diff -up --recursive mod_auth_kerb-5.4.orig/README mod_auth_kerb-5.4/README
--- mod_auth_kerb-5.4.orig/README 2008-11-26 11:51:05.000000000 -0500
+++ mod_auth_kerb-5.4/README 2012-01-04 11:17:22.000000000 -0500
@@ -122,4 +122,16 @@ KrbSaveCredentials, the tickets will be
credential cache that will be available for the request handler. The ticket
file will be removed after request is handled.
+Constrained Delegation
+----------------------
+S4U2Proxy, or constrained delegation, enables a service to use a client's
+ticket to itself to request another ticket for delegation. The KDC
+checks krbAllowedToDelegateTo to decide if it will issue a new ticket.
+If KrbConstrainedDelegation is enabled the server will use its own credentials
+to retrieve a delegated ticket for the user. For this to work the user must
+have a forwardable ticket (though the delegation flag need not be set).
+The server needs a valid credentials cache for this to work.
+
+The module itself will obtain and manage the necessary credentials.
+
$Id: README,v 1.12 2008/09/17 14:01:55 baalberith Exp $
diff -up --recursive mod_auth_kerb-5.4.orig/src/mod_auth_kerb.c mod_auth_kerb-5.4/src/mod_auth_kerb.c
--- mod_auth_kerb-5.4.orig/src/mod_auth_kerb.c 2011-12-09 17:55:05.000000000 -0500
+++ mod_auth_kerb-5.4/src/mod_auth_kerb.c 2012-03-01 14:19:40.000000000 -0500
@@ -42,6 +42,31 @@
* POSSIBILITY OF SUCH DAMAGE.
*/
+/*
+ * Locking mechanism inspired by mod_rewrite.
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * S4U2Proxy code
+ *
+ * Copyright (C) 2012 Red Hat
+ */
+
#ident "$Id: mod_auth_kerb.c,v 1.150 2008/12/04 10:14:03 baalberith Exp $"
#include "config.h"
@@ -49,6 +74,7 @@
#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>
+#include <unixd.h>
#define MODAUTHKERB_VERSION "5.4"
@@ -131,6 +157,12 @@ module AP_MODULE_DECLARE_DATA auth_kerb_
module auth_kerb_module;
#endif
+#ifdef STANDARD20_MODULE_STUFF
+/* s4u2proxy only supported in 2.0+ */
+static const char *lockname;
+static apr_global_mutex_t *s4u2proxy_lock = NULL;
+#endif
+
/***************************************************************************
Macros To Ease Compatibility
***************************************************************************/
@@ -165,6 +197,7 @@ typedef struct {
int krb_method_gssapi;
int krb_method_k5pass;
int krb5_do_auth_to_local;
+ int krb5_s4u2proxy;
#endif
#ifdef KRB4
char *krb_4_srvtab;
@@ -185,6 +218,11 @@ set_kerb_auth_headers(request_rec *r, co
static const char*
krb5_save_realms(cmd_parms *cmd, void *sec, const char *arg);
+static const char *
+cmd_delegationlock(cmd_parms *cmd, void *dconf, const char *a1);
+
+static int
+obtain_server_credentials(request_rec *r, const char *service_name);
#ifdef STANDARD20_MODULE_STUFF
#define command(name, func, var, type, usage) \
@@ -237,6 +275,12 @@ static const command_rec kerb_auth_cmds[
command("KrbLocalUserMapping", ap_set_flag_slot, krb5_do_auth_to_local,
FLAG, "Set to 'on' to have Kerberos do auth_to_local mapping of principal names to system user names."),
+
+ command("KrbConstrainedDelegation", ap_set_flag_slot, krb5_s4u2proxy,
+ FLAG, "Set to 'on' to have Kerberos use S4U2Proxy delegation."),
+
+ AP_INIT_TAKE1("KrbConstrainedDelegationLock", cmd_delegationlock, NULL,
+ RSRC_CONF, "the filename of a lockfile used for inter-process synchronization"),
#endif
#ifdef KRB4
@@ -302,6 +346,7 @@ static void *kerb_dir_create_config(MK_P
#endif
#ifdef KRB5
((kerb_auth_config *)rec)->krb5_do_auth_to_local = 0;
+ ((kerb_auth_config *)rec)->krb5_s4u2proxy = 0;
((kerb_auth_config *)rec)->krb_method_k5pass = 1;
((kerb_auth_config *)rec)->krb_method_gssapi = 1;
#endif
@@ -319,6 +364,24 @@ krb5_save_realms(cmd_parms *cmd, void *v
return NULL;
}
+static const char *
+cmd_delegationlock(cmd_parms *cmd, void *dconf, const char *a1)
+{
+ const char *error;
+
+ if ((error = ap_check_cmd_context(cmd, GLOBAL_ONLY)) != NULL)
+ return error;
+
+ /* fixup the path, especially for s4u2proxylock_remove() */
+ lockname = ap_server_root_relative(cmd->pool, a1);
+
+ if (!lockname) {
+ return apr_pstrcat(cmd->pool, "Invalid KrbConstrainedDelegationLock path ", a1, NULL);
+ }
+
+ return NULL;
+}
+
static void
log_rerror(const char *file, int line, int level, int status,
const request_rec *r, const char *fmt, ...)
@@ -1170,6 +1233,7 @@ get_gss_creds(request_rec *r,
gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
OM_uint32 major_status, minor_status, minor_status2;
gss_name_t server_name = GSS_C_NO_NAME;
+ gss_cred_usage_t usage = GSS_C_ACCEPT;
char buf[1024];
int have_server_princ;
@@ -1212,10 +1276,14 @@ get_gss_creds(request_rec *r,
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Acquiring creds for %s",
token.value);
+ if (conf->krb5_s4u2proxy) {
+ usage = GSS_C_BOTH;
+ obtain_server_credentials(r, conf->krb_service_name);
+ }
gss_release_buffer(&minor_status, &token);
major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
- GSS_C_NO_OID_SET, GSS_C_ACCEPT,
+ GSS_C_NO_OID_SET, usage,
server_creds, NULL, NULL);
gss_release_name(&minor_status2, &server_name);
if (GSS_ERROR(major_status)) {
@@ -1257,6 +1325,293 @@ cmp_gss_type(gss_buffer_t token, gss_OID
}
#endif
+/* Renew the ticket if it will expire in under a minute */
+#define RENEWAL_TIME 60
+
+/*
+ * Services4U2Proxy lets a server prinicipal request another service
+ * principal on behalf of a user. To do this the Apache service needs
+ * to have its own ccache. This will ensure that the ccache has a valid
+ * principal and will initialize or renew new credentials when needed.
+ */
+
+static int
+verify_server_credentials(request_rec *r,
+ krb5_context kcontext,
+ krb5_ccache ccache,
+ krb5_principal princ,
+ int *renew
+)
+{
+ krb5_creds match_cred;
+ krb5_creds creds;
+ char * princ_name = NULL;
+ char *tgs_princ_name = NULL;
+ krb5_timestamp now;
+ krb5_error_code kerr = 0;
+
+ *renew = 0;
+
+ memset (&match_cred, 0, sizeof(match_cred));
+ memset (&creds, 0, sizeof(creds));
+
+ if (NULL == ccache || NULL == princ) {
+ /* Nothing to verify */
+ *renew = 1;
+ goto cleanup;
+ }
+
+ if ((kerr = krb5_unparse_name(kcontext, princ, &princ_name))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Could not unparse principal %s (%d)",
+ error_message(kerr), kerr);
+ goto cleanup;
+ }
+
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "Using principal %s for s4u2proxy", princ_name);
+
+ tgs_princ_name = apr_psprintf(r->pool, "%s/%.*s@%.*s", KRB5_TGS_NAME,
+ krb5_princ_realm(kcontext, princ)->length,
+ krb5_princ_realm(kcontext, princ)->data,
+ krb5_princ_realm(kcontext, princ)->length,
+ krb5_princ_realm(kcontext, princ)->data);
+
+ if ((kerr = krb5_parse_name(kcontext, tgs_princ_name, &match_cred.server)))
+ {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Could not parse principal %s: %s (%d)",
+ tgs_princ_name, error_message(kerr), kerr);
+ goto cleanup;
+ }
+
+ match_cred.client = princ;
+
+ if ((kerr = krb5_cc_retrieve_cred(kcontext, ccache, 0, &match_cred, &creds)))
+ {
+ krb5_unparse_name(kcontext, princ, &princ_name);
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "Could not unparse principal %s: %s (%d)",
+ princ_name, error_message(kerr), kerr);
+ goto cleanup;
+ }
+
+ if ((kerr = krb5_timeofday(kcontext, &now))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Could not get current time: %d (%s)",
+ kerr, error_message(kerr));
+ goto cleanup;
+ }
+
+ if (now > (creds.times.endtime + RENEWAL_TIME)) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Credentials for %s have expired or will soon "
+ "expire - now %d endtime %d",
+ princ_name, now, creds.times.endtime);
+ *renew = 1;
+ } else {
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "Credentials for %s will expire at "
+ "%d, it is now %d", princ_name, creds.times.endtime, now);
+ }
+
+cleanup:
+ /* Closing context, ccache, etc happens elsewhere */
+ if (match_cred.server) {
+ krb5_free_principal(kcontext, match_cred.server);
+ }
+ if (creds.client) {
+ krb5_free_cred_contents(kcontext, &creds);
+ }
+
+ return kerr;
+}
+
+static int
+obtain_server_credentials(request_rec *r,
+ const char *service_name)
+{
+ krb5_context kcontext = NULL;
+ krb5_keytab keytab = NULL;
+ krb5_ccache ccache = NULL;
+ char * princ_name = NULL;
+ char *tgs_princ_name = NULL;
+ krb5_error_code kerr = 0;
+ krb5_principal princ = NULL;
+ krb5_creds creds;
+ krb5_get_init_creds_opt gicopts;
+ int renew = 0;
+ apr_status_t rv = 0;
+
+ memset(&creds, 0, sizeof(creds));
+
+ if ((kerr = krb5_init_context(&kcontext))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Kerberos context initialization failed: %s (%d)", error_message(kerr), kerr);
+ goto done;
+ }
+
+ if ((kerr = krb5_cc_default(kcontext, &ccache))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Could not get default Kerberos ccache: %s (%d)",
+ error_message(kerr), kerr);
+ goto done;
+ }
+
+ if ((kerr = krb5_cc_get_principal(kcontext, ccache, &princ))) {
+ char * name = NULL;
+
+ if ((asprintf(&name, "%s:%s", krb5_cc_get_type(kcontext, ccache),
+ krb5_cc_get_name(kcontext, ccache))) == -1) {
+ kerr = KRB5_CC_NOMEM;
+ goto done;
+ }
+
+ if (KRB5_FCC_NOFILE == kerr) {
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "Credentials cache %s not found, create one", name);
+ krb5_cc_close(kcontext, ccache);
+ ccache = NULL;
+ free(name);
+ } else {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Failure to open credentials cache %s: %s (%d)",
+ name, error_message(kerr), kerr);
+ free(name);
+ goto done;
+ }
+ }
+
+ kerr = verify_server_credentials(r, kcontext, ccache, princ, &renew);
+
+ if (kerr || !renew) {
+ goto done;
+ }
+
+#ifdef STANDARD20_MODULE_STUFF
+ if (s4u2proxy_lock) {
+ rv = apr_global_mutex_lock(s4u2proxy_lock);
+ if (rv != APR_SUCCESS) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,
+ "apr_global_mutex_lock(s4u2proxy_lock) "
+ "failed");
+ }
+ }
+#endif
+
+ /* We have the lock, check again to be sure another process hasn't already
+ * renewed the ticket.
+ */
+ kerr = verify_server_credentials(r, kcontext, ccache, princ, &renew);
+ if (kerr || !renew) {
+ goto unlock;
+ }
+
+ if (NULL == princ) {
+ princ_name = apr_psprintf(r->pool, "%s/%s",
+ (service_name) ? service_name : SERVICE_NAME,
+ ap_get_server_name(r));
+
+ if ((kerr = krb5_parse_name(kcontext, princ_name, &princ))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Could not parse principal %s: %s (%d) ",
+ princ_name, error_message(kerr), kerr);
+ goto unlock;
+ }
+ } else if (NULL == princ_name) {
+ if ((kerr = krb5_unparse_name(kcontext, princ, &princ_name))) {
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "Could not unparse principal %s: %s (%d)",
+ princ_name, error_message(kerr), kerr);
+ goto unlock;
+ }
+ }
+
+ if ((kerr = krb5_kt_default(kcontext, &keytab))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Unable to get default keytab: %s (%d)",
+ error_message(kerr), kerr);
+ goto unlock;
+ }
+
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "Obtaining new credentials for %s", princ_name);
+ krb5_get_init_creds_opt_init(&gicopts);
+ krb5_get_init_creds_opt_set_forwardable(&gicopts, 1);
+
+ tgs_princ_name = apr_psprintf(r->pool, "%s/%.*s@%.*s", KRB5_TGS_NAME,
+ krb5_princ_realm(kcontext, princ)->length,
+ krb5_princ_realm(kcontext, princ)->data,
+ krb5_princ_realm(kcontext, princ)->length,
+ krb5_princ_realm(kcontext, princ)->data);
+
+ if ((kerr = krb5_get_init_creds_keytab(kcontext, &creds, princ, keytab,
+ 0, tgs_princ_name, &gicopts))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Failed to obtain credentials for principal %s: "
+ "%s (%d)", princ_name, error_message(kerr), kerr);
+ goto unlock;
+ }
+
+ krb5_kt_close(kcontext, keytab);
+ keytab = NULL;
+
+ if (NULL == ccache) {
+ if ((kerr = krb5_cc_default(kcontext, &ccache))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Failed to open default ccache: %s (%d)",
+ error_message(kerr), kerr);
+ goto unlock;
+ }
+ }
+
+ if ((kerr = krb5_cc_initialize(kcontext, ccache, princ))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Failed to initialize ccache for %s: %s (%d)",
+ princ_name, error_message(kerr), kerr);
+ goto unlock;
+ }
+
+ if ((kerr = krb5_cc_store_cred(kcontext, ccache, &creds))) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Failed to store %s in ccache: %s (%d)",
+ princ_name, error_message(kerr), kerr);
+ goto unlock;
+ }
+
+unlock:
+#ifdef STANDARD20_MODULE_STUFF
+ if (s4u2proxy_lock) {
+ apr_global_mutex_unlock(s4u2proxy_lock);
+ if (rv != APR_SUCCESS) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,
+ "apr_global_mutex_unlock(s4u2proxy_lock) "
+ "failed");
+ }
+ }
+#endif
+
+done:
+ if (0 == kerr)
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "Done obtaining credentials for s4u2proxy");
+ else
+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+ "Failed to obtain credentials for s4u2proxy");
+
+ if (creds.client) {
+ krb5_free_cred_contents(kcontext, &creds);
+ }
+ if (ccache) {
+ krb5_cc_close(kcontext, ccache);
+ }
+ if (kcontext) {
+ krb5_free_context(kcontext);
+ }
+
+ return kerr;
+}
+
static int
authenticate_user_gss(request_rec *r, kerb_auth_config *conf,
const char *auth_line, char **negotiate_ret_value)
@@ -1697,10 +2052,60 @@ have_rcache_type(const char *type)
/***************************************************************************
Module Setup/Configuration
***************************************************************************/
+#ifdef STANDARD20_MODULE_STUFF
+static apr_status_t
+s4u2proxylock_create(server_rec *s, apr_pool_t *p)
+{
+ apr_status_t rc;
+
+ /* only operate if a lockfile is used */
+ if (lockname == NULL || *(lockname) == '\0') {
+ return APR_SUCCESS;
+ }
+
+ /* create the lockfile */
+ rc = apr_global_mutex_create(&s4u2proxy_lock, lockname,
+ APR_LOCK_DEFAULT, p);
+ if (rc != APR_SUCCESS) {
+ ap_log_error(APLOG_MARK, APLOG_CRIT, rc, s,
+ "Parent could not create lock file %s", lockname);
+ return rc;
+ }
+
+#ifdef AP_NEED_SET_MUTEX_PERMS
+ rc = unixd_set_global_mutex_perms(s4u2proxy_lock);
+ if (rc != APR_SUCCESS) {
+ ap_log_error(APLOG_MARK, APLOG_CRIT, rc, s,
+ "mod_auth_kerb: Parent could not set permissions "
+ "on lock; check User and Group directives");
+ return rc;
+ }
+#endif
+
+ return APR_SUCCESS;
+}
+
+static apr_status_t
+s4u2proxylock_remove(void *unused)
+{
+ /* only operate if a lockfile is used */
+ if (lockname == NULL || *(lockname) == '\0') {
+ return APR_SUCCESS;
+ }
+
+ /* destroy the rewritelock */
+ apr_global_mutex_destroy(s4u2proxy_lock);
+ s4u2proxy_lock = NULL;
+ lockname = NULL;
+ return APR_SUCCESS;
+}
+#endif
+
#ifndef STANDARD20_MODULE_STUFF
static void
kerb_module_init(server_rec *dummy, pool *p)
{
+ apr_status_t status;
#ifndef HEIMDAL
/* Suppress the MIT replay cache. Requires MIT Kerberos 1.4.0 or later.
1.3.x are covered by the hack overiding the replay calls */
@@ -1741,6 +2146,7 @@ static int
kerb_init_handler(apr_pool_t *p, apr_pool_t *plog,
apr_pool_t *ptemp, server_rec *s)
{
+ apr_status_t rv;
ap_add_version_component(p, "mod_auth_kerb/" MODAUTHKERB_VERSION);
#ifndef HEIMDAL
/* Suppress the MIT replay cache. Requires MIT Kerberos 1.4.0 or later.
@@ -1748,14 +2154,41 @@ kerb_init_handler(apr_pool_t *p, apr_poo
if (getenv("KRB5RCACHETYPE") == NULL && have_rcache_type("none"))
putenv(strdup("KRB5RCACHETYPE=none"));
#endif
+#ifdef STANDARD20_MODULE_STUFF
+ rv = s4u2proxylock_create(s, p);
+ if (rv != APR_SUCCESS) {
+ return HTTP_INTERNAL_SERVER_ERROR;
+ }
+
+ apr_pool_cleanup_register(p, (void *)s, s4u2proxylock_remove,
+ apr_pool_cleanup_null);
+#endif
return OK;
}
static void
+initialize_child(apr_pool_t *p, server_rec *s)
+{
+ apr_status_t rv = 0;
+
+#ifdef STANDARD20_MODULE_STUFF
+ if (lockname != NULL && *(lockname) != '\0') {
+ rv = apr_global_mutex_child_init(&s4u2proxy_lock, lockname, p);
+ if (rv != APR_SUCCESS) {
+ ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s,
+ "mod_auth_kerb: could not init s4u2proxy_lock"
+ " in child");
+ }
+ }
+#endif
+}
+
+static void
kerb_register_hooks(apr_pool_t *p)
{
ap_hook_post_config(kerb_init_handler, NULL, NULL, APR_HOOK_MIDDLE);
+ ap_hook_child_init(initialize_child, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_check_user_id(kerb_authenticate_user, NULL, NULL, APR_HOOK_MIDDLE);
}
distrib
>
Mageia
>
3
>
i586
>
media
>
core-release-src
>
by-pkgid
>
451bb0991d27cdb1979ea3513327c101
>
files
>
6
