ccachesSimo Sorce2013-09-091-16/+14
| | | | | | | | | | This function replaces and combines check_for_valid_tgt() and type specific functions that checked for ccache existence by using generic krb5 cache function and executing them as the target user (implicitly validate the target use rcan properly access the ccache). Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: move template check to initializzationSimo Sorce2013-09-091-4/+1
| | | | | | | | | | | | The randomized template check realy only makes sense for the FILE ccache which is the only one that normally needs to use randomizing chars. Also it is better to warn the admin early rather than to warn 'when it is too late'. So move the check at initialization time when we determine what the template actually is. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Move determination of user being activeSimo Sorce2013-09-091-2/+8
| | | | | | | | The way a user is checked for being active does not depend on the ccache type so move that check out of the ccache specific functions. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Replace type-specific ccache/principal checkSimo Sorce2013-09-091-7/+4
| | | | | | | | | Instead of having duplicate functions that are type custom use a signle common function that also performs access to the cache as the user owner, implicitly validating correctness of ownership. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Use krb5_cc_destroy to remove old ccachesSimo Sorce2013-09-091-45/+18
| | | | | | | | | This completely replaces the per-ccache-type custom code to remove old cacches and instead uses libkrb5 base doperations (krb5_cc_destroy) and operating as the user owner. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Fetch ccname template from krb5.confStephen Gallagher2013-08-281-2/+2
| | | | | | | | | | | | | In order to use the same defaults in all system daemons that needs to know how to generate or search for ccaches we introduce ode here to take advantage of the new option called default_ccache_name provided by libkrb5. If set this variable we establish the same default for all programs that surce it out of krb5.conf therefore providing a consistent experience across the system. Related: https://fedorahosted.org/sssd/ticket/2036
* KRB: Replace multiple calls with variableOndrej Kos2013-07-181-6/+9
| | | | | Instead of multiple calls of sss_authtok_get_type, perform the call just once and store into variable.
* KRB: Handle empty password gracefullyOndrej Kos2013-07-181-0/+11
| | | | | | https://fedorahosted.org/sssd/ticket/1814 Return authentication error when empty password is passed.
* KRB5: guess UPN for subdomain usersJakub Hrozek2013-06-271-1/+1
|
* KRB5: use the right authtok type for renewalsSumit Bose2013-06-241-3/+20
|
* KRB: Handle preauthentication error correctlyOndrej Kos2013-06-141-0/+6
| | | | | | https://fedorahosted.org/sssd/ticket/1873 KRB preauthentication error was later mishandled like authentication error.
* Always update cached upn if enterprise principals are usedSumit Bose2013-05-141-3/+4
| | | | | | | | | | Instead of continuing to use the initial upn if enterprise principals are used if should always be replaced. The enterprise principal is stored in the credential cache and without knowing it the ccache_for_princ() calls to determine the location of the credential cache will fail. Fixes https://fedorahosted.org/sssd/ticket/1921
* Only check UPN if enterprise principals are not usedJakub Hrozek2013-05-031-0/+5
| | | | | | | | If enterprise principals are enabled (which is the default in the AD provider), then the returned UPN might be slightly different from the one SSSD constructs before attempting the login. This patch makes SSSD only check if the principal is the same when the enterprise principals are disabled.
* Fix krbcc dir creation issue with MIT krb5 1.11Lukas Slebodnik2013-04-121-1/+11
| | | | | | | | | | | | | | | | In krb5-libs >= 1.11, function krb5_cc_resolve verify if credential cache dir exists. If it doesn't exist, than it will be created with process permissions and not user permissions. Function cc_residual_is_used has already checked for non existing directory, but it wasn't considered to be a failure and therefore next call of krb5_init_context will create directory with wrong permissions. Now if directory doesn't exist, it will be handled like there was not ccache attribute in sysdb cache. We also check if "primary" file in ccache directory has right permissions. But we ignore missing "primary" file. https://fedorahosted.org/sssd/ticket/1822
* Allow setting krb5_renew_interval with a delimiterAriel Barria2013-04-031-3/+15
| | | | | | | https://fedorahosted.org/sssd/ticket/902 changed the data type the krb5_renew_interval to string. function krb5_string_to_deltat is used to convert and allow delimiters
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-021-5/+5
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* Retry the correct service on krb5 child timeoutJakub Hrozek2013-03-181-1/+1
|
* Add support for krb5 1.11's responder callback.Nathaniel McCallum2013-03-081-1/+1
| | | | | | | | | | | krb5 1.11 adds support for a new method for responding to structured data queries. This method, called the responder, provides an alternative to the prompter interface. This patch adds support for this method. It takes the password and provides it via a responder instead of the prompter. In the case of OTP authentication, it also disables the caching of credentials (since the credentials are one-time only).
* Cleanup error message handling for krb5 childSimo Sorce2013-03-041-67/+80
| | | | | | | | | | | | | | | | | | | | Use the new internal SSSD errors, to simplify error handling. Instead of using up to 3 different error types (system, krb5 and pam_status), collapse all error reporting into one error type mapped on errno_t. The returned error can contain either SSSD internal errors, kerberos errors or system errors, they all use different number spaces so there is no overlap and they can be safely merged. This means that errors being sent from the child to the parent are not pam status error messages anymore. The callers have been changed to properly deal with that. Also note that this patch removes returning SSS_PAM_SYSTEM_INFO from the krb5_child for kerberos errors as all it was doing was simply to make the parent emit the same debug log already emitted by the child, and the code is simpler if we do not do that.
* Add be_req_get_data() helper funciton.Simo Sorce2013-01-211-4/+4
| | | | In preparation for making struct be_req opaque.
* Add be_req_get_be_ctx() helper.Simo Sorce2013-01-211-7/+7
| | | | In preparation for making be_req opaque
* Introduce be_req_terminate() helperSimo Sorce2013-01-211-10/+3
| | | | | Call it everywhere instead of directly dereferencing be_req->fn This is in preparation of making be_req opaque.
* Remove sysdb as a be context structure memberSimo Sorce2013-01-211-2/+2
| | | | The sysdb context is already available through the 'domain' structure.
* Add domain argument to sysdb_cache_auth()Simo Sorce2013-01-151-1/+5
|
* Add domain argument to sysdb_cache_password()Simo Sorce2013-01-151-3/+5
|
* Add domain argument to sysdb_set_user_attr()Simo Sorce2013-01-151-5/+8
|
* Add domain argument to sysdb_get_user_attr()Simo Sorce2013-01-151-7/+7
|
* Change pam data auth tokens.Simo Sorce2013-01-101-35/+23
| | | | Use the new authtok abstraction and interfaces throught the code.
* Code can only check for cached passwordsSimo Sorce2013-01-101-4/+17
| | | | | Make it clear to the API users that we can not take arbitrary auth tokens. We can only take a password for now so simplify and clarify the interface.
* let krb5_kpasswd failover workPavel Březina2012-12-101-3/+7
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1680 There were two errors: 1. kr->kpasswd_srv was never set 2. bad service name (KERBEROS) was provided when setting port status, thus the port status never changed
* Fix tevent_req style for krb5_authSimo Sorce2012-12-041-358/+323
| | | | | | No functionality changes, just make the code respect the tevent_req style and naming conventions and enhance readability by adding some helper functions.
* Do not always return PAM_SYSTEM_ERR when offline krb5 authentication failsJakub Hrozek2012-11-121-1/+2
|
* krb5_auth: update with correct UPN if neededSumit Bose2012-10-261-0/+30
| | | | | | | | | The Active Directory KDC handles request case in-sensitive and it might not always to possible to guess the UPN with the correct case. We check if the returned principal has a different case then the one used in the request and updates the principal if needed. This will help using calls from the Kerberos client libraries later on which would otherwise fail because the principal is handled case sensitive by those libraries.
* Use find_or_guess_upn() where neededSumit Bose2012-10-261-14/+13
|
* krb5_mod_ccname: replace wrong memory contextSumit Bose2012-10-261-1/+1
|
* krb5_auth: check if principal belongs to a different realmSumit Bose2012-10-261-0/+7
| | | | | | Add a flag if the principal used for authentication does not belong to our realm. This can be used to act differently for users from other realms.
* krb5_auth_send: check for sub-domainsSumit Bose2012-10-261-5/+15
| | | | | | If there is an authentication request for a user from a sub-domain a temporary sysdb context is generated to allow lookups in the corresponding sub-tree in the cache.
* Log possibly non-randomizable ccache file templateOndrej Kos2012-10-041-2/+5
| | | | | | | fixes https://fedorahosted.org/sssd/ticket/1533 ccache file template is now checked for appended XXXXXX for use with mkstemp. When those characters are not present, warning is written to log.
generated by cgit (git 2.34.1) at 2024-05-21 07:08:56 +0000