Add mod_session support

By setting GssapiUseSessions we enable the module to store a bearer
token with the user and gss names in the client, this way we can allow
clients to perform authentication once but then remain authenticaed
for the duration of the session or until the original credentials expire.

The Secure cookie used to store the token is encrypted using a randomly
generated AES key at process startup. This means multiple apache servers
will not be able to use the same cookie, however the client will reauth
transparently if the cookie cannot be read.

1 files changed, 23 insertions, 2 deletions

diff --git a/src/mod_auth_gssapi.h b/src/mod_auth_gssapi.h
index 2022061..6a21254 100644
--- a/src/mod_auth_gssapi.h
+++ b/src/mod_auth_gssapi.h
@@ -2,16 +2,21 @@
 
 #include <stdbool.h>
 #include <stdint.h>
+#include <time.h>
 #include <gssapi/gssapi.h>
 #include <gssapi/gssapi_ext.h>
 
+#define APR_WANT_STRFUNC
+#include "apr_want.h"
+#include <apr_strings.h>
+#include <apr_base64.h>
+
 #include <httpd.h>
 #include <http_core.h>
 #include <http_connection.h>
 #include <http_log.h>
 #include <http_request.h>
-#include <apr_strings.h>
-#include <apr_base64.h>
+#include <mod_session.h>
 
 /* apache's httpd.h drags in empty PACKAGE_* variables.
  * undefine them to avoid annoying compile warnings as they
@@ -23,10 +28,26 @@
 #undef PACKAGE_VERSION
 #include "config.h"
 
+#include "crypto.h"
+#include "sessions.h"
+
+#define MIN_SESS_EXP_TIME 300 /* 5 minutes validity minimum */
+
 struct mag_config {
+    apr_pool_t *pool;
     bool ssl_only;
     bool map_to_local;
     bool gss_conn_ctx;
+    bool use_sessions;
     gss_key_value_set_desc cred_store;
+    struct seal_key *mag_skey;
 };
 
+struct mag_conn {
+    apr_pool_t *parent;
+    gss_ctx_id_t ctx;
+    bool established;
+    const char *user_name;
+    const char *gss_name;
+    time_t expiration;
+};