From 7c53b5d0be7fb5f82f29483d25416e92ae93d015 Mon Sep 17 00:00:00 2001 From: megacz Date: Wed, 20 Jun 2007 03:26:58 +0000 Subject: [PATCH] reinstated pre-umbc behavior to use mod_auth_kerb credentials when available git-svn-id: https://modwaklog.svn.sourceforge.net/svnroot/modwaklog/trunk/modwaklog@56 0d961d1b-a432-0410-8fea-cc29f225fe07 --- mod_waklog.c | 66 +++++++++++++++++++++++++++++++--------------------- 1 file changed, 40 insertions(+), 26 deletions(-) diff --git a/mod_waklog.c b/mod_waklog.c index 0a0fae5..685e6e8 100644 --- a/mod_waklog.c +++ b/mod_waklog.c @@ -247,25 +247,32 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta int indentical; int cell_in_principal; int attempt; + int use_client_credentials = 0; char k5user[MAXNAMELEN]; char *k5secret; + char *k5path = NULL; + k5path = !r ? NULL : MK_TABLE_GET( r->subprocess_env, "KRB5CCNAME" ); + memset((char *) &increds, 0, sizeof(increds)); - /* init some stuff if it ain't already */ if ( ! child.kcontext ) { kerror = krb5_init_context(&child.kcontext); } - if ( ( ! child.ccache ) && ( kerror = krb5_cc_resolve(child.kcontext, "MEMORY:tmpcache", &child.ccache) ) ) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize in-memory credentials cache %d", kerror ); + if (!k5path || !*k5path) { + k5path = "MEMORY:tmpcache"; + } + if ( ( ! child.ccache ) && ( kerror = krb5_cc_resolve(child.kcontext, k5path, &child.ccache) ) ) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: can't initialize credentials cache %s err=%d", + k5path, kerror ); } - - log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: %d, %s, %s, %d", self, principal ? principal : "NULL", - keytab ? keytab : "NULL", storeonly); + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: %d, %s, %s, %d, KRB5CC=%s", + self, principal ? principal : "NULL", + keytab ? keytab : "NULL", storeonly, k5path ? k5path : "NULL"); /* pull the server config record that we care about... */ @@ -289,6 +296,7 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta if ( ! ( r && r->connection && r->user )) { log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: self authentication selected, but no data available"); + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: r->user=%s", (r->user==NULL ? "null" : r->user==NULL)); return -1; } @@ -304,10 +312,14 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta } else #endif - if ( principal ) { + if (r && r->user) { + strncpy(k5user, r->user, sizeof(k5user)); + keytab = NULL; + } else if ( principal ) { strncpy( k5user, principal, sizeof(k5user)); } + log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "mod_waklog: set_auth: k5user=%s", k5user ? k5user : "NULL"); mytime = time(0); /* see if we should just go ahead and ignore this call, since we already should be set to these @@ -376,9 +388,8 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta } } - + /* if 'usecached' isn't set, we've got to get our tokens from somewhere... */ - if (( ! usecached ) && ( k5user )) { /* clear out the creds structure */ @@ -438,27 +449,23 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta memset(k5secret, 0, sizeof(k5secret)); } else { - - /* degenerate case -- we don't have enough information to do anything */ - - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: no keytab, no self?"); - kerror = -1; - goto cleanup; - + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: no keytab, no self; assuming mod_auth_kerb or similar"); + use_client_credentials = 1; } /* initialize the credentials cache and store the stuff we just got */ + if (!use_client_credentials) { + if ( kerror = krb5_cc_initialize (child.kcontext, child.ccache, kprinc)) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: init credentials cache %s", + error_message(kerror)); + goto cleanup; + } - if ( kerror = krb5_cc_initialize (child.kcontext, child.ccache, kprinc)) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: init credentials cache %s", - error_message(kerror)); - goto cleanup; - } - - if ( kerror = krb5_cc_store_cred(child.kcontext, child.ccache, &v5creds) ) { - log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cannot store credentials %s", - error_message(kerror)); - goto cleanup; + if ( kerror = krb5_cc_store_cred(child.kcontext, child.ccache, &v5creds) ) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: cannot store credentials %s", + error_message(kerror)); + goto cleanup; + } } krb5_free_cred_contents(child.kcontext, &v5creds); @@ -490,6 +497,13 @@ set_auth ( server_rec *s, request_rec *r, int self, char *principal, char *keyta log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_parse name %s", error_message(kerror)); goto cleanup; } + + if (use_client_credentials) { + if (( kerror = krb5_cc_resolve( child.kcontext, k5path, &child.ccache)) != 0 ) { + log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_cc_resolve %s", error_message(kerror)); + goto cleanup; + } + } if ((kerror = krb5_cc_get_principal(child.kcontext, child.ccache, &increds.client))) { log_error(APLOG_MARK, APLOG_ERR, 0, s, "mod_waklog: krb5_cc_get_princ %s", error_message(kerror)); -- 2.20.1