summaryrefslogtreecommitdiffstats
path: root/src/providers/krb5
Commit message (Collapse)AuthorAgeFilesLines
* KRB5: Authenticate users in a non-POSIX domain using a MEMORY ccacheJakub Hrozek2017-03-306-22/+99
| | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 The following changes were done to the Kerberos authentication code in order to support authentication in a non-POSIX environment: - delayed authentication is disabled in non-POSIX domains - when a user logs in in a non-POSIX domain, SSSD uses a MEMORY:$username ccache and destroys is then krb5_child finishes so that just the numeric result is used - krb5_child doesn't drop privileges in this configuration because there is nothing to drop privileges to Reviewed-by: Sumit Bose <sbose@redhat.com>
* krb5: return to responder that pkinit is not availableSumit Bose2017-03-291-4/+13
| | | | | | | | | | | If pkinit is not available for a user but other authentication methods are SSSD should still fall back to local certificate based authentication if Smartcard credentials are provided. Resolves https://pagure.io/SSSD/sssd/issue/3343 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: allow pkinit pre-authenticationSumit Bose2017-02-233-13/+297
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam: enhance Smartcard authentication tokenSumit Bose2017-02-232-1/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Suppres implicit-fallthrough from gcc 7Lukas Slebodnik2017-02-011-0/+1
| | | | | | | Some kind of comments are recognized by gcc7 but they are ignored with -Wimplicit-fallthrough=5 and only attributes disable the warning. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: Advise the user to inspect the krb5_child.log if the child fails with ↵Jakub Hrozek2017-01-121-0/+3
| | | | | | | | | | | | | | a System Error It's often not clear to admins where to look further if the krb5_child fails with a generic error. This patch just adds a DEBUG message advising the admin to look into the krb5_child.log for more information. Related: https://fedorahosted.org/sssd/ticket/2955 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* krb5: fix two memory leaksSumit Bose2016-11-281-7/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: Use command line arguments instead env vars for krb5_childSumit Bose2016-11-287-131/+276
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/697 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Remove spurious warning in logsLukas Slebodnik2016-11-221-1/+1
| | | | | | | | | | The option krb5_map_user is empty by default. Therefore we should not confuse users wih warning (Fri Nov 15 09:58:49 2016) [sssd[be[example.com]]] [parse_krb5_map_user] (0x0200): Warning: krb5_map_user is empty! Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: Fixing FQ name of user in krb5_setup()Petr Čech2016-09-224-3/+36
| | | | | | | | | | This patch fixes creation of FQ username if krb5_map_user option ise used. Resolves: https://fedorahosted.org/sssd/ticket/3188 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Remove double semicolon at the end of lineLukas Slebodnik2016-09-211-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5: Return ERR_NETWORK_IO on clock skewJakub Hrozek2016-09-131-0/+2
| | | | | | | | | | | Adds two more return codes to the list of codes we translate to ERR_NETWORK_IO. Resolves: https://fedorahosted.org/sssd/ticket/3174 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Send the output username, not internal fqname to krb5_childJakub Hrozek2016-09-084-11/+30
| | | | | | | | | | | | | | | | | | krb5_child calls krb5_kuserok() during the access phase which checks if a particular user is allowed to authenticate as a particular principal. We used to pass the internal fqname to krb5_kuserok() which broke the functionality and all users were denied access. This patch changes that to send the 'output' username to krb5_child, because that's the username the system receives through getpwnam() or getpwuid() anyway. The patch also adds a new structure member fo the krb5child_req structure to avoid reusing the pd->user variable but have an explicit one that serves as the input for the child process. Resolves: https://fedorahosted.org/sssd/ticket/3172 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM/KRB5: optional otp and password promptingSumit Bose2016-07-071-3/+82
| | | | | | | | | | Depending on the available Kerberos pre-authentication methods pam_sss will prompt the user for a password, 2 authentication factors or both. Resolves https://fedorahosted.org/sssd/ticket/2988 Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Use shortname when expanding the user template in Kerberos ccacheJakub Hrozek2016-07-071-4/+4
| | | | | | | | Creating the username part of the ccache file is an output operation, it makes sense to use sss_output_name() there which parses the name out of the internal qualified name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Rely on sysdb names for the renewal taskJakub Hrozek2016-07-071-18/+6
| | | | | | | The domain name is part of the domain name, so we can parse it from there instead of relying on DN components. Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Rely on internal fqname when constructing UPNsJakub Hrozek2016-07-071-10/+9
| | | | | | | | Because internally, we use the same name for all users and groups regardless of the domain they belong to, we can parse the username from the qualified name in a simpler manner. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Switch to new interfacePavel Březina2016-06-204-212/+241
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_backend.h to backend.hPavel Březina2016-06-204-4/+4
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Remove braces from DEBUG statementsPavel Březina2016-06-181-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Do not leak fds in case of failures setting up a child processJakub Hrozek2016-05-311-20/+22
| | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3006 The handling of open pipes in failure cases was suboptimal. Moreover, the faulty logic was copied all over the place. This patch introduces helper macros to: - initialize the pipe endpoints to -1 - close an open pipe fd and set it to -1 afterwards - close both ends unless already closed These macros are used in the child handling code. The patch also uses child_io_destructor in the p11_child code for safer fd handling. Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: exit() the forked process if exec()-ing a child process failsJakub Hrozek2016-05-191-9/+7
| | | | | | | | | | | When exec() fails, we should not attempt to continue, but just kill the forked process. The patch adds this logic to the exec_child() and exec_child_ex() functions to avoid code duplication Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5_auth_store_creds: silence spurious debug messageSumit Bose2016-04-191-1/+5
| | | | | | | | | | | During a pre-authentication request there are always messages like: ... [krb5_auth_store_creds] (0x0010): unsupported PAM command [249]. ... [krb5_auth_store_creds] (0x0010): password not available, offline auth may not work. This patch removes them. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Fix typos reported by lintianLukas Slebodnik2016-02-231-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* krb5_child: Warn if user cannot read krb5.confLukas Slebodnik2016-02-191-0/+24
| | | | | | | | | | | | | | | | | | Attached patch should siplify troubleshoting of issues with permission of krb5.conf. It's not clear from krb5_child.log even with full debug level. [sss_get_ccache_name_for_principal] (0x4000): Location: [FILE:/tmp/krb5cc_12069_XXXXXX] [sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match failed: [-1765328243] [Can't find client principal user@EXAMPLE.COM in cache collection] [create_ccache] (0x0020): 735: [13][Permission denied] Resolves: https://fedorahosted.org/sssd/ticket/2931 Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: allow to skip default options for child processesSumit Bose2016-01-191-1/+1
| | | | | | | | | | | | | Currently the SSSD default options like e.g. --debug-level are added unconditionally to the command line options of a child process when started with the child helper functions. If a binary from a different source should be started as a child by SSSD those options might not be known or used differently. This patch adds an option to exec_child_ex() which allows to skip the default options and only add specific options. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Krb5/PAM: Fix account lockout error handlingSimo Sorce2016-01-142-0/+9
| | | | | | | | | | | | | | The krb5 provider was mapping KRB5KDC_ERR_CLIENT_REVOKED as ERR_ACCOUNT_EXPIRED. This is incorrect as KRB5KDC_ERR_CLIENT_REVOKED is returned by the KDC when an account lockout is in effect. When an account is expired the kdc returns KRB5KDC_ERR_NAME_EXP. Fix the mapping by adding a new ERR_ACCOUNT_LOCKOUT sssd_error code. Resolves: https://fedorahosted.org/sssd/ticket/2924 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Adding DNS SRV lookup for krb5 providerPetr Cech2016-01-141-0/+7
| | | | | | | | | This patch add DNS SRV lookup for krb5 provider. Resolves: https://fedorahosted.org/sssd/ticket/2888 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5_CHILD: Debug logs for PAC timeoutPetr Cech2015-12-141-0/+3
| | | | | | | | | | | | This patch adds debug message that inform user when KRB5_CHILD calls PAC responder. This action might take a bit of time in case the cache is not populated or up to date. Resolves: https://fedorahosted.org/sssd/ticket/2846 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Mark globals in krb5_opts.h as externPavel Březina2015-12-142-23/+48
| | | | | | To avoid collisions when we want to work with them elsewhere in the code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Handle KRB5_REALM_UNKNOWN as ERR_NETWORK_IOJakub Hrozek2015-12-071-0/+1
| | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2866 This would help users who authenticate to AD trust servers while offline and see error messages such as: [get_and_save_tgt] (0x0020): 996: [-1765328230][Cannot find KDC for realm "AD.EXAMPLE.COM"] in the krb5_child.log Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5: Handle preauth request timeout more gracefullyJakub Hrozek2015-12-071-0/+5
| | | | | | | | The error itself doesn't matter that much, because pam_sss.so handles all preauth errors gracefully already, but the issue triggered a loud and confusing debug message in the logs. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5_CHILD: More restrictive umaskPetr Cech2015-11-051-1/+1
| | | | | | | | | | | We could use more restrictive umask in krb5_child. I found out that there is directory creation, but it is done by create_ccache_dir() which has its own umask setup. Resolves: https://fedorahosted.org/sssd/ticket/2424 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FO: Use refcount to keep track of servers returned to callersJakub Hrozek2015-10-231-2/+2
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2829 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* REFACTOR: umask(077) --> umask(SSS_DFL_X_UMASK)Petr Cech2015-10-141-1/+1
| | | | | | | | | | | There are many calls of umask function with 077 argument. This patch add new constant SSS_DFL_X_UMASK which stands fot 077. So all occurences of umask(077) are replaced by constant SSS_DFL_X_UMASK. Resolves: https://fedorahosted.org/sssd/ticket/2424 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Offline operation with disabled domainJakub Hrozek2015-09-211-1/+11
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2637 If a subdomain is in the disabled state, switch krb5_child operation into offline mode. Similarly, instead of marking the whole back end as offline, mark just the domain as offline -- depending on the domain type, this would mark the whole back end or just inactivate subdomain. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sssd: incorrect checks on length values during packet decodingMichal Židek2015-08-312-8/+8
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1697 It is safer to isolate the checked (unknown/untrusted) value on the left hand side in the conditions to avoid overflows/underflows. Reviewed-by: Petr Cech <pcech@redhat.com>
* KRB5: Use sss_unique_file when creating kdcinfo filesJakub Hrozek2015-08-171-7/+9
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5: Use sss_unique file in krb5_childJakub Hrozek2015-08-171-16/+11
| | | | | | | | In krb5_child, we intentionally don' set the owner of the temporary file, because we're not renaming it to a 'stable' name, but rather directly using it as the ccache. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* krb5: assume online state if KDC proxy is configuredSumit Bose2015-08-051-0/+6
| | | | | | | | | | | If a KDC proxy is configured a request in the KRB5 provider will assume online state even if the backend is offline without changing the state of the backend. Resolves https://fedorahosted.org/sssd/ticket/2700 Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: do not create kdcinfo file if proxy configuration existsSumit Bose2015-08-051-0/+7
| | | | | | | Resolves https://fedorahosted.org/sssd/ticket/2652 Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Do not try to remove missing ccacheLukas Slebodnik2015-08-051-0/+5
| | | | | | | | | There was a misleading debug message in krb5_child [[sssd[krb5_child[16629]]]] [get_and_save_tgt] (0x0080): Failed to remove old ccache file [(null)], please remove it manually. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* krb5: do not send SSS_OTP if two factors were usedSumit Bose2015-07-291-1/+6
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2729 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Use the right domain for case-sensitive flagJakub Hrozek2015-07-221-1/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* KRB5: Return right data provider error codeLukas Slebodnik2015-07-151-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2719 Reviewed-by: Michal Židek <mzidek@redhat.com>
* KRB5: Add and use krb5_auth_queue_send to queue requests by defaultJakub Hrozek2015-07-065-48/+199
| | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2701 Previously, only the krb5 provides used to queue requests, which resulted in concurrent authentication requests stepping on one another. This patch queues requests by default. Reviewed-by: Sumit Bose <sbose@redhat.com>
* krb: remove duplicit decl. of write_krb5info_filePavel Reichl2015-06-051-3/+0
| | | | | | function write_krb5info_file() was declared twice in krb5_common.h Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* krb5: new option krb5_map_userPavel Reichl2015-05-288-15/+213
| | | | | | | | | | New option `krb5_map_user` providing mapping of ID provider names to Kerberos principals. Resolves: https://fedorahosted.org/sssd/ticket/2509 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: remove field run_as_userPavel Reichl2015-05-142-15/+0
| | | | | | run_as_user is set set but never read. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: try delayed online authentication only for single factor authSumit Bose2015-05-081-0/+7
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 19:57:11 +0000