summaryrefslogtreecommitdiffstats
path: root/src/providers/krb5/krb5_child_handler.c
Commit message (Collapse)AuthorAgeFilesLines
* KRB5: Move all ccache operations to krb5_child.cJakub Hrozek2014-11-181-0/+13
| | | | | | | | | | | | | | | | | | | The credential cache operations must be now performed by the krb5_child completely, because the sssd_be process might be running as the sssd user who doesn't have access to the ccaches. src/providers/krb5/krb5_ccache.c is still linked against libsss_krb5 until we fix Kerberos ticket renewal as non-root. Also includes a new error code that indicates that the back end should remove the old ccache attribute -- the child can't do that if it's running as the user. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Drop privileges in the child, not the back endJakub Hrozek2014-11-181-8/+0
| | | | | | | | | | | | | | | | | | In future patches, sssd_be will be running as a non-privileged user, who will execute the setuid krb5_child. In this case, the child will start as root and drop the privileges as soon as possible. However, we need to also remove the privilege drop in sssd_be, because if we dropped to the user who is authenticating, we wouldn't be even allowed to execute krb5_child. The krb5_child permissions should be 4750, owned by root.sssd, to make sure only root and sssd can execute the child and if executed by sssd, the child will run as root. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Remove code duplication of struct ioJakub Hrozek2014-11-051-36/+2
| | | | | | | | We had struct io and the associated destructor copied twice in the code already and need it again in the SELinux provider. Instead of adding another copy, move the code to a shared subtree under util/ Reviewed-by: Michal Židek <mzidek@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-121-17/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-31/+31
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* krb5: hint to increase krb5_auth_timeoutPavel Reichl2014-01-221-1/+4
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2202
* FAST: when parsing krb5_child response, make sure to not miss OTP message if ↵Alexander Bokovoy2014-01-091-3/+4
| | | | | | | | | | | | | it was last one The last message in the stream might be with empty payload which means we get only message type and message length (0) returned, i.e. 8 bytes left remaining in the stream after processing preceding message. This makes our calculation at the end of a message processing loop incorrect -- p+2*sizeof(int32_t) can be equal to len, after all. Fixes FAST processing for FreeIPA native OTP case: https://fedorahosted.org/sssd/ticket/2186
* krb5: Alignment warning reported by clangMichal Zidek2013-11-151-7/+7
| | | | | | | Do not store address from byte buffer into pointer of diffrent type! https://fedorahosted.org/sssd/ticket/1359
* krb5: do not expand enterprise principals is offlineSumit Bose2013-09-231-1/+1
| | | | | | | | Expanding a principle to an enterprise principal only makes sense if there is a KDC available which can process it. If we are offline the plain principal should be used, e.g. to create an expired ccache. Fixes https://fedorahosted.org/sssd/ticket/2060
* Fix formating of variables with type: time_tLukas Slebodnik2013-09-111-1/+1
|
* Fix formating of variables with type: size_tLukas Slebodnik2013-09-111-1/+1
|
* Fix formating of variables with type: ssize_tLukas Slebodnik2013-09-111-1/+1
|
* KRB5: Do not send PAC in server modeJakub Hrozek2013-07-231-5/+11
| | | | | | | | The krb5 child contacts the PAC responder for any user except for the IPA native users if the PAC is configured. This works fine for the general case but the ipa_server_mode is a special one. The PAC responder is there, but since in the server mode we should be operating as AD provider default, the PAC shouldn't be analyzed either in this case.
* Fix warnings: uninitialized variableLukas Slebodnik2013-07-221-2/+2
|
* SIGCHLD handler: do not call callback when pvt data where freedPavel Březina2013-07-171-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1992
* krb5: do not use enterprise principals for renewalsSumit Bose2013-06-251-1/+6
| | | | | | When renewing a ticket we already know the canonical principal hence it is not needed to expand it to an enterprise principal but we can contact the KDC of the corresponding realm directly.
* krb5: do not send pac for IPA users from the local domainSumit Bose2013-06-251-3/+9
| | | | | | | | | | | | | So far we didn't send the PAC of IPA users to the PAC responder during password authentication because group memberships for IPA users can be retrieved efficiently with LDAP calls. Recently patches added PAC support for the AD provider as well and removed the restriction for the IPA users. This patch restores the original behaviour by introducing a new flag in struct krb5_ctx which is only set for the IPA provider. Additionally a different flag is renamed to make it's purpose more clear. Fixes https://fedorahosted.org/sssd/ticket/1995
* Fix typo in pack_authtok()Sumit Bose2013-06-241-1/+1
|
* Allow usage of enterprise principalsSumit Bose2013-04-221-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | Enterprise principals are currently most useful for the AD provider and hence enabled here by default while for the other Kerberos based authentication providers they are disabled by default. If additional UPN suffixes are configured for the AD domain the user principal stored in the AD LDAP server might not contain the real Kerberos realm of the AD domain but one of the additional suffixes which might be completely randomly chooses, e.g. are not related to any existing DNS domain. This make it hard for a client to figure out the right KDC to send requests to. To get around this enterprise principals (see http://tools.ietf.org/html/rfc6806 for details) were introduced. Basically a default realm is added to the principal so that the Kerberos client libraries at least know where to send the request to. It is not in the responsibility of the KDC to either handle the request itself, return a client referral if he thinks a different KDC can handle the request or return and error. This feature is also use to allow authentication in AD environments with cross forest trusts. Fixes https://fedorahosted.org/sssd/ticket/1842
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-021-4/+4
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* Fix initialization of multiple variablesOndrej Kos2013-03-131-2/+2
|
* Add support for krb5 1.11's responder callback.Nathaniel McCallum2013-03-081-0/+7
| | | | | | | | | | | krb5 1.11 adds support for a new method for responding to structured data queries. This method, called the responder, provides an alternative to the prompter interface. This patch adds support for this method. It takes the password and provides it via a responder instead of the prompter. In the case of OTP authentication, it also disables the caching of credentials (since the credentials are one-time only).
* Change pam data auth tokens.Simo Sorce2013-01-101-10/+49
| | | | Use the new authtok abstraction and interfaces throught the code.
* krb5_child: send back the client principalSumit Bose2012-10-261-0/+16
| | | | | | | | | | | | | In general Kerberos is case sensitive but the KDC of Active Directory typically handles request case in-sensitive. In the case where we guess a user principal by combining the user name and the realm and are not sure about the cases of the letters used in the user name we might get a valid ticket from the AD KDC but are not able to access it with the Kerberos client library because we assume a wrong case. The client principal in the returned credentials will always have the right cases. To be able to update the cache user principal name the krb5_child will return the principal for further processing.
* krb5_auth: send different_realm flag to krb5_childSumit Bose2012-10-261-1/+4
| | | | | | | The different_realm flag which was set by the responder is send to the krb5_child so that it can act differently on users from other realms. To avoid code duplication and inconsistent behaviour the krb5_child will not set the flag on its own but use the one from the provider.
* Fix uninitialized valuesNick Guay2012-07-181-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1379
* Fix uninitialized memcpy errorStephen Gallagher2012-07-091-0/+2
| | | | Coverity #12784
* Split parse_krb5_child_response so it can be reusedJakub Hrozek2012-06-141-0/+132
| | | | | krb5-child-test will be another consumer. It also makes the code more readable by splitting a huge function.
* Allow redefining the KRB5_CHILD pathJakub Hrozek2012-06-141-3/+7
| | | | | The krb5-child-test will want to run the child from the current directory.
* Move child_common routines to utilStephen Gallagher2011-12-191-1/+1
|
* Add support for automatic Kerberos ticket renewalSumit Bose2010-12-031-0/+2
|
* Send authtok_type to krb5_childSumit Bose2010-12-031-2/+4
|
* Make handle_child_* request publicSumit Bose2010-11-041-0/+409
I took the opportunity to move everything related to the handling of the krb5_child into a separate file and cleaned the interfaces and related structures a bit.
generated by cgit (git 2.34.1) at 2024-05-17 14:21:59 +0000