KRB5: Authenticate users in a non-POSIX domain using a MEMORY ccache

Related to:
https://pagure.io/SSSD/sssd/issue/3310

The following changes were done to the Kerberos authentication code
in order to support authentication in a non-POSIX environment:
    - delayed authentication is disabled in non-POSIX domains
    - when a user logs in in a non-POSIX domain, SSSD uses a
      MEMORY:$username ccache and destroys is then krb5_child finishes
      so that just the numeric result is used
    - krb5_child doesn't drop privileges in this configuration because
      there is nothing to drop privileges to

Reviewed-by: Sumit Bose <sbose@redhat.com>

6 files changed, 99 insertions, 22 deletions

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index c2d6d7eea..2faf18d17 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -42,6 +42,8 @@
 #include "providers/krb5/krb5_utils.h"
 #include "providers/krb5/krb5_ccache.h"
 
+#define  NON_POSIX_CCNAME_FMT       "MEMORY:sssd_nonposix_dummy_%u"
+
 static int krb5_mod_ccname(TALLOC_CTX *mem_ctx,
                            struct sysdb_ctx *sysdb,
                            struct sss_domain_info *domain,
@@ -200,6 +202,7 @@ errno_t krb5_setup(TALLOC_CTX *mem_ctx,
     talloc_set_destructor((TALLOC_CTX *) kr, krb5_cleanup);
 
     kr->pd = pd;
+    kr->dom = dom;
     kr->krb5_ctx = krb5_ctx;
 
     ret = get_krb_primary(krb5_ctx->name_to_primary,
@@ -275,8 +278,11 @@ static void krb5_auth_cache_creds(struct krb5_ctx *krb5_ctx,
         return;
     }
 
-    ret = add_user_to_delayed_online_authentication(krb5_ctx, pd, uid);
-    if (ret != EOK) {
+    ret = add_user_to_delayed_online_authentication(krb5_ctx, domain, pd, uid);
+    if (ret == ENOTSUP) {
+        /* This error is not fatal */
+        DEBUG(SSSDBG_MINOR_FAILURE, "Delayed authentication not supported\n");
+    } else if (ret != EOK) {
         /* This error is not fatal */
         DEBUG(SSSDBG_CRIT_FAILURE,
               "add_user_to_delayed_online_authentication failed.\n");
@@ -291,21 +297,43 @@ static errno_t krb5_auth_prepare_ccache_name(struct krb5child_req *kr,
 {
     const char *ccname_template;
 
-    ccname_template = dp_opt_get_cstring(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL);
+    switch (kr->dom->type) {
+    case DOM_TYPE_POSIX:
+        ccname_template = dp_opt_get_cstring(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL);
 
-    kr->ccname = expand_ccname_template(kr, kr, ccname_template,
-                                        kr->krb5_ctx->illegal_path_re, true,
-                                        be_ctx->domain->case_sensitive);
-    if (kr->ccname == NULL) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "expand_ccname_template failed.\n");
-        return ENOMEM;
-    }
+        kr->ccname = expand_ccname_template(kr, kr, ccname_template,
+                                            kr->krb5_ctx->illegal_path_re, true,
+                                            be_ctx->domain->case_sensitive);
+        if (kr->ccname == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "expand_ccname_template failed.\n");
+            return ENOMEM;
+        }
 
-    kr->old_ccname = ldb_msg_find_attr_as_string(user_msg,
-                                                 SYSDB_CCACHE_FILE, NULL);
-    if (kr->old_ccname == NULL) {
-        DEBUG(SSSDBG_TRACE_LIBS,
-                "No ccache file for user [%s] found.\n", kr->pd->user);
+        kr->old_ccname = ldb_msg_find_attr_as_string(user_msg,
+                                                    SYSDB_CCACHE_FILE, NULL);
+        if (kr->old_ccname == NULL) {
+            DEBUG(SSSDBG_TRACE_LIBS,
+                    "No ccache file for user [%s] found.\n", kr->pd->user);
+        }
+        break;
+    case DOM_TYPE_APPLICATION:
+        DEBUG(SSSDBG_TRACE_FUNC,
+               "Domain type application, will use in-memory ccache\n");
+        /* We don't care about using cryptographic randomness, just
+         * a non-predictable ccname, so using rand() here is fine
+         */
+        kr->ccname = talloc_asprintf(kr,
+                                     NON_POSIX_CCNAME_FMT,
+                                     rand() % UINT_MAX);
+        if (kr->ccname == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");
+            return ENOMEM;
+        }
+
+        break;
+    default:
+        DEBUG(SSSDBG_FATAL_FAILURE, "Unsupported domain type\n");
+        return EINVAL;
     }
 
     return EOK;
@@ -617,7 +645,7 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
         kr->uid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
                                                        res->msgs[0],
                                                        SYSDB_UIDNUM, 0);
-        if (kr->uid == 0) {
+        if (kr->uid == 0 && state->domain->type == DOM_TYPE_POSIX) {
             DEBUG(SSSDBG_CONF_SETTINGS,
                   "UID for user [%s] not known.\n", pd->user);
             ret = ENOENT;
@@ -627,7 +655,7 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
         kr->gid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
                                                        res->msgs[0],
                                                        SYSDB_GIDNUM, 0);
-        if (kr->gid == 0) {
+        if (kr->gid == 0 && state->domain->type == DOM_TYPE_POSIX) {
             DEBUG(SSSDBG_CONF_SETTINGS,
                   "GID for user [%s] not known.\n", pd->user);
             ret = ENOENT;
diff --git a/src/providers/krb5/krb5_auth.h b/src/providers/krb5/krb5_auth.h
index 75ad916e7..8ad3aeff2 100644
--- a/src/providers/krb5/krb5_auth.h
+++ b/src/providers/krb5/krb5_auth.h
@@ -50,6 +50,7 @@
 struct krb5child_req {
     struct pam_data *pd;
     struct krb5_ctx *krb5_ctx;
+    struct sss_domain_info *dom;
 
     const char *ccname;
     const char *old_ccname;
@@ -118,6 +119,7 @@ parse_krb5_child_response(TALLOC_CTX *mem_ctx, uint8_t *buf, ssize_t len,
                           struct krb5_child_response **_res);
 
 errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
+                                                  struct sss_domain_info *domain,
                                                   struct pam_data *pd,
                                                   uid_t uid);
 errno_t init_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index a4128dda6..cbbc892be 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -80,6 +80,7 @@ struct krb5_req {
     char *ccname;
     char *keytab;
     bool validate;
+    bool posix_domain;
     bool send_pac;
     bool use_enterprise_princ;
     char *fast_ccname;
@@ -102,6 +103,16 @@ struct krb5_req {
 static krb5_context krb5_error_ctx;
 #define KRB5_CHILD_DEBUG(level, error) KRB5_DEBUG(level, krb5_error_ctx, error)
 
+static errno_t k5c_become_user(uid_t uid, gid_t gid, bool is_posix)
+{
+    if (is_posix == false) {
+        DEBUG(SSSDBG_TRACE_FUNC,
+              "Will not drop privileges for a non-POSIX user\n");
+        return EOK;
+    }
+    return become_user(uid, gid);
+}
+
 static krb5_error_code set_lifetime_options(struct cli_opts *cli_opts,
                                             krb5_get_init_creds_opt *options)
 {
@@ -1561,6 +1572,15 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr,
         DEBUG(SSSDBG_CONF_SETTINGS, "TGT validation is disabled.\n");
     }
 
+    /* In a non-POSIX environment, we only care about the return code from
+     * krb5_child, so let's not even attempt to create the ccache
+     */
+    if (kr->posix_domain == false) {
+        DEBUG(SSSDBG_TRACE_LIBS,
+              "Finished authentication in a non-POSIX domain\n");
+        goto done;
+    }
+
     /* If kr->ccname is cache collection (DIR:/...), we want to work
      * directly with file ccache (DIR::/...), but cache collection
      * should be returned back to back end.
@@ -2146,6 +2166,7 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
     size_t p = 0;
     uint32_t len;
     uint32_t validate;
+    uint32_t posix_domain;
     uint32_t send_pac;
     uint32_t use_enterprise_princ;
     struct pam_data *pd;
@@ -2167,6 +2188,8 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
     SAFEALIGN_COPY_UINT32_CHECK(&kr->gid, buf + p, size, &p);
     SAFEALIGN_COPY_UINT32_CHECK(&validate, buf + p, size, &p);
     kr->validate = (validate == 0) ? false : true;
+    SAFEALIGN_COPY_UINT32_CHECK(&posix_domain, buf + p, size, &p);
+    kr->posix_domain = (posix_domain == 0) ? false : true;
     SAFEALIGN_COPY_UINT32_CHECK(offline, buf + p, size, &p);
     SAFEALIGN_COPY_UINT32_CHECK(&send_pac, buf + p, size, &p);
     kr->send_pac = (send_pac == 0) ? false : true;
@@ -2331,6 +2354,7 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
                                          krb5_context ctx,
                                          uid_t fast_uid,
                                          gid_t fast_gid,
+                                         bool posix_domain,
                                          struct cli_opts *cli_opts,
                                          const char *primary,
                                          const char *realm,
@@ -2420,7 +2444,7 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
                 /* Try to carry on */
             }
 
-            kerr = become_user(fast_uid, fast_gid);
+            kerr = k5c_become_user(fast_uid, fast_gid, posix_domain);
             if (kerr != 0) {
                 DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed: %d\n", kerr);
                 exit(1);
@@ -2572,7 +2596,7 @@ static int k5c_setup_fast(struct krb5_req *kr, bool demand)
     }
 
     kerr = check_fast_ccache(kr, kr->ctx, kr->fast_uid, kr->fast_gid,
-                             kr->cli_opts,
+                             kr->posix_domain, kr->cli_opts,
                              fast_principal, fast_principal_realm,
                              kr->keytab, &kr->fast_ccname);
     if (kerr != 0) {
@@ -2773,7 +2797,7 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
          * the user who is logging in. The same applies to the offline case
          * the user who is logging in. The same applies to the offline case.
          */
-        kerr = become_user(kr->uid, kr->gid);
+        kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
         if (kerr != 0) {
             DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed.\n");
             return kerr;
@@ -3075,7 +3099,7 @@ int main(int argc, const char *argv[])
     if ((sss_authtok_get_type(kr->pd->authtok) != SSS_AUTHTOK_TYPE_SC_PIN
             && sss_authtok_get_type(kr->pd->authtok)
                                         != SSS_AUTHTOK_TYPE_SC_KEYPAD)) {
-        kerr = become_user(kr->uid, kr->gid);
+        kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
         if (kerr != 0) {
             DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed.\n");
             ret = EFAULT;
diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
index 680e67b08..87e79a06e 100644
--- a/src/providers/krb5/krb5_child_handler.c
+++ b/src/providers/krb5/krb5_child_handler.c
@@ -107,6 +107,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
     uint32_t validate;
     uint32_t send_pac;
     uint32_t use_enterprise_principal;
+    uint32_t posix_domain;
     size_t username_len = 0;
     errno_t ret;
 
@@ -131,6 +132,17 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
             break;
     }
 
+    switch (kr->dom->type) {
+    case DOM_TYPE_POSIX:
+        posix_domain = 1;
+        break;
+    case DOM_TYPE_APPLICATION:
+        posix_domain = 0;
+        break;
+    default:
+        return EINVAL;
+    }
+
     if (kr->pd->cmd == SSS_CMD_RENEW || kr->is_offline) {
         use_enterprise_principal = false;
     } else {
@@ -151,7 +163,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
         kr->pd->cmd == SSS_CMD_RENEW ||
         kr->pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM ||
         kr->pd->cmd == SSS_PAM_CHAUTHTOK) {
-        buf->size += 4*sizeof(uint32_t) + strlen(kr->ccname) + strlen(keytab) +
+        buf->size += 5*sizeof(uint32_t) + strlen(kr->ccname) + strlen(keytab) +
                      sss_authtok_get_size(kr->pd->authtok);
 
         buf->size += sizeof(uint32_t);
@@ -182,6 +194,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
     SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->uid, &rp);
     SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->gid, &rp);
     SAFEALIGN_COPY_UINT32(&buf->data[rp], &validate, &rp);
+    SAFEALIGN_COPY_UINT32(&buf->data[rp], &posix_domain, &rp);
     SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->is_offline, &rp);
     SAFEALIGN_COPY_UINT32(&buf->data[rp], &send_pac, &rp);
     SAFEALIGN_COPY_UINT32(&buf->data[rp], &use_enterprise_principal, &rp);
diff --git a/src/providers/krb5/krb5_delayed_online_authentication.c b/src/providers/krb5/krb5_delayed_online_authentication.c
index bf2ef7755..1cb7eade0 100644
--- a/src/providers/krb5/krb5_delayed_online_authentication.c
+++ b/src/providers/krb5/krb5_delayed_online_authentication.c
@@ -234,6 +234,7 @@ static void delayed_online_authentication_callback(void *private_data)
 }
 
 errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
+                                                  struct sss_domain_info *domain,
                                                   struct pam_data *pd,
                                                   uid_t uid)
 {
@@ -242,6 +243,12 @@ errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
     hash_value_t value;
     struct pam_data *new_pd;
 
+    if (domain->type != DOM_TYPE_POSIX) {
+        DEBUG(SSSDBG_MINOR_FAILURE,
+              "Domain type does not support delayed authentication\n");
+        return ENOTSUP;
+    }
+
     if (krb5_ctx->deferred_auth_ctx == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE,
               "Missing context for delayed online authentication.\n");
diff --git a/src/providers/krb5/krb5_init.c b/src/providers/krb5/krb5_init.c
index 12c8dfcc4..66ae68fb4 100644
--- a/src/providers/krb5/krb5_init.c
+++ b/src/providers/krb5/krb5_init.c
@@ -136,6 +136,9 @@ errno_t sssm_krb5_init(TALLOC_CTX *mem_ctx,
         return ENOMEM;
     }
 
+    /* Only needed to generate random ccache names for non-POSIX domains */
+    srand(time(NULL) * getpid());
+
     ret = sss_krb5_get_options(ctx, be_ctx->cdb, be_ctx->conf_path, &ctx->opts);
     if (ret != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Unable to get krb5 options [%d]: %s\n",