X-Git-Url: https://git.hcoop.net/hcoop/debian/libapache-mod-waklog.git/blobdiff_plain/bce7d4d9aa632d757285cc408933ed39f8301539..c760f0a1e3894bda8bb599a5b02582793b7e76ab:/mod_waklog.c

diff --git a/mod_waklog.c b/mod_waklog.c
index 0a0fae5..fae5c73 100644
--- a/mod_waklog.c
+++ b/mod_waklog.c
@@ -106,6 +106,7 @@ typedef struct
   char *default_principal;
   char *default_keytab;
   char *afs_cell;
+  char *afs_cell_realm;
   char *path;
   MK_POOL *p;
 }
@@ -231,6 +232,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
   krb5_get_init_creds_opt kopts;
   krb5_creds v5creds;
   krb5_creds increds;
+  krb5_ccache clientccache;
   struct ktc_principal server = { "afs", "", "" };
   struct ktc_principal client;
   struct ktc_token token;
@@ -241,31 +243,50 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
   int rc = 0;
   int buflen = 0;
   time_t oldest_time = 0;
-  int oldest;
+  int oldest = 0;
   int stored = -1;
   time_t mytime;
   int indentical;
   int cell_in_principal;
   int attempt;
+  int use_client_credentials = 0;
   
-  char k5user[MAXNAMELEN];
-  char *k5secret;
+  char k5user[MAXNAMELEN] = "";
+  char *k5secret = NULL;
+
+  char *k5path = NULL;
   
   memset((char *) &increds, 0, sizeof(increds));
-  
   /* init some stuff if it ain't already */
-  
+  /* XXX - In what situation will these not be initialized? */
+
   if ( ! child.kcontext ) {
-    kerror = krb5_init_context(&child.kcontext);
+    if ((kerror = krb5_init_context(&child.kcontext))) {
+      log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize Kerberos context err=%d", 
+		kerror);
+      return(-1);
+    }
   }
-  
-  if ( ( ! child.ccache ) && ( kerror = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) ) {
-    log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize in-memory credentials cache %d", kerror );
+
+  if ( !child.ccache) {
+    if ((kerror = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache))) {
+      log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize credentials cache %s err=%d",
+                k5path, kerror );
+      return(-1);
+    }
   }
   
-  
-  log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: %d, %s, %s, %d", self, principal ? principal : "NULL", 
-    keytab ? keytab : "NULL", storeonly);
+  log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: %d, %s, %s, %d, KRB5CC=%s user=%s",
+            self, principal ? principal : "NULL", 
+            keytab ? keytab : "NULL",
+            storeonly,
+            k5path ? k5path : "NULL",
+#ifdef APACHE2
+            (r && r->user) ? r->user : "NULL"
+#else
+            (r && r->connection && r->connection->user) ? r->connection->user : "NULL"
+#endif
+            );
   
   /* pull the server config record that we care about... */
   
@@ -280,34 +301,51 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
   if ( ! cfg ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: cfg is %d", cfg );
   }
-  
-#ifdef APACHE2
+
+
   if ( self ) {
     /* pull out our principal name and stuff from the environment -- webauth better have sent
-       through.  This here is also where you'd suck stuff out of KRB5CCNAME if we were
-       using something like Cosign */
-       
+       through. */
+
+#ifdef APACHE2       
        if ( ! ( r && r->connection && r->user )) {
          log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: self authentication selected, but no data available");
+         log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: r->user=%s", (r->user==NULL ? "null" : r->user==NULL));
          return -1;
        }
        
        strncpy(k5user, r->user, sizeof(k5user));
-       
-       /* the other thing we need is someone's password */       
-       if ( ! ( k5secret = (char *) MK_TABLE_GET( r->notes, "ATTR_PASSWORD" ) ) ) {
-         log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cant do self auth without a secret");
+#else
+       if ( ! (r && r->connection && r->connection->user)) {
+	 log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: self authentication selected, but no username available");
          return -1;
-       }     
+       }
+
+       strncpy(k5user, r->connection->user, sizeof(k5user));
+#endif
+       /* if they've supplied a credentials cache */
+       k5path = (char *) MK_TABLE_GET( r->subprocess_env, "KRB5CCNAME" );
+
+       /* the other thing we need is someone's password */       
+       k5secret = (char *) MK_TABLE_GET( r->notes, "ATTR_PASSWORD" );
        
        /* we'll pick this up later after we've checked the cache and current state */
              
   } else
-#endif
   if ( principal ) {
-    strncpy( k5user, principal, sizeof(k5user));
+    strncpy(k5user, principal, sizeof(k5user));
+  } else
+#ifdef APACHE2
+  if (r && r->user) {
+    strncpy(k5user, r->user, sizeof(k5user));
+  }
+#else
+  if (r && r->connection && r->connection->user) {
+    strncpy(k5user, r->connection->user, sizeof(k5user));
   }
+#endif
   
+  log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: k5user=%s", k5user ? k5user : "NULL");
   mytime = time(0);
   
   /* see if we should just go ahead and ignore this call, since we already should be set to these
@@ -376,9 +414,8 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
     }
   
   }
-  
+
   /* if 'usecached' isn't set, we've got to get our tokens from somewhere... */
-  
   if (( ! usecached ) && ( k5user )) {
 
     /* clear out the creds structure */
@@ -386,7 +423,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
     
     /* create a principal out of our k5user string */
     
-    if ( kerror = krb5_parse_name (child.kcontext, k5user, &kprinc ) ) {
+    if ( ( kerror = krb5_parse_name (child.kcontext, k5user, &kprinc ) ) ) {
       log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_parse_name %s", (char *) error_message(kerror) );
       goto cleanup;
     }
@@ -399,90 +436,94 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
     krb5_get_init_creds_opt_set_forwardable ( &kopts, 0 );
     krb5_get_init_creds_opt_set_proxiable ( &kopts, 0 );
     
-    if ( keytab ) {
+    if ( keytab || k5secret ) {
     
-      /* if we've been passed a keytab, we're going to be getting our credentials from it */
+      if (keytab) {
+        /* if we've been passed a keytab, we're going to be getting our credentials from it */
     
-      log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: using keytab %s", keytab);
+        log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: using keytab %s", keytab);
     
-      if ( kerror = krb5_kt_resolve(child.kcontext, keytab, &krb5kt ) ) {
-        log_error( APLOG_MARK, APLOG_ERR, 0, s,
-          "mod_waklog: krb5_kt_resolve %s", error_message(kerror) );
-        goto cleanup;
-      }
+        if ( ( kerror = krb5_kt_resolve(child.kcontext, keytab, &krb5kt ) ) ) {
+          log_error( APLOG_MARK, APLOG_ERR, 0, s,
+            "mod_waklog: krb5_kt_resolve %s", error_message(kerror) );
+          goto cleanup;
+        }
     
-      if ((kerror = krb5_get_init_creds_keytab (child.kcontext, &v5creds,
-            kprinc, krb5kt, 0, NULL, &kopts ) ) ) {
-              log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_keytab %s",
-                error_message(kerror) );
-              goto cleanup;
-      }
+        if ((kerror = krb5_get_init_creds_keytab (child.kcontext, &v5creds,
+              kprinc, krb5kt, 0, NULL, &kopts ) ) ) {
+                log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_keytab %s",
+                  error_message(kerror) );
+                goto cleanup;
+        }
+      } else if (k5secret) {
       
-    } else if ( self ) {
+        /* If the WebSSO is lame enough to provide a secret, then try and use that to get a token */
       
-      /* if 'self' is set, we're going to use the credentials provided in the credential information */
-      /* if you're using CoSign, you'd actually just set the ccache to the KRB5CCNAME credentials */
-      /* and skip ahead...  Our WebSSO is lame, but has a way for us to snarf the password out of */
-      /* the encrypted token for proxy-authentication stuff.  We only hand out keys that allow this */
-      /* functionality to VERY special people. */
+        if ((kerror = krb5_get_init_creds_password ( child.kcontext, &v5creds,
+              kprinc, k5secret, NULL, NULL, 0, NULL, &kopts ) ) ) {
+                log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_password %s",
+                  error_message(kerror) );
+                  /* nuke the password so it doesn't end up in core files */
+                  memset(k5secret, 0, sizeof(k5secret));               
+                goto cleanup;
+        }
       
-      if ((kerror = krb5_get_init_creds_password ( child.kcontext, &v5creds,
-            kprinc, k5secret, NULL, NULL, 0, NULL, &kopts ) ) ) {
-              log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_password %s",
-                error_message(kerror) );
-                /* nuke the password so it doesn't end up in core files */
-                memset(k5secret, 0, sizeof(k5secret));               
-              goto cleanup;
+        memset(k5secret, 0, sizeof(k5secret));      
       }
-      
-      memset(k5secret, 0, sizeof(k5secret));      
-      
-    } else {
-      
-      /* degenerate case -- we don't have enough information to do anything */
-      
-      log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: no keytab, no self?");
-      kerror = -1;
-      goto cleanup;
-      
-    } 
-    
+
       /* initialize the credentials cache and store the stuff we just got */
+      if ( ( kerror = krb5_cc_initialize (child.kcontext, child.ccache, kprinc) ) ) {
+        log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: init credentials cache %s", 
+                  error_message(kerror));
+        goto cleanup;
+      }
       
-    if ( kerror = krb5_cc_initialize (child.kcontext, child.ccache, kprinc)) {
-      log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: init credentials cache %s", 
-      error_message(kerror));
-      goto cleanup;
-    }
-  
-    if ( kerror = krb5_cc_store_cred(child.kcontext, child.ccache, &v5creds) ) {
-       log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cannot store credentials %s", 
-       error_message(kerror));
-       goto cleanup;
-    }
+      if ( ( kerror = krb5_cc_store_cred(child.kcontext, child.ccache, &v5creds) ) ) {
+        log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cannot store credentials %s", 
+                  error_message(kerror));
+        goto cleanup;
+      }
     
-    krb5_free_cred_contents(child.kcontext, &v5creds);
+      krb5_free_cred_contents(child.kcontext, &v5creds);
+ 
+      if ( kerror ) {
+        log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: store cred %s", error_message(kerror));
+        goto cleanup;
+      }
+      
+      log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: kinit ok for %s", k5user );
+
+    } else if (k5path) {
+      /* If we've got a path to a credentials cache, then try and use that. We can't just
+       * replace child.creds, because we want to ensure that only this request gets access to
+       * that cache */
+
+      if ( ( kerror = krb5_cc_resolve(child.kcontext, k5path, &clientccache ) ) ) {
+        log_error(APLOG_MARK, APLOG_ERR, 0, s,
+		  "mod_waklog: can't open provided credentials cache %s err=%d",
+		  k5path, kerror );
+        goto cleanup;
+      }
+
+      use_client_credentials = 1;
+    } 
     
-    if ( kerror ) {
-      log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: store cred %s", error_message(kerror));
-      goto cleanup;
-    }
-  
-    log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: kinit ok for %s", k5user );
-  
     /* now, to the 'aklog' portion of our program. */
     
-    strncpy( buf, "afs", sizeof(buf) - 1 );
-
     /** we make two attempts here, one for afs@REALM and one for afs/cell@REALM */
     for(attempt = 0; attempt <= 1; attempt++) {
+      strncpy( buf, "afs", sizeof(buf) - 1 );
       cell_in_principal = (cfg->cell_in_principal + attempt) % 2;
 
       log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: cell_in_principal=%d", cell_in_principal );
       if (cell_in_principal) {
-        strncat(buf, "/", sizeof(buf) - strlen(buf) - 1);
+        strncat(buf, "/",           sizeof(buf) - strlen(buf) - 1);
         strncat(buf, cfg->afs_cell, sizeof(buf) - strlen(buf) - 1);
       }
+      if (cfg->afs_cell_realm != WAKLOG_UNSET) {
+        strncat(buf, "@",                 sizeof(buf) - strlen(buf) - 1);
+        strncat(buf, cfg->afs_cell_realm, sizeof(buf) - strlen(buf) - 1);
+      }
       
       log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: using AFS principal: %s", buf);
       
@@ -490,9 +531,13 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
         log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_parse name %s", error_message(kerror));
         goto cleanup;
       }
-      
-      if ((kerror = krb5_cc_get_principal(child.kcontext, child.ccache, &increds.client))) {
-        log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_cc_get_princ %s", error_message(kerror));
+
+      if (!use_client_credentials) {
+        clientccache = child.ccache;
+      }
+
+      if ((kerror = krb5_cc_get_principal(child.kcontext, clientccache, &increds.client))) {
+        log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_cc_get_princ %s %p", error_message(kerror), clientccache);
         goto cleanup;
       }
       
@@ -502,7 +547,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
       
       increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
       
-      if (kerror = krb5_get_credentials (child.kcontext, 0, child.ccache, &increds, &v5credsp )) {
+      if ( ( kerror = krb5_get_credentials (child.kcontext, 0, clientccache, &increds, &v5credsp ) ) ) {
         /* only complain once we've tried both afs@REALM and afs/cell@REALM */
         if (attempt>=1) {
           log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_credentials: %s",
@@ -673,6 +718,8 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
   }
   
   cleanup:
+  if (use_client_credentials)
+    krb5_cc_close(child.kcontext, clientccache);
   if ( v5credsp )
     krb5_free_cred_contents(child.kcontext, v5credsp);
   if ( increds.client )
@@ -715,6 +762,7 @@ waklog_create_server_config (MK_POOL * p, server_rec * s)
   cfg->default_principal = WAKLOG_UNSET;
   cfg->default_keytab = WAKLOG_UNSET;
   cfg->afs_cell = WAKLOG_UNSET;
+  cfg->afs_cell_realm = WAKLOG_UNSET;
   cfg->forked = 0;
   cfg->configured = 0;
 
@@ -743,6 +791,7 @@ waklog_create_dir_config (MK_POOL * p, char *dir)
   cfg->default_principal = WAKLOG_UNSET;
   cfg->default_keytab = WAKLOG_UNSET;
   cfg->afs_cell = WAKLOG_UNSET;
+  cfg->afs_cell_realm = WAKLOG_UNSET;
   cfg->forked = 0;
   cfg->configured = 0;
 
@@ -772,6 +821,8 @@ static void *waklog_merge_dir_config(MK_POOL *p, void *parent_conf, void *newloc
   merged->default_principal = child->default_principal != WAKLOG_UNSET ? child->default_principal : parent->default_principal;
   
   merged->afs_cell = child->afs_cell != WAKLOG_UNSET ? child->afs_cell : parent->afs_cell;
+
+  merged->afs_cell_realm = child->afs_cell_realm != WAKLOG_UNSET ? child->afs_cell_realm : parent->afs_cell_realm;
   
   return (void *) merged;
   
@@ -798,6 +849,9 @@ static void *waklog_merge_server_config(MK_POOL *p, void *parent_conf, void *new
   merged->afs_cell = nconf->afs_cell  == WAKLOG_UNSET ? ap_pstrdup(p, pconf->afs_cell) : 
       ( nconf->afs_cell == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->afs_cell) );    
   
+  merged->afs_cell_realm = nconf->afs_cell_realm  == WAKLOG_UNSET ? ap_pstrdup(p, pconf->afs_cell_realm) : 
+      ( nconf->afs_cell_realm == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->afs_cell_realm) );    
+  
   merged->default_keytab = nconf->default_keytab ==  WAKLOG_UNSET ? ap_pstrdup(p, pconf->default_keytab) : 
         ( nconf->default_keytab == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->default_keytab) );
 
@@ -892,6 +946,24 @@ set_waklog_afs_cell (cmd_parms * params, void *mconfig, char *file)
   return (NULL);
 }
 
+static const char *
+set_waklog_afs_cell_realm (cmd_parms * params, void *mconfig, char *file)
+{
+  waklog_config *waklog_mconfig = ( waklog_config * ) mconfig;
+  waklog_config *waklog_srvconfig =
+    ( waklog_config * ) ap_get_module_config(params->server->module_config, &waklog_module );
+
+  log_error (APLOG_MARK, APLOG_INFO, 0, params->server,
+             "mod_waklog: will use afs_cell_realm: %s", file);
+
+  waklog_srvconfig->afs_cell_realm = ap_pstrdup (params->pool, file);
+
+  if (waklog_mconfig != NULL) {
+    waklog_mconfig->afs_cell_realm = ap_pstrdup (params->pool, file);
+  }
+  return (NULL);
+}
+
 static const char *
 set_waklog_default_principal (cmd_parms * params, void *mconfig, char *principal, char *keytab)
 {
@@ -1007,11 +1079,11 @@ waklog_child_init (server_rec * s, MK_POOL * p)
 
   memset (&child, 0, sizeof(child));
   
-  if ( code = krb5_init_context(&child.kcontext) ) {
+  if ( ( code = krb5_init_context(&child.kcontext) ) ) {
     log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't init kerberos context %d", code );
   }
   
-  if ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) {
+  if ( ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) ) {
     log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize in-memory credentials cache %d", code );
   }
   
@@ -1044,6 +1116,9 @@ command_rec waklog_cmds[] = {
   command ("WaklogAFSCell", set_waklog_afs_cell, 0, TAKE1,
            "Use the supplied AFS cell (required)"),
 
+  command ("WaklogAFSCellRealm", set_waklog_afs_cell_realm, 0, TAKE1,
+           "Assume that the AFS cell belongs to the specified Kerberos realm (optional)"),
+
   command ("WaklogEnabled", set_waklog_enabled, 0, FLAG,
            "enable waklog on a server, location, or directory basis"),
 
@@ -1101,18 +1176,22 @@ waklog_child_routine (void *data, child_info * pinfo)
   
   memset (&child, 0, sizeof(child));
   
-  if ( code = krb5_init_context(&child.kcontext) ) {
+  if ( ( code = krb5_init_context(&child.kcontext) ) ) {
     log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't init kerberos context %d", code );
   }
   
-  if ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) {
+  if ( ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) ) {
     log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize in-memory credentials cache %d", code );
   }
   
+  log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: about to pr_Initialize");
+
   /* need to do this so we can make PTS calls */
   cell = strdup(cfg->afs_cell); /* stupid */
   pr_Initialize(  0, AFSDIR_CLIENT_ETC_DIR, cell );
-  
+ 
+  log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: still here");
+
   while(1) {
   
     for ( i = 0; i < renewcount; ++i ) {
@@ -1298,7 +1377,6 @@ waklog_init (server_rec * s, MK_POOL * p)
   extern char *version;
   int pid;
   waklog_config *cfg;
-  char *cell;
   int fd = -1;
   int use_existing = 1;
   int oldrenewcount;
@@ -1342,7 +1420,7 @@ waklog_init (server_rec * s, MK_POOL * p)
 
     /* mmap the region */
     
-    if ( ( sharedspace = (struct sharedspace_s *) mmap ( NULL, sizeof(struct sharedspace_s), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0 ) ) != -1 ) {
+    if ( ( sharedspace = (struct sharedspace_s *) mmap ( NULL, sizeof(struct sharedspace_s), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0 ) ) != (void *) -1 ) {
       log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: shared mmap region ok %d", sharedspace );
       close(fd);
     } else {
@@ -1358,7 +1436,7 @@ waklog_init (server_rec * s, MK_POOL * p)
 #endif
 
   /* mmap our shared space for our lock */  
-  if ( sharedlock = ( locktype * ) mmap ( NULL, sizeof(locktype), PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, 0 ) ) {
+  if ( ( sharedlock = ( locktype * ) mmap ( NULL, sizeof(locktype), PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, 0 ) ) )  {
 #ifndef use_pthreads
     rwlock_init(sharedlock, USYNC_PROCESS, NULL );
 #else
@@ -1420,6 +1498,12 @@ waklog_phase0 (request_rec * r)
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase0 using default user %s", cfg->default_principal);
     set_auth(r->server, r, 0, cfg->default_principal, cfg->default_keytab, 0);
   } else {
+
+    if (child.token.ticketLen) {
+      memset( &child.token, 0, sizeof (struct ktc_token) );
+      ktc_ForgetAllTokens();
+    }
+
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase0 not doing nothin.");
   }
 
@@ -1515,6 +1599,12 @@ waklog_phase7 (request_rec * r)
   } else if ( cfg->default_principal ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase7 using default user %s", cfg->default_principal);
     rc = set_auth( r->server, r, 0, cfg->default_principal, cfg->default_keytab, 0);
+  } else {
+    log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: no tokens");
+    if (child.token.ticketLen) {
+       memset(&child.token, 0, sizeof(struct ktc_token));
+       ktc_ForgetAllTokens();
+    }
   }
   
   if ( rc ) {
@@ -1628,7 +1718,7 @@ module MODULE_VAR_EXPORT waklog_module = {
   waklog_phase6,                      /* [#6] determine MIME type            */
   waklog_phase7,                      /* [#7] pre-run fixups                 */
   waklog_phase9,                      /* [#9] log a transaction              */
-  NULL,                               /* [#2] header parser                  */
+  waklog_phase2,                      /* [#2] header parser                  */
   waklog_child_init,                  /* child_init                          */
   waklog_child_exit,                  /* child_exit                          */
   waklog_phase0                       /* [#0] post read-request              */