oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc: use attribute dictionary in altsec authorizer plugin

Browse Source
This commit is contained in:
Luke Howard
2021-12-30 21:49:53 +11:00
parent a8ff420b16
commit b0f0ed74e8
3 changed files with 55 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
kdc/altsecid_gss_preauth_authorizer.c
View File

@@ -272,7 +272,7 @@ ad_lookup(krb5_context context,
gss_const_name_t initiator_name,
gss_const_OID mech_type,
krb5_principal *canon_principal,
krb5_data *requestor_sid)
heim_data_t *requestor_sid)
{
krb5_error_code ret;
OM_uint32 minor;
@@ -286,7 +286,8 @@ ad_lookup(krb5_context context,
struct berval **values = NULL;
*canon_principal = NULL;
krb5_data_zero(requestor_sid);
if (requestor_sid)
*requestor_sid = NULL;
mech_type_str = gss_oid_to_name(mech_type);
if (mech_type_str == NULL) {
@@ -335,18 +336,6 @@ ad_lookup(krb5_context context,
if (m0 == NULL)
goto out;
if (requestor_sid) {
values = ldap_get_values_len(server->ld, m0, "objectSid");
if (values == NULL ||
ldap_count_values_len(values) == 0)
goto out;
if (krb5_data_copy(requestor_sid, values[0]->bv_val, values[0]->bv_len) != 0)
goto enomem;
ldap_value_free_len(values);
}
values = ldap_get_values_len(server->ld, m0, "sAMAccountName");
if (values == NULL ||
ldap_count_values_len(values) == 0)
@@ -354,6 +343,22 @@ ad_lookup(krb5_context context,
ret = krb5_make_principal(context, canon_principal, realm,
values[0]->bv_val, NULL);
if (ret)
goto out;
if (requestor_sid) {
ldap_value_free_len(values);
values = ldap_get_values_len(server->ld, m0, "objectSid");
if (values == NULL ||
ldap_count_values_len(values) == 0)
goto out;
*requestor_sid = heim_data_create(values[0]->bv_val, values[0]->bv_len);
if (*requestor_sid == NULL)
goto enomem;
}
goto out;
enomem:
@@ -361,6 +366,16 @@ enomem:
goto out;
out:
if (ret) {
krb5_free_principal(context, *canon_principal);
*canon_principal = NULL;
if (requestor_sid) {
heim_release(*requestor_sid);
*requestor_sid = NULL;
}
}
ldap_value_free_len(values);
ldap_msgfree(m);
ldap_memfree(basedn);
@@ -377,8 +392,7 @@ authorize(void *ctx,
gss_const_OID mech_type,
OM_uint32 ret_flags,
krb5_boolean *authorized,
krb5_principal *mapped_name,
krb5_data *requestor_sid)
krb5_principal *mapped_name)
{
struct altsecid_gss_preauth_authorizer_context *c = ctx;
struct ad_server_tuple *server = NULL;
@@ -386,10 +400,10 @@ authorize(void *ctx,
krb5_const_realm realm = krb5_principal_get_realm(r->context, r->client->entry.principal);
krb5_boolean reconnect_p = FALSE;
krb5_boolean is_tgs;
heim_data_t requestor_sid = NULL;
*authorized = FALSE;
*mapped_name = NULL;
krb5_data_zero(requestor_sid);
if (!krb5_principal_is_federated(r->context, r->client->entry.principal) ||
(ret_flags & GSS_C_ANON_FLAG))
@@ -425,7 +439,7 @@ authorize(void *ctx,
ret = ad_lookup(r->context, realm, server,
initiator_name, mech_type,
mapped_name, is_tgs ? requestor_sid : NULL);
mapped_name, is_tgs ? &requestor_sid : NULL);
if (ret == KRB5KDC_ERR_SVC_UNAVAILABLE) {
ldap_unbind_ext_s(server->ld, NULL, NULL);
server->ld = NULL;
@@ -437,17 +451,27 @@ authorize(void *ctx,
*authorized = (ret == 0);
} while (reconnect_p);
if (requestor_sid) {
krb5_kdc_request_set_attribute((kdc_request_t)r,
HSTR("org.h5l.pac-requestor-sid"), requestor_sid);
heim_release(requestor_sid);
}
return ret;
}
static KRB5_LIB_CALL krb5_error_code
finalize_pac(void *ctx, astgs_request_t r, krb5_data *requestor_sid)
finalize_pac(void *ctx, astgs_request_t r)
{
if (requestor_sid->length == 0)
heim_data_t requestor_sid;
requestor_sid = krb5_kdc_request_get_attribute((kdc_request_t)r,
HSTR("org.h5l.pac-requestor-sid"));
if (requestor_sid == NULL)
return 0;
return krb5_pac_add_buffer(r->context, r->pac,
PAC_REQUESTOR_SID, requestor_sid);
return krb5_pac_add_buffer(r->context, r->pac, PAC_REQUESTOR_SID,
heim_data_get_data(requestor_sid));
}
static KRB5_LIB_CALL krb5_error_code