summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Actually store basic_hash in the session dataSimo Sorce2015-06-134-4/+26
| | | | | | Also fixes a segfault when mc->basic_hash.value is NULL Signed-off-by: Simo Sorce <simo@redhat.com>
* Optimize BASIC AUTH checks with sessions.Simo Sorce2015-06-136-6/+85
| | | | | | | | If sessions are enbled store a MAC of the password and use it to check if the password is the same on follow-up requests. If it is, avoid the whole gssapi dance and use the session data instead. Signed-off-by: Simo Sorce <simo@redhat.com>
* Split HMAC_BUFFER out as a separate publi functionSimo Sorce2015-06-132-31/+40
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Set KRB5CCNAME on follow up requests with sessionSimo Sorce2015-06-099-26/+412
| | | | | | | | | | If the original context establishment delegated credentials, set the KRB5CCNAME variable to the proper file name for follow up connections that uses the session to validate access. Closes #18 Signed-off-by: Simo Sorce <simo@redhat.com>
* Use a compiler to marshall/unmarshall the sessionsSimo Sorce2015-06-0955-49/+10287
| | | | | | This way changes are easier, all is needed is to change the session.asn1 file to add or remove elements, and different session types can also be supported at the same time.
* Disable connection-bound for basic-authIsaac Boukris2015-06-081-0/+4
| | | | | | | | | | | | Clients don't expect this and therefore might inappropriately reuse the connection for another user identity (with or without creds). This is currently more of an issue due to issue 22, example: curl -v http://myhost/ -u usera:passa --next http://myhost/ -u userb:passb Closes #36 Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix segfault if req->main is NULLSimo Sorce2015-06-061-1/+1
| | | | | | | | Seen in the wild. Closes #35 Signed-off-by: Simo Sorce <simo@redhat.com>
* Allow raw NTLM authenticationSimo Sorce2015-06-033-39/+116
| | | | | | | | | Some clients may decide to use raw NTLM authentication instead of wrapping it into a Negotiate (SPNEGO) authentication request. If the NTLMSSP mechanism is allowed/supported then allow this request to be processed. Closes #23
* Add GssapiAllowedMech optionSimo Sorce2015-06-033-1/+71
| | | | | This option allows the admin to list the mechanisms that can be used for authentication. An empty list allows any locally supported mechanisms.
* Move acquire_cred functions into a helperSimo Sorce2015-06-011-44/+35
| | | | | | | This makes the code more readable and easier to deal with. Side effect: now we always acquire credentials Signed-off-by: Simo Sorce <simo@redhat.com>
* More work on keeping cred_store functions optionalSimo Sorce2015-06-012-6/+21
| | | | | | | Some more definitions that depend on cred_store functions were not properly ifdef-ed Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix conditional support for gss_acquire_cred_fromSimo Sorce2015-06-011-1/+5
| | | | | | | This function is supported only on some GSSAPI versions. Keep it optional. Signed-off-by: Simo Sorce <simo@redhat.com>
* Find the right server name when using basic authSimo Sorce2015-05-261-1/+31
| | | | | | | | When S4U2Proxy is used in combination with Basic Auth, the gss_inquire_cred() call will return the client name instead of the server name we need. Detect this case and aquire a separate set of credentials in that case. Fixes #28
* Ignore generated files.Joe Orton2015-05-241-0/+24
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* Export only the symbol named auth_gssapi_moduleJoe Orton2015-05-241-1/+2
| | | | | | | | | The only entry point into the module DSO is the module structure itself; use libtool's export-symbols linker trick to hide all the other global symbols, which otherwise are potentially visible outside the module itself (SEAL_* etc). Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove all uses of APLOG_NOERRNOJoe Orton2015-05-241-28/+28
| | | | | | This directive is deprecated and has no effect in all httpd 2.x releases. Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix typo.Joe Orton2015-05-241-1/+1
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* Drop OOM handling.Joe Orton2015-05-241-41/+0
| | | | | | | | | | In httpd/APR it is best practice to assume that memory allocation always succeeds, which simplifies module code. APR internally calls abort() if memory allocation ever actually fails, so in pratice you cannot trigger these code paths anyway. Reviewed-by: Simo Sorce <simo@redhat.com>
* Use the "ssl_is_https" definition from mod_ssl.h.Joe Orton2015-05-242-2/+1
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* Add GssapiSignalPersistentAuth directiveIsaac Boukris2015-05-243-3/+22
| | | | | | | Controls whether to send the Persistent-Auth header, and sets it only when necessary/appropriate Reviewed-by: Simo Sorce <simo@redhat.com>
* Export variable with session expiration timeSimo Sorce2015-05-051-1/+8
| | | | Closes #16
* Revert "Use aes-256-gcm rather than aes-128-cbc"Simo Sorce2015-04-232-70/+130
| | | | | | | | | | | This reverts commit e9c92795d87a316ea47f6bf37c9636e86eec57e7. AESGCM is a neat idea but it is not really appropriate to be used in mod_auth_gssapi because we cannot gurantee that the nonce will never be reused. It is not very probable, and it is also not easy to force the server to generate so many encyrpted sessions to have a good chance of a collision that I know of, but better to avoid the whole issue, than risk unforseen cases where it may happen.
* Bump version to 1.2.0Simo Sorce2015-04-212-2/+5
|
* Properly complete context establishmentSimo Sorce2015-04-191-18/+16
| | | | | | | On success do not forget to send the last negotiate packet (if any) to the client within the 200 Reply. Fixes #21
* Add support for delegate creds on basic authSimo Sorce2015-04-141-2/+9
| | | | | | | | When doing fallback basic auth, we may also want to honor the configured directive about storing delegated credentials. Detect if we are configured to store them and set the appopriate init_sec_context flag that will cause the accept_sec_context call to get valid delegated credentials for later storage.
* Bump version to 1.1.1Simo Sorce2015-04-022-2/+5
|
* Handle authentication on subrequestsSimo Sorce2015-03-311-4/+29
| | | | | | | | | | | | | In some cases (like during directory listing) Apache will re-run the authentication code. Many GSSAPI mechanism have replay detection so we cannot simply rerun the accept_sec_context phase. Others require multiple steps. When authntication has already been estalished just implicitly consider the authentication successfully performed and copy the user name. Otherwise fail. If a subrequest hits a location with a different mod_auth_gssapi configuration warn but do not error off right away. Fixes #15
* Escape principal name to remove the path separatorSimo Sorce2015-03-261-2/+54
| | | | | | | | The principla name is used as a file name, any embedded path separators are going to cause trouble if used in the file name, so we need to escape them away. Usee ~ as the escape chracter (~~ to escape ~ itself) Fixes #14
* Bump version to 1.1.0Simo Sorce2015-03-122-2/+5
|
* Use aes-256-gcm rather than aes-128-cbcNathaniel McCallum2015-03-102-130/+70
| | | | | | | | | Also, remove all the manual HMAC code since it is no longer needed. The end result should be faster and stronger authenticated encryption. Closes #12 Reviewed-by: Simo Sorce <simo@redhat.com>
* Do not free orig_ccacheSimo Sorce2015-03-101-5/+2
| | | | | | | | | It realy is const memory referenced internally by MIT's gssapi. Freeing it will cause a segfault on the next invocation. This memory is kept in thread local storage and freed by gssapi itself as needed. Fixes #11
* Improve Basic Auth based loginsSimo Sorce2015-03-103-1/+44
| | | | | | | | | | Set a per-thread Credentials Cache Name that will be thrown away once authentication is done. This handles both an issue with stomping on ccaches if two authentications happen in concurrent threads, as well as issues with gss_acquire_cred_with_password() reusing the ccache without actually performing an AS request. Fixes #11
* Fix random number generationSimo Sorce2015-03-101-3/+3
| | | | Untested code is broken code :(
* Use apr function for random bytesSimo Sorce2015-03-101-3/+3
| | | | | The apr function is thread safe while the OpenSSL one depdns on setting up custom locking, which is hard in a library.
* Documentation fixesSimo Sorce2015-03-091-2/+9
| | | | | | | Fix GssapiDelegCcacheDir examples and add all the required options to make GssapiUseS4U2Proxy really work. Thanks to David Kupka for testing that highlighted these issues.
* Remove forward basic auth and fix docsSimo Sorce2015-03-063-35/+21
| | | | Fixes #8
* Add support for handling Basic AuthSimo Sorce2015-03-054-13/+182
| | | | | | | Support either passing Basic Auth Through to another module, or handling it directly through gss_acquire_cred_with_password() Fixes #8
* Do not leak acquired_credSimo Sorce2015-03-051-0/+1
|
* Replace block size constants with actual block sizeNathaniel McCallum2015-02-031-6/+7
|
* Bump version to 1.0.4Simo Sorce2014-11-082-2/+5
|
* Fix error message copy&paste errorwipSimo Sorce2014-10-211-1/+1
|
* Fix build on some platforms by adding extra flagsSimo Sorce2014-10-141-1/+1
| | | | | | For some reason all the necessary CFALGS are not returned by simply querying the CFLAGS from apxs. We also need to query EXTRA_CPPFLAGS apparently.
* Properly initialize loggingSimo Sorce2014-10-132-0/+4
| | | | | | | We need to call APLOG_USE_MODULE() so that the module name is reported properly in log lines, and per module logging level can be set. Fixes #6
* Attempt to use sessions only when they are enabledSimo Sorce2014-10-131-2/+6
|
* Bump version to 1.0.3Simo Sorce2014-10-112-2/+5
|
* Change the modules build processSimo Sorce2014-09-112-5/+23
| | | | | | | USe automake directives to directly invoke the apxs favored libtool, and use APXS only to perform the final install. Fixes #4
* Include only necessary libs when calling apxsSimo Sorce2014-08-292-2/+2
| | | | | | Drop cflags and libs options that make apxs unhappy Closes #3
* Bump version to 1.0.2Simo Sorce2014-08-262-2/+5
|
* Add instructions to README fileSimo Sorce2014-08-261-0/+171
|
* Fix GssapiCredStore usageSimo Sorce2014-08-261-1/+5
| | | | | | | This allows to always define the keytab in terms of GssapiCredStore options instead of having to set a KRB5_KTNAME variable. Fixes Issue 2
generated by cgit (git 2.34.1) at 2025-07-01 15:08:37 +0000