summaryrefslogtreecommitdiffstats
path: root/src/mod_auth_gssapi.h
Commit message (Collapse)AuthorAgeFilesLines
* Add cleanup function for mag_conn->name_attributesHEADmasterAlejandro Perez2017-02-131-0/+1
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Closes #127
* Add option to set alternative ccname env varFraser Tweedale2017-02-081-0/+1
| | | | | | | | | | | | | In some cases (e.g. if you want to convey the ccname over AJP) the request environment variable name "KRB5CCNAME" is not appropriate. Add the GssapiDelegCcacheEnvVar option that allows the env var name to be changed. Fixes: https://github.com/modauthgssapi/mod_auth_gssapi/issues/123 Reviewed-by: Simo Sorce <simo@redhat.com> Closes #124 Closes #123
* rewrite: implicitly handle internal redirectsIsaac Boukris2017-01-111-1/+4
| | | | | | | | | | | | | | Internal redirects are a special case of subrequest - they have no req->main but req->prev instead, so we should check for that too in case the request is not initial. Also, make sure to export MAG environment variables to subrequests and internal redirects. Signed-off-by: Isaac Boukris <iboukris@gmail.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reported-by: scopev24 Closes #119
* Add option to set custom permissions on ccacheSimo Sorce2016-11-301-0/+7
| | | | | | | | | This allows apache to set permission so that another user in the default group can access the ccache. Useful when apache passes the request to a process running under a different user or group id number. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* Add support for GssapiImpersonate.Jan Pazdziora2016-06-091-0/+1
| | | | | | | | | | | | | | | | This is can be enabled on locations that are authenticated by another module to obtain a ticket for the user, so that the application gets access to krb5 credentials and all named attributes for the client. The service needs to be authorized by the KDC if there is the need to use credentials for further ticket acquisition by setting the ok_to_auth_as_delegate flag on the service principal. This will provide a forwardable ticket that can be used to obtain additional tickets via consrained delegation (also subkect to KDC access control). Signed-off-by: Jan Pazdziora <jpazdziora@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com> Close #92
* Implement unique ccache namesRobbie Harwood2016-05-181-3/+5
| | | | | | | | | | | Unique ccache names may be requested using the GssapiDelegCcacheUnique configuration option. This option is off by default. If both unique ccache names and session use are enabled, then a mechanism for removing old ccaches must be supplied. Signed-off-by: Robbie Harwood <rharwood@redhat.com> Also-authored-by: Petr Vobornik <pvoborni@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Unify copyright conventionRobbie Harwood2016-05-181-1/+1
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add option to not send a Negotiate headersJames Groffen2016-02-171-0/+1
| | | | | | | | | | | | | | | | If negotiation was attempted but failed do not send a new Negotiate header. Useful when only one single sign on mechanism is allowed and to avoid misleading login prompts in some browsers. Added a test of the GssapiDontReauth option to the test suite. Also added SPNEGO no auth test. [SS: reworded and fixed commit subject/comment] [SS: fixed whitespace errors and 80 column wrappings] Reviewed-by: Simo Sorce <simo@redhat.com> Close #65
* Add code to set attribute names in the environmentname_attrsSimo Sorce2015-12-031-0/+20
| | | | | | | | | | | | This code allows to specify which attributes in a name are interesting to the application and set them as named environemnt variables. Optionally the whole set of attributes can be exported in a json formatted structure. Signed-off-by: Simo Sorce <simo@redhat.com> Close #62 Close #63
* Move setting request data to a separate fileSimo Sorce2015-12-021-0/+5
| | | | | | In preparation for the next commit. Signed-off-by: Simo Sorce <simo@redhat.com>
* Allow building without NTLMSSP supportSimo Sorce2015-09-031-4/+7
| | | | | | | | | | | | | If gssapi/gssapi_ntlmssp.h is not available simply disable NTLMSSP. Coauthored Signed-off-by: Dennis Schridde <dennis.schridde@uni-heidelberg.de> Signed-off-by: Simo Sorce <simo@redhat.com> Closes #52 Closes #53 Closes #54
* Allocate new keys at server startup.Simo Sorce2015-08-301-0/+3
| | | | | | | | This avoids a potential race condition if the first 2 request come in at the same time. It also avoids issues with forked apapche processes which may end up with different keys per fork. Signed-off-by: Simo Sorce <simo@redhat.com>
* Support forward proxy authenticationIsaac Boukris2015-08-061-0/+9
| | | | | | | | Proxy auth headers are a little different. Sessions cannot be used as we cannot set a cookie. Reviewed-by: Simo Sorce <simo@redhat.com>
* Retrieve default mechs at server initIsaac Boukris2015-06-251-0/+4
| | | | | | | | | | This avoids the need to retrieve the list on every auth attempt, and then free it every time. Implemented by adding a server config struct and populating it at server init with gss_indicate_mechs(). Reviewed-by: Simo Sorce <simo@redhat.com>
* Add GssapiBasicAuthMech optionSimo Sorce2015-06-201-0/+2
| | | | | | | | | This option allows to set a different list of mechanisms to use with Basic Auth (Basic Auth must be explicitly enabled) than the list of mechs that are allowed with Negotiate or Raw GSSAPI Client authentication. Signed-off-by: Simo Sorce <simo@redhat.com>
* Improve mag_conn memory handlingSimo Sorce2015-06-161-1/+3
| | | | | | | | | | | | Create a pool just for the mag_conn structure, so that we can clear up all the memory used when a reset is necessary. This also fixes a segfault introduced by a previous patch where we mistakenly zeroed the whole structure including the memory pool pointer, which needs to be preserved. Closes #40 Signed-off-by: Simo Sorce <simo@redhat.com>
* Optimize BASIC AUTH checks with sessions.Simo Sorce2015-06-131-0/+1
| | | | | | | | If sessions are enbled store a MAC of the password and use it to check if the password is the same on follow-up requests. If it is, avoid the whole gssapi dance and use the session data instead. Signed-off-by: Simo Sorce <simo@redhat.com>
* Set KRB5CCNAME on follow up requests with sessionSimo Sorce2015-06-091-0/+1
| | | | | | | | | | If the original context establishment delegated credentials, set the KRB5CCNAME variable to the proper file name for follow up connections that uses the session to validate access. Closes #18 Signed-off-by: Simo Sorce <simo@redhat.com>
* Allow raw NTLM authenticationSimo Sorce2015-06-031-1/+3
| | | | | | | | | Some clients may decide to use raw NTLM authentication instead of wrapping it into a Negotiate (SPNEGO) authentication request. If the NTLMSSP mechanism is allowed/supported then allow this request to be processed. Closes #23
* Add GssapiAllowedMech optionSimo Sorce2015-06-031-0/+2
| | | | | This option allows the admin to list the mechanisms that can be used for authentication. An empty list allows any locally supported mechanisms.
* More work on keeping cred_store functions optionalSimo Sorce2015-06-011-0/+8
| | | | | | | Some more definitions that depend on cred_store functions were not properly ifdef-ed Signed-off-by: Simo Sorce <simo@redhat.com>
* Use the "ssl_is_https" definition from mod_ssl.h.Joe Orton2015-05-241-0/+1
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* Add GssapiSignalPersistentAuth directiveIsaac Boukris2015-05-241-0/+1
| | | | | | | Controls whether to send the Persistent-Auth header, and sets it only when necessary/appropriate Reviewed-by: Simo Sorce <simo@redhat.com>
* Improve Basic Auth based loginsSimo Sorce2015-03-101-0/+1
| | | | | | | | | | Set a per-thread Credentials Cache Name that will be thrown away once authentication is done. This handles both an issue with stomping on ccaches if two authentications happen in concurrent threads, as well as issues with gss_acquire_cred_with_password() reusing the ccache without actually performing an AS request. Fixes #11
* Remove forward basic auth and fix docsSimo Sorce2015-03-061-5/+1
| | | | Fixes #8
* Add support for handling Basic AuthSimo Sorce2015-03-051-0/+6
| | | | | | | Support either passing Basic Auth Through to another module, or handling it directly through gss_acquire_cred_with_password() Fixes #8
* Add S4U2Proxy supports4u2proxySimo Sorce2014-07-201-1/+3
| | | | | | | | | | SU2Proxy support is enabled when GssapiUseS4U2Proxy is set to On When S4U2Proxy is enabled GssapiDelegCcacheDir is used to determine where delegated credentials are stored. The ccache type used is always of type FILE and is located in the provided directory (defaults to /tmp). The credentials are stored in a file named after the client credentials so the directory SHOUL NOT be world writeable if a mutiuser system is used as ccache file names are predictable.
* Add mod_session supportSimo Sorce2014-07-101-2/+23
| | | | | | | | | | | | By setting GssapiUseSessions we enable the module to store a bearer token with the user and gss names in the client, this way we can allow clients to perform authentication once but then remain authenticaed for the duration of the session or until the original credentials expire. The Secure cookie used to store the token is encrypted using a randomly generated AES key at process startup. This means multiple apache servers will not be able to use the same cookie, however the client will reauth transparently if the cookie cannot be read.
* Add mod_auth_gssapi.hSimo Sorce2014-07-101-0/+32
Move all includes into it and also include config.h which was missing causing some ifdefed code not to be compiled. Also address includes conflict between httpd.h and config.h and the PACKAGE_* variables.
generated by cgit (git 2.34.1) at 2025-07-01 08:31:51 +0000