summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix conditional support for gss_acquire_cred_fromSimo Sorce2015-06-011-1/+5
| | | | | | | This function is supported only on some GSSAPI versions. Keep it optional. Signed-off-by: Simo Sorce <simo@redhat.com>
* Find the right server name when using basic authSimo Sorce2015-05-261-1/+31
| | | | | | | | When S4U2Proxy is used in combination with Basic Auth, the gss_inquire_cred() call will return the client name instead of the server name we need. Detect this case and aquire a separate set of credentials in that case. Fixes #28
* Ignore generated files.Joe Orton2015-05-241-0/+24
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* Export only the symbol named auth_gssapi_moduleJoe Orton2015-05-241-1/+2
| | | | | | | | | The only entry point into the module DSO is the module structure itself; use libtool's export-symbols linker trick to hide all the other global symbols, which otherwise are potentially visible outside the module itself (SEAL_* etc). Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove all uses of APLOG_NOERRNOJoe Orton2015-05-241-28/+28
| | | | | | This directive is deprecated and has no effect in all httpd 2.x releases. Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix typo.Joe Orton2015-05-241-1/+1
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* Drop OOM handling.Joe Orton2015-05-241-41/+0
| | | | | | | | | | In httpd/APR it is best practice to assume that memory allocation always succeeds, which simplifies module code. APR internally calls abort() if memory allocation ever actually fails, so in pratice you cannot trigger these code paths anyway. Reviewed-by: Simo Sorce <simo@redhat.com>
* Use the "ssl_is_https" definition from mod_ssl.h.Joe Orton2015-05-242-2/+1
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* Add GssapiSignalPersistentAuth directiveIsaac Boukris2015-05-243-3/+22
| | | | | | | Controls whether to send the Persistent-Auth header, and sets it only when necessary/appropriate Reviewed-by: Simo Sorce <simo@redhat.com>
* Export variable with session expiration timeSimo Sorce2015-05-051-1/+8
| | | | Closes #16
* Revert "Use aes-256-gcm rather than aes-128-cbc"Simo Sorce2015-04-232-70/+130
| | | | | | | | | | | This reverts commit e9c92795d87a316ea47f6bf37c9636e86eec57e7. AESGCM is a neat idea but it is not really appropriate to be used in mod_auth_gssapi because we cannot gurantee that the nonce will never be reused. It is not very probable, and it is also not easy to force the server to generate so many encyrpted sessions to have a good chance of a collision that I know of, but better to avoid the whole issue, than risk unforseen cases where it may happen.
* Bump version to 1.2.0Simo Sorce2015-04-212-2/+5
|
* Properly complete context establishmentSimo Sorce2015-04-191-18/+16
| | | | | | | On success do not forget to send the last negotiate packet (if any) to the client within the 200 Reply. Fixes #21
* Add support for delegate creds on basic authSimo Sorce2015-04-141-2/+9
| | | | | | | | When doing fallback basic auth, we may also want to honor the configured directive about storing delegated credentials. Detect if we are configured to store them and set the appopriate init_sec_context flag that will cause the accept_sec_context call to get valid delegated credentials for later storage.
* Bump version to 1.1.1Simo Sorce2015-04-022-2/+5
|
* Handle authentication on subrequestsSimo Sorce2015-03-311-4/+29
| | | | | | | | | | | | | In some cases (like during directory listing) Apache will re-run the authentication code. Many GSSAPI mechanism have replay detection so we cannot simply rerun the accept_sec_context phase. Others require multiple steps. When authntication has already been estalished just implicitly consider the authentication successfully performed and copy the user name. Otherwise fail. If a subrequest hits a location with a different mod_auth_gssapi configuration warn but do not error off right away. Fixes #15
* Escape principal name to remove the path separatorSimo Sorce2015-03-261-2/+54
| | | | | | | | The principla name is used as a file name, any embedded path separators are going to cause trouble if used in the file name, so we need to escape them away. Usee ~ as the escape chracter (~~ to escape ~ itself) Fixes #14
* Bump version to 1.1.0Simo Sorce2015-03-122-2/+5
|
* Use aes-256-gcm rather than aes-128-cbcNathaniel McCallum2015-03-102-130/+70
| | | | | | | | | Also, remove all the manual HMAC code since it is no longer needed. The end result should be faster and stronger authenticated encryption. Closes #12 Reviewed-by: Simo Sorce <simo@redhat.com>
* Do not free orig_ccacheSimo Sorce2015-03-101-5/+2
| | | | | | | | | It realy is const memory referenced internally by MIT's gssapi. Freeing it will cause a segfault on the next invocation. This memory is kept in thread local storage and freed by gssapi itself as needed. Fixes #11
* Improve Basic Auth based loginsSimo Sorce2015-03-103-1/+44
| | | | | | | | | | Set a per-thread Credentials Cache Name that will be thrown away once authentication is done. This handles both an issue with stomping on ccaches if two authentications happen in concurrent threads, as well as issues with gss_acquire_cred_with_password() reusing the ccache without actually performing an AS request. Fixes #11
* Fix random number generationSimo Sorce2015-03-101-3/+3
| | | | Untested code is broken code :(
* Use apr function for random bytesSimo Sorce2015-03-101-3/+3
| | | | | The apr function is thread safe while the OpenSSL one depdns on setting up custom locking, which is hard in a library.
* Documentation fixesSimo Sorce2015-03-091-2/+9
| | | | | | | Fix GssapiDelegCcacheDir examples and add all the required options to make GssapiUseS4U2Proxy really work. Thanks to David Kupka for testing that highlighted these issues.
* Remove forward basic auth and fix docsSimo Sorce2015-03-063-35/+21
| | | | Fixes #8
* Add support for handling Basic AuthSimo Sorce2015-03-054-13/+182
| | | | | | | Support either passing Basic Auth Through to another module, or handling it directly through gss_acquire_cred_with_password() Fixes #8
* Do not leak acquired_credSimo Sorce2015-03-051-0/+1
|
* Replace block size constants with actual block sizeNathaniel McCallum2015-02-031-6/+7
|
* Bump version to 1.0.4Simo Sorce2014-11-082-2/+5
|
* Fix error message copy&paste errorwipSimo Sorce2014-10-211-1/+1
|
* Fix build on some platforms by adding extra flagsSimo Sorce2014-10-141-1/+1
| | | | | | For some reason all the necessary CFALGS are not returned by simply querying the CFLAGS from apxs. We also need to query EXTRA_CPPFLAGS apparently.
* Properly initialize loggingSimo Sorce2014-10-132-0/+4
| | | | | | | We need to call APLOG_USE_MODULE() so that the module name is reported properly in log lines, and per module logging level can be set. Fixes #6
* Attempt to use sessions only when they are enabledSimo Sorce2014-10-131-2/+6
|
* Bump version to 1.0.3Simo Sorce2014-10-112-2/+5
|
* Change the modules build processSimo Sorce2014-09-112-5/+23
| | | | | | | USe automake directives to directly invoke the apxs favored libtool, and use APXS only to perform the final install. Fixes #4
* Include only necessary libs when calling apxsSimo Sorce2014-08-292-2/+2
| | | | | | Drop cflags and libs options that make apxs unhappy Closes #3
* Bump version to 1.0.2Simo Sorce2014-08-262-2/+5
|
* Add instructions to README fileSimo Sorce2014-08-261-0/+171
|
* Fix GssapiCredStore usageSimo Sorce2014-08-261-1/+5
| | | | | | | This allows to always define the keytab in terms of GssapiCredStore options instead of having to set a KRB5_KTNAME variable. Fixes Issue 2
* Release v1.0.1Simo Sorce2014-08-142-4/+7
|
* Fix typo in contrib spec fileSimo Sorce2014-08-141-1/+1
|
* Announce module name and version in the server signatureAlexander Bokovoy2014-08-141-0/+2
|
* GssapiLocalName is about translating principals to local usernamesAlexander Bokovoy2014-08-141-1/+1
| | | | Fix wrong description
* Make dependency on openssl for EVP functions explicitAlexander Bokovoy2014-08-141-2/+6
|
* Suppress -Werror=format-security errorsSimo Sorce2014-08-121-5/+5
|
* Add openssl BuildRequiresSimo Sorce2014-08-121-1/+1
|
* Add simple spec fileSimo Sorce2014-08-111-2/+2
|
* Quick and dirty fix for make distSimo Sorce2014-08-112-0/+49
|
* Release version 1.0.0Simo Sorce2014-08-041-1/+1
|
* Add S4U2Proxy supports4u2proxySimo Sorce2014-07-202-21/+127
| | | | | | | | | | SU2Proxy support is enabled when GssapiUseS4U2Proxy is set to On When S4U2Proxy is enabled GssapiDelegCcacheDir is used to determine where delegated credentials are stored. The ccache type used is always of type FILE and is located in the provided directory (defaults to /tmp). The credentials are stored in a file named after the client credentials so the directory SHOUL NOT be world writeable if a mutiuser system is used as ccache file names are predictable.
generated by cgit (git 2.34.1) at 2025-09-16 09:20:45 +0000