summaryrefslogtreecommitdiffstats
path: root/src/providers/krb5/krb5_child.c
Commit message (Collapse)AuthorAgeFilesLines
* KRB5: Do not attempt to get a TGT after a password change using OTPJakub Hrozek2014-03-261-0/+12
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2271 The current krb5_child code attempts to get a TGT for the convenience of the user using the new password after a password change operation. However, an OTP should never be used twice, which means we can't perform the kinit operation after chpass is finished. Instead, we only print a PAM information instructing the user to log out and back in manually. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* krb5-child: add revert_changepw_options()Sumit Bose2014-03-211-0/+22
| | | | | | | | | | After changing the Kerberos password krb5-child will try to get a fresh TGT with the new password. This patch tries to make sure the right gic options are used. Resolves: https://fedorahosted.org/sssd/ticket/2289 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_client: rename krb5_set_canonicalize() to set_canonicalize_option()Sumit Bose2014-03-211-16/+16
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5-child: extract lifetime settings into set_lifetime_options()Sumit Bose2014-03-211-34/+55
| | | | | | | | Additionally the lifetime option flags are unset if there are no explicit settings to make sure the defaults from krb5.conf are used even if other values were set manually in between. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_child: remove unused option lifetime_str from k5c_setup_fast()Sumit Bose2014-03-211-6/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA/KRB5: handle KRB5_PROG_ETYPE_NOSUPP during IPA password migrationSumit Bose2014-03-121-0/+4
| | | | | | | Fixes https://fedorahosted.org/sssd/ticket/2279 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 63bf0b7697d5a51b5338070d0e2652d49a4728ce)
* Fix krb5 changepw when FAST-only preauth methods are used (like OTP)Nathaniel McCallum2014-03-101-34/+6
| | | | | | | | | | | | | | | | | | | | | Before this patch, a different set of options was used when calling krb5_get_init_creds_password() for the changepw principal. Because this set of options did not contain the same FAST settings as the options for normal requests, all authentication would fail when the password of a FAST-only account would expire. The two sets approach was cargo-cult from kinit where multiple requests could be issued using the same options set. However, in the case of krb5_child, only one request (or occasionally a well-defined second request) will be issued. Two option sets are therefore not required. To fix this problem we removed the second option set used for changepw requests. All requests now use a single option set which is modified, if needed, for well-defined subsequent requests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* krb5: fix warning may be used uninitializedLukas Slebodnik2014-01-291-0/+1
|
* krb5: Use right function to free data.Lukas Slebodnik2013-10-221-1/+2
| | | | | | | In function create_empty_cred, krb5_creds was aloocated using calloc, but krb5_free_creds was used to remove this creds in done section. Therefore clang static analyzer repoted this as warning: Potential leak of memory pointed to by 'cred'
* krb5: Remove warning dereference of a null pointerLukas Slebodnik2013-10-171-4/+2
| | | | | | | | | Variable kr->creds is initialized in function krb5_get_init_creds_password. It does not make sense to check kr->creds for null, because we have already checked return value of function krb5_get_init_creds_password. Resolves: https://fedorahosted.org/sssd/ticket/2112
* KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD userJakub Hrozek2013-10-171-0/+3
| | | | | | | If an expired AD user logs in, the SSSD receives KRB5KDC_ERR_CLIENT_REVOKED from the KDC. This error code was not handled by the SSSD which resulted in System Error being returned to the PAM stack.
* KRB5: Return ERR_NETWORK_IO when trusted AD server can't be resolvedJakub Hrozek2013-09-271-0/+1
|
* KRB5: Call umask before mkstemp in the krb5 child codeJakub Hrozek2013-09-171-0/+3
|
* Fix formating of variables with type: size_tLukas Slebodnik2013-09-111-3/+3
|
* Fix formating of variables with type: longLukas Slebodnik2013-09-111-1/+1
|
* krb5_child: Simplify ccache creationSimo Sorce2013-09-091-387/+87
| | | | | | | | | | | | The containing ccache directory is precreated by the parent code, so there is no special need to do so here for any type. Also the special handling for the FILE ccache temporary file is not really useful, because libkrb5 internally unlinks and then recreate the file, so mkstemp cannot really prevent subtle races, it can only make sure the file is unique at creation time. Resolves: https://fedorahosted.org/sssd/ticket/2061
* KRB5: Add support for KEYRING cache typeStephen Gallagher2013-08-271-0/+49
| | | | https://fedorahosted.org/sssd/ticket/2036
* KRB5: Remove unnecessary call to become_user()Stephen Gallagher2013-08-271-6/+0
| | | | | | | | By the time that the create_ccache_in_dir() routine is called, we are already guaranteed to have dropped privileges. This has either happened because we dropped them before the exec() in the normal operation case or because we dropped them explicitly after we completed the TGT validation step if that or FAST is configured.
* KRB5: Add new #define for collection cache typesStephen Gallagher2013-08-221-8/+8
| | | | | | Kerberos now supports multiple types of collection caches, not just DIR: caches. We should add a macro for generic collection behavior and use that where appropriate.
* KRB5: Do not log to syslog on each loginJakub Hrozek2013-08-191-1/+3
|
* KRB5: Formatting changesJakub Hrozek2013-08-191-4/+4
|
* ldap, krb5: More descriptive msg on chpass failure.Michal Zidek2013-08-111-0/+15
| | | | | | | | Print more descriptive message when wrong current password is given during password change operation. resolves: https://fedorahosted.org/sssd/ticket/2029
* Fix warnings: uninitialized variableLukas Slebodnik2013-07-221-2/+1
|
* Remove unused memory context from function unpack_authtokLukas Slebodnik2013-07-221-3/+3
|
* print hint about password complexity when new password is rejectedPavel Březina2013-07-171-1/+7
| | | | https://fedorahosted.org/sssd/ticket/1827
* Use conditional build for retrieving ccache.Lukas Slebodnik2013-07-151-47/+2
| | | | | | | | Some krb5 functions needn't be available for retrieving ccache with principal. Therefore ifdef is used to solve this situation with older version of libkrb5. There were two functions with similar functionality in krb5_child and krb5_utils. They were merged to one universal function, which was moved to file src/util/sss_krb5.c
* KRB5_CHILD: Fix handling of get_password return codeOndrej Kos2013-07-101-4/+10
| | | | The switch statement was dead code due to missing case/default.
* Do not switch to credentials everytime.Lukas Slebodnik2013-06-261-4/+69
| | | | | | | | | If user decide to kinit as another user we do not want to switch back to user ccache at another login. We will switch to new ccache if and only if default principal name is the same as current principal name, or there is not any default ccache. https://fedorahosted.org/sssd/ticket/1936
* Every time return directory for krb5 cache collection.Lukas Slebodnik2013-06-261-3/+60
| | | | | | | | Function krb5_cc_get_full_name is called only as a way to validate that, we have the right cache. Instead of returned name, location will be returned from function cc_dir_cache_for_princ. https://fedorahosted.org/sssd/ticket/1936
* krb5: do not send pac for IPA users from the local domainSumit Bose2013-06-251-7/+7
| | | | | | | | | | | | | So far we didn't send the PAC of IPA users to the PAC responder during password authentication because group memberships for IPA users can be retrieved efficiently with LDAP calls. Recently patches added PAC support for the AD provider as well and removed the restriction for the IPA users. This patch restores the original behaviour by introducing a new flag in struct krb5_ctx which is only set for the IPA provider. Additionally a different flag is renamed to make it's purpose more clear. Fixes https://fedorahosted.org/sssd/ticket/1995
* Revert "Always send the PAC to the PAC responder"Sumit Bose2013-06-251-18/+20
| | | | This reverts commit d153941864fe481399665be8fe583c9317194a99.
* Set default realm for enterprise principalsSumit Bose2013-06-171-0/+12
| | | | | | | | | | Enterprise principals require that a default realm is available. To make SSSD more robust in the case that the default realm option is missing in krb5.conf or to allow SSSD to work with multiple unconnected realms (e.g. AD domains without trust between them) the default realm will be set explicitly. Fixes https://fedorahosted.org/sssd/ticket/1931
* Use principal from the ticket to find validation entrySumit Bose2013-06-171-1/+1
| | | | | | | | | If canonicalization or enterprise principals are enabled the realm of the client principal might have changed compared to the original request. To find the most suitable keytab entry to validate the TGT is it better to use the returned client principal. Fixes https://fedorahosted.org/sssd/ticket/1931
* KRB: Handle preauthentication error correctlyOndrej Kos2013-06-141-1/+3
| | | | | | https://fedorahosted.org/sssd/ticket/1873 KRB preauthentication error was later mishandled like authentication error.
* Always send the PAC to the PAC responderSumit Bose2013-06-061-20/+18
| | | | | | | | | | | Currently while doing a Kerberos based authentication the PAC was only send to the PAC responder for principals from a different realm. This reflects the FreeIPA use case of users from trusted domains. This restriction does not make sense anymore when the data from the PAC should be used for the AD provider as well. It also makes only limited sense for the IPA use case, because when using GSSAPI the PAC of users from the local IPA domain are already evaluated by the PAC responder.
* Fixing critical format string issues.Lukas Slebodnik2013-05-201-1/+3
| | | | | | --missing arguments. --format '%s', but argument is integer. --wrong format string, examle: '%\n'
* Allow usage of enterprise principalsSumit Bose2013-04-221-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | Enterprise principals are currently most useful for the AD provider and hence enabled here by default while for the other Kerberos based authentication providers they are disabled by default. If additional UPN suffixes are configured for the AD domain the user principal stored in the AD LDAP server might not contain the real Kerberos realm of the AD domain but one of the additional suffixes which might be completely randomly chooses, e.g. are not related to any existing DNS domain. This make it hard for a client to figure out the right KDC to send requests to. To get around this enterprise principals (see http://tools.ietf.org/html/rfc6806 for details) were introduced. Basically a default realm is added to the principal so that the Kerberos client libraries at least know where to send the request to. It is not in the responsibility of the KDC to either handle the request itself, return a client referral if he thinks a different KDC can handle the request or return and error. This feature is also use to allow authentication in AD environments with cross forest trusts. Fixes https://fedorahosted.org/sssd/ticket/1842
* Check for correct variable nameJakub Hrozek2013-04-031-4/+0
| | | | https://fedorahosted.org/sssd/ticket/1864
* krb5 child: Use the correct type when processing OTPJakub Hrozek2013-04-031-1/+1
|
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-021-14/+14
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* Reusing create_pam_data() on the other places.Lukas Slebodnik2013-04-021-1/+1
| | | | | | Function create_pam_data() should be only one way how to create new struct pam_data, because it also initialize destructor to created object.
* Add support for krb5 1.11's responder callback.Nathaniel McCallum2013-03-081-0/+223
| | | | | | | | | | | krb5 1.11 adds support for a new method for responding to structured data queries. This method, called the responder, provides an alternative to the prompter interface. This patch adds support for this method. It takes the password and provides it via a responder instead of the prompter. In the case of OTP authentication, it also disables the caching of credentials (since the credentials are one-time only).
* Cleanup error message handling for krb5 childSimo Sorce2013-03-041-229/+160
| | | | | | | | | | | | | | | | | | | | Use the new internal SSSD errors, to simplify error handling. Instead of using up to 3 different error types (system, krb5 and pam_status), collapse all error reporting into one error type mapped on errno_t. The returned error can contain either SSSD internal errors, kerberos errors or system errors, they all use different number spaces so there is no overlap and they can be safely merged. This means that errors being sent from the child to the parent are not pam status error messages anymore. The callers have been changed to properly deal with that. Also note that this patch removes returning SSS_PAM_SYSTEM_INFO from the krb5_child for kerberos errors as all it was doing was simply to make the parent emit the same debug log already emitted by the child, and the code is simpler if we do not do that.
* krb5_child: fix value type and initializationOndrej Kos2013-03-041-1/+2
| | | | ret was defined as integer, instead of errno_t, and was uninitialized
* Refactor krb5 childSimo Sorce2013-02-281-288/+210
| | | | | | | | | | | | | | | | | | | | | | | | | | The aim of this refactoring is to make the code readable and understandable. This code has grown organically over time and has becomed confused and baroque enough that understanding it's very simple flow had become very complex for the uninitiated. Complex flows easily hide nasty bugs. Improvements: - Remove dead/unused data storage - Fix and simplify talloc hierarchy, use a memory context (kr) for the whole code and allocate kr->pd where it is filled up. - Rename some functions to create a better name space (easier for searching fucntions across the tree) - Streamline setup function, by spliting out fast setup in a subroutine. - Avoid confusing indirection in executng actual functions by not using the krb5_req child_req member. - Make main() flow s now simmetric, send abck data from the main function instead of delegating a reply to every inner function that implements a command. Now the flow is evident from the main function: 1. read request 2. setup data 3. execute command 4. send reply back
* krb5_child style fixSimo Sorce2013-02-281-11/+11
| | | | Use the standard 'done' label for exceptions.
* Change pam data auth tokens.Simo Sorce2013-01-101-71/+77
| | | | Use the new authtok abstraction and interfaces throught the code.
* Disable canonicalization during password changesSumit Bose2012-11-191-2/+43
| | | | | | | | | | | | | | | If canonicalization is enabled Active Directory KDCs return 'krbtgt/AD.DOMAIN' as service name instead of the expected 'kadmin/changepw' which causes a 'KDC reply did not match expectations' error. Additionally the forwardable and proxiable flags are disabled, the renewable lifetime is set to 0 and the lifetime of the ticket is set to 5 minutes as recommended in https://fedorahosted.org/sssd/ticket/1405 and also done by the kpasswd utility. Fixes: https://fedorahosted.org/sssd/ticket/1405 https://fedorahosted.org/sssd/ticket/1615
* Just use the service name with krb5_get_init_creds_password()Sumit Bose2012-11-191-24/+2
| | | | | | | | | Currently we add the realm name to change password principal but according to the MIT Kerberos docs and the upstream usage the realm name is just ignored. Dropping the realm name also does not lead to confusion if the change password request was received for a user of a trusted domain.
* Only build extract_and_send_pac on platforms that support itJakub Hrozek2012-11-121-104/+18
|
generated by cgit (git 2.34.1) at 2024-05-04 02:47:05 +0000