gss-proxy.git/proxy, branch impersonate

Change version to 0.3.0

2013-10-18T19:33:55+00:00

Add impersonation support

2013-10-18T19:33:55+00:00

By setting the impersonate flag to true, the acquisition of credentials will
be done using constrained delegation (s4uself + s4u2proxy).

To work this needs MIT Kereberos 1.11.4 or later.
Previous versions have a bug in the import_cred function that prevents the
library from properly importing previously exported delegated credentials.

Resolves: https://fedorahosted.org/gss-proxy/ticket/95

Move uid to name resolution in its own function.

2013-10-18T14:35:26+00:00

Add option to specify allowed usage.

2013-10-18T13:46:24+00:00

Credentials can often be used both to accept and to initiate contexts.
With this option admins can allow a specific usage only.
This is to avoid allowing an unprivileged process to fool a remote
client by allowing it to impersonate a server, when we only want to
allow this service to use credentials to initiate contexts.

Reviewed-by: Günther Deschner

Allow arbitrary users to connect to a service

2013-10-18T13:46:24+00:00

The rpc.gssd daemon is changing to fork and change uid to the unprivileged
user it wants to authenticate, this means gssproxy needs to allow connection
from any euid. When this is done though, the trusted flag needs to be dropped,
if the connecting euid does not match the default trusted uid to prevent
improper impersonation.

Resolves: https://fedorahosted.org/gss-proxy/ticket/103
Reviewed-by: Günther Deschner

docs: Fill in GSSPROXY_BEHAVIOR default setting from configure option.

2013-10-18T13:17:52+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

docs: autogenerate proxymech manpage.

2013-10-18T13:17:47+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Fix documentation to match reality

2013-10-18T12:34:54+00:00

LOCAL_FIRST is our default

Reviewed-by: Günther Deschner

Fix LOCAL_FIRST behavior

2013-10-18T12:34:46+00:00

We were erroneously returning and never falling back if LOCAL_FIRST was
selected. Correct also the remote first fallback flow.

Resolves: https://fedorahosted.org/gss-proxy/ticket/105

Reviewed-by: Günther Deschner

Fix resource leak in gpm_accept_sec_context().

2013-10-15T11:48:20+00:00

Resolves Coverity CID #12027.

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce