X-Git-Url: https://git.hcoop.net/hcoop/zz_old/modwaklog.git/blobdiff_plain/7d202cddb03fa093c78cf75f455ae882d3820e40..95ad25b8e289abffe534912cf5f485146af74710:/mod_waklog.c?ds=sidebyside

diff --git a/mod_waklog.c b/mod_waklog.c
index 0c126eb..99f1de6 100644
--- a/mod_waklog.c
+++ b/mod_waklog.c
@@ -81,9 +81,7 @@ const char *userdata_key = "waklog_init";
 #define TKT_LIFE  ( 12 * 60 * 60 )
 #define SLEEP_TIME      ( TKT_LIFE - 5*60 )
 
-#define WAKLOG_ON 1
-#define WAKLOG_OFF 2
-#define WAKLOG_UNSET 0
+#define WAKLOG_UNSET -1
 
 #ifdef WAKLOG_DEBUG
 #undef APLOG_DEBUG
@@ -232,6 +230,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
   krb5_get_init_creds_opt kopts;
   krb5_creds v5creds;
   krb5_creds increds;
+  krb5_ccache clientccache;
   struct ktc_principal server = { "afs", "", "" };
   struct ktc_principal client;
   struct ktc_token token;
@@ -242,7 +241,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
   int rc = 0;
   int buflen = 0;
   time_t oldest_time = 0;
-  int oldest;
+  int oldest = 0;
   int stored = -1;
   time_t mytime;
   int indentical;
@@ -250,30 +249,42 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
   int attempt;
   int use_client_credentials = 0;
   
-  char k5user[MAXNAMELEN];
-  char *k5secret;
+  char k5user[MAXNAMELEN] = "";
+  char *k5secret = NULL;
+
   char *k5path = NULL;
   
-  k5path = !r ? NULL : MK_TABLE_GET( r->subprocess_env, "KRB5CCNAME" );
-
   memset((char *) &increds, 0, sizeof(increds));
   /* init some stuff if it ain't already */
-  
+  /* XXX - In what situation will these not be initialized? */
+
   if ( ! child.kcontext ) {
-    kerror = krb5_init_context(&child.kcontext);
-  }
-  
-  if (!k5path || !*k5path) {
-    k5path = "MEMORY:tmpcache";
+    if ((kerror = krb5_init_context(&child.kcontext))) {
+      log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize Kerberos context err=%d", 
+		kerror);
+      return(-1);
+    }
   }
-  if ( ( ! child.ccache ) && ( kerror = krb5_cc_resolve(child.kcontext, k5path, &child.ccache) ) ) {
-    log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize credentials cache %s err=%d",
-              k5path, kerror );
+
+  if ( !child.ccache) {
+    if ((kerror = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache))) {
+      log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize credentials cache %s err=%d",
+                k5path, kerror );
+      return(-1);
+    }
   }
   
-  log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: %d, %s, %s, %d, KRB5CC=%s",
+  log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: %d, %s, %s, %d, KRB5CC=%s user=%s",
             self, principal ? principal : "NULL", 
-            keytab ? keytab : "NULL", storeonly, k5path ? k5path : "NULL");
+            keytab ? keytab : "NULL",
+            storeonly,
+            k5path ? k5path : "NULL",
+#ifdef APACHE2
+            (r && r->user) ? r->user : "NULL"
+#else
+            (r && r->connection && r->connection->user) ? r->connection->user : "NULL"
+#endif
+            );
   
   /* pull the server config record that we care about... */
   
@@ -288,13 +299,13 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
   if ( ! cfg ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: cfg is %d", cfg );
   }
-  
-#ifdef APACHE2
+
+
   if ( self ) {
     /* pull out our principal name and stuff from the environment -- webauth better have sent
-       through.  This here is also where you'd suck stuff out of KRB5CCNAME if we were
-       using something like Cosign */
-       
+       through. */
+
+#ifdef APACHE2       
        if ( ! ( r && r->connection && r->user )) {
          log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: self authentication selected, but no data available");
          log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: r->user=%s", (r->user==NULL ? "null" : r->user==NULL));
@@ -302,24 +313,35 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
        }
        
        strncpy(k5user, r->user, sizeof(k5user));
-       
-       /* the other thing we need is someone's password */       
-       if ( ! ( k5secret = (char *) MK_TABLE_GET( r->notes, "ATTR_PASSWORD" ) ) ) {
-         log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cant do self auth without a secret");
+#else
+       if ( ! (r && r->connection && r->connection->user)) {
+	 log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: self authentication selected, but no username available");
          return -1;
-       }     
+       }
+
+       strncpy(k5user, r->connection->user, sizeof(k5user));
+#endif
+       /* if they've supplied a credentials cache */
+       k5path = (char *) MK_TABLE_GET( r->subprocess_env, "KRB5CCNAME" );
+
+       /* the other thing we need is someone's password */       
+       k5secret = (char *) MK_TABLE_GET( r->notes, "ATTR_PASSWORD" );
        
        /* we'll pick this up later after we've checked the cache and current state */
              
   } else
-  if (r && r->user && !principal) {
-    strncpy(k5user, r->user, sizeof(k5user));
-    keytab = NULL;
+  if ( principal ) {
+    strncpy(k5user, principal, sizeof(k5user));
   } else
-#endif
- if ( principal ) {
-    strncpy( k5user, principal, sizeof(k5user));
+#ifdef APACHE2
+  if (r && r->user) {
+    strncpy(k5user, r->user, sizeof(k5user));
+  }
+#else
+  if (r && r->connection && r->connection->user) {
+    strncpy(k5user, r->connection->user, sizeof(k5user));
   }
+#endif
   
   log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: k5user=%s", k5user ? k5user : "NULL");
   mytime = time(0);
@@ -399,7 +421,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
     
     /* create a principal out of our k5user string */
     
-    if ( kerror = krb5_parse_name (child.kcontext, k5user, &kprinc ) ) {
+    if ( ( kerror = krb5_parse_name (child.kcontext, k5user, &kprinc ) ) ) {
       log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_parse_name %s", (char *) error_message(kerror) );
       goto cleanup;
     }
@@ -412,73 +434,78 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
     krb5_get_init_creds_opt_set_forwardable ( &kopts, 0 );
     krb5_get_init_creds_opt_set_proxiable ( &kopts, 0 );
     
-    if ( keytab ) {
+    if ( keytab || k5secret ) {
     
-      /* if we've been passed a keytab, we're going to be getting our credentials from it */
+      if (keytab) {
+        /* if we've been passed a keytab, we're going to be getting our credentials from it */
     
-      log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: using keytab %s", keytab);
+        log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: using keytab %s", keytab);
     
-      if ( kerror = krb5_kt_resolve(child.kcontext, keytab, &krb5kt ) ) {
-        log_error( APLOG_MARK, APLOG_ERR, 0, s,
-          "mod_waklog: krb5_kt_resolve %s", error_message(kerror) );
-        goto cleanup;
-      }
+        if ( ( kerror = krb5_kt_resolve(child.kcontext, keytab, &krb5kt ) ) ) {
+          log_error( APLOG_MARK, APLOG_ERR, 0, s,
+            "mod_waklog: krb5_kt_resolve %s", error_message(kerror) );
+          goto cleanup;
+        }
     
-      if ((kerror = krb5_get_init_creds_keytab (child.kcontext, &v5creds,
-            kprinc, krb5kt, 0, NULL, &kopts ) ) ) {
-              log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_keytab %s",
-                error_message(kerror) );
-              goto cleanup;
-      }
+        if ((kerror = krb5_get_init_creds_keytab (child.kcontext, &v5creds,
+              kprinc, krb5kt, 0, NULL, &kopts ) ) ) {
+                log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_keytab %s",
+                  error_message(kerror) );
+                goto cleanup;
+        }
+      } else if (k5secret) {
       
-    } else if ( self ) {
+        /* If the WebSSO is lame enough to provide a secret, then try and use that to get a token */
       
-      /* if 'self' is set, we're going to use the credentials provided in the credential information */
-      /* if you're using CoSign, you'd actually just set the ccache to the KRB5CCNAME credentials */
-      /* and skip ahead...  Our WebSSO is lame, but has a way for us to snarf the password out of */
-      /* the encrypted token for proxy-authentication stuff.  We only hand out keys that allow this */
-      /* functionality to VERY special people. */
+        if ((kerror = krb5_get_init_creds_password ( child.kcontext, &v5creds,
+              kprinc, k5secret, NULL, NULL, 0, NULL, &kopts ) ) ) {
+                log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_password %s",
+                  error_message(kerror) );
+                  /* nuke the password so it doesn't end up in core files */
+                  memset(k5secret, 0, sizeof(k5secret));               
+                goto cleanup;
+        }
       
-      if ((kerror = krb5_get_init_creds_password ( child.kcontext, &v5creds,
-            kprinc, k5secret, NULL, NULL, 0, NULL, &kopts ) ) ) {
-              log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_init_creds_password %s",
-                error_message(kerror) );
-                /* nuke the password so it doesn't end up in core files */
-                memset(k5secret, 0, sizeof(k5secret));               
-              goto cleanup;
+        memset(k5secret, 0, sizeof(k5secret));      
       }
-      
-      memset(k5secret, 0, sizeof(k5secret));      
-      
-    } else {
-      log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: no keytab, no self; assuming mod_auth_kerb or similar");
-      use_client_credentials = 1;
-    } 
-    
+
       /* initialize the credentials cache and store the stuff we just got */
-    if (!use_client_credentials) {
-      if ( kerror = krb5_cc_initialize (child.kcontext, child.ccache, kprinc)) {
+      if ( ( kerror = krb5_cc_initialize (child.kcontext, child.ccache, kprinc) ) ) {
         log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: init credentials cache %s", 
                   error_message(kerror));
         goto cleanup;
       }
       
-      if ( kerror = krb5_cc_store_cred(child.kcontext, child.ccache, &v5creds) ) {
+      if ( ( kerror = krb5_cc_store_cred(child.kcontext, child.ccache, &v5creds) ) ) {
         log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cannot store credentials %s", 
                   error_message(kerror));
         goto cleanup;
       }
-    }
     
-    krb5_free_cred_contents(child.kcontext, &v5creds);
+      krb5_free_cred_contents(child.kcontext, &v5creds);
+ 
+      if ( kerror ) {
+        log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: store cred %s", error_message(kerror));
+        goto cleanup;
+      }
+      
+      log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: kinit ok for %s", k5user );
+
+    } else if (k5path) {
+      /* If we've got a path to a credentials cache, then try and use that. We can't just
+       * replace child.creds, because we want to ensure that only this request gets access to
+       * that cache */
+
+      if ( ( kerror = krb5_cc_resolve(child.kcontext, k5path, &clientccache ) ) ) {
+        log_error(APLOG_MARK, APLOG_ERR, 0, s,
+		  "mod_waklog: can't open provided credentials cache %s err=%d",
+		  k5path, kerror );
+        goto cleanup;
+      }
+
+      use_client_credentials = 1;
+    } 
     
-    if ( kerror ) {
-      log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: store cred %s", error_message(kerror));
-      goto cleanup;
-    }
-  
-    log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: kinit ok for %s", k5user );
-  
     /* now, to the 'aklog' portion of our program. */
     
     /** we make two attempts here, one for afs@REALM and one for afs/cell@REALM */
@@ -491,7 +518,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
         strncat(buf, "/",           sizeof(buf) - strlen(buf) - 1);
         strncat(buf, cfg->afs_cell, sizeof(buf) - strlen(buf) - 1);
       }
-      if (cfg->afs_cell_realm != WAKLOG_UNSET) {
+      if (cfg->afs_cell_realm != NULL) {
         strncat(buf, "@",                 sizeof(buf) - strlen(buf) - 1);
         strncat(buf, cfg->afs_cell_realm, sizeof(buf) - strlen(buf) - 1);
       }
@@ -503,15 +530,12 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
         goto cleanup;
       }
 
-      if (use_client_credentials) {
-        if (( kerror = krb5_cc_resolve( child.kcontext, k5path, &child.ccache)) != 0 ) {
-          log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_cc_resolve %s", error_message(kerror));          
-          goto cleanup;
-        }
-      } 
-      
-      if ((kerror = krb5_cc_get_principal(child.kcontext, child.ccache, &increds.client))) {
-        log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_cc_get_princ %s", error_message(kerror));
+      if (!use_client_credentials) {
+        clientccache = child.ccache;
+      }
+
+      if ((kerror = krb5_cc_get_principal(child.kcontext, clientccache, &increds.client))) {
+        log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_cc_get_princ %s %p", error_message(kerror), clientccache);
         goto cleanup;
       }
       
@@ -521,7 +545,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
       
       increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
       
-      if (kerror = krb5_get_credentials (child.kcontext, 0, child.ccache, &increds, &v5credsp )) {
+      if ( ( kerror = krb5_get_credentials (child.kcontext, 0, clientccache, &increds, &v5credsp ) ) ) {
         /* only complain once we've tried both afs@REALM and afs/cell@REALM */
         if (attempt>=1) {
           log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_get_credentials: %s",
@@ -692,6 +716,8 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
   }
   
   cleanup:
+  if (use_client_credentials)
+    krb5_cc_close(child.kcontext, clientccache);
   if ( v5credsp )
     krb5_free_cred_contents(child.kcontext, v5credsp);
   if ( increds.client )
@@ -716,6 +742,27 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta
 }
 
 
+int get_cfg_usertokens(waklog_config *cfg)
+{
+  if (cfg->usertokens==WAKLOG_UNSET)
+    return 0; /* default */
+  return cfg->usertokens;
+}
+
+int get_cfg_protect(waklog_config *cfg)
+{
+  if (cfg->protect==WAKLOG_UNSET)
+    return 0; /* default */
+  return cfg->protect;
+}
+
+int get_cfg_disable_token_cache(waklog_config *cfg)
+{
+  if (cfg->disable_token_cache==WAKLOG_UNSET)
+    return 0; /* default */
+  return cfg->disable_token_cache;
+}
+
 
 static void *
 waklog_create_server_config (MK_POOL * p, server_rec * s)
@@ -729,12 +776,12 @@ waklog_create_server_config (MK_POOL * p, server_rec * s)
   cfg->protect = WAKLOG_UNSET;
   cfg->usertokens = WAKLOG_UNSET;
   cfg->disable_token_cache = WAKLOG_UNSET;
-  cfg->keytab = WAKLOG_UNSET;
-  cfg->principal = WAKLOG_UNSET;
-  cfg->default_principal = WAKLOG_UNSET;
-  cfg->default_keytab = WAKLOG_UNSET;
-  cfg->afs_cell = WAKLOG_UNSET;
-  cfg->afs_cell_realm = WAKLOG_UNSET;
+  cfg->keytab = NULL;
+  cfg->principal = NULL;
+  cfg->default_principal = NULL;
+  cfg->default_keytab = NULL;
+  cfg->afs_cell = NULL;
+  cfg->afs_cell_realm = NULL;
   cfg->forked = 0;
   cfg->configured = 0;
 
@@ -758,12 +805,12 @@ waklog_create_dir_config (MK_POOL * p, char *dir)
   cfg->protect = WAKLOG_UNSET;
   cfg->usertokens = WAKLOG_UNSET;
   cfg->disable_token_cache = WAKLOG_UNSET;
-  cfg->keytab = WAKLOG_UNSET;
-  cfg->principal = WAKLOG_UNSET;
-  cfg->default_principal = WAKLOG_UNSET;
-  cfg->default_keytab = WAKLOG_UNSET;
-  cfg->afs_cell = WAKLOG_UNSET;
-  cfg->afs_cell_realm = WAKLOG_UNSET;
+  cfg->keytab = NULL;
+  cfg->principal = NULL;
+  cfg->default_principal = NULL;
+  cfg->default_keytab = NULL;
+  cfg->afs_cell = NULL;
+  cfg->afs_cell_realm = NULL;
   cfg->forked = 0;
   cfg->configured = 0;
 
@@ -778,23 +825,23 @@ static void *waklog_merge_dir_config(MK_POOL *p, void *parent_conf, void *newloc
   
   merged->protect = child->protect != WAKLOG_UNSET ? child->protect : parent->protect;
   
-  merged->path = child->path != WAKLOG_UNSET ? child->path : parent->path;
+  merged->path = child->path != NULL ? child->path : parent->path;
   
   merged->usertokens = child->usertokens != WAKLOG_UNSET ? child->usertokens : parent->usertokens;
 
   merged->disable_token_cache = child->disable_token_cache != WAKLOG_UNSET ? child->disable_token_cache : parent->disable_token_cache;
   
-  merged->principal = child->principal != WAKLOG_UNSET ? child->principal : parent->principal;
+  merged->principal = child->principal != NULL ? child->principal : parent->principal;
   
-  merged->keytab = child->keytab != WAKLOG_UNSET ? child->keytab : parent->keytab;
+  merged->keytab = child->keytab != NULL ? child->keytab : parent->keytab;
   
-  merged->default_keytab = child->default_keytab != WAKLOG_UNSET ? child->default_keytab : parent->default_keytab;
+  merged->default_keytab = child->default_keytab != NULL ? child->default_keytab : parent->default_keytab;
   
-  merged->default_principal = child->default_principal != WAKLOG_UNSET ? child->default_principal : parent->default_principal;
+  merged->default_principal = child->default_principal != NULL ? child->default_principal : parent->default_principal;
   
-  merged->afs_cell = child->afs_cell != WAKLOG_UNSET ? child->afs_cell : parent->afs_cell;
+  merged->afs_cell = child->afs_cell != NULL ? child->afs_cell : parent->afs_cell;
 
-  merged->afs_cell_realm = child->afs_cell_realm != WAKLOG_UNSET ? child->afs_cell_realm : parent->afs_cell_realm;
+  merged->afs_cell_realm = child->afs_cell_realm != NULL ? child->afs_cell_realm : parent->afs_cell_realm;
   
   return (void *) merged;
   
@@ -812,23 +859,23 @@ static void *waklog_merge_server_config(MK_POOL *p, void *parent_conf, void *new
 
   merged->disable_token_cache = nconf->disable_token_cache == WAKLOG_UNSET ? pconf->disable_token_cache : nconf->disable_token_cache;
 
-  merged->keytab = nconf->keytab ==  WAKLOG_UNSET ? ap_pstrdup(p, pconf->keytab) : 
-    ( nconf->keytab == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->keytab) );
+  merged->keytab = nconf->keytab == NULL ? ap_pstrdup(p, pconf->keytab) : 
+    ( nconf->keytab == NULL ? NULL : ap_pstrdup(p, nconf->keytab) );
     
-  merged->principal = nconf->principal == WAKLOG_UNSET ? ap_pstrdup(p, pconf->principal) : 
-      ( nconf->principal == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->principal) );
+  merged->principal = nconf->principal == NULL ? ap_pstrdup(p, pconf->principal) : 
+      ( nconf->principal == NULL ? NULL : ap_pstrdup(p, nconf->principal) );
       
-  merged->afs_cell = nconf->afs_cell  == WAKLOG_UNSET ? ap_pstrdup(p, pconf->afs_cell) : 
-      ( nconf->afs_cell == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->afs_cell) );    
+  merged->afs_cell = nconf->afs_cell == NULL ? ap_pstrdup(p, pconf->afs_cell) : 
+      ( nconf->afs_cell == NULL ? NULL : ap_pstrdup(p, nconf->afs_cell) );    
   
-  merged->afs_cell_realm = nconf->afs_cell_realm  == WAKLOG_UNSET ? ap_pstrdup(p, pconf->afs_cell_realm) : 
-      ( nconf->afs_cell_realm == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->afs_cell_realm) );    
+  merged->afs_cell_realm = nconf->afs_cell_realm  == NULL ? ap_pstrdup(p, pconf->afs_cell_realm) : 
+      ( nconf->afs_cell_realm == NULL ? NULL : ap_pstrdup(p, nconf->afs_cell_realm) );    
   
-  merged->default_keytab = nconf->default_keytab ==  WAKLOG_UNSET ? ap_pstrdup(p, pconf->default_keytab) : 
-        ( nconf->default_keytab == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->default_keytab) );
+  merged->default_keytab = nconf->default_keytab == NULL ? ap_pstrdup(p, pconf->default_keytab) : 
+        ( nconf->default_keytab == NULL ? NULL : ap_pstrdup(p, nconf->default_keytab) );
 
-  merged->default_principal = nconf->default_principal == WAKLOG_UNSET ? ap_pstrdup(p, pconf->default_principal) : 
-        ( nconf->default_principal == WAKLOG_UNSET ? WAKLOG_UNSET : ap_pstrdup(p, pconf->default_principal) );
+  merged->default_principal = nconf->default_principal == NULL ? ap_pstrdup(p, pconf->default_principal) : 
+        ( nconf->default_principal == NULL ? NULL : ap_pstrdup(p, nconf->default_principal) );
   
   
   return (void *) merged;
@@ -906,7 +953,9 @@ set_waklog_afs_cell (cmd_parms * params, void *mconfig, char *file)
   log_error (APLOG_MARK, APLOG_INFO, 0, params->server,
              "mod_waklog: will use afs_cell: %s", file);
 
-  waklog_srvconfig->cell_in_principal = 0;
+  // Prefer afs/cell@REALM over afs@REALM, just like the OpenAFS tools
+  waklog_srvconfig->cell_in_principal = 1;
+
   waklog_srvconfig->afs_cell = ap_pstrdup (params->pool, file);
   waklog_srvconfig->configured = 1;
 
@@ -1051,11 +1100,11 @@ waklog_child_init (server_rec * s, MK_POOL * p)
 
   memset (&child, 0, sizeof(child));
   
-  if ( code = krb5_init_context(&child.kcontext) ) {
+  if ( ( code = krb5_init_context(&child.kcontext) ) ) {
     log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't init kerberos context %d", code );
   }
   
-  if ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) {
+  if ( ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) ) {
     log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize in-memory credentials cache %d", code );
   }
   
@@ -1065,7 +1114,7 @@ waklog_child_init (server_rec * s, MK_POOL * p)
 
   getModConfig (cfg, s);
 
-  if ( cfg->default_principal != WAKLOG_UNSET ) {
+  if ( cfg->default_principal != NULL ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: child_init setting default user %s, %s", cfg->default_principal, cfg->default_keytab);
     set_auth( s, NULL, 0, cfg->default_principal, cfg->default_keytab, 0);
   }
@@ -1148,18 +1197,22 @@ waklog_child_routine (void *data, child_info * pinfo)
   
   memset (&child, 0, sizeof(child));
   
-  if ( code = krb5_init_context(&child.kcontext) ) {
+  if ( ( code = krb5_init_context(&child.kcontext) ) ) {
     log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't init kerberos context %d", code );
   }
   
-  if ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) {
+  if ( ( code = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) ) {
     log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize in-memory credentials cache %d", code );
   }
   
+  log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: about to pr_Initialize");
+
   /* need to do this so we can make PTS calls */
   cell = strdup(cfg->afs_cell); /* stupid */
   pr_Initialize(  0, AFSDIR_CLIENT_ETC_DIR, cell );
-  
+ 
+  log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: still here");
+
   while(1) {
   
     for ( i = 0; i < renewcount; ++i ) {
@@ -1274,8 +1327,14 @@ waklog_init_handler (apr_pool_t * p, apr_pool_t * plog,
         /* mmap the region */
 
         if ( ( sharedspace = (struct sharedspace_s *) mmap ( NULL, sizeof(struct sharedspace_s), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0 ) ) != MAP_FAILED ) {
+          int err = 0;
           log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: shared mmap region ok %d", sharedspace );
-          close(fd);
+          err = unlink(cache_file);
+          if (err) {
+            log_error( APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: unable to delete %s due to %d", cache_file, errno);
+          } else {
+            log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: shared cache unlinked (will be deleted when Apache quits)");
+          }
         } else {
            log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: mmap failed %d", errno );
            exit(errno);
@@ -1345,7 +1404,6 @@ waklog_init (server_rec * s, MK_POOL * p)
   extern char *version;
   int pid;
   waklog_config *cfg;
-  char *cell;
   int fd = -1;
   int use_existing = 1;
   int oldrenewcount;
@@ -1389,7 +1447,7 @@ waklog_init (server_rec * s, MK_POOL * p)
 
     /* mmap the region */
     
-    if ( ( sharedspace = (struct sharedspace_s *) mmap ( NULL, sizeof(struct sharedspace_s), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0 ) ) != -1 ) {
+    if ( ( sharedspace = (struct sharedspace_s *) mmap ( NULL, sizeof(struct sharedspace_s), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0 ) ) != (void *) -1 ) {
       log_error( APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: shared mmap region ok %d", sharedspace );
       close(fd);
     } else {
@@ -1405,7 +1463,7 @@ waklog_init (server_rec * s, MK_POOL * p)
 #endif
 
   /* mmap our shared space for our lock */  
-  if ( sharedlock = ( locktype * ) mmap ( NULL, sizeof(locktype), PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, 0 ) ) {
+  if ( ( sharedlock = ( locktype * ) mmap ( NULL, sizeof(locktype), PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, 0 ) ) )  {
 #ifndef use_pthreads
     rwlock_init(sharedlock, USYNC_PROCESS, NULL );
 #else
@@ -1460,13 +1518,19 @@ waklog_phase0 (request_rec * r)
 
   cfg = retrieve_config(r);
 
-  if ( cfg->protect && cfg->principal ) {
+  if ( get_cfg_protect(cfg) && cfg->principal ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase0 using user %s", cfg->principal);
     set_auth(r->server, r, 0, cfg->principal, cfg->keytab, 0);
   } else if ( cfg->default_principal ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase0 using default user %s", cfg->default_principal);
     set_auth(r->server, r, 0, cfg->default_principal, cfg->default_keytab, 0);
   } else {
+
+    if (child.token.ticketLen) {
+      memset( &child.token, 0, sizeof (struct ktc_token) );
+      ktc_ForgetAllTokens();
+    }
+
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase0 not doing nothin.");
   }
 
@@ -1483,7 +1547,7 @@ waklog_phase1 (request_rec * r)
 
   cfg = retrieve_config(r);
 
-  if ( cfg->protect && cfg->principal ) {
+  if ( get_cfg_protect(cfg) && cfg->principal ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase1 using user %s", cfg->principal);
     set_auth(r->server, r, 0, cfg->principal, cfg->keytab, 0);
   } else if ( cfg->default_principal ) {
@@ -1506,7 +1570,7 @@ waklog_phase3 (request_rec * r)
 
   cfg = retrieve_config(r);
   
-  if ( cfg->protect && cfg->principal ) {
+  if ( get_cfg_protect(cfg) && cfg->principal ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase3 using user %s", cfg->principal);
     set_auth(r->server, r, 0, cfg->principal, cfg->keytab, 0);
   } else if ( cfg->default_principal ) {
@@ -1529,7 +1593,7 @@ waklog_phase6 (request_rec * r)
 
   cfg = retrieve_config(r);
   
-  if ( cfg->protect && cfg->principal ) {
+  if ( get_cfg_protect(cfg) && cfg->principal ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase6 using user %s", cfg->principal);
     set_auth(r->server, r, 0, cfg->principal, cfg->keytab, 0);
   } else if ( cfg->default_principal ) {
@@ -1553,15 +1617,21 @@ waklog_phase7 (request_rec * r)
 
   cfg = retrieve_config (r);
 
-  if ( cfg->protect && cfg->usertokens ) {
+  if ( get_cfg_protect(cfg) && get_cfg_usertokens(cfg) ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase7 using usertokens");
     rc = set_auth( r->server, r, 1, NULL, NULL, 0);
-  } else if ( cfg->protect && cfg->principal ) {
+  } else if ( get_cfg_protect(cfg) && cfg->principal ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase7 using user %s", cfg->principal);
     rc = set_auth( r->server, r, 0, cfg->principal, cfg->keytab, 0);
   } else if ( cfg->default_principal ) {
     log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: phase7 using default user %s", cfg->default_principal);
     rc = set_auth( r->server, r, 0, cfg->default_principal, cfg->default_keytab, 0);
+  } else {
+    log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "mod_waklog: no tokens");
+    if (child.token.ticketLen) {
+       memset(&child.token, 0, sizeof(struct ktc_token));
+       ktc_ForgetAllTokens();
+    }
   }
   
   if ( rc ) {
@@ -1675,7 +1745,7 @@ module MODULE_VAR_EXPORT waklog_module = {
   waklog_phase6,                      /* [#6] determine MIME type            */
   waklog_phase7,                      /* [#7] pre-run fixups                 */
   waklog_phase9,                      /* [#9] log a transaction              */
-  NULL,                               /* [#2] header parser                  */
+  waklog_phase2,                      /* [#2] header parser                  */
   waklog_child_init,                  /* child_init                          */
   waklog_child_exit,                  /* child_exit                          */
   waklog_phase0                       /* [#0] post read-request              */