354 lines
16 KiB
Diff
354 lines
16 KiB
Diff
From 861ab44e8148208425b67c4711bc8fade10fd3ed Mon Sep 17 00:00:00 2001
|
|
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
Date: Wed, 22 Mar 2017 13:01:18 +0100
|
|
Subject: [PATCH 75/97] KRB5: Authenticate users in a non-POSIX domain using a
|
|
MEMORY ccache
|
|
|
|
Related to:
|
|
https://pagure.io/SSSD/sssd/issue/3310
|
|
|
|
The following changes were done to the Kerberos authentication code
|
|
in order to support authentication in a non-POSIX environment:
|
|
- delayed authentication is disabled in non-POSIX domains
|
|
- when a user logs in in a non-POSIX domain, SSSD uses a
|
|
MEMORY:$username ccache and destroys is then krb5_child finishes
|
|
so that just the numeric result is used
|
|
- krb5_child doesn't drop privileges in this configuration because
|
|
there is nothing to drop privileges to
|
|
|
|
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
---
|
|
src/providers/krb5/krb5_auth.c | 62 ++++++++++++++++------
|
|
src/providers/krb5/krb5_auth.h | 2 +
|
|
src/providers/krb5/krb5_child.c | 32 +++++++++--
|
|
src/providers/krb5/krb5_child_handler.c | 15 +++++-
|
|
.../krb5/krb5_delayed_online_authentication.c | 7 +++
|
|
src/providers/krb5/krb5_init.c | 3 ++
|
|
6 files changed, 99 insertions(+), 22 deletions(-)
|
|
|
|
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
|
|
index c2d6d7eeacc1f766024c4d629f25fd0f0be24e5e..2faf18d17a735476c20f9cc27b15be4a39cadc5c 100644
|
|
--- a/src/providers/krb5/krb5_auth.c
|
|
+++ b/src/providers/krb5/krb5_auth.c
|
|
@@ -42,6 +42,8 @@
|
|
#include "providers/krb5/krb5_utils.h"
|
|
#include "providers/krb5/krb5_ccache.h"
|
|
|
|
+#define NON_POSIX_CCNAME_FMT "MEMORY:sssd_nonposix_dummy_%u"
|
|
+
|
|
static int krb5_mod_ccname(TALLOC_CTX *mem_ctx,
|
|
struct sysdb_ctx *sysdb,
|
|
struct sss_domain_info *domain,
|
|
@@ -200,6 +202,7 @@ errno_t krb5_setup(TALLOC_CTX *mem_ctx,
|
|
talloc_set_destructor((TALLOC_CTX *) kr, krb5_cleanup);
|
|
|
|
kr->pd = pd;
|
|
+ kr->dom = dom;
|
|
kr->krb5_ctx = krb5_ctx;
|
|
|
|
ret = get_krb_primary(krb5_ctx->name_to_primary,
|
|
@@ -275,8 +278,11 @@ static void krb5_auth_cache_creds(struct krb5_ctx *krb5_ctx,
|
|
return;
|
|
}
|
|
|
|
- ret = add_user_to_delayed_online_authentication(krb5_ctx, pd, uid);
|
|
- if (ret != EOK) {
|
|
+ ret = add_user_to_delayed_online_authentication(krb5_ctx, domain, pd, uid);
|
|
+ if (ret == ENOTSUP) {
|
|
+ /* This error is not fatal */
|
|
+ DEBUG(SSSDBG_MINOR_FAILURE, "Delayed authentication not supported\n");
|
|
+ } else if (ret != EOK) {
|
|
/* This error is not fatal */
|
|
DEBUG(SSSDBG_CRIT_FAILURE,
|
|
"add_user_to_delayed_online_authentication failed.\n");
|
|
@@ -291,21 +297,43 @@ static errno_t krb5_auth_prepare_ccache_name(struct krb5child_req *kr,
|
|
{
|
|
const char *ccname_template;
|
|
|
|
- ccname_template = dp_opt_get_cstring(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL);
|
|
+ switch (kr->dom->type) {
|
|
+ case DOM_TYPE_POSIX:
|
|
+ ccname_template = dp_opt_get_cstring(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL);
|
|
|
|
- kr->ccname = expand_ccname_template(kr, kr, ccname_template,
|
|
- kr->krb5_ctx->illegal_path_re, true,
|
|
- be_ctx->domain->case_sensitive);
|
|
- if (kr->ccname == NULL) {
|
|
- DEBUG(SSSDBG_CRIT_FAILURE, "expand_ccname_template failed.\n");
|
|
- return ENOMEM;
|
|
- }
|
|
+ kr->ccname = expand_ccname_template(kr, kr, ccname_template,
|
|
+ kr->krb5_ctx->illegal_path_re, true,
|
|
+ be_ctx->domain->case_sensitive);
|
|
+ if (kr->ccname == NULL) {
|
|
+ DEBUG(SSSDBG_CRIT_FAILURE, "expand_ccname_template failed.\n");
|
|
+ return ENOMEM;
|
|
+ }
|
|
|
|
- kr->old_ccname = ldb_msg_find_attr_as_string(user_msg,
|
|
- SYSDB_CCACHE_FILE, NULL);
|
|
- if (kr->old_ccname == NULL) {
|
|
- DEBUG(SSSDBG_TRACE_LIBS,
|
|
- "No ccache file for user [%s] found.\n", kr->pd->user);
|
|
+ kr->old_ccname = ldb_msg_find_attr_as_string(user_msg,
|
|
+ SYSDB_CCACHE_FILE, NULL);
|
|
+ if (kr->old_ccname == NULL) {
|
|
+ DEBUG(SSSDBG_TRACE_LIBS,
|
|
+ "No ccache file for user [%s] found.\n", kr->pd->user);
|
|
+ }
|
|
+ break;
|
|
+ case DOM_TYPE_APPLICATION:
|
|
+ DEBUG(SSSDBG_TRACE_FUNC,
|
|
+ "Domain type application, will use in-memory ccache\n");
|
|
+ /* We don't care about using cryptographic randomness, just
|
|
+ * a non-predictable ccname, so using rand() here is fine
|
|
+ */
|
|
+ kr->ccname = talloc_asprintf(kr,
|
|
+ NON_POSIX_CCNAME_FMT,
|
|
+ rand() % UINT_MAX);
|
|
+ if (kr->ccname == NULL) {
|
|
+ DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");
|
|
+ return ENOMEM;
|
|
+ }
|
|
+
|
|
+ break;
|
|
+ default:
|
|
+ DEBUG(SSSDBG_FATAL_FAILURE, "Unsupported domain type\n");
|
|
+ return EINVAL;
|
|
}
|
|
|
|
return EOK;
|
|
@@ -617,7 +645,7 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
|
|
kr->uid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
|
|
res->msgs[0],
|
|
SYSDB_UIDNUM, 0);
|
|
- if (kr->uid == 0) {
|
|
+ if (kr->uid == 0 && state->domain->type == DOM_TYPE_POSIX) {
|
|
DEBUG(SSSDBG_CONF_SETTINGS,
|
|
"UID for user [%s] not known.\n", pd->user);
|
|
ret = ENOENT;
|
|
@@ -627,7 +655,7 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
|
|
kr->gid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
|
|
res->msgs[0],
|
|
SYSDB_GIDNUM, 0);
|
|
- if (kr->gid == 0) {
|
|
+ if (kr->gid == 0 && state->domain->type == DOM_TYPE_POSIX) {
|
|
DEBUG(SSSDBG_CONF_SETTINGS,
|
|
"GID for user [%s] not known.\n", pd->user);
|
|
ret = ENOENT;
|
|
diff --git a/src/providers/krb5/krb5_auth.h b/src/providers/krb5/krb5_auth.h
|
|
index 75ad916e79b29043120543ab3c4c1bd27e09d913..8ad3aeff21e58f9055ae144eaa450992c6391ba6 100644
|
|
--- a/src/providers/krb5/krb5_auth.h
|
|
+++ b/src/providers/krb5/krb5_auth.h
|
|
@@ -50,6 +50,7 @@
|
|
struct krb5child_req {
|
|
struct pam_data *pd;
|
|
struct krb5_ctx *krb5_ctx;
|
|
+ struct sss_domain_info *dom;
|
|
|
|
const char *ccname;
|
|
const char *old_ccname;
|
|
@@ -118,6 +119,7 @@ parse_krb5_child_response(TALLOC_CTX *mem_ctx, uint8_t *buf, ssize_t len,
|
|
struct krb5_child_response **_res);
|
|
|
|
errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
|
|
+ struct sss_domain_info *domain,
|
|
struct pam_data *pd,
|
|
uid_t uid);
|
|
errno_t init_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
|
|
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
|
|
index a4128dda6b0861a95dba223047d66c4158b1afb6..cbbc892bee0365892ac66d3654c974d325166b60 100644
|
|
--- a/src/providers/krb5/krb5_child.c
|
|
+++ b/src/providers/krb5/krb5_child.c
|
|
@@ -80,6 +80,7 @@ struct krb5_req {
|
|
char *ccname;
|
|
char *keytab;
|
|
bool validate;
|
|
+ bool posix_domain;
|
|
bool send_pac;
|
|
bool use_enterprise_princ;
|
|
char *fast_ccname;
|
|
@@ -102,6 +103,16 @@ struct krb5_req {
|
|
static krb5_context krb5_error_ctx;
|
|
#define KRB5_CHILD_DEBUG(level, error) KRB5_DEBUG(level, krb5_error_ctx, error)
|
|
|
|
+static errno_t k5c_become_user(uid_t uid, gid_t gid, bool is_posix)
|
|
+{
|
|
+ if (is_posix == false) {
|
|
+ DEBUG(SSSDBG_TRACE_FUNC,
|
|
+ "Will not drop privileges for a non-POSIX user\n");
|
|
+ return EOK;
|
|
+ }
|
|
+ return become_user(uid, gid);
|
|
+}
|
|
+
|
|
static krb5_error_code set_lifetime_options(struct cli_opts *cli_opts,
|
|
krb5_get_init_creds_opt *options)
|
|
{
|
|
@@ -1561,6 +1572,15 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr,
|
|
DEBUG(SSSDBG_CONF_SETTINGS, "TGT validation is disabled.\n");
|
|
}
|
|
|
|
+ /* In a non-POSIX environment, we only care about the return code from
|
|
+ * krb5_child, so let's not even attempt to create the ccache
|
|
+ */
|
|
+ if (kr->posix_domain == false) {
|
|
+ DEBUG(SSSDBG_TRACE_LIBS,
|
|
+ "Finished authentication in a non-POSIX domain\n");
|
|
+ goto done;
|
|
+ }
|
|
+
|
|
/* If kr->ccname is cache collection (DIR:/...), we want to work
|
|
* directly with file ccache (DIR::/...), but cache collection
|
|
* should be returned back to back end.
|
|
@@ -2146,6 +2166,7 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
|
|
size_t p = 0;
|
|
uint32_t len;
|
|
uint32_t validate;
|
|
+ uint32_t posix_domain;
|
|
uint32_t send_pac;
|
|
uint32_t use_enterprise_princ;
|
|
struct pam_data *pd;
|
|
@@ -2167,6 +2188,8 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
|
|
SAFEALIGN_COPY_UINT32_CHECK(&kr->gid, buf + p, size, &p);
|
|
SAFEALIGN_COPY_UINT32_CHECK(&validate, buf + p, size, &p);
|
|
kr->validate = (validate == 0) ? false : true;
|
|
+ SAFEALIGN_COPY_UINT32_CHECK(&posix_domain, buf + p, size, &p);
|
|
+ kr->posix_domain = (posix_domain == 0) ? false : true;
|
|
SAFEALIGN_COPY_UINT32_CHECK(offline, buf + p, size, &p);
|
|
SAFEALIGN_COPY_UINT32_CHECK(&send_pac, buf + p, size, &p);
|
|
kr->send_pac = (send_pac == 0) ? false : true;
|
|
@@ -2331,6 +2354,7 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
|
|
krb5_context ctx,
|
|
uid_t fast_uid,
|
|
gid_t fast_gid,
|
|
+ bool posix_domain,
|
|
struct cli_opts *cli_opts,
|
|
const char *primary,
|
|
const char *realm,
|
|
@@ -2420,7 +2444,7 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
|
|
/* Try to carry on */
|
|
}
|
|
|
|
- kerr = become_user(fast_uid, fast_gid);
|
|
+ kerr = k5c_become_user(fast_uid, fast_gid, posix_domain);
|
|
if (kerr != 0) {
|
|
DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed: %d\n", kerr);
|
|
exit(1);
|
|
@@ -2572,7 +2596,7 @@ static int k5c_setup_fast(struct krb5_req *kr, bool demand)
|
|
}
|
|
|
|
kerr = check_fast_ccache(kr, kr->ctx, kr->fast_uid, kr->fast_gid,
|
|
- kr->cli_opts,
|
|
+ kr->posix_domain, kr->cli_opts,
|
|
fast_principal, fast_principal_realm,
|
|
kr->keytab, &kr->fast_ccname);
|
|
if (kerr != 0) {
|
|
@@ -2773,7 +2797,7 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
|
|
* the user who is logging in. The same applies to the offline case
|
|
* the user who is logging in. The same applies to the offline case.
|
|
*/
|
|
- kerr = become_user(kr->uid, kr->gid);
|
|
+ kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
|
|
if (kerr != 0) {
|
|
DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed.\n");
|
|
return kerr;
|
|
@@ -3075,7 +3099,7 @@ int main(int argc, const char *argv[])
|
|
if ((sss_authtok_get_type(kr->pd->authtok) != SSS_AUTHTOK_TYPE_SC_PIN
|
|
&& sss_authtok_get_type(kr->pd->authtok)
|
|
!= SSS_AUTHTOK_TYPE_SC_KEYPAD)) {
|
|
- kerr = become_user(kr->uid, kr->gid);
|
|
+ kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
|
|
if (kerr != 0) {
|
|
DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed.\n");
|
|
ret = EFAULT;
|
|
diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
|
|
index 680e67b089fcb32280352af24aae35af133a52f3..87e79a06e917aadb622455bccfc2e9c6769f70c2 100644
|
|
--- a/src/providers/krb5/krb5_child_handler.c
|
|
+++ b/src/providers/krb5/krb5_child_handler.c
|
|
@@ -107,6 +107,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
|
|
uint32_t validate;
|
|
uint32_t send_pac;
|
|
uint32_t use_enterprise_principal;
|
|
+ uint32_t posix_domain;
|
|
size_t username_len = 0;
|
|
errno_t ret;
|
|
|
|
@@ -131,6 +132,17 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
|
|
break;
|
|
}
|
|
|
|
+ switch (kr->dom->type) {
|
|
+ case DOM_TYPE_POSIX:
|
|
+ posix_domain = 1;
|
|
+ break;
|
|
+ case DOM_TYPE_APPLICATION:
|
|
+ posix_domain = 0;
|
|
+ break;
|
|
+ default:
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
if (kr->pd->cmd == SSS_CMD_RENEW || kr->is_offline) {
|
|
use_enterprise_principal = false;
|
|
} else {
|
|
@@ -151,7 +163,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
|
|
kr->pd->cmd == SSS_CMD_RENEW ||
|
|
kr->pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM ||
|
|
kr->pd->cmd == SSS_PAM_CHAUTHTOK) {
|
|
- buf->size += 4*sizeof(uint32_t) + strlen(kr->ccname) + strlen(keytab) +
|
|
+ buf->size += 5*sizeof(uint32_t) + strlen(kr->ccname) + strlen(keytab) +
|
|
sss_authtok_get_size(kr->pd->authtok);
|
|
|
|
buf->size += sizeof(uint32_t);
|
|
@@ -182,6 +194,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
|
|
SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->uid, &rp);
|
|
SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->gid, &rp);
|
|
SAFEALIGN_COPY_UINT32(&buf->data[rp], &validate, &rp);
|
|
+ SAFEALIGN_COPY_UINT32(&buf->data[rp], &posix_domain, &rp);
|
|
SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->is_offline, &rp);
|
|
SAFEALIGN_COPY_UINT32(&buf->data[rp], &send_pac, &rp);
|
|
SAFEALIGN_COPY_UINT32(&buf->data[rp], &use_enterprise_principal, &rp);
|
|
diff --git a/src/providers/krb5/krb5_delayed_online_authentication.c b/src/providers/krb5/krb5_delayed_online_authentication.c
|
|
index bf2ef775573ba6bad79a99ad43b5d9748516e794..1cb7eade0e4cb9afbc4d031a07b3519ba08456d6 100644
|
|
--- a/src/providers/krb5/krb5_delayed_online_authentication.c
|
|
+++ b/src/providers/krb5/krb5_delayed_online_authentication.c
|
|
@@ -234,6 +234,7 @@ static void delayed_online_authentication_callback(void *private_data)
|
|
}
|
|
|
|
errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
|
|
+ struct sss_domain_info *domain,
|
|
struct pam_data *pd,
|
|
uid_t uid)
|
|
{
|
|
@@ -242,6 +243,12 @@ errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
|
|
hash_value_t value;
|
|
struct pam_data *new_pd;
|
|
|
|
+ if (domain->type != DOM_TYPE_POSIX) {
|
|
+ DEBUG(SSSDBG_MINOR_FAILURE,
|
|
+ "Domain type does not support delayed authentication\n");
|
|
+ return ENOTSUP;
|
|
+ }
|
|
+
|
|
if (krb5_ctx->deferred_auth_ctx == NULL) {
|
|
DEBUG(SSSDBG_CRIT_FAILURE,
|
|
"Missing context for delayed online authentication.\n");
|
|
diff --git a/src/providers/krb5/krb5_init.c b/src/providers/krb5/krb5_init.c
|
|
index 12c8dfcc49af75de619ec0858aaff81504698273..66ae68fb4773af3987f2062246bc6493107c74d5 100644
|
|
--- a/src/providers/krb5/krb5_init.c
|
|
+++ b/src/providers/krb5/krb5_init.c
|
|
@@ -136,6 +136,9 @@ errno_t sssm_krb5_init(TALLOC_CTX *mem_ctx,
|
|
return ENOMEM;
|
|
}
|
|
|
|
+ /* Only needed to generate random ccache names for non-POSIX domains */
|
|
+ srand(time(NULL) * getpid());
|
|
+
|
|
ret = sss_krb5_get_options(ctx, be_ctx->cdb, be_ctx->conf_path, &ctx->opts);
|
|
if (ret != EOK) {
|
|
DEBUG(SSSDBG_CRIT_FAILURE, "Unable to get krb5 options [%d]: %s\n",
|
|
--
|
|
2.12.2
|
|
|