1 |
unnilennium |
1.1 |
From d29b108d879b4de27d235a1692e090c0993582df Mon Sep 17 00:00:00 2001 |
2 |
|
|
From: Stefan Metzmacher <metze@samba.org> |
3 |
|
|
Date: Wed, 6 Jul 2016 12:48:11 +0200 |
4 |
|
|
Subject: [PATCH 1/2] libads: ensure the right ccache is used during gssapi |
5 |
|
|
bind |
6 |
|
|
|
7 |
|
|
When doing gssapi sasl bind: |
8 |
|
|
1. Try working without kinit only if a password is not |
9 |
|
|
provided |
10 |
|
|
2. When using kinit, ensure the KRB5CCNAME env var is set |
11 |
|
|
to a private memory ccache, so that the bind is on behalf |
12 |
|
|
of the requested user. |
13 |
|
|
|
14 |
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12007 |
15 |
|
|
|
16 |
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org> |
17 |
|
|
Reviewed-by: Uri Simchoni <uri@samba.org> |
18 |
|
|
(cherry picked from commit 2672968851966e5c01e4fc4d906b45b5c047e655) |
19 |
|
|
--- |
20 |
|
|
source3/libads/sasl.c | 23 ++++++++++++++++------- |
21 |
|
|
1 file changed, 16 insertions(+), 7 deletions(-) |
22 |
|
|
|
23 |
|
|
diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c |
24 |
|
|
index d76d872..6c054cd 100644 |
25 |
|
|
--- a/source3/libads/sasl.c |
26 |
|
|
+++ b/source3/libads/sasl.c |
27 |
|
|
@@ -26,6 +26,7 @@ |
28 |
|
|
#include "smb_krb5.h" |
29 |
|
|
#include "system/gssapi.h" |
30 |
|
|
#include "lib/param/loadparm.h" |
31 |
|
|
+#include "krb5_env.h" |
32 |
|
|
|
33 |
|
|
#ifdef HAVE_LDAP |
34 |
|
|
|
35 |
|
|
@@ -1015,21 +1016,29 @@ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads) |
36 |
|
|
{ |
37 |
|
|
ADS_STATUS status; |
38 |
|
|
struct ads_service_principal p; |
39 |
|
|
+ const char *ccache_name = "MEMORY:ads_sasl_gssapi_do_bind"; |
40 |
|
|
|
41 |
|
|
status = ads_generate_service_principal(ads, &p); |
42 |
|
|
if (!ADS_ERR_OK(status)) { |
43 |
|
|
return status; |
44 |
|
|
} |
45 |
|
|
|
46 |
|
|
- status = ads_sasl_gssapi_do_bind(ads, p.name); |
47 |
|
|
- if (ADS_ERR_OK(status)) { |
48 |
|
|
- ads_free_service_principal(&p); |
49 |
|
|
- return status; |
50 |
|
|
- } |
51 |
|
|
+ if (ads->auth.password == NULL || |
52 |
|
|
+ ads->auth.password[0] == '\0') { |
53 |
|
|
+ status = ads_sasl_gssapi_do_bind(ads, p.name); |
54 |
|
|
+ if (ADS_ERR_OK(status)) { |
55 |
|
|
+ ads_free_service_principal(&p); |
56 |
|
|
+ return status; |
57 |
|
|
+ } |
58 |
|
|
|
59 |
|
|
- DEBUG(10,("ads_sasl_gssapi_do_bind failed with: %s, " |
60 |
|
|
- "calling kinit\n", ads_errstr(status))); |
61 |
|
|
+ DEBUG(10,("ads_sasl_gssapi_do_bind failed with: %s, " |
62 |
|
|
+ "calling kinit\n", ads_errstr(status))); |
63 |
|
|
+ } |
64 |
|
|
|
65 |
|
|
+ if (ads->auth.ccache_name != NULL) { |
66 |
|
|
+ ccache_name = ads->auth.ccache_name; |
67 |
|
|
+ } |
68 |
|
|
+ setenv(KRB5_ENV_CCNAME, ccache_name, 1); |
69 |
|
|
status = ADS_ERROR_KRB5(ads_kinit_password(ads)); |
70 |
|
|
|
71 |
|
|
if (ADS_ERR_OK(status)) { |
72 |
|
|
-- |
73 |
|
|
2.5.5 |
74 |
|
|
|
75 |
|
|
|
76 |
|
|
From 416ba773c332288e948871d8f649c0310a94f906 Mon Sep 17 00:00:00 2001 |
77 |
|
|
From: Stefan Metzmacher <metze@samba.org> |
78 |
|
|
Date: Wed, 6 Jul 2016 12:44:11 +0200 |
79 |
|
|
Subject: [PATCH 2/2] libads: ensure the right ccache is used during spnego |
80 |
|
|
bind |
81 |
|
|
|
82 |
|
|
When doing spnego sasl bind: |
83 |
|
|
1. Try working without kinit only if a password is not |
84 |
|
|
provided |
85 |
|
|
2. When using kinit, ensure the KRB5CCNAME env var is set |
86 |
|
|
to a private memory ccache, so that the bind is on behalf |
87 |
|
|
of the requested user. |
88 |
|
|
|
89 |
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12007 |
90 |
|
|
|
91 |
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org> |
92 |
|
|
Reviewed-by: Uri Simchoni <uri@samba.org> |
93 |
|
|
|
94 |
|
|
Autobuild-User(master): Stefan Metzmacher <metze@samba.org> |
95 |
|
|
Autobuild-Date(master): Tue Jul 12 03:23:33 CEST 2016 on sn-devel-144 |
96 |
|
|
|
97 |
|
|
(cherry picked from commit a1743de74f09d5bf695f077f5127d02352a014e2) |
98 |
|
|
--- |
99 |
|
|
source3/libads/sasl.c | 29 ++++++++++++++++++++--------- |
100 |
|
|
1 file changed, 20 insertions(+), 9 deletions(-) |
101 |
|
|
|
102 |
|
|
diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c |
103 |
|
|
index 6c054cd..85a2eb0 100644 |
104 |
|
|
--- a/source3/libads/sasl.c |
105 |
|
|
+++ b/source3/libads/sasl.c |
106 |
|
|
@@ -749,18 +749,29 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) |
107 |
|
|
if (!(ads->auth.flags & ADS_AUTH_DISABLE_KERBEROS) && |
108 |
|
|
got_kerberos_mechanism) |
109 |
|
|
{ |
110 |
|
|
- status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", |
111 |
|
|
- CRED_MUST_USE_KERBEROS, |
112 |
|
|
- p.service, p.hostname, |
113 |
|
|
- blob); |
114 |
|
|
- if (ADS_ERR_OK(status)) { |
115 |
|
|
- ads_free_service_principal(&p); |
116 |
|
|
- goto done; |
117 |
|
|
+ const char *ccache_name = "MEMORY:ads_sasl_spnego_bind"; |
118 |
|
|
+ if (ads->auth.ccache_name != NULL) { |
119 |
|
|
+ ccache_name = ads->auth.ccache_name; |
120 |
|
|
} |
121 |
|
|
|
122 |
|
|
- DEBUG(10,("ads_sasl_spnego_gensec_bind(KRB5) failed with: %s, " |
123 |
|
|
- "calling kinit\n", ads_errstr(status))); |
124 |
|
|
+ if (ads->auth.password == NULL || |
125 |
|
|
+ ads->auth.password[0] == '\0') |
126 |
|
|
+ { |
127 |
|
|
+ |
128 |
|
|
+ status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", |
129 |
|
|
+ CRED_MUST_USE_KERBEROS, |
130 |
|
|
+ p.service, p.hostname, |
131 |
|
|
+ blob); |
132 |
|
|
+ if (ADS_ERR_OK(status)) { |
133 |
|
|
+ ads_free_service_principal(&p); |
134 |
|
|
+ goto done; |
135 |
|
|
+ } |
136 |
|
|
+ |
137 |
|
|
+ DEBUG(10,("ads_sasl_spnego_gensec_bind(KRB5) failed with: %s, " |
138 |
|
|
+ "calling kinit\n", ads_errstr(status))); |
139 |
|
|
+ } |
140 |
|
|
|
141 |
|
|
+ setenv(KRB5_ENV_CCNAME, ccache_name, 1); |
142 |
|
|
status = ADS_ERROR_KRB5(ads_kinit_password(ads)); |
143 |
|
|
|
144 |
|
|
if (ADS_ERR_OK(status)) { |
145 |
|
|
-- |
146 |
|
|
2.5.5 |
147 |
|
|
|