Adding new components to the server side of auth_token.

auth_token/server/ApacheSupport/2.2/Makefile.am

@@ -0,0 +1,37 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+SUBDIRS = $(TARGET_OS)
+
+DIST_SUBDIRS = linux
+
+CFILES =
+
+EXTRA_DIST = $(CFILES) *.h
+
+.PHONY: package package-clean package-install package-uninstall
+package package-clean package-install package-uninstall:
+	$(MAKE) -C $(TARGET_OS) $@
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/ApacheSupport/2.2/README

@@ -0,0 +1,108 @@
+/***********************************************************************
+ *
+ *  README for mod_authn_casa
+ *
+ ***********************************************************************/
+
+INTRODUCTION
+
+mod_authn_casa is an Apache 2.2 Basic Authentication Provider that
+can be configured to validate Basic Credentials carrying CASA
+Authentication Tokens.
+
+Clients sending CASA Authentication Tokens as part of the Basic Credentials
+will format them in the following manner: "username:CasaAuthenticationToken",
+where the username is set to "CasaPrincipal" and the CasaAuthenticationToken
+is the token string obtained from the CASA Get Authentication Token API..
+
+CONFIGURATION
+
+To use mod_authn_casa as an authentication provider for a specific location
+you must first tell Apache that it must load the module, you do this by
+placing the module or a link to the module in the Apache server's modules
+folder and by placing the following line in the server's httpd.conf file:
+
+LoadModule authn_casa_module modules/mod_authn_casa.so
+
+The following lines show how Apache is configured to use mod_authn_casa
+for authenticating requests issued to mod_example:
+
+<Location /example-info>
+    SetHandler example-handler
+    AuthType Basic
+    AuthName "CASA-Authentication"
+    AuthBasicProvider casa
+    Require valid-user
+</Location>
+
+Note that the name specified in the AuthName directive should match the name
+configured under CASA for the authentication realm used by CASA to obtain
+identity information for the service.
+
+mod_authn_casa supports the following configuration directives:
+
+UsernameCheck - This is a per-directory or per-location directive which
+                configures whether or not mod_authn_casa must verify that
+                the username is set to "CasaPrincipal". Possible values
+                for this directive are 'on' or 'off'. Default is 'off'.
+
+                To enable UsernameChack for a particular location using
+                CASA Authentication, include the following line inside
+                the location configuration block:
+
+                UsernameCheck on
+
+CLIENT PROGRAMMING NOTES
+
+HTTP Clients sending requests to a location being protected by the CASA
+Authentication Provider must obtain an Authentication Token from the CASA
+Client for authenticating to the Service identified as the "location" being
+accessed in the HTTP Server. In the case of mod_example, the service name
+would be "example-info". Once the client obtains an Authentication Token
+from the CASA Client it must then include it in the HTTP Basic Authentication
+header that it must include in the HTTP Request. The HTTP Basic Authentication
+credentials should be in the following form:
+
+Base64("CasaPrincipal":"AuthenticationToken")
+
+SERVER PROGRAMMING NOTES
+
+Apache modules being protected by the CASA Authentication Provider can obtain
+the following information about the authenticated identity:
+
+username - This is accessed via the r->user variable or by examining the IdentityId
+environment variable associated with the request block. The username is the
+user's unique id within the authentication realm. When the authentication realm
+is an LDAP database, the username consists of the user's fdn.
+
+Name of the source of identity data (Authentication Realm) - This is accessed by
+examining the IdentityDataSourceName environment variable associated with the
+request block.
+
+URL to the source of identity data - This is accessed by examining the
+IdentityDataSourceUrl environment variable associated with the request block.
+
+Attributes of the authenticated identity - The attributes are set as environment
+variables associated with the request block. The environment variable names match
+the names of the attributes. The attributes associated with the authenticated
+identity and expressed as environment variables are configured at the time that
+the service is enabled for CASA Authentication.
+
+Note that environment variables are contained in the r->subprocess_env table.
+
+SECURITY CONSIDERATIONS
+
+CASA Authenticatication Tokens when compromised can be used to either impersonate
+a user or to obtain identity information about the user. Because of this it is
+important that the tokens be secured by applications making use of them. It is
+recommended that the tokens be transmitted using HTTPS.
+ 
+
+
+
+                
+
+
+
+
+

auth_token/server/ApacheSupport/2.2/TODO

@@ -0,0 +1,13 @@
+/***********************************************************************
+ *
+ *  TODO for mod_authn_casa
+ *
+ ***********************************************************************/
+
+INTRODUCTION
+
+This file contains a list of the items still outstanding for mod_authn_casa.
+
+OUTSTANDING ITEMS
+
+None.

auth_token/server/ApacheSupport/2.2/linux/Makefile.am

@@ -0,0 +1,111 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+if DEBUG
+TARGET_CFG = Debug
+CFLAGS += -v -w
+else
+TARGET_CFG = Release
+endif
+
+SUBDIRS =
+
+DIST_SUBDIRS =
+
+CASAROOT = ../../../../..
+
+CASALIBDIR = $(CASAROOT)/$(LIB)
+APACHEROOT = /home/jluciani/dev-local/apache2.2
+
+# handle Mono secondary dependencies
+export MONO_PATH := $(MONO_PATH)
+
+PLATFORMINDEPENDENTSOURCEDIR = ..
+PLATFORMDEPENDENTSOURCEDIR = .
+
+MODULE_NAME = mod_authn_casa
+MODULE_EXT = so
+
+CFILES = ../mod_authn_casa.c
+
+CSFILES_CSC :=
+INCLUDES = -I. -I$(CASAROOT)/include -I$(APACHEROOT)/include
+RESOURCES =
+DEFINES = -Wno-format-extra-args -fno-strict-aliasing
+
+CFLAGS += $(INCLUDES) $(DEFINES) -D_LARGEFILE64_SOURCE
+LIBS = -lpthread -lcasa_s_authtoken -lapr-1 -laprutil-1
+LDFLAGS = -Bsymbolic -shared -Wl,-soname=$(MODULE_NAME).$(MODULE_EXT) -L$(CASALIBDIR)/$(TARGET_CFG) -L$(APACHEROOT)/lib -Xlinker -rpath -Xlinker /opt/novell/CASA/lib
+
+OBJDIR = ./$(TARGET_CFG)/$(LIB)
+OBJS = $(addprefix $(OBJDIR)/, $(CFILES:%.c=%.o))
+
+EXTRA_DIST = $(CFILES)
+
+CUR_DIR := $(shell pwd)
+
+all: $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+
+#
+# Pattern based rules.
+#
+vpath %.c $(PLATFORMDEPENDENTSOURCEDIR) $(PLATFORMINDEPENDENTSOURCEDIR)
+vpath %.cpp $(PLATFORMDEPENDENTSOURCEDIR) $(PLATFORMINDEPENDENTSOURCEDIR)
+
+$(OBJDIR)/%.o: %.c
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+$(OBJDIR)/%.o: %.cpp
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+$(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT): $(OBJDIR) $(OBJS)
+	@echo [======== Linking $@ ========]
+	$(LINK) -o $@ $(LDFLAGS) $(OBJS) $(LIBS)
+	cp -f $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT) $(CASALIBDIR)/$(TARGET_CFG)/$(MODULE_NAME).$(MODULE_EXT)
+
+$(OBJDIR):
+	[ -d $(OBJDIR) ] || mkdir -p $(OBJDIR)
+	[ -d $(CASALIBDIR) ] || mkdir -p $(CASALIBDIR)
+	[ -d $(CASALIBDIR)/$(TARGET_CFG) ] || mkdir -p $(CASALIBDIR)/$(TARGET_CFG)
+
+install-exec-local: $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+	$(mkinstalldirs) $(DESTDIR)$(libdir)
+	$(INSTALL_PROGRAM) $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT) $(DESTDIR)$(libdir)/
+
+uninstall-local:
+	cd $(DESTDIR)$(libdir); rm -f $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+	rmdir $(DESTDIR)$(libdir)
+
+#installcheck-local: install
+#	$(mkinstalldirs) $(DESTDIR)$(libdir)
+#	$(INSTALL_PROGRAM) $(DESTDIR)$(libdir)
+#	cd $(DESTDIR)$(libdir); $(MONO)
+
+clean-local:
+#cd $(TARGET_CFG); rm -rf *.dbg *.exe *.dll *.o *.so; cd ..; rmdir $(OBJDIR)
+	rm -rf $(TARGET_CFG)
+
+distclean-local:
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/ApacheSupport/2.2/mod_authn_casa.c

@@ -0,0 +1,478 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+#include <stdbool.h>
+
+#include "apr_strings.h"
+#include "ap_config.h"
+#include "ap_provider.h"
+#include "httpd.h"
+#include "http_config.h"
+#include "http_core.h"
+#include "http_log.h"
+#include "http_protocol.h"
+#include "http_request.h"
+
+#include "mod_auth.h"
+
+#include "casa_s_authtoken.h"
+
+//
+// Module per-dir configuration structure.
+// 
+typedef struct _authn_casa_dir_cfg
+{
+   int   performUsernameCheck;
+
+} authn_casa_dir_cfg;
+
+
+//
+// Forward declaration of our module structure.
+// 
+module AP_MODULE_DECLARE_DATA authn_casa_module;
+
+//
+// Environment variables set by module
+// 
+static char CasaIdentityIdEnvVar[] = "IdentityId";
+static char CasaIdentitySourceNameEnvVar[] = "IdentityDataSourceName";
+static char CasaIdentitySourceUrlEnvVar[] = "IdentityDataSourceUrl";
+
+//
+// Function: create_per_dir_config()
+// 
+// Create per-dir configuration structure.
+// 
+static void*
+create_per_dir_config(
+   apr_pool_t *p,
+   char *x)
+{
+    authn_casa_dir_cfg *pDirConfig;
+
+    // Allocate space for our configuration structure
+    pDirConfig = (authn_casa_dir_cfg*) apr_palloc(p, sizeof(*pDirConfig));
+
+    // Return our new configuration structure
+    return  (void*) pDirConfig;
+}
+
+/* ************************************************************************
+ * set_authn_casa_uname_check()
+ * 
+ * Process UsernameCheck configuration directive..
+ *
+ * L2
+ * ************************************************************************/
+static const char*
+set_authn_casa_uname_check(
+   cmd_parms *cmd,
+   void *cfg,
+   int arg)
+{
+   authn_casa_dir_cfg *pDirConfig = (authn_casa_dir_cfg*) cfg;
+
+   // Record the value in our structure
+   pDirConfig->performUsernameCheck = arg;
+
+   return NULL;
+}
+
+//
+// Configuration directives array structure.
+// 
+static const command_rec authn_casa_cmds[] =
+{
+    AP_INIT_FLAG("UsernameCheck",               // tbd - May be this directive should be on a per-directory or per-location basis
+                 set_authn_casa_uname_check,
+                 NULL,
+                 OR_AUTHCFG,
+                 "Check for username == CasaPrincipal (Value limited to 'on' or 'off')"),
+    {NULL}
+};
+
+/* ************************************************************************
+ * check_password()
+ * 
+ * Given a user and password, expected to return AUTH_GRANTED if we
+ * can validate the user/password combination.
+ *
+ * L2
+ * ************************************************************************/
+static authn_status
+check_password(
+   request_rec *r,
+   const char *user,
+   const char *password)
+{
+   authn_status         retStatus; 
+   authn_casa_dir_cfg   *pDirConfig;
+   bool                 userNameChecked = false;
+   int                  i;
+   char                 *pLocationName;
+
+   // First determine the length of the name of the location being protected
+   i = 0;
+   while (r->uri[i] != '\0')
+   {
+      if (r->uri[i] == '/')
+      {
+         // Ignore the slash if it is at the beginning of the uri
+         if (i != 0)
+         {
+            // The slash is not at the beggining of the uri, stop.
+            break;
+         }
+      }
+
+      i++;
+   }
+
+   // Now get a copy of the location being protected
+   if (i > 1)
+   {
+      pLocationName = apr_palloc(r->pool, i);
+      if (pLocationName)
+      {
+         memset(pLocationName, 0, i);
+         memcpy(pLocationName, &(r->uri[1]), i - 1);  // Do not include the slashes
+      }
+      else
+      {
+         ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
+         return AUTH_GENERAL_ERROR;
+      }
+   }
+   else
+   {
+      // We are protecting the server root
+      pLocationName = "apache_root";
+   }
+
+   // Get access to our per-dir configuration structure
+   pDirConfig = ap_get_module_config(r->per_dir_config,
+                                     &authn_casa_module);
+   if (pDirConfig)
+   {
+      // Assume success
+      retStatus = AUTH_GRANTED;
+
+      // Check if we must perform the username check
+      if (pDirConfig->performUsernameCheck != 0)
+      {
+         // Remember that we performed this check
+         userNameChecked = true;
+
+         // Check if the username matches the name what we are expecting
+         if (strcmp(user, "CasaPrincipal") != 0)
+         {
+            // The username does not match, allow other providers to get
+            // a crack to it.
+            retStatus = AUTH_USER_NOT_FOUND;
+         }
+      }
+
+      // Check the token if a problem has not been found
+      if (retStatus == AUTH_GRANTED)
+      {
+         CasaStatus  casaStatus;
+         PrincipalIf *pPrincipalIf;
+
+         // Validate the token
+         casaStatus = ValidateAuthToken(pLocationName,
+                                        password,
+                                        strlen(password),
+                                        &pPrincipalIf);
+         if (CASA_SUCCESS(casaStatus))
+         {
+
+            int            buffLen = 0;
+            apr_table_t    *e = r->subprocess_env;
+
+            // Associate necessary environment variables with the request block
+            casaStatus = pPrincipalIf->getIdentityId(pPrincipalIf,
+                                                     NULL,
+                                                     &buffLen);
+            if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
+            {
+               char  *pBuff;
+
+               // Allocate buffer to obtain the Identity Id
+               pBuff = apr_pcalloc(r->pool, buffLen);
+               if (pBuff)
+               {
+                  // Read the value into our buffer
+                  if (CASA_SUCCESS(pPrincipalIf->getIdentityId(pPrincipalIf,
+                                                               pBuff,
+                                                               &buffLen)))
+                  {
+                     // Now set the environment variable
+                     apr_table_setn(e, CasaIdentityIdEnvVar, pBuff);
+
+                     // Also, update the username within the request block with the identity id
+                     r->user = pBuff;
+                  }
+                  else
+                  {
+                     ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Unable to obtain identity id");
+                     retStatus = AUTH_GENERAL_ERROR;
+                  }
+               }
+               else
+               {
+                  ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
+                  retStatus = AUTH_GENERAL_ERROR;
+               }
+            }
+            else
+            {
+               ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Un-expected error obtaining identity id, %08X", casaStatus);
+               retStatus = AUTH_GENERAL_ERROR;
+            }
+
+            if (retStatus == AUTH_GRANTED)
+            {
+               buffLen = 0;
+               casaStatus = pPrincipalIf->getSourceName(pPrincipalIf,
+                                                        NULL,
+                                                        &buffLen);
+               if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
+               {
+                  char  *pBuff;
+
+                  // Allocate buffer to obtain the Identity Source Name
+                  pBuff = apr_pcalloc(r->pool, buffLen);
+                  if (pBuff)
+                  {
+                     // Read the value into our buffer
+                     if (CASA_SUCCESS(pPrincipalIf->getSourceName(pPrincipalIf,
+                                                                  pBuff,
+                                                                  &buffLen)))
+                     {
+                        // Now set the environment variable
+                        apr_table_setn(e, CasaIdentitySourceNameEnvVar, pBuff);
+                     }
+                     else
+                     {
+                        ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Unable to obtain identity source name");
+                        retStatus = AUTH_GENERAL_ERROR;
+                     }
+                  }
+                  else
+                  {
+                     ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
+                     retStatus = AUTH_GENERAL_ERROR;
+                  }
+               }
+               else
+               {
+                  ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Un-expected error obtaining identity source name, %08X", casaStatus);
+                  retStatus = AUTH_GENERAL_ERROR;
+               }
+            }
+
+            if (retStatus == AUTH_GRANTED)
+            {
+               buffLen = 0;
+               casaStatus = pPrincipalIf->getSourceUrl(pPrincipalIf,
+                                                       NULL,
+                                                       &buffLen);
+               if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
+               {
+                  char  *pBuff;
+
+                  // Allocate buffer to obtain the Identity Source Url
+                  pBuff = apr_pcalloc(r->pool, buffLen);
+                  if (pBuff)
+                  {
+                     // Read the value into our buffer
+                     if (CASA_SUCCESS(pPrincipalIf->getSourceUrl(pPrincipalIf,
+                                                                 pBuff,
+                                                                 &buffLen)))
+                     {
+                        // Now set the environment variable
+                        apr_table_setn(e, CasaIdentitySourceUrlEnvVar, pBuff);
+                     }
+                     else
+                     {
+                        ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Unable to obtain identity source url");
+                        retStatus = AUTH_GENERAL_ERROR;
+                     }
+                  }
+                  else
+                  {
+                     ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
+                     retStatus = AUTH_GENERAL_ERROR;
+                  }
+               }
+               else
+               {
+                  ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Un-expected error obtaining identity source url, %08X", casaStatus);
+                  retStatus = AUTH_GENERAL_ERROR;
+               }
+            }
+
+            if (retStatus == AUTH_GRANTED)
+            {
+               char  *pAttribNameBuff, *pAttribValueBuff;
+               int   enumHandle = 0;
+               int   attribNameBuffLen, attribValueBuffLen;
+
+               while (retStatus == AUTH_GRANTED)
+               {
+                  // Get attribute lengths
+                  attribNameBuffLen = attribValueBuffLen = 0;
+                  casaStatus = pPrincipalIf->attributeEnumerate(pPrincipalIf,
+                                                                &enumHandle,
+                                                                NULL,
+                                                                &attribNameBuffLen,
+                                                                NULL,
+                                                                &attribValueBuffLen);
+                  if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
+                  {
+                     // Allocate buffers to obtain the attribute data
+                     pAttribNameBuff = apr_pcalloc(r->pool, attribNameBuffLen);
+                     pAttribValueBuff = apr_pcalloc(r->pool, attribValueBuffLen);
+                     if (pAttribNameBuff && pAttribValueBuff)
+                     {
+                        // Read the attribute into our buffer
+                        if (CASA_SUCCESS(pPrincipalIf->attributeEnumerate(pPrincipalIf,
+                                                                          &enumHandle,
+                                                                          pAttribNameBuff,
+                                                                          &attribNameBuffLen,
+                                                                          pAttribValueBuff,
+                                                                          &attribValueBuffLen)))
+                        {
+                           // Now set the environment variable
+                           apr_table_setn(e, pAttribNameBuff, pAttribValueBuff);
+                        }
+                        else
+                        {
+                           ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Unable to obtain identity attribute");
+                           retStatus = AUTH_GENERAL_ERROR;
+                        }
+                     }
+                     else
+                     {
+                        ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
+                        retStatus = AUTH_GENERAL_ERROR;
+                     }
+                  }
+                  else
+                  {
+                     // Check if we are done going through the attributes
+                     if (CasaStatusCode(casaStatus) == CASA_STATUS_NO_MORE_ENTRIES)
+                     {
+                        // Done
+                        break;
+                     }
+                     else
+                     {
+                        ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Un-expected error during attribute enumeration, %08X", casaStatus);
+                        retStatus = AUTH_GENERAL_ERROR;
+                     }
+                  }
+               }
+            }
+
+            // Release the principal interface instance
+            pPrincipalIf->releaseReference(pPrincipalIf);
+         }
+         else
+         {
+            // Check if the token validation failed for a CasaPrincipal
+            if (userNameChecked)
+            {
+               // Token validation failed for a CasaPrincipal, always return AUTH_DENIED.
+               retStatus = AUTH_DENIED;
+            }
+            else
+            {
+               // We did not check the username, set the return status based on the status
+               // returned by ValidateAuthToken().
+               if (CasaStatusCode(casaStatus) == CASA_STATUS_AUTHENTICATION_FAILURE)
+               {
+                  // Authentication failed
+                  retStatus = AUTH_DENIED;
+               }
+               else
+               {
+                  // Allow other providers to get a crack to it
+                  retStatus = AUTH_USER_NOT_FOUND;
+               }
+            }
+         }
+      }
+   }
+   else
+   {
+      ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Did not get module per-server config structure");
+      retStatus = AUTH_GENERAL_ERROR;
+   }
+
+    return retStatus;
+}
+
+//
+// Authentication Provider Function Table
+// 
+static const authn_provider authn_casa_provider =
+{
+    &check_password,
+    NULL,            // We do not support Digest Authentication
+};
+
+/* ************************************************************************
+ * register_hooks()
+ * 
+ * Register all of the module hooks.
+ *
+ * L2
+ * ************************************************************************/
+static void
+register_hooks(
+   apr_pool_t *p)
+{
+   // Register as an authentication provider
+   ap_register_provider(p,
+                        AUTHN_PROVIDER_GROUP,   // Provider group
+                        "casa",                 // Provider name
+                        "0",                    // Provider version
+                        &authn_casa_provider);  // Authentication Provider function table
+}
+
+//
+// Declare ourselves to the HTTPD core.
+// 
+module AP_MODULE_DECLARE_DATA authn_casa_module =
+{
+   STANDARD20_MODULE_STUFF,
+   create_per_dir_config,        // Create per-dir config structures
+   NULL,                         // merge per-dir config structures
+   NULL,                         // Create per-server config structures
+   NULL,                         // merge per-server config structures
+   authn_casa_cmds,              // command handlers
+   register_hooks                // register hooks
+};

auth_token/server/ApacheSupport/Makefile.am

@@ -0,0 +1,37 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+SUBDIRS = 2.2
+
+DIST_SUBDIRS = 2.2
+
+CFILES =
+
+EXTRA_DIST = $(CFILES)
+
+.PHONY: package package-clean package-install package-uninstall
+package package-clean package-install package-uninstall:
+	$(MAKE) -C $(TARGET_OS) $@
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/AuthTokenValidate/Makefile.am

@@ -0,0 +1,37 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+SUBDIRS = $(TARGET_OS) idenTokenProviders
+
+DIST_SUBDIRS = linux idenTokenProviders
+
+CFILES =
+
+EXTRA_DIST = $(CFILES) *.h
+
+.PHONY: package package-clean package-install package-uninstall
+package package-clean package-install package-uninstall:
+	$(MAKE) -C $(TARGET_OS) $@
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/AuthTokenValidate/README

@@ -0,0 +1,77 @@
+/***********************************************************************
+ *
+ *  README for libcasa_s_authtoken
+ *
+ ***********************************************************************/
+
+INTRODUCTION
+
+libcasa_s_authtoken provides an API for the validation of CASA Authentication Tokens.
+The API provides a means for obtaining identity information about authenticated
+entities.
+
+Applications should avoid calling directly into this library's APIs. Instead, applications
+should code to the PAM API to validate authentication credentials or allow an external
+module to perform the credential validation. To facilitate this, CASA Authentication
+provides PAM, Apache, and JAAS modules that can be used to validate credentials containing
+CASA Authentication tokens,
+
+CONFIGURING TRUSTED AUTHENTICATION TOKEN SERVICES
+
+tbd. Add info about the installation of public certificates and trusted certificate authorities.
+
+CONFIGURING ADDITIONAL IDENTITY TOKEN PROVIDER MODULES
+
+CASA Authentication Tokens contain Identity Tokens. The Identity Tokens contain the identity
+information about the entity being authenticated. Identity Tokens can be of different types,
+the type utilized for use with a particular service is configured at the time that the service
+is configured for CASA Authentication. The default identity token type is CasaIdentityToken.
+
+libcasa_s_authtoken supports different identity token types through an API that allows for the
+configuration of different Identity Token Provider plug-ins. An Identity Token Provider plug-in
+is configured by placing a configuration file for the plug-ins in the
+/etc/opt/CASA/authtoken.d/modules.d folder. The name of the plug-in configuration file is related
+to the identity token type in the following manner: IdentityTokenTypeName.conf.
+
+Identity Token Provider plug-in configuration files must must contain a directive indicating the
+path to the library implementing the Identity Token Provider plug-in (See the configuration file
+for the CasaIdentityToken plug-in for an example).
+
+SERVER APPLICATION PROGRAMMING NOTES
+
+The Validate CASA Authentication Token API is defined in casa_s_authtoken.h.
+
+The API consists of a call to validate authentication tokens. The caller must supply a service
+name which must match the service name provided by the client when requesting the authentication
+token. Successful calls to the validate authentication token API will return a handle to a principal
+interface object. The principal interface object handle can be used to obtain identity information
+about the authenticated entity as well as information about the authentication realm. The principal
+interface object must be released after it is no longer needed. The amount and type of identity
+information associated with the principal interface is dependent on what is configured at the
+time that the service is enabled for CASA Authentication.
+
+For examples of code which uses the Validate CASA Authentication Token API look at the implementations
+of the CASA Authentication PAM module and the CASA Authentication Provider Apache module. 
+
+IDENTITY TOKEN PROVIDER PROGRAMMING NOTES
+
+The Identity Token Provider API is defined in iden_token_provider.h.
+
+For an example see the implementation of the CASA Identity Token Provider.
+
+SECURITY CONSIDERATIONS
+
+CASA Authentication Tokens when compromised can be used to either impersonate
+a user or to obtain identity information about the user. Because of this it is
+important that the tokens be secured by applications making use of them. It is
+recommended that the tokens be transmitted using SSL.
+ 
+
+
+
+                
+
+
+
+
+

auth_token/server/AuthTokenValidate/TODO

@@ -0,0 +1,15 @@
+/***********************************************************************
+ *
+ *  TODO for libcasa_s_authtoken
+ *
+ ***********************************************************************/
+
+INTRODUCTION
+
+This file contains a list of the items still outstanding for libcasa_s_authtoken.
+
+OUTSTANDING ITEMS
+
+- Change AuthTokens to be SOAP messages secured with WS-Security and WS-Trust.
+- Implement CheckAuthToken().
+- Finish README documentation.

auth_token/server/AuthTokenValidate/authtoken.c

@@ -0,0 +1,693 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+
+//===[ Include files ]=====================================================
+
+#include "internal.h"
+
+//===[ Type definitions ]==================================================
+
+//
+// Parse states
+//
+#define AWAITING_ROOT_ELEMENT_START          0x0
+#define AWAITING_ROOT_ELEMENT_END            0x1
+#define AWAITING_SIGNATURE_DATA              0x2
+#define AWAITING_SIGNATURE_ELEMENT_START     0x3
+#define AWAITING_SIGNATURE_ELEMENT_END       0x4
+#define AWAITING_LIFETIME_DATA               0x5
+#define AWAITING_LIFETIME_ELEMENT_START      0x6
+#define AWAITING_LIFETIME_ELEMENT_END        0x7
+#define AWAITING_IDENT_TOKEN_ELEMENT_START   0x8
+#define AWAITING_IDENT_TOKEN_ELEMENT_END     0x9
+#define AWAITING_IDENT_TOKEN_DATA            0xA
+#define AWAITING_TYPE_ELEMENT_START          0xB
+#define AWAITING_TYPE_ELEMENT_END            0xC
+#define AWAITING_TYPE_DATA                   0xD
+#define DONE_PARSING                         0xE
+
+//
+// Authentication Token Parse Structure
+//
+typedef struct _AuthTokenParse
+{
+   XML_Parser           p;
+   int                  state;
+   int                  elementDataProcessed;
+   AuthToken            *pAuthToken;
+   CasaStatus           status;
+
+} AuthTokenParse, *PAuthTokenParse;
+
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+//++=======================================================================
+static
+void XMLCALL
+AuthTokenStartElementHandler(
+   IN    void *pUserData,
+   IN    const XML_Char *name,
+   IN    const XML_Char **atts)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   AuthTokenParse    *pAuthTokenParse = (AuthTokenParse*) pUserData;
+
+   DbgTrace(2, "-AuthTokenStartElementHandler- Start\n", 0);
+
+   // Proceed based on the state
+   switch (pAuthTokenParse->state)
+   {
+      case AWAITING_ROOT_ELEMENT_START:
+
+         // In this state, we are only expecting the Authentication
+         // Response Element.
+         if (strcmp(name, AUTH_TOKEN_ELEMENT_NAME) == 0)
+         {
+            // Good, advance to the next state.
+            pAuthTokenParse->state = AWAITING_SIGNATURE_ELEMENT_START;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenStartElementHandler- Un-expected start element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+
+      case AWAITING_SIGNATURE_ELEMENT_START:
+   
+         // In this state, we are only expecting the Signature Element.
+         if (strcmp(name, SIGNATURE_ELEMENT_NAME) == 0)
+         {
+            // Good, advance to the next state.
+            pAuthTokenParse->state = AWAITING_SIGNATURE_DATA;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenStartElementHandler- Un-expected start element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+
+      case AWAITING_LIFETIME_ELEMENT_START:
+   
+         // In this state, we are only expecting the Lifetime Element.
+         if (strcmp(name, LIFETIME_ELEMENT_NAME) == 0)
+         {
+            // Good, advance to the next state.
+            pAuthTokenParse->state = AWAITING_LIFETIME_DATA;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenStartElementHandler- Un-expected start element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+
+      case AWAITING_IDENT_TOKEN_ELEMENT_START:
+   
+         // In this state, we are only expecting the Identity Token Element.
+         if (strcmp(name, IDENTITY_TOKEN_ELEMENT_NAME) == 0)
+         {
+            // Good, advance to the next state.
+            pAuthTokenParse->state = AWAITING_TYPE_ELEMENT_START;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenStartElementHandler- Un-expected start element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+   
+      case AWAITING_TYPE_ELEMENT_START:
+   
+         // In this state, we are only expecting the Type Element.
+         if (strcmp(name, TYPE_ELEMENT_NAME) == 0)
+         {
+            // Good, advance to the next state.
+            pAuthTokenParse->state = AWAITING_TYPE_DATA;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenStartElementHandler- Un-expected start element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+
+      default:
+         DbgTrace(0, "-AuthTokenStartElementHandler- Un-expected state = %d\n", pAuthTokenParse->state);
+         XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         break;
+   }
+
+   DbgTrace(2, "-AuthTokenStartElementHandler- End\n", 0);
+}
+
+
+//++=======================================================================
+static
+CasaStatus
+ConsumeElementData(
+   IN    AuthTokenParse *pAuthTokenParse,
+   IN    const XML_Char *s,
+   IN    int len,
+   INOUT char **ppElementData,
+   INOUT int *pElementDataLen)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus  retStatus = CASA_STATUS_SUCCESS;
+
+   DbgTrace(3, "-ConsumeElementData- Start\n", 0);
+
+   // Proceed based on whether or not we have already consumed data
+   // for this element.
+   if (*ppElementData == NULL)
+   {
+      // We have not yet consumed data for this element
+      pAuthTokenParse->elementDataProcessed = len;
+
+      // Allocate a buffer to hold this element data (null terminated).
+      *ppElementData = (char*) malloc(len + 1);
+      if (*ppElementData)
+      {
+         memset(*ppElementData, 0, len + 1);
+         memcpy(*ppElementData, s, len);
+
+         // Return the length of the element data buffer
+         *pElementDataLen = pAuthTokenParse->elementDataProcessed + 1;
+      }
+      else
+      {
+         DbgTrace(0, "-ConsumeElementData- Buffer allocation failure\n", 0);
+         retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                     CASA_FACILITY_AUTHTOKEN,
+                                     CASA_STATUS_INSUFFICIENT_RESOURCES);
+      }
+   }
+   else
+   {
+      char  *pNewBuf;
+
+      // We have already received token data, append this data to it.
+      pNewBuf = (char*) malloc(pAuthTokenParse->elementDataProcessed + len + 1);
+      if (pNewBuf)
+      {
+         memset(pNewBuf,
+                0,
+                pAuthTokenParse->elementDataProcessed + len + 1);
+         memcpy(pNewBuf,
+                *ppElementData,
+                pAuthTokenParse->elementDataProcessed);
+         memcpy(pNewBuf + pAuthTokenParse->elementDataProcessed, s, len);
+         pAuthTokenParse->elementDataProcessed += len;
+
+         // Swap the buffers
+         free(*ppElementData);
+         *ppElementData = pNewBuf;
+
+         // Return the length of the element data buffer
+         *pElementDataLen = pAuthTokenParse->elementDataProcessed + 1;
+      }
+      else
+      {
+         DbgTrace(0, "-ConsumeElementData- Buffer allocation failure\n", 0);
+         retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                     CASA_FACILITY_AUTHTOKEN,
+                                     CASA_STATUS_INSUFFICIENT_RESOURCES);
+      }
+   }
+
+   DbgTrace(3, "-ConsumeElementData- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+static
+void XMLCALL
+AuthTokenCharDataHandler(
+   IN    void *pUserData,
+   IN    const XML_Char *s,
+   IN    int len)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   AuthTokenParse    *pAuthTokenParse = (AuthTokenParse*) pUserData;
+
+   DbgTrace(2, "-AuthTokenCharDataHandler- Start\n", 0);
+
+   // Just exit if being called to process LF and CR characters
+   if (len == 1
+       && ((*s == '\n') || (*s == '\r')))
+   {
+      goto exit;
+   }
+
+   // Proceed based on the state
+   switch (pAuthTokenParse->state)
+   {
+      case AWAITING_SIGNATURE_DATA:
+      case AWAITING_SIGNATURE_ELEMENT_END:
+
+         pAuthTokenParse->status = ConsumeElementData(pAuthTokenParse,
+                                                      s,
+                                                      len,
+                                                      &pAuthTokenParse->pAuthToken->pSignature,
+                                                      &pAuthTokenParse->pAuthToken->signatureLen);
+         if (CASA_SUCCESS(pAuthTokenParse->status))
+         {
+            // Advanced to the next state
+            pAuthTokenParse->state = AWAITING_SIGNATURE_ELEMENT_END;
+         }
+         else
+         {
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+
+      case AWAITING_LIFETIME_DATA:
+      case AWAITING_LIFETIME_ELEMENT_END:
+   
+         // Convert the lifetime string to a numeric value
+         pAuthTokenParse->pAuthToken->tokenLifetime = dtoul((char*) s, len);
+   
+         // Advanced to the next state
+         pAuthTokenParse->state = AWAITING_LIFETIME_ELEMENT_END;
+         break;
+
+      case AWAITING_TYPE_DATA:
+      case AWAITING_TYPE_ELEMENT_END:
+
+         pAuthTokenParse->status = ConsumeElementData(pAuthTokenParse,
+                                                      s,
+                                                      len,
+                                                      &pAuthTokenParse->pAuthToken->pIdenTokenType,
+                                                      &pAuthTokenParse->pAuthToken->idenTokenTypeLen);
+         if (CASA_SUCCESS(pAuthTokenParse->status))
+         {
+            // Advanced to the next state
+            pAuthTokenParse->state = AWAITING_TYPE_ELEMENT_END;
+         }
+         else
+         {
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+
+      case AWAITING_IDENT_TOKEN_DATA:
+      case AWAITING_IDENT_TOKEN_ELEMENT_END:
+
+         pAuthTokenParse->status = ConsumeElementData(pAuthTokenParse,
+                                                      s,
+                                                      len,
+                                                      &pAuthTokenParse->pAuthToken->pIdenToken,
+                                                      &pAuthTokenParse->pAuthToken->idenTokenLen);
+         if (CASA_SUCCESS(pAuthTokenParse->status))
+         {
+            // Advanced to the next state
+            pAuthTokenParse->state = AWAITING_IDENT_TOKEN_ELEMENT_END;
+         }
+         else
+         {
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+
+      default:
+         DbgTrace(0, "-AuthTokenCharDataHandler- Un-expected state = %d\n", pAuthTokenParse->state);
+         XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         break;
+   }
+
+exit:
+
+   DbgTrace(2, "-AuthTokenCharDataHandler- End\n", 0);
+}
+
+
+//++=======================================================================
+static
+void XMLCALL
+AuthTokenEndElementHandler(
+   IN    void *pUserData,
+   IN    const XML_Char *name)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   AuthTokenParse    *pAuthTokenParse = (AuthTokenParse*) pUserData;
+
+   DbgTrace(2, "-AuthTokenEndElementHandler- Start\n", 0);
+
+   // Proceed based on the state
+   switch (pAuthTokenParse->state)
+   {
+      case AWAITING_ROOT_ELEMENT_END:
+
+         // In this state, we are only expecting the Authentication
+         // Token Element.
+         if (strcmp(name, AUTH_TOKEN_ELEMENT_NAME) == 0)
+         {
+            // Done.
+            pAuthTokenParse->state = DONE_PARSING;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenEndHandler- Un-expected end element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+
+      case AWAITING_SIGNATURE_ELEMENT_END:
+   
+         // In this state, we are only expecting the Signature Element.
+         if (strcmp(name, SIGNATURE_ELEMENT_NAME) == 0)
+         {
+            // Good, advance to the next state.
+            pAuthTokenParse->state = AWAITING_LIFETIME_ELEMENT_START;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenEndElementHandler- Un-expected end element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+
+      case AWAITING_LIFETIME_ELEMENT_END:
+   
+         // In this state, we are only expecting the Lifetime Element.
+         if (strcmp(name, LIFETIME_ELEMENT_NAME) == 0)
+         {
+            // Good, advance to the next state.
+            pAuthTokenParse->state = AWAITING_IDENT_TOKEN_ELEMENT_START;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenEndElementHandler- Un-expected end element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+   
+      case AWAITING_TYPE_ELEMENT_END:
+   
+         // In this state, we are only expecting the Type Element.
+         if (strcmp(name, TYPE_ELEMENT_NAME) == 0)
+         {
+            // Good, advance to the next state.
+            pAuthTokenParse->state = AWAITING_IDENT_TOKEN_DATA;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenEndElementHandler- Un-expected end element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+   
+      case AWAITING_IDENT_TOKEN_ELEMENT_END:
+   
+         // In this state, we are only expecting the Identity Token Element.
+         if (strcmp(name, IDENTITY_TOKEN_ELEMENT_NAME) == 0)
+         {
+            // Good, advance to the next state.
+            pAuthTokenParse->state = AWAITING_ROOT_ELEMENT_END;
+         }
+         else
+         {
+            DbgTrace(0, "-AuthTokenEndElementHandler- Un-expected end element\n", 0);
+            XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         }
+         break;
+   
+      default:
+         DbgTrace(0, "-AuthTokenEndElementHandler- Un-expected state = %d\n", pAuthTokenParse->state);
+         XML_StopParser(pAuthTokenParse->p, XML_FALSE);
+         break;
+   }
+
+   DbgTrace(2, "-AuthTokenEndElementHandler- End\n", 0);
+}
+
+
+//++=======================================================================
+CasaStatus
+CreateAuthToken(
+   IN    char *pTokenBuf,
+   IN    int tokenBufLen,
+   INOUT AuthToken **ppAuthToken)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus        retStatus = CASA_STATUS_SUCCESS;
+   AuthTokenParse    authTokenParse = {0};
+   AuthToken         *pAuthToken;
+
+   DbgTrace(1, "-CreateAuthToken- Start\n", 0);
+
+   /*
+   * Authentication tokens have the following format:
+   * 
+   * <?xml version="1.0" encoding="ISO-8859-1"?>
+   * <auth_token>
+   * <signature>signature value</signature>
+   * <lifetime>lifetime value</lifetime>
+   * <ident_token><type>identity token type</type>identity token data</ident_token>
+   * </auth_token>
+   *
+   */
+
+   // Allocate AuthToken object
+   pAuthToken = malloc(sizeof(*pAuthToken));
+   if (pAuthToken)
+   {
+      XML_Parser  p;
+
+      // Initialize the AuthToken object and set it in the
+      // authentication response parse object.
+      memset(pAuthToken, 0, sizeof(*pAuthToken));
+      authTokenParse.pAuthToken = pAuthToken;
+
+      // Create parser
+      p = XML_ParserCreate(NULL);
+      if (p)
+      {
+         // Keep track of the parser in our parse object
+         authTokenParse.p = p;
+
+         // Initialize the status within the parse object
+         authTokenParse.status = CASA_STATUS_SUCCESS;
+
+         // Set the start and end element handlers
+         XML_SetElementHandler(p,
+                               AuthTokenStartElementHandler,
+                               AuthTokenEndElementHandler);
+
+         // Set the character data handler
+         XML_SetCharacterDataHandler(p, AuthTokenCharDataHandler);
+
+
+         // Set our user data
+         XML_SetUserData(p, &authTokenParse);
+
+         // Parse the document
+         if (XML_Parse(p, pTokenBuf, tokenBufLen, 1) == XML_STATUS_OK)
+         {
+            // Verify that the parse operation completed successfully
+            if (authTokenParse.state == DONE_PARSING)
+            {
+               // The parse operation succeded.
+               retStatus = CASA_STATUS_SUCCESS;
+            }
+            else
+            {
+               DbgTrace(0, "-CreateAuthToken- Parse operation did not complete\n", 0);
+
+               // Check if a status has been recorded
+               if (authTokenParse.status != CASA_STATUS_SUCCESS)
+               {
+                  retStatus = authTokenParse.status;
+               }
+               else
+               {
+                  retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                              CASA_FACILITY_AUTHTOKEN,
+                                              CASA_STATUS_PROTOCOL_ERROR);
+               }
+            }
+         }
+         else
+         {
+            DbgTrace(0, "-CreateAuthToken- Parse error %d\n", XML_GetErrorCode(p));
+            retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                        CASA_FACILITY_AUTHTOKEN,
+                                        CASA_STATUS_PROTOCOL_ERROR);
+         }
+
+         // Free the parser
+         XML_ParserFree(p);
+      }
+      else
+      {
+         DbgTrace(0, "-CreateAuthToken- Parser creation error\n", 0);
+         retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                     CASA_FACILITY_AUTHTOKEN,
+                                     CASA_STATUS_INSUFFICIENT_RESOURCES);
+      }
+
+      // Return the AuthenticationResp object to the caller if necessary
+      if (CASA_SUCCESS(retStatus))
+      {
+         *ppAuthToken = pAuthToken;
+      }
+      else
+      {
+         free(pAuthToken);
+      }
+   }
+   else
+   {
+      DbgTrace(0, "-CreateAuthToken- Memory allocation error\n", 0);
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INSUFFICIENT_RESOURCES);
+   }
+
+   DbgTrace(1, "-CreateAuthToken- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+void
+RelAuthToken(
+   IN    AuthToken *pAuthToken)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   DbgTrace(1, "-RelAuthToken- Start\n", 0);
+
+   // Free the resources associated with the object
+   if (pAuthToken->pSignature)
+      free(pAuthToken->pSignature);
+
+   if (pAuthToken->pIdenTokenType)
+      free(pAuthToken->pIdenTokenType);
+
+   if (pAuthToken->pIdenToken)
+      free(pAuthToken->pIdenToken);
+
+   free(pAuthToken);
+
+   DbgTrace(1, "-RelAuthToken- End\n", 0);
+}
+
+
+//++=======================================================================
+CasaStatus
+CheckAuthToken(
+   IN    AuthToken *pAuthToken,
+   IN    const char *pServiceName)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L0
+//=======================================================================--
+{
+   CasaStatus  retStatus = CASA_STATUS_SUCCESS;
+
+   DbgTrace(1, "-CheckuthToken- Start\n", 0);
+
+   // tbd
+
+   DbgTrace(1, "-CheckAuthToken- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+

auth_token/server/AuthTokenValidate/config.c

@@ -0,0 +1,764 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+
+//===[ Include files ]=====================================================
+
+#include "internal.h"
+
+//===[ Type definitions ]==================================================
+
+//
+// Config Key object
+// 
+typedef struct _ConfigKey
+{
+   LIST_ENTRY  listEntry;
+   char        *pKeyName;
+   int         keyNameLen;
+   char        *pValue;
+   int         valueLen;
+
+} ConfigKey, *pConfigKey;
+
+//
+// Config Interface instance data
+// 
+typedef struct _ConfigIfInstance
+{
+   LIST_ENTRY     listEntry;
+   int            refCount;
+   char           *pConfigFolder;
+   int            configFolderLen;
+   char           *pConfigName;
+   int            configNameLen;
+   LIST_ENTRY     configKeyListHead;
+   ConfigIf       configIf;
+
+} ConfigIfInstance, *PConfigIfInstance;
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+// ConfigIf variables
+static
+LIST_ENTRY        g_configIfListHead = {&g_configIfListHead, &g_configIfListHead};
+
+static
+int               g_numConfigIfObjs = 0;
+
+// Synchronization mutex
+static
+HANDLE            g_configIfMutex = NULL;
+
+
+//++=======================================================================
+static
+void
+RemoveWhiteSpaceFromTheEnd(
+   IN       const char     *pInString)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   char  *pLineEnd = (char*) pInString + strlen(pInString) - 1;
+
+
+   DbgTrace(3, "-RemoveWhiteSpaceFromTheEnd- Start\n", 0);
+
+   while (pLineEnd != pInString)
+   {
+      if (*pLineEnd == '\n'
+          || *pLineEnd == ' '
+          || *pLineEnd == '\t')
+      {
+         // Strike this character
+         *pLineEnd = '\0';
+         pLineEnd --;
+      }
+      else
+      {
+         // Found a non-white character
+         break;
+      }
+   }
+
+   DbgTrace(3, "-RemoveWhiteSpaceFromTheEnd- End\n", 0);
+}
+
+
+//++=======================================================================
+static
+char*
+SkipWhiteSpace(
+   IN       const char     *pInString)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   char  *pOutString = (char*) pInString;
+
+   DbgTrace(3, "-SkipWhiteSpace- Start\n", 0);
+
+   while (*pOutString != '\0')
+   {
+      if (*pOutString == '\n'
+          || *pOutString == ' '
+          || *pOutString == '\t')
+      {
+         // Skip this character
+         pOutString ++;
+      }
+      else
+      {
+         // Found a non-white character
+         break;
+      }
+   }
+
+   DbgTrace(3, "-SkipWhiteSpace- End\n", 0);
+
+   return pOutString;
+}
+
+
+//++=======================================================================
+static
+char*
+SkipNonWhiteSpace(
+   IN       const char     *pInString)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   char  *pOutString = (char*) pInString;
+
+   DbgTrace(3, "-SkipNonWhiteSpace- Start\n", 0);
+
+   while (*pOutString != '\0')
+   {
+      if (*pOutString == '\n'
+          || *pOutString == ' '
+          || *pOutString == '\t')
+      {
+         // Found a white character
+         break;
+      }
+      else
+      {
+         // Skip this character
+         pOutString ++;
+      }
+   }
+
+   DbgTrace(3, "-SkipNonWhiteSpace- End\n", 0);
+
+   return pOutString;
+}
+
+
+//++=======================================================================
+static
+void
+LowerCaseString(
+   IN       char        *pDestString,
+   IN       const char  *pSrcString)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   int   i;
+
+   DbgTrace(3, "-LowerCaseString- Start\n", 0);
+
+   // Copy the string as lower case
+   for (i = 0; pSrcString[i] != '\0'; i++)
+   {
+      if (isalpha(pSrcString[i]))
+         pDestString[i] = tolower(pSrcString[i]);
+      else
+         pDestString[i] = pSrcString[i];
+   }
+
+   // Null terminate the destination string
+   pDestString[i] = '\0';
+
+   DbgTrace(3, "-LowerCaseString- End\n", 0);
+}
+
+
+//++=======================================================================
+static
+int SSCS_CALL
+AddReference(
+   IN       const void  *pIfInstance)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Interface reference count.
+//                           
+// Description:
+//    Increases interface reference count.
+//
+// L2
+//=======================================================================--
+{
+   int               refCount;
+   ConfigIfInstance  *pConfigIfInstance = CONTAINING_RECORD(pIfInstance, ConfigIfInstance, configIf);
+
+   DbgTrace(2, "-AddReference- Start\n", 0);
+
+   // Increment the reference count on the object
+   PlatAcquireMutex(g_configIfMutex);
+   pConfigIfInstance->refCount ++;
+   refCount = pConfigIfInstance->refCount;
+   PlatReleaseMutex(g_configIfMutex);
+
+   DbgTrace(2, "-AddReference- End, refCount = %08X\n", refCount);
+
+   return refCount;
+}
+
+
+//++=======================================================================
+static
+void SSCS_CALL
+ReleaseReference(
+   IN       const void  *pIfInstance)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Nothing.
+//                           
+// Description:
+//    Decreases interface reference count. The interface is deallocated if
+//    the reference count becomes zero.
+//
+// L2
+//=======================================================================--
+{
+   bool              freeObj = false;
+   ConfigIfInstance  *pConfigIfInstance = CONTAINING_RECORD(pIfInstance, ConfigIfInstance, configIf);
+
+   DbgTrace(2, "-ReleaseReference- Start\n", 0);
+
+   // Decrement the reference count on the object and determine if it needs to
+   // be released.
+   PlatAcquireMutex(g_configIfMutex);
+   pConfigIfInstance->refCount --;
+   if (pConfigIfInstance->refCount == 0)
+   {
+      // The object needs to be released, forget about it.
+      freeObj = true;
+      g_numConfigIfObjs --;
+      RemoveEntryList(&pConfigIfInstance->listEntry);
+   }
+   PlatReleaseMutex(g_configIfMutex);
+
+   // Free object if necessary
+   if (freeObj)
+   {
+      // Free all of the config key objects associated with this configuration
+      // interface instance.
+      while (!IsListEmpty(&pConfigIfInstance->configKeyListHead))
+      {
+         LIST_ENTRY  *pListEntry;
+         ConfigKey   *pConfigKey;
+
+         // Get reference to entry at the head of the list
+         pListEntry = pConfigIfInstance->configKeyListHead.Flink;
+         pConfigKey = CONTAINING_RECORD(pListEntry, ConfigKey, listEntry);
+
+         // Free the buffers associated with the ConfigKey
+         free(pConfigKey->pKeyName);
+         free(pConfigKey->pValue);
+
+         // Remove the entry from the list
+         RemoveEntryList(&pConfigKey->listEntry);
+
+         // Finish freeing the ConfigKey
+         free(pConfigKey);
+      }
+
+      // Free the rest of the buffers associated with the interface instance data
+      free(pConfigIfInstance->pConfigFolder);
+      free(pConfigIfInstance->pConfigName);
+      free(pConfigIfInstance);
+   }
+
+   DbgTrace(2, "-ReleaseReference- End\n", 0);
+}
+
+
+//++=======================================================================
+static
+char* SSCS_CALL
+GetEntryValue(
+   IN       const void  *pIfInstance,
+   IN       const char  *pKeyName)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pKeyName -
+//       Pointer to NULL terminated string that contains the
+//       name of the key whose value is being requested.
+//               
+// Returns:
+//    Pointer to NULL terminated string with value being requested or NULL.
+//                           
+// Description:
+//    Gets value associated with a key for the configuration object.
+//
+// L2
+//=======================================================================--
+{
+   ConfigIfInstance  *pConfigIfInstance = CONTAINING_RECORD(pIfInstance, ConfigIfInstance, configIf);
+   char              *pValue = NULL;
+   LIST_ENTRY        *pListEntry;
+   ConfigKey         *pConfigKey;
+   int               keyNameLen = strlen(pKeyName);
+   char              *pKeyNameLowercase;
+
+   DbgTrace(2, "-GetEntryValue- Start\n", 0);
+
+   // Allocate enough space to hold lower case version of the key name
+   pKeyNameLowercase = malloc(keyNameLen + 1);
+   if (pKeyNameLowercase)
+   {
+      // Lower case the key name
+      LowerCaseString(pKeyNameLowercase, pKeyName);
+
+      // Try to find matching ConfigKey
+      pListEntry = pConfigIfInstance->configKeyListHead.Flink;
+      while (pListEntry != &pConfigIfInstance->configKeyListHead)
+      {
+         // Get pointer to the current entry
+         pConfigKey = CONTAINING_RECORD(pListEntry, ConfigKey, listEntry);
+
+         // Check if we have a match
+         if (pConfigKey->keyNameLen == keyNameLen
+             && memcmp(pKeyNameLowercase, pConfigKey->pKeyName, keyNameLen) == 0)
+         {
+            // We found it, return its value.
+            pValue = malloc(pConfigKey->valueLen + 1);
+            if (pValue)
+            {
+               strcpy(pValue, pConfigKey->pValue);
+            }
+            else
+            {
+               DbgTrace(0, "-GetEntryValue- Buffer allocation failure\n", 0);
+            }
+            break;
+         }
+
+         // Advance to the next entry
+         pListEntry = pListEntry->Flink;
+      }
+
+      // Free the lower case version of the key name
+      free(pKeyNameLowercase);
+   }
+   else
+   {
+      DbgTrace(0, "-GetEntryValue- Buffer allocation failure\n", 0);
+   }
+
+   DbgTrace(2, "-GetEntryValue- End, pValue = %08X\n", (unsigned int) pValue);
+
+   return pValue;
+}
+
+
+//++=======================================================================
+CasaStatus
+GetConfigInterface(
+   IN       const char  *pConfigFolder,
+   IN       const char  *pConfigName,
+   INOUT    ConfigIf    **ppConfigIf)
+//
+// Arguments:  
+//    pConfigFolder -
+//       Pointer to NULL terminated string that contains the name of
+//       the folder containing the configuration file.
+//               
+//    pConfigName -
+//       Pointer to NULL terminated string containing the name of the
+//       configuration entry.
+//
+//    ppConfigIf -
+//       Pointer to variable that will receive pointer to ConfigIf
+//       instance.
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get configuration interface to specified configuration entry.
+//
+// L2
+//=======================================================================--
+{
+   int               configFolderLen = strlen(pConfigFolder);
+   int               configNameLen = strlen(pConfigName);
+   ConfigIfInstance  *pConfigIfInstance;
+   LIST_ENTRY        *pListEntry;
+   CasaStatus        retStatus = CasaStatusBuild(CASA_SEVERITY_INFORMATIONAL,
+                                                 CASA_FACILITY_AUTHTOKEN,
+                                                 CASA_STATUS_OBJECT_NOT_FOUND);
+
+   DbgTrace(2, "-GetConfigInterface- Start\n", 0);
+
+   PlatAcquireMutex(g_configIfMutex);
+
+   // Check if we already have an entry in our list for the configuration
+   pListEntry = g_configIfListHead.Flink;
+   while (pListEntry != &g_configIfListHead)
+   {
+      // Get pointer to the current entry
+      pConfigIfInstance = CONTAINING_RECORD(pListEntry, ConfigIfInstance, listEntry);
+
+      // Check if we have a match
+      if (pConfigIfInstance->configFolderLen == configFolderLen
+          && pConfigIfInstance->configNameLen == configNameLen
+          && memcmp(pConfigFolder, pConfigIfInstance->pConfigFolder, configFolderLen) == 0
+          && memcmp(pConfigName, pConfigIfInstance->pConfigName, configNameLen) == 0)
+      {
+         // We found it, return the ConfigIf associated with the instance data
+         // after incrementing its reference count.
+         pConfigIfInstance->refCount ++;
+         *ppConfigIf = &pConfigIfInstance->configIf;
+
+         // Success
+         retStatus = CASA_STATUS_SUCCESS;
+         break;
+      }
+
+      // Advance to the next entry
+      pListEntry = pListEntry->Flink;
+   }
+
+   // Proceed to create interface instance data for the configuration if none was found
+   if (retStatus != CASA_STATUS_SUCCESS)
+   {
+      char  *pFilePath;
+
+      // Build a string containing the configuration file path
+      pFilePath = malloc(configFolderLen + 1 + configNameLen + sizeof(".conf"));
+      if (pFilePath)
+      {
+         FILE  *pConfigFile;
+
+         strcpy(pFilePath, pConfigFolder);
+         strcat(pFilePath, "/");
+         strcat(pFilePath, pConfigName);
+         strcat(pFilePath, ".conf");
+
+         // Open the configuration file for reading
+         pConfigFile = fopen(pFilePath, "r");
+         if (pConfigFile)
+         {
+            // Opened the file, create a ConfigIfInstance object for it.
+            pConfigIfInstance = malloc(sizeof(*pConfigIfInstance));
+            if (pConfigIfInstance)
+            {
+               // Initialize the list head within the instance data
+               InitializeListHead(&pConfigIfInstance->configKeyListHead);
+
+               // Initialize the ConfigIf within the instance data
+               pConfigIfInstance->configIf.addReference = AddReference;
+               pConfigIfInstance->configIf.releaseReference = ReleaseReference;
+               pConfigIfInstance->configIf.getEntryValue = GetEntryValue;
+
+               // Save the ConfigFolder and ConfigName information within the instance data
+               pConfigIfInstance->pConfigFolder = malloc(configFolderLen + 1);
+               if (pConfigIfInstance->pConfigFolder)
+               {
+                  strcpy(pConfigIfInstance->pConfigFolder, pConfigFolder);
+                  pConfigIfInstance->configFolderLen = configFolderLen;
+
+                  pConfigIfInstance->pConfigName = malloc(configNameLen + 1);
+                  if (pConfigIfInstance->pConfigName)
+                  {
+                     strcpy(pConfigIfInstance->pConfigName, pConfigName);
+                     pConfigIfInstance->configNameLen = configNameLen;
+
+                     // Add the instance data into our list and bump up its reference count
+                     // since we did that.
+                     InsertTailList(&g_configIfListHead, &pConfigIfInstance->listEntry);
+                     pConfigIfInstance->refCount = 1;
+
+                     // At this point we want to return success to the caller even if we
+                     // experience a read error.
+                     retStatus = CASA_STATUS_SUCCESS;
+
+                     // Return the ConfigIf associated with the instance data after
+                     // incrementing its reference count.
+                     pConfigIfInstance->refCount ++;
+                     *ppConfigIf = &pConfigIfInstance->configIf;
+
+                     // Now update the instance data with the information present in the file
+                     if (fseek(pConfigFile, 0, SEEK_SET) == 0)
+                     {
+                        char  line[512];
+
+                        while (fgets(line, sizeof(line), pConfigFile) != NULL)
+                        {
+                           int   lineLength;
+
+                           RemoveWhiteSpaceFromTheEnd(line);
+
+                           lineLength = strlen(line);
+                           if (lineLength != 0)
+                           {
+                              char        *pKey;
+                              char        *pKeyEnd;
+                              char        *pValue;
+                              ConfigKey   *pConfigKey;
+
+                              // Attempt to find the key
+                              pKey = SkipWhiteSpace(line);
+
+                              // Make sure that we are not dealing with an empty line or a comment
+                              if (*pKey == '\0' || *pKey == '#')
+                                 continue;
+
+                              // Go past the key
+                              pKeyEnd = SkipNonWhiteSpace(pKey);
+
+                              // Protect against a malformed line
+                              if (*pKeyEnd == '\0')
+                              {
+                                 DbgTrace(0, "-GetConfigInterface- Key found without value\n", 0);
+                                 continue;
+                              }
+
+                              // Attempt to find the value
+                              pValue = SkipWhiteSpace(pKeyEnd);
+
+                              // Protect against a malformed line
+                              if (*pValue == '\0')
+                              {
+                                 DbgTrace(0, "-GetConfigInterface- Key found without value\n", 0);
+                                 continue;
+                              }
+
+                              // Delineate the key
+                              *pKeyEnd = '\0';
+
+                              // Create a ConfigKey object for this key/value pair
+                              pConfigKey = malloc(sizeof(*pConfigKey));
+                              if (pConfigKey)
+                              {
+                                 pConfigKey->keyNameLen = strlen(pKey);
+                                 pConfigKey->pKeyName = malloc(pConfigKey->keyNameLen + 1);
+                                 if (pConfigKey->pKeyName)
+                                 {
+                                    // Save the key name in lower case
+                                    LowerCaseString(pConfigKey->pKeyName, pKey);
+
+                                    pConfigKey->valueLen = strlen(pValue);
+                                    pConfigKey->pValue = malloc(pConfigKey->valueLen + 1);
+                                    if (pConfigKey->pValue)
+                                    {
+                                       strcpy(pConfigKey->pValue, pValue);
+
+                                       // The entry is ready, now associate it with the instance data.
+                                       InsertTailList(&pConfigIfInstance->configKeyListHead, &pConfigKey->listEntry);
+                                    }
+                                    else
+                                    {
+                                       DbgTrace(0, "-GetConfigInterface- Buffer allocation failure\n", 0);
+                                       free(pConfigKey->pKeyName);
+                                       free(pConfigKey);
+                                    }
+                                 }
+                                 else
+                                 {
+                                    DbgTrace(0, "-GetConfigInterface- Buffer allocation failure\n", 0);
+                                    free(pConfigKey);
+                                 }
+                              }
+                              else
+                              {
+                                 DbgTrace(0, "-GetConfigInterface- Buffer allocation failure\n", 0);
+                              }
+                           }
+                        }
+                     }
+                     else
+                     {
+                        DbgTrace(0, "-GetConfigInterface- File seek error, errno = %d\n", errno);
+                     }
+                  }
+                  else
+                  {
+                     DbgTrace(0, "-GetConfigInterface- Buffer allocation failure\n", 0);
+
+                     // Free the buffers associated with the instance data
+                     free(pConfigIfInstance->pConfigFolder);
+                     free(pConfigIfInstance);
+                  }
+               }
+               else
+               {
+                  DbgTrace(0, "-GetConfigInterface- Buffer allocation failure\n", 0);
+
+                  // Free the buffer allocated for the instance data
+                  free(pConfigIfInstance);
+               }
+            }
+            else
+            {
+               DbgTrace(0, "-GetConfigInterface- Buffer allocation failure\n", 0);
+            }
+
+            // Close the file
+            fclose(pConfigFile);
+         }
+         else
+         {
+            DbgTrace(1, "-GetConfigInterface- Unable to open config file, errno = %d\n", errno);
+         }
+      }
+      else
+      {
+         DbgTrace(0, "-GetConfigInterface- Buffer allocation error\n", 0);
+      }
+   }
+
+   PlatReleaseMutex(g_configIfMutex);
+
+   DbgTrace(2, "-GetConfigInterface- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+CasaStatus
+ConfigIfInit(void)
+//
+// Arguments:  
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Initializes the configuration interface complex.
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus        retStatus;
+
+   DbgTrace(1, "-ConfigIfInit- Start\n", 0);
+
+   // Allocate mutex
+   if ((g_configIfMutex = PlatAllocMutex()) != NULL)
+      retStatus = CASA_STATUS_SUCCESS;
+   else
+      retStatus = CasaStatusBuild(CASA_SEVERITY_INFORMATIONAL,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INSUFFICIENT_RESOURCES);
+
+   DbgTrace(1, "-ConfigIfInit- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+void
+ConfigIfUninit(void)
+//
+// Arguments:  
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Uninitializes the configuration interface complex.
+//
+// L2
+//=======================================================================--
+{
+   DbgTrace(1, "-ConfigIfUninit- Start\n", 0);
+
+   // Free mutex if necessary
+   if (g_configIfMutex)
+   {
+      PlatDestroyMutex(g_configIfMutex);
+      g_configIfMutex = NULL;
+   }
+
+   DbgTrace(1, "-ConfigIfUninit- End\n", 0);
+}
+
+
+//++=======================================================================
+//++=======================================================================
+//++=======================================================================
+

auth_token/server/AuthTokenValidate/config_if.h

@@ -0,0 +1,120 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+
+#ifndef _CONFIG_IF_H_
+#define _CONFIG_IF_H_
+
+
+//===[ Include files ]=====================================================
+
+//===[ Type definitions ]==================================================
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+/**************************************************************************
+***************************************************************************
+**                                                                       **
+**    Configuration Object Interface Definitions                         **
+**                                                                       **
+***************************************************************************
+**************************************************************************/
+
+
+//++=======================================================================
+typedef
+int       
+(SSCS_CALL *PFNConfiglIf_AddReference)(
+   IN       const void  *pIfInstance);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Interface reference count.
+//                           
+// Description:
+//    Increases interface reference count.
+//=======================================================================--
+
+
+//++=======================================================================
+typedef
+void       
+(SSCS_CALL *PFNConfiglIf_ReleaseReference)(
+   IN       const void  *pIfInstance);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Nothing.
+//                           
+// Description:
+//    Decreases interface reference count. The interface is deallocated if
+//    the reference count becomes zero.
+//=======================================================================--
+
+
+//++=======================================================================
+typedef
+char*
+(SSCS_CALL *PFNConfiglIf_GetEntryValue)(
+   IN       const void  *pIfInstance,
+   IN       const char  *pKeyName);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pKeyName -
+//       Pointer to NULL terminated string that contains the
+//       name of the key whose value is being requested.
+//               
+// Returns:
+//    Pointer to NULL terminated string with value being requested or NULL.
+//                           
+// Description:
+//    Gets value associated with a key for the configuration object.
+//=======================================================================--
+
+
+//
+// Config Interface Object
+// 
+typedef struct _ConfigIf
+{
+   PFNConfiglIf_AddReference     addReference;
+   PFNConfiglIf_ReleaseReference releaseReference;
+   PFNConfiglIf_GetEntryValue    getEntryValue;
+
+} ConfigIf, *PConfigIf;
+
+
+#endif // #ifndef _CONFIG_IF_H_
+

auth_token/server/AuthTokenValidate/idenTokenProviders/Makefile.am

@@ -0,0 +1,37 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+SUBDIRS = casa
+
+DIST_SUBDIRS = casa
+
+CFILES =
+
+EXTRA_DIST = $(CFILES) *.h
+
+.PHONY: package package-clean package-install package-uninstall
+package package-clean package-install package-uninstall:
+	$(MAKE) -C $(TARGET_OS) $@
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/Makefile.am

@@ -0,0 +1,37 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+SUBDIRS = $(TARGET_OS)
+
+DIST_SUBDIRS = linux
+
+CFILES =
+
+EXTRA_DIST = $(CFILES) *.h
+
+.PHONY: package package-clean package-install package-uninstall
+package package-clean package-install package-uninstall:
+	$(MAKE) -C $(TARGET_OS) $@
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/README

@@ -0,0 +1,39 @@
+/***********************************************************************
+ *
+ *  README for casa_identoken
+ *
+ ***********************************************************************/
+
+INTRODUCTION
+
+casa_identoken is the Identity Token Provider plug-in for tokens of type
+CasaIdentityToken. This are the default identity tokens utilized by CASA
+Authentication.
+
+CONFIGURATION
+
+The path to the casa_identoken plug-in is configured by placing the file
+CasaIdentityToken.conf in the /etc/opt/CASA/authtoken.d/modules.d folder.
+
+PROGRAMMING NOTES
+
+This module does not provide APIs to components outside of the CASA
+Authentication framework.
+
+SECURITY CONSIDERATIONS
+
+CasaIdentityTokens are embedded inside CASA Authentication Tokens. CasaIdentityTokens
+contain identity information which may be confidential and no attempts are made to
+ensure the confidentiality of the data. Because of this it is important that CASA
+Authentication Tokens be secured by applications making use of them. It is recommended
+that CASA authentication tokens be transmitted using SSL.
+ 
+
+
+
+                
+
+
+
+
+

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/TODO

@@ -0,0 +1,13 @@
+/***********************************************************************
+ *
+ *  TODO for casa_identoken
+ *
+ ***********************************************************************/
+
+INTRODUCTION
+
+This file contains a list of the items still outstanding for casa_identoken.
+
+OUTSTANDING ITEMS
+
+None.

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/identokenprovider.c

@@ -0,0 +1,346 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+//===[ Include files ]=====================================================
+
+#include "internal.h"
+
+//===[ Type definitions ]==================================================
+
+//
+// Identity Token Provider Interface instance data
+// 
+typedef struct _IdenTokenProviderIfInstance
+{
+   int                  refCount;
+   IdenTokenProviderIf  idenTokenProviderIf;
+
+} IdenTokenProviderIfInstance, *PIdenTokenProviderIfInstance;
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+// IdenTokenProviderIf variables
+static
+int   g_numIdenTokenProviderIfObjs = 0;
+
+// Debug Level
+int   DebugLevel = 0;
+
+//
+// Initialization variables
+//
+static
+bool  g_moduleInitialized = false;
+
+// Synchronization mutex
+static
+HANDLE   g_idenTokenProviderIfMutex = NULL;
+
+
+//++=======================================================================
+static
+int SSCS_CALL
+AddReference(
+   IN       const void  *pIfInstance)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Interface reference count.
+//                           
+// Description:
+//    Increases interface reference count.
+//
+// L2
+//=======================================================================--
+{
+   int                           refCount;
+   IdenTokenProviderIfInstance   *pIdenTokenProviderIfInstance = CONTAINING_RECORD(pIfInstance, IdenTokenProviderIfInstance, idenTokenProviderIf);
+
+   DbgTrace(2, "-AddReference- Start\n", 0);
+
+   // Increment the reference count on the object
+   PlatAcquireMutex(g_idenTokenProviderIfMutex);
+   pIdenTokenProviderIfInstance->refCount ++;
+   refCount = pIdenTokenProviderIfInstance->refCount;
+   PlatReleaseMutex(g_idenTokenProviderIfMutex);
+
+   DbgTrace(2, "-AddReference- End, refCount = %08X\n", refCount);
+
+   return refCount;
+}
+
+
+//++=======================================================================
+static
+void SSCS_CALL
+ReleaseReference(
+   IN       const void  *pIfInstance)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Nothing.
+//                           
+// Description:
+//    Decreases interface reference count. The interface is deallocated if
+//    the reference count becomes zero.
+//
+// L2
+//=======================================================================--
+{
+   bool                          freeObj = false;
+   IdenTokenProviderIfInstance   *pIdenTokenProviderIfInstance = CONTAINING_RECORD(pIfInstance, IdenTokenProviderIfInstance, idenTokenProviderIf);
+
+   DbgTrace(2, "-ReleaseReference- Start\n", 0);
+
+   // Decrement the reference count on the object and determine if it needs to
+   // be released.
+   PlatAcquireMutex(g_idenTokenProviderIfMutex);
+   pIdenTokenProviderIfInstance->refCount --;
+   if (pIdenTokenProviderIfInstance->refCount == 0)
+   {
+      // The object needs to be released, forget about it.
+      freeObj = true;
+      g_numIdenTokenProviderIfObjs --;
+   }
+   PlatReleaseMutex(g_idenTokenProviderIfMutex);
+
+   // Free object if necessary
+   if (freeObj)
+      free(pIdenTokenProviderIfInstance);
+
+   DbgTrace(2, "-ReleaseReference- End\n", 0);
+}
+
+
+//++=======================================================================
+static
+CasaStatus 
+GetIdentityTokenIf(
+   IN       const void        *pIfInstance,
+   IN       const char        *pTokenBuf,
+   IN       const int         tokenLen,
+   INOUT    IdenTokenIf       **ppIdenTokenIf)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pTokenBuf -
+//       Pointer to null terminated string containing an identity token.
+//
+//    tokenLen -
+//       Length of the token contained in the token buffer.
+//
+//    ppIdenTokenIf -
+//       Pointer to variable that will receive pointer to identity
+//       token interface.
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get identity token interface instance for the specified token.
+// 
+// L2
+//=======================================================================--
+{
+   CasaStatus  retStatus;
+   char        *pDecodedTokenBuf;
+   int         decodedTokenBufLen;
+
+   DbgTrace(2, "-GetIdentityTokenIf- Start\n", 0);
+
+   // Validate input parameters
+   if (pIfInstance == NULL
+       || pTokenBuf == NULL
+       || tokenLen == 0
+       || ppIdenTokenIf == NULL)
+   {
+      DbgTrace(0, "-GetIdentityTokenIf- Invalid input parameter\n", 0);
+
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INVALID_PARAMETER);
+      goto exit;
+   }
+
+   // First decode the token string
+   retStatus = DecodeData(pTokenBuf,
+                          tokenLen,
+                          (void**) &pDecodedTokenBuf,
+                          &decodedTokenBufLen);
+   if (CASA_SUCCESS(retStatus))
+   {
+      // Get the identity token interface
+      retStatus = GetIdenTokenInterface(pDecodedTokenBuf,
+                                        decodedTokenBufLen,
+                                        ppIdenTokenIf);
+
+      // Free the decoded token buffer
+      free(pDecodedTokenBuf);
+   }
+   else
+   {
+      DbgTrace(0, "-GetIdentityTokenIf- Token decode failure\n", 0);
+   }
+
+exit:
+
+   DbgTrace(2, "-GetIdentityTokenIf- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+CasaStatus SSCS_CALL
+GET_IDEN_TOKEN_PROVIDER_INTERFACE_RTN(
+   IN       const ConfigIf    *pModuleConfigIf,
+   INOUT    IdenTokenProviderIf  **ppIdenTokenProviderIf)
+//
+// Arguments:  
+//    pModuleConfigIf -
+//       Pointer to configuration interface instance for the module.
+//               
+//    ppIdenTokenProviderIf -
+//       Pointer to variable that will receive pointer to
+//       IdentityTokenProviderIf instance.
+//
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Gets identity token provider interface instance.
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus                    retStatus;
+   IdenTokenProviderIfInstance   *pIdenTokenProviderIfInstance;
+
+   DbgTrace(1, "-GetIdenTokenProviderInterface- Start\n", 0);
+
+   // Validate input parameters
+   if (pModuleConfigIf == NULL
+       || ppIdenTokenProviderIf == NULL)
+   {
+      DbgTrace(0, "-GetIdenTokenProviderInterface- Invalid input parameter\n", 0);
+
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_KRB5TOKEN,
+                                  CASA_STATUS_INVALID_PARAMETER);
+      goto exit;
+   }
+
+    // Make sure that the module has been initialized
+   if (g_moduleInitialized == false)
+   {
+      // The module has not been initialized, synchronize access thought this section
+      // to avoid having two threads performing initialization.
+      AcquireModuleMutex;
+
+      // Assume success
+      retStatus = CASA_STATUS_SUCCESS;
+
+      // Check again in case another thread pre-empted us.
+      if (g_moduleInitialized == false)
+      {
+         // Initialize the IdenTokenIf complex
+         retStatus = IdenTokenIfInit();
+         if (CASA_SUCCESS(retStatus))
+         {
+            // Allocate mutex
+            if ((g_idenTokenProviderIfMutex = PlatAllocMutex()) != NULL)
+            {
+               // Success
+               g_moduleInitialized = true;
+            }
+            else
+            {
+               IdenTokenIfUninit();
+               retStatus = CasaStatusBuild(CASA_SEVERITY_INFORMATIONAL,
+                                           CASA_FACILITY_AUTHTOKEN,
+                                           CASA_STATUS_INSUFFICIENT_RESOURCES);
+            }
+         }
+      }
+
+      // Stop synchronization
+      ReleaseModuleMutex;
+
+      // Exit if we failed
+      if (g_moduleInitialized == false)
+         goto exit;
+   }
+
+   // Allocate space for the interface instance
+   pIdenTokenProviderIfInstance = malloc(sizeof(*pIdenTokenProviderIfInstance));
+   if (pIdenTokenProviderIfInstance)
+   {
+      // Initialize the interface instance data
+      pIdenTokenProviderIfInstance->refCount = 1;
+      pIdenTokenProviderIfInstance->idenTokenProviderIf.addReference = AddReference;
+      pIdenTokenProviderIfInstance->idenTokenProviderIf.releaseReference = ReleaseReference;
+      pIdenTokenProviderIfInstance->idenTokenProviderIf.getIdentityTokenIf = GetIdentityTokenIf;
+
+      // Keep track of this object
+      PlatAcquireMutex(g_idenTokenProviderIfMutex);
+      g_numIdenTokenProviderIfObjs ++;
+      PlatReleaseMutex(g_idenTokenProviderIfMutex);
+
+      // Return the interface to the caller
+      *ppIdenTokenProviderIf = &pIdenTokenProviderIfInstance->idenTokenProviderIf;
+
+      // Success
+      retStatus = CASA_STATUS_SUCCESS;
+   }
+   else
+   {
+      DbgTrace(0, "-GetIdenTokenProviderInterface- Buffer allocation failure\n", 0);
+
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_KRB5TOKEN,
+                                  CASA_STATUS_INSUFFICIENT_RESOURCES);
+   }
+
+exit:
+
+   DbgTrace(1, "-GetIdenTokenProviderInterface- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+//++=======================================================================
+//++=======================================================================
+

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/internal.h

@@ -0,0 +1,122 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+#ifndef _INTERNAL_H_
+#define _INTERNAL_H_
+
+//===[ Include files ]=====================================================
+
+#include "platform.h"
+#include <expat.h>
+#include <micasa_types.h>
+#include <casa_status.h>
+#include <casa_s_authtoken.h>
+#include "config_if.h"
+#include "iden_token_provider_if.h"
+#include "list_entry.h"
+
+//===[ Type definitions ]==================================================
+
+//===[ Inlines functions   ]===============================================
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+//===[ Global externals ]==================================================
+
+extern int  DebugLevel;
+
+//===[ External prototypes ]===============================================
+
+//
+// Defined in identoken.c
+//
+
+extern
+CasaStatus
+GetIdenTokenInterface(
+   IN       const char   *pTokenBuf,
+   IN       const int    tokenLen,
+   INOUT    IdenTokenIf  **ppIdenTokenIf);
+
+extern
+CasaStatus
+IdenTokenIfInit(void);
+
+extern
+void
+IdenTokenIfUninit(void);
+
+//
+// Defined in utils.c
+//
+
+extern
+CasaStatus
+EncodeData(
+   IN    const void *pData,
+   IN    const int32_t dataLen,
+   INOUT char **ppEncodedData,
+   INOUT int32_t *pEncodedDataLen);
+
+extern
+CasaStatus
+DecodeData(
+   IN    const char *pEncodedData,
+   IN    const int32_t encodedDataLen, // Does not include NULL terminator
+   INOUT void **ppData,
+   INOUT int32_t *pDataLen);
+
+extern
+int
+dtoul(
+   IN    char *cp,
+   IN    int len);
+
+//
+// Functions exported by platform.c
+// 
+
+extern
+HANDLE
+PlatAllocMutex(void);
+
+extern
+void
+PlatDestroyMutex(HANDLE hMutex);
+
+extern
+void
+PlatAcquireMutex(HANDLE hMutex);
+
+extern
+void
+PlatReleaseMutex(HANDLE hMutex);
+
+
+//=========================================================================
+
+#endif // _INTERNAL_H_
+

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/linux/CasaIdentityToken.conf

@@ -0,0 +1,15 @@
+#######################################################
+#                                                     #
+# CASA Authentication Token System configuration file #
+# for module:                                         #
+#                                                     #
+#     CasaIdentityToken                               #
+#                                                     # 
+# Note: This module is the provider of Casa Identity  #
+#       tokens.                                       #
+#                                                     #
+#######################################################
+
+LibraryName		/opt/novell/CASA/lib/casa_iden_token.so
+
+

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/linux/Makefile.am

@@ -0,0 +1,112 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+if DEBUG
+TARGET_CFG = Debug
+CFLAGS += -v -w
+else
+TARGET_CFG = Release
+endif
+
+SUBDIRS =
+
+DIST_SUBDIRS =
+
+CASAROOT = ../../../../../..
+
+CASALIBDIR = $(CASAROOT)/$(LIB)
+
+# handle Mono secondary dependencies
+export MONO_PATH := $(MONO_PATH)
+
+PLATFORMINDEPENDENTSOURCEDIR = ..
+PLATFORMDEPENDENTSOURCEDIR = .
+
+MODULE_NAME = casa_iden_token
+MODULE_EXT = so
+
+CFILES = $(srcdir)/identokenprovider.c \
+	 $(srcdir)/identoken.c \
+	 $(srcdir)/util.c \
+	 $(srcdir)/platform.c
+
+CSFILES_CSC :=
+INCLUDES = -I. -I.. -I../../.. -I$(CASAROOT)/include -I../../../../../include
+RESOURCES =
+DEFINES = -Wno-format-extra-args -fno-strict-aliasing 
+CFLAGS += $(INCLUDES) $(DEFINES)
+LIBS = -lpthread -ldl -lexpat
+LDFLAGS = -Bsymbolic -shared -Wl,-soname=$(MODULE_NAME).$(MODULE_EXT)
+
+OBJDIR = ./$(TARGET_CFG)/$(LIB)
+OBJS = $(addprefix $(OBJDIR)/, $(CFILES:%.c=%.o))
+
+EXTRA_DIST = $(CFILES) *.h
+
+CUR_DIR := $(shell pwd)
+
+all: $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+
+#
+# Pattern based rules.
+#
+vpath %.c $(PLATFORMDEPENDENTSOURCEDIR) $(PLATFORMINDEPENDENTSOURCEDIR)
+vpath %.cpp $(PLATFORMDEPENDENTSOURCEDIR) $(PLATFORMINDEPENDENTSOURCEDIR)
+
+$(OBJDIR)/%.o: %.c
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+$(OBJDIR)/%.o: %.cpp
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+$(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT): $(OBJDIR) $(OBJS)
+	@echo [======== Linking $@ ========]
+	$(LINK) -o $@ $(LDFLAGS) $(OBJS) $(LIBS)
+	cp -f $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT) $(CASALIBDIR)/$(TARGET_CFG)/$(MODULE_NAME).$(MODULE_EXT)
+
+$(OBJDIR):
+	[ -d $(OBJDIR) ] || mkdir -p $(OBJDIR)
+	[ -d $(CASALIBDIR) ] || mkdir -p $(CASALIBDIR)
+	[ -d $(CASALIBDIR)/$(TARGET_CFG) ] || mkdir -p $(CASALIBDIR)/$(TARGET_CFG)
+
+
+install-exec-local: $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+	$(mkinstalldirs) $(DESTDIR)$(libdir)
+	$(INSTALL_PROGRAM) $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT) $(DESTDIR)$(libdir)/
+
+uninstall-local:
+	cd $(DESTDIR)$(libdir); rm -f $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+	rmdir $(DESTDIR)$(libdir)
+
+#installcheck-local: install
+#	$(mkinstalldirs) $(DESTDIR)$(libdir)
+#	$(INSTALL_PROGRAM) $(DESTDIR)$(libdir)
+#	cd $(DESTDIR)$(libdir); $(MONO)
+
+clean-local:
+	if [ -d $(TARGET_CFG) ]; then  rm -rf $(TARGET_CFG); fi
+
+distclean-local:
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/linux/platform.c

@@ -0,0 +1,178 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+//===[ Include files ]=====================================================
+
+#include "internal.h"
+
+//===[ Type definitions ]==================================================
+
+//
+// Platform Mutex structure
+//
+typedef struct _PlatformMutex
+{
+   pthread_mutex_t   mutex;
+
+} PlatformMutex, *PPlatformMutex;
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+//
+// Module synchronization mutex
+// 
+pthread_mutex_t   g_hModuleMutex = PTHREAD_MUTEX_INITIALIZER;
+
+
+//++=======================================================================
+HANDLE
+PlatAllocMutex(void)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+// L2
+//=======================================================================--
+{
+   PlatformMutex        *pPlatMutex;
+   pthread_mutexattr_t  mutexAttr = {PTHREAD_MUTEX_RECURSIVE};
+
+   DbgTrace(2, "-PlatAllocMutex- Start\n", 0);
+
+   // Allocate space for our mutex structure
+   pPlatMutex = malloc(sizeof(*pPlatMutex));
+   if (pPlatMutex)
+   {
+      // Finish initializing the mutex
+      pthread_mutex_init(&pPlatMutex->mutex, &mutexAttr);
+   }
+   else
+   {
+      DbgTrace(0, "-PlatAllocMutex- Memory allocation failure\n", 0);
+   }
+
+   DbgTrace(2, "-PlatAllocMutex- End, retHandle = %08X\n", (unsigned int) pPlatMutex);
+
+   return (HANDLE) pPlatMutex;
+}
+
+
+//++=======================================================================
+void
+PlatDestroyMutex(HANDLE hMutex)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+// L2
+//=======================================================================--
+{
+   PlatformMutex  *pPlatMutex = (PlatformMutex*) hMutex;
+
+   DbgTrace(2, "-PlatDestroyMutex- Start\n", 0);
+
+   // Free the resources associated with the mutex
+   pthread_mutex_destroy(&pPlatMutex->mutex);
+   free(pPlatMutex);
+
+   DbgTrace(2, "-PlatDestroyMutex- End\n", 0);
+}
+
+
+//++=======================================================================
+void
+PlatAcquireMutex(HANDLE hMutex)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+// L2
+//=======================================================================--
+{
+   PlatformMutex  *pPlatMutex = (PlatformMutex*) hMutex;
+
+   DbgTrace(2, "-PlatAcquireMutex- Start\n", 0);
+
+   // Acquire the mutex
+   pthread_mutex_lock(&pPlatMutex->mutex);
+
+   DbgTrace(2, "-PlatAcquireMutex- End\n", 0);
+}
+
+
+//++=======================================================================
+void
+PlatReleaseMutex(HANDLE hMutex)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+// L2
+//=======================================================================--
+{
+   PlatformMutex  *pPlatMutex = (PlatformMutex*) hMutex;
+
+   DbgTrace(2, "-PlatReleaseMutex- Start\n", 0);
+
+   // Release the mutex
+   pthread_mutex_unlock(&pPlatMutex->mutex);
+
+   DbgTrace(2, "-PlatRelease- End\n", 0);
+}
+
+
+//++=======================================================================
+//++=======================================================================
+//++=======================================================================
+

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/linux/platform.h

@@ -0,0 +1,93 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+#define _GNU_SOURCE
+
+//===[ Include files ]=====================================================
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <string.h>
+#include <syslog.h>
+#include <pthread.h>
+#include <string.h>
+#include <ctype.h>
+#include <errno.h>
+#include <dlfcn.h>
+
+//===[ Type definitions ]==================================================
+
+#define HANDLE void*
+
+#ifndef CONTAINING_RECORD
+#define CONTAINING_RECORD(address, type, field) ((type *)(     \
+             (char*)(address) -                                \
+             (char*)(&((type *)0)->field)))
+#endif
+
+//
+// DbgTrace macro define
+//
+#define DbgTrace(LEVEL, X, Y) {                          \
+char printBuff[256];                                     \
+   if (LEVEL == 0 || DebugLevel >= LEVEL)                \
+   {                                                     \
+      _snprintf(printBuff, sizeof(printBuff), X, Y);     \
+      fprintf(stderr, "CASA_IdenToken %s", printBuff);    \
+   }                                                     \
+}
+/*#define DbgTrace(LEVEL, X, Y) {                                                  \
+   if (LEVEL == 0 || DebugLevel >= LEVEL)                                        \
+   {                                                                             \
+      openlog("CASA_IdenToken", LOG_CONS | LOG_NOWAIT | LOG_ODELAY, LOG_USER);   \
+      syslog(LOG_USER | LOG_INFO, X, Y);                                         \
+      closelog();                                                                \
+   }                                                                             \
+}*/
+
+
+// Deal with function name mapping issues
+#define _snprintf snprintf
+
+
+//
+// Module synchronization
+// 
+extern pthread_mutex_t  g_hModuleMutex;
+
+#define AcquireModuleMutex    pthread_mutex_lock(&g_hModuleMutex)
+#define ReleaseModuleMutex    pthread_mutex_unlock(&g_hModuleMutex)
+
+
+//===[ Inlines functions   ]===============================================
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global externals ]==================================================
+
+//===[ External prototypes ]===============================================
+
+//=========================================================================
+

auth_token/server/AuthTokenValidate/idenTokenProviders/casa/util.c

@@ -0,0 +1,321 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+//===[ Include files ]=====================================================
+
+#include "internal.h"
+
+//===[ Type definitions ]==================================================
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+// Tables for Base64 encoding and decoding
+static const int8_t  g_Base64[] =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static const uint8_t g_Expand64[256] =
+{
+    /* ASCII table */
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 62, 64, 64, 64, 63,
+    52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 64, 64, 64, 64, 64, 64,
+    64,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
+    15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 64, 64, 64, 64, 64,
+    64, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
+    41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64
+};
+
+
+//++=======================================================================
+CasaStatus
+EncodeData(
+   IN    const void *pData,
+   IN    const int32_t dataLen,
+   INOUT char **ppEncodedData,
+   INOUT int32_t *pEncodedDataLen)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Description:  
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus  retStatus;
+   int         encodedSize;
+
+   char        *pTmp;
+
+   DbgTrace(3, "-EncodeData- Start\n", 0);
+
+   // Determine the encoded size and allocate a buffer to hold the encoded data
+   encodedSize = ((dataLen * 4 + 2) / 3) - (dataLen % 3 ) + 4;
+   pTmp = (char*) malloc(encodedSize);
+   *ppEncodedData = pTmp;
+   if (*ppEncodedData)
+   {
+      uint8_t  *pOut, *pIn;
+      int      i;
+
+      // Setup pointers to move through the buffers
+      pIn = (uint8_t*) pData;
+      pOut = (uint8_t*) *ppEncodedData;
+
+      // Perform the encoding
+      for (i = 0; i < dataLen - 2; i += 3)
+      {
+          *pOut++ = g_Base64[(pIn[i] >> 2) & 0x3F];
+          *pOut++ = g_Base64[((pIn[i] & 0x3) << 4) |
+                          ((int32_t)(pIn[i + 1] & 0xF0) >> 4)];
+          *pOut++ = g_Base64[((pIn[i + 1] & 0xF) << 2) |
+                          ((int32_t)(pIn[i + 2] & 0xC0) >> 6)];
+          *pOut++ = g_Base64[pIn[i + 2] & 0x3F];
+      }
+      if (i < dataLen)
+      {
+          *pOut++ = g_Base64[(pIn[i] >> 2) & 0x3F];
+          if (i == (dataLen - 1))
+          {
+              *pOut++ = g_Base64[((pIn[i] & 0x3) << 4)];
+              *pOut++ = '=';
+          }
+          else
+          {
+              *pOut++ = g_Base64[((pIn[i] & 0x3) << 4) |
+                              ((int32_t)(pIn[i + 1] & 0xF0) >> 4)];
+              *pOut++ = g_Base64[((pIn[i + 1] & 0xF) << 2)];
+          }
+          *pOut++ = '=';
+      }
+      *pOut++ = '\0';
+
+      // Return the encoded data length
+      *pEncodedDataLen = (int32_t)(pOut - (uint8_t*)*ppEncodedData); 
+
+      // Success
+      retStatus = CASA_STATUS_SUCCESS;
+   }
+   else
+   {
+      DbgTrace(0, "-EncodeData- Buffer allocation failure\n", 0);
+
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INSUFFICIENT_RESOURCES);
+   }
+
+   DbgTrace(3, "-EncodeData- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+CasaStatus
+DecodeData(
+   IN    const char *pEncodedData,
+   IN    const int32_t encodedDataLen, // Does not include NULL terminator
+   INOUT void **ppData,
+   INOUT int32_t *pDataLen)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Description:  
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus  retStatus;
+   int         i, j;
+   int         decodedSize;
+
+   DbgTrace(3, "-DecodeData- Start\n", 0);
+
+   // Determine the decoded size
+   for (i = 0, j = 0; i < encodedDataLen; i++)
+       if (g_Expand64[((uint8_t*) pEncodedData)[i]] < 64)
+           j++;
+   decodedSize = (j * 3 + 3) / 4;
+
+   // Allocate buffer to hold the decoded data
+   *ppData = malloc(decodedSize);
+   if (*ppData)
+   {
+      bool  endReached = false;
+      uint8_t  c0, c1, c2, c3;
+      uint8_t  *p, *q;
+
+      // Initialize parameters that will be used during the decode operation
+      c0 = c1 = c2 = c3 = 0;
+      p = (uint8_t*) pEncodedData;
+      q = (uint8_t*) *ppData;
+
+      // Decode the data
+      //
+      // Loop through the data, piecing back information. Any newlines, and/or
+      // carriage returns need to be skipped.
+      while (j > 4)
+      {
+          while ((64 == g_Expand64[*p]) && (('\n' == *p) || ('\r' == *p)))
+              p++;
+          if (64 == g_Expand64[*p])
+          {
+              endReached = true;
+              break;
+          }
+          c0 = *(p++);
+
+          while ((64 == g_Expand64[*p]) && (('\n' == *p) || ('\r' == *p)))
+              p++;
+          if (64 == g_Expand64[*p])
+          {
+              *(q++) = (uint8_t)(g_Expand64[c0] << 2);
+              j--;
+              endReached = true;
+              break;
+          }
+          c1 = *(p++);
+
+          while ((64 == g_Expand64[*p]) && (('\n' == *p) || ('\r' == *p)))
+              p++;
+          if (64 == g_Expand64[*p])
+          {
+              *(q++) = (uint8_t)(g_Expand64[c0] << 2 | g_Expand64[c1] >> 4);
+              *(q++) = (uint8_t)(g_Expand64[c1] << 4);
+              j -= 2;
+              endReached = true;
+              break;
+          }
+          c2 = *(p++);
+
+          while ((64 == g_Expand64[*p]) && (('\n' == *p) || ('\r' == *p)))
+              p++;
+          if (64 == g_Expand64[*p])
+          {
+              *(q++) = (uint8_t)(g_Expand64[c0] << 2 | g_Expand64[c1] >> 4);
+              *(q++) = (uint8_t)(g_Expand64[c1] << 4 | g_Expand64[c2] >> 2);
+              *(q++) = (uint8_t)(g_Expand64[c2] << 6);
+              j -= 3;
+              endReached = true;
+              break;
+          }
+          c3 = *(p++);
+
+          *(q++) = (uint8_t)(g_Expand64[c0] << 2 | g_Expand64[c1] >> 4);
+          *(q++) = (uint8_t)(g_Expand64[c1] << 4 | g_Expand64[c2] >> 2);
+          *(q++) = (uint8_t)(g_Expand64[c2] << 6 | g_Expand64[c3]);
+          j -= 4;
+      }
+      if (!endReached)
+      {
+          if (j > 1)
+              *(q++) = (uint8_t)(g_Expand64[*p] << 2 | g_Expand64[p[1]] >> 4);
+          if (j > 2)
+              *(q++) = (uint8_t)(g_Expand64[p[1]] << 4 | g_Expand64[p[2]] >> 2);
+          if (j > 3)
+              *(q++) = (uint8_t)(g_Expand64[p[2]] << 6 | g_Expand64[p[3]]);
+      }
+
+      // Return the length of the decoded data
+      *pDataLen = (int32_t)(q - (uint8_t*)*ppData);
+
+      // Success
+      retStatus = CASA_STATUS_SUCCESS;
+   }
+   else
+   {
+      DbgTrace(0, "-DecodeData- Buffer allocation failure\n", 0);
+
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INSUFFICIENT_RESOURCES);
+   }
+
+   DbgTrace(3, "-DecodeData- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+int
+dtoul(
+   IN    char *cp,
+   IN    int len)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L0
+//=======================================================================--
+{
+   int   n = 0;
+   int   i;
+
+   DbgTrace(2, "-dtoul- Start\n", 0);
+
+   for (i = 0; i < len; i++, cp++)
+   {
+      // Verify that we are dealing with a valid digit
+      if (*cp >= '0' && *cp <= '9')
+      {
+         n = 10 * n + (*cp - '0');
+      }
+      else
+      {
+         DbgTrace(0, "-dtoul- Found invalid digit\n", 0);
+         break;
+      }
+   }
+      
+   DbgTrace(2, "-dtoul- End, result = %d\n", n);
+
+   return n;
+}
+
+
+//++=======================================================================
+//++=======================================================================
+//++=======================================================================
+

auth_token/server/AuthTokenValidate/iden_token_provider_if.h

@@ -0,0 +1,356 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+#ifndef _IDEN_TOKEN_PROVIDER_IF_H_
+#define _IDEN_TOKEN_PROVIDER_IF_H_
+
+
+//===[ Include files ]=====================================================
+
+#include "config_if.h"
+
+//===[ Type definitions ]==================================================
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+
+/**************************************************************************
+***************************************************************************
+**                                                                       **
+**    Identity Token Interface Definitions                               **
+**                                                                       **
+***************************************************************************
+**************************************************************************/
+
+
+//++=======================================================================
+typedef
+int       
+(SSCS_CALL *PFNIdenTokenIf_AddReference)(
+   IN       const void  *pIfInstance);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Interface reference count.
+//                           
+// Description:
+//    Increases interface reference count.
+//=======================================================================--
+
+
+//++=======================================================================
+typedef
+void       
+(SSCS_CALL *PFNIdenTokenIf_ReleaseReference)(
+   IN       const void  *pIfInstance);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Nothing.
+//                           
+// Description:
+//    Decreases interface reference count. The interface is deallocated if
+//    the reference count becomes zero.
+//=======================================================================--
+
+
+//++=======================================================================
+typedef
+CasaStatus 
+(SSCS_CALL *PFNIdenTokenIf_GetIdentityId)(
+   IN       const void  *pIfInstance,
+   INOUT    char        *pIdentIdBuf,
+   INOUT    int         *pIdentIdLen);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pIdentIdBuf -
+//       Pointer to buffer that will receive the identity id. The returned
+//       id will be in the form of a NULL terminated string.
+//
+//    pIdentIdBufLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pIdentIdBuf. On exit it contains the length of the returned id
+//       (including the NULL terminator).
+//
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get the identity id associated with the identity token.
+//=======================================================================--
+
+
+//++=======================================================================
+typedef
+CasaStatus 
+(SSCS_CALL *PFNIdenTokenIf_GetSourceName)(
+   IN       const void  *pIfInstance,
+   INOUT    char        *pSourceNameBuf,
+   INOUT    int         *pSourceNameLen);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pSourceNameBuf -
+//       Pointer to buffer that will receive the name associated with the
+//       identity information source. The returned name will be in the form
+//       of a NULL terminated string.
+//
+//    pSourceNameBufLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pSourceNameBuf. On exit it contains the length of the returned
+//       name (including the NULL terminator).
+//
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get the name of the identity source associated with the identity token.
+//=======================================================================--
+
+
+//++=======================================================================
+typedef
+CasaStatus 
+(SSCS_CALL *PFNIdenTokenIf_GetSourceUrl)(
+   IN       const void  *pIfInstance,
+   INOUT    char        *pSourceUrlBuf,
+   INOUT    int         *pSourceUrlLen);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pSourceUrlBuf -
+//       Pointer to buffer that will receive the URL associated with the
+//       identity information source. The returned URL will be in the form
+//       of a NULL terminated string.
+//
+//    pSourceUrlBufLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pSourceUrlBuf. On exit it contains the length of the returned
+//       URL (including the NULL terminator).
+//
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get the URL to the identity source associated with the identity token.
+//=======================================================================--
+
+
+//++=======================================================================
+typedef
+CasaStatus 
+(SSCS_CALL *PFNIdenTokenIf_AttributeEnumerate)(
+   IN       const void  *pIfInstance,
+   INOUT    int         *pEnumHandle,       
+   INOUT    char        *pAttribNameBuf,
+   INOUT    int         *pAttribNameLen,
+   INOUT    char        *pAttribValueBuf,
+   INOUT    int         *pAttribValueLen);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pEnumHandle -
+//       Pointer to enumeration handle. Must be set to 0 to start an
+//       enumeration. Note the enumeration handle advances if the
+//       function returns success.
+//
+//    pAttribNameBuf -
+//       Pointer to buffer that will receive the identity attribute name. The
+//       returned name will be in the form of a NULL terminated string.
+//
+//    pAttribNameLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pAttribNameBuf. On exit it contains the length of the returned
+//       name (including the NULL terminator).
+//
+//    pAttribValueBuf -
+//       Pointer to buffer that will receive the identity attribute value. The
+//       returned value will be in the form of a NULL terminated string.
+//
+//    pAttribValueLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pAttribValueBuf. On exit it contains the length of the returned
+//       value (including the NULL terminator).
+//
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Enumerates through the attributes associated with the identity token.
+//=======================================================================--
+
+
+//
+// Identity Token Interface Object
+// 
+typedef struct _IdenTokenIf
+{
+   PFNIdenTokenIf_AddReference         addReference;
+   PFNIdenTokenIf_ReleaseReference     releaseReference;
+   PFNIdenTokenIf_GetIdentityId        getIdentityId;
+   PFNIdenTokenIf_GetSourceName        getSourceName;
+   PFNIdenTokenIf_GetSourceUrl         getSourceUrl;
+   PFNIdenTokenIf_AttributeEnumerate   attributeEnumerate;
+
+} IdenTokenIf, *PIdenTokenIf;
+
+
+/**************************************************************************
+***************************************************************************
+**                                                                       **
+**    Identity Token Provider Interface Definitions                      **
+**                                                                       **
+***************************************************************************
+**************************************************************************/
+
+
+//++=======================================================================
+typedef
+int       
+(SSCS_CALL *PFNIdenTokenProviderIf_AddReference)(
+   IN       const void  *pIfInstance);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Interface reference count.
+//                           
+// Description:
+//    Increases interface reference count.
+//=======================================================================--
+
+
+//++=======================================================================
+typedef
+void       
+(SSCS_CALL *PFNIdenTokenProviderIf_ReleaseReference)(
+   IN       const void  *pIfInstance);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Nothing.
+//                           
+// Description:
+//    Decreases interface reference count. The interface is deallocated if
+//    the reference count becomes zero.
+//=======================================================================--
+
+
+//++=======================================================================
+typedef
+CasaStatus 
+(SSCS_CALL *PFNIdenTokenProviderIf_GetIdentityTokenIf)(
+   IN       const void        *pIfInstance,
+   IN       const char        *pTokenBuf,
+   IN       const int         tokenLen,
+   INOUT    IdenTokenIf       **ppIdenTokenIf);
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pTokenBuf -
+//       Pointer to null terminated string containing an identity token.
+//
+//    tokenLen -
+//       Length of the token contained in the token buffer.
+//
+//    ppIdenTokenIf -
+//       Pointer to variable that will receive pointer to identity
+//       token interface.
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get identity token interface instance for the specified token.
+//=======================================================================--
+
+
+//
+// Identity Token Provider Interface Object
+// 
+typedef struct _IdenTokenProviderIf
+{
+   PFNIdenTokenProviderIf_AddReference          addReference;
+   PFNIdenTokenProviderIf_ReleaseReference      releaseReference;
+   PFNIdenTokenProviderIf_GetIdentityTokenIf    getIdentityTokenIf;
+
+} IdenTokenProviderIf, *PIdenTokenProviderIf;
+
+
+//++=======================================================================
+typedef
+CasaStatus
+(SSCS_CALL *PFN_GetIdenTokenProviderIfRtn)(
+   IN       const ConfigIf       *pModuleConfigIf,
+   INOUT    IdenTokenProviderIf  **ppIdenTokenProviderIf);
+//
+// Arguments:  
+//    pModuleConfigIf -
+//       Pointer to configuration interface instance for the module.
+//               
+//    ppIdenTokenProviderIf -
+//       Pointer to variable that will receive pointer to
+//       IdentityTokenProviderIf instance.
+//
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Gets identity token provider interface instance.
+//=======================================================================--
+
+#define GET_IDEN_TOKEN_PROVIDER_INTERFACE_RTN_SYMBOL  "GetIdenTokenProviderInterface"
+#define GET_IDEN_TOKEN_PROVIDER_INTERFACE_RTN         GetIdenTokenProviderInterface
+
+
+#endif // #ifndef _IDEN_TOKEN_PROVIDER_IF_H_
+

auth_token/server/AuthTokenValidate/internal.h

@@ -0,0 +1,196 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+#ifndef _INTERNAL_H_
+#define _INTERNAL_H_
+
+//===[ Include files ]=====================================================
+
+#include "platform.h"
+#include <expat.h>
+#include <micasa_types.h>
+#include <casa_status.h>
+#include <casa_s_authtoken.h>
+#include "proto.h"
+#include "list_entry.h"
+#include "config_if.h"
+#include "iden_token_provider_if.h"
+
+//===[ Type definitions ]==================================================
+
+//
+// Authentication Token structure
+//
+typedef struct _AuthToken
+{
+   int   tokenLifetime;
+   char  *pSignature;
+   int   signatureLen;
+   char  *pIdenTokenType;
+   int   idenTokenTypeLen;
+   char  *pIdenToken;
+   int   idenTokenLen;
+
+} AuthToken, *PAuthToken;
+
+
+//===[ Inlines functions   ]===============================================
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+//===[ Global externals ]==================================================
+
+extern int  DebugLevel;
+
+//===[ External prototypes ]===============================================
+
+//
+// Functions exported by config.c
+//
+extern
+CasaStatus
+GetConfigInterface(
+   IN       const char  *pConfigFolder,
+   IN       const char  *pConfigName,
+   INOUT    ConfigIf    **ppConfigIf);
+
+extern
+CasaStatus
+ConfigIfInit(void);
+
+extern
+void
+ConfigIfUninit(void);
+
+//
+// Functions exported by platform.c
+// 
+
+extern
+CasaStatus
+GetIdenTokenProviderInterface(
+   IN       const char           *pIdenTokenTypeName,
+   INOUT    IdenTokenProviderIf  **ppIdenTokenProviderIf);
+
+extern
+HANDLE
+PlatAllocMutex(void);
+
+extern
+void
+PlatDestroyMutex(HANDLE hMutex);
+
+extern
+void
+PlatAcquireMutex(HANDLE hMutex);
+
+extern
+void
+PlatReleaseMutex(HANDLE hMutex);
+
+//
+// Functions exported by principal.c
+// 
+
+extern
+CasaStatus
+GetPrincipalInterface(
+   IN       IdenTokenIf  *pIdenTokenIf,
+   INOUT    PrincipalIf  **ppPrincipalIf);
+
+extern
+CasaStatus
+PrincipalIfInit(void);
+
+extern
+void
+PrincipalIfUninit(void);
+
+//
+// Functions exported by validate.c
+// 
+
+extern
+CasaStatus SSCS_CALL
+ValidateAuthToken(
+   IN       const char  *pServiceName,
+   IN       const char  *pTokenBuf,
+   IN       const int   tokenBufLen,
+   INOUT    PrincipalIf **ppPrincipalIf);
+
+//
+// Functions exported by authtoken.c
+// 
+
+extern
+CasaStatus
+CreateAuthToken(
+   IN    char *pTokenBuf,
+   IN    int tokenBufLen,
+   INOUT AuthToken **ppAuthToken);
+
+extern
+void
+RelAuthToken(
+   IN    AuthToken *pAuthToken);
+
+extern
+CasaStatus
+CheckAuthToken(
+   IN    AuthToken *pAuthToken,
+   IN    const char *pServiceName);
+
+//
+// Defined in utils.c
+//
+
+extern
+CasaStatus
+EncodeData(
+   IN    const void *pData,
+   IN    const int32_t dataLen,
+   INOUT char **ppEncodedData,
+   INOUT int32_t *pEncodedDataLen);
+
+extern
+CasaStatus
+DecodeData(
+   IN    const char *pEncodedData,
+   IN    const int32_t encodedDataLen, // Does not include NULL terminator
+   INOUT void **ppData,
+   INOUT int32_t *pDataLen);
+
+extern
+int
+dtoul(
+   IN    char *cp,
+   IN    int len);
+
+
+//=========================================================================
+
+#endif // _INTERNAL_H_
+

auth_token/server/AuthTokenValidate/linux/Makefile.am

@@ -0,0 +1,114 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+if DEBUG
+TARGET_CFG = Debug
+CFLAGS += -v -w
+else
+TARGET_CFG = Release
+endif
+
+SUBDIRS =
+
+DIST_SUBDIRS =
+
+CASAROOT = ../../../../
+
+CASALIBDIR = $(CASAROOT)/$(LIB)
+
+# handle Mono secondary dependencies
+export MONO_PATH := $(MONO_PATH)
+
+PLATFORMINDEPENDENTSOURCEDIR = ..
+PLATFORMDEPENDENTSOURCEDIR = .
+
+MODULE_NAME = libcasa_s_authtoken
+MODULE_EXT = so
+
+CFILES = $(srcdir)/config.c \
+	 $(srcdir)/authtoken.c \
+	 $(srcdir)/principal.c \
+	 $(srcdir)/util.c \
+	 $(srcdir)/validate.c \
+	 $(srcdir)/platform.c
+
+CSFILES_CSC :=
+INCLUDES = -I. -I.. -I$(CASAROOT)/include -I../../../include
+RESOURCES =
+DEFINES = -Wno-format-extra-args -fno-strict-aliasing 
+CFLAGS += $(INCLUDES) $(DEFINES)
+LIBS = -lpthread -ldl -lexpat
+LDFLAGS = -Bsymbolic -shared -Wl,-soname=$(MODULE_NAME).$(MODULE_EXT)
+
+OBJDIR = ./$(TARGET_CFG)/$(LIB)
+OBJS = $(addprefix $(OBJDIR)/, $(CFILES:%.c=%.o))
+
+EXTRA_DIST = $(CFILES) *.h
+
+CUR_DIR := $(shell pwd)
+
+all: $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+
+#
+# Pattern based rules.
+#
+vpath %.c $(PLATFORMDEPENDENTSOURCEDIR) $(PLATFORMINDEPENDENTSOURCEDIR)
+vpath %.cpp $(PLATFORMDEPENDENTSOURCEDIR) $(PLATFORMINDEPENDENTSOURCEDIR)
+
+$(OBJDIR)/%.o: %.c
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+$(OBJDIR)/%.o: %.cpp
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+$(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT): $(OBJDIR) $(OBJS)
+	@echo [======== Linking $@ ========]
+	$(LINK) -o $@ $(LDFLAGS) $(OBJS) $(LIBS)
+	cp -f $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT) $(CASALIBDIR)/$(TARGET_CFG)/$(MODULE_NAME).$(MODULE_EXT)
+
+$(OBJDIR):
+	[ -d $(OBJDIR) ] || mkdir -p $(OBJDIR)
+	[ -d $(CASALIBDIR) ] || mkdir -p $(CASALIBDIR)
+	[ -d $(CASALIBDIR)/$(TARGET_CFG) ] || mkdir -p $(CASALIBDIR)/$(TARGET_CFG)
+
+
+install-exec-local: $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+	$(mkinstalldirs) $(DESTDIR)$(libdir)
+	$(INSTALL_PROGRAM) $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT) $(DESTDIR)$(libdir)/
+
+uninstall-local:
+	cd $(DESTDIR)$(libdir); rm -f $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+	rmdir $(DESTDIR)$(libdir)
+
+#installcheck-local: install
+#	$(mkinstalldirs) $(DESTDIR)$(libdir)
+#	$(INSTALL_PROGRAM) $(DESTDIR)$(libdir)
+#	cd $(DESTDIR)$(libdir); $(MONO)
+
+clean-local:
+	if [ -d $(TARGET_CFG) ]; then  rm -rf $(TARGET_CFG); fi
+
+distclean-local:
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/AuthTokenValidate/linux/platform.c

@@ -0,0 +1,397 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+//===[ Include files ]=====================================================
+
+#include "internal.h"
+
+//===[ Type definitions ]==================================================
+
+//
+// Identity Token Module definition
+// 
+typedef struct _IdenTokenProviderModule
+{
+   LIST_ENTRY           listEntry;
+   char                 *pTypeName;
+   int                  typeNameLen;
+   void                 *libHandle;
+   IdenTokenProviderIf  *pIdenTokenProviderIf;
+
+} IdenTokenProviderModule, *PIdenTokenProviderModule;
+
+//
+// Platform Mutex structure
+//
+typedef struct _PlatformMutex
+{
+   pthread_mutex_t   mutex;
+
+} PlatformMutex, *PPlatformMutex;
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+//
+// Module synchronization mutex
+// 
+pthread_mutex_t   g_hModuleMutex = PTHREAD_MUTEX_INITIALIZER;
+
+
+//
+// IdenTokenProviderModule list and syncronization mutex
+// 
+static
+LIST_ENTRY        g_IdenTokenProviderModuleListHead = {&g_IdenTokenProviderModuleListHead, &g_IdenTokenProviderModuleListHead};
+
+static
+pthread_mutex_t   g_IdenTokenProviderModuleMutex = PTHREAD_MUTEX_INITIALIZER;
+
+
+//++=======================================================================
+CasaStatus
+GetIdenTokenProviderInterface(
+   IN       const char           *pIdenTokenTypeName,
+   INOUT    IdenTokenProviderIf  **ppIdenTokenProviderIf)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus  retStatus;
+   ConfigIf    *pModuleConfigIf;
+
+   DbgTrace(2, "-GetIdenTokenProviderInterface- Start\n", 0);
+
+   // Get the configuration for the module
+   retStatus = GetConfigInterface("/etc/opt/novell/CASA/authtoken.d/modules.d",
+                                  pIdenTokenTypeName,
+                                  &pModuleConfigIf);
+   if (CASA_SUCCESS(retStatus)
+       && CasaStatusCode(retStatus) != CASA_STATUS_OBJECT_NOT_FOUND)
+   {
+      LIST_ENTRY              *pListEntry;
+      IdenTokenProviderModule *pIdenTokenProviderModule = NULL;
+      int32_t                 idenTokenTypeNameLen = strlen(pIdenTokenTypeName);
+
+      // Gain exclusive access to our mutex
+      pthread_mutex_lock(&g_IdenTokenProviderModuleMutex);
+
+      // Look if we already have the module in our list
+      pListEntry = g_IdenTokenProviderModuleListHead.Flink;
+      while (pListEntry != &g_IdenTokenProviderModuleListHead)
+      {
+         // Get pointer to the current entry
+         pIdenTokenProviderModule = CONTAINING_RECORD(pListEntry, IdenTokenProviderModule, listEntry);
+
+         // Check if this is the module that we need
+         if (pIdenTokenProviderModule->typeNameLen == idenTokenTypeNameLen
+             && memcmp(pIdenTokenTypeName, pIdenTokenProviderModule->pTypeName, idenTokenTypeNameLen) == 0)
+         {
+            // This is the module that we need, stop looking.
+            break;
+         }
+         else
+         {
+            // This is not the module that we are looking for
+            pIdenTokenProviderModule = NULL;
+         }
+
+         // Advance to the next entry
+         pListEntry = pListEntry->Flink;
+      }
+
+      // Proceed based on whether or not a module was found
+      if (pIdenTokenProviderModule)
+      {
+         // Module found in our list, provide the caller with its IdenTokenProviderIf
+         // instance after we have incremented its reference count.
+         pIdenTokenProviderModule->pIdenTokenProviderIf->addReference(pIdenTokenProviderModule->pIdenTokenProviderIf);
+         *ppIdenTokenProviderIf = pIdenTokenProviderModule->pIdenTokenProviderIf;
+
+         // Success
+         retStatus = CASA_STATUS_SUCCESS;
+      }
+      else
+      {
+         // Needed module not found in our list, create an entry.
+         pIdenTokenProviderModule = malloc(sizeof(*pIdenTokenProviderModule));
+         if (pIdenTokenProviderModule)
+         {
+            // Allocate buffer to contain the authentication type name within the module entry
+            pIdenTokenProviderModule->pTypeName = malloc(idenTokenTypeNameLen + 1);
+            if (pIdenTokenProviderModule->pTypeName)
+            {
+               char  *pLibraryName;
+
+               // Initialize the library handle field
+               pIdenTokenProviderModule->libHandle = NULL;
+
+               // Save the auth type name within the entry
+               strcpy(pIdenTokenProviderModule->pTypeName, pIdenTokenTypeName);
+               pIdenTokenProviderModule->typeNameLen = idenTokenTypeNameLen;
+
+               // Obtain the name of the library that we must load
+               pLibraryName = pModuleConfigIf->getEntryValue(pModuleConfigIf, "LibraryName");
+               if (pLibraryName)
+               {
+                  // Load the library
+                  pIdenTokenProviderModule->libHandle = dlopen(pLibraryName, RTLD_LAZY);
+                  if (pIdenTokenProviderModule->libHandle)
+                  {
+                     PFN_GetIdenTokenProviderIfRtn   pGetIdenTokenProviderIfRtn;
+
+                     // Library has been loaded, now get a pointer to its GetIdenTokenProviderProviderInterface routine
+                     pGetIdenTokenProviderIfRtn = dlsym(pIdenTokenProviderModule->libHandle, GET_IDEN_TOKEN_PROVIDER_INTERFACE_RTN_SYMBOL);
+                     if (pGetIdenTokenProviderIfRtn)
+                     {
+                        // Now, obtain the modules IdenTokenProviderIf.
+                        retStatus = (pGetIdenTokenProviderIfRtn)(pModuleConfigIf, &pIdenTokenProviderModule->pIdenTokenProviderIf);
+                     }
+                     else
+                     {
+                        DbgTrace(0, "-GetIdenTokenProviderInterface- dlsym error = %s\n", dlerror());
+                        retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                                    CASA_FACILITY_AUTHTOKEN,
+                                                    CASA_STATUS_LIBRARY_LOAD_FAILURE);
+                     }
+                  }
+                  else
+                  {
+                     DbgTrace(0, "-GetIdenTokenProviderInterface- dlopen error = %s\n", dlerror());
+                     retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                                 CASA_FACILITY_AUTHTOKEN,
+                                                 CASA_STATUS_LIBRARY_LOAD_FAILURE);
+                  }
+
+                  // Free the buffer holding the library name
+                  free(pLibraryName);
+               }
+               else
+               {
+                  DbgTrace(0, "-GetIdenTokenProviderInterface- Library name not configured\n", 0);
+                  retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                              CASA_FACILITY_AUTHTOKEN,
+                                              CASA_STATUS_CONFIGURATION_ERROR);
+               }
+
+               // Check if we were successful at obtaining the IdenTokenProviderIf instance for the
+               // module.
+               if (CASA_SUCCESS(retStatus))
+               {
+                  // Insert the entry in the list, provide the caller with its IdenTokenProviderIf
+                  // instance after we have incremented its reference count.
+                  InsertTailList(&g_IdenTokenProviderModuleListHead, &pIdenTokenProviderModule->listEntry);
+                  pIdenTokenProviderModule->pIdenTokenProviderIf->addReference(pIdenTokenProviderModule->pIdenTokenProviderIf);
+                  *ppIdenTokenProviderIf = pIdenTokenProviderModule->pIdenTokenProviderIf;
+               }
+               else
+               {
+                  // Failed, free resources.
+                  free(pIdenTokenProviderModule->pTypeName);
+                  if (pIdenTokenProviderModule->libHandle)
+                     dlclose(pIdenTokenProviderModule->libHandle);
+                  free(pIdenTokenProviderModule);
+               }
+            }
+            else
+            {
+               DbgTrace(0, "-GetIdenTokenProviderInterface- Unable to allocate buffer\n", 0);
+
+               // Free buffer allocated for entry
+               free(pIdenTokenProviderModule);
+
+               retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                           CASA_FACILITY_AUTHTOKEN,
+                                           CASA_STATUS_INSUFFICIENT_RESOURCES);
+            }
+         }
+         else
+         {
+            DbgTrace(0, "-GetIdenTokenProviderInterface- Unable to allocate buffer\n", 0);
+            retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                        CASA_FACILITY_AUTHTOKEN,
+                                        CASA_STATUS_INSUFFICIENT_RESOURCES);
+         }
+      }
+
+      // Release exclusive access to our mutex
+      pthread_mutex_unlock(&g_IdenTokenProviderModuleMutex);
+
+      // Release config interface instance
+      pModuleConfigIf->releaseReference(pModuleConfigIf);
+   }
+   else
+   {
+      DbgTrace(0, "-GetIdenTokenProviderInterface- Unable to obtain config interface\n", 0);
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_CONFIGURATION_ERROR);
+   }
+
+   DbgTrace(2, "-GetIdenTokenProviderInterface- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+HANDLE
+PlatAllocMutex(void)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+// L2
+//=======================================================================--
+{
+   PlatformMutex        *pPlatMutex;
+   pthread_mutexattr_t  mutexAttr = {PTHREAD_MUTEX_RECURSIVE};
+
+   DbgTrace(2, "-PlatAllocMutex- Start\n", 0);
+
+   // Allocate space for our mutex structure
+   pPlatMutex = malloc(sizeof(*pPlatMutex));
+   if (pPlatMutex)
+   {
+      // Finish initializing the mutex
+      pthread_mutex_init(&pPlatMutex->mutex, &mutexAttr);
+   }
+   else
+   {
+      DbgTrace(0, "-PlatAllocMutex- Memory allocation failure\n", 0);
+   }
+
+   DbgTrace(2, "-PlatAllocMutex- End, retHandle = %08X\n", (unsigned int) pPlatMutex);
+
+   return (HANDLE) pPlatMutex;
+}
+
+
+//++=======================================================================
+void
+PlatDestroyMutex(HANDLE hMutex)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+// L2
+//=======================================================================--
+{
+   PlatformMutex  *pPlatMutex = (PlatformMutex*) hMutex;
+
+   DbgTrace(2, "-PlatDestroyMutex- Start\n", 0);
+
+   // Free the resources associated with the mutex
+   pthread_mutex_destroy(&pPlatMutex->mutex);
+   free(pPlatMutex);
+
+   DbgTrace(2, "-PlatDestroyMutex- End\n", 0);
+}
+
+
+//++=======================================================================
+void
+PlatAcquireMutex(HANDLE hMutex)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+// L2
+//=======================================================================--
+{
+   PlatformMutex  *pPlatMutex = (PlatformMutex*) hMutex;
+
+   DbgTrace(2, "-PlatAcquireMutex- Start\n", 0);
+
+   // Acquire the mutex
+   pthread_mutex_lock(&pPlatMutex->mutex);
+
+   DbgTrace(2, "-PlatAcquireMutex- End\n", 0);
+}
+
+
+//++=======================================================================
+void
+PlatReleaseMutex(HANDLE hMutex)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+// L2
+//=======================================================================--
+{
+   PlatformMutex  *pPlatMutex = (PlatformMutex*) hMutex;
+
+   DbgTrace(2, "-PlatReleaseMutex- Start\n", 0);
+
+   // Release the mutex
+   pthread_mutex_unlock(&pPlatMutex->mutex);
+
+   DbgTrace(2, "-PlatRelease- End\n", 0);
+}
+
+
+//++=======================================================================
+//++=======================================================================
+//++=======================================================================
+

auth_token/server/AuthTokenValidate/linux/platform.h

@@ -0,0 +1,95 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+#define _GNU_SOURCE
+
+//===[ Include files ]=====================================================
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <string.h>
+#include <syslog.h>
+#include <pthread.h>
+#include <string.h>
+#include <ctype.h>
+#include <errno.h>
+#include <dlfcn.h>
+
+//===[ Type definitions ]==================================================
+
+#define HANDLE void*
+
+#ifndef CONTAINING_RECORD
+#define CONTAINING_RECORD(address, type, field) ((type *)(     \
+             (char*)(address) -                                \
+             (char*)(&((type *)0)->field)))
+#endif
+
+
+//
+// DbgTrace macro define
+//
+#define DbgTrace(LEVEL, X, Y) {                          \
+char printBuff[256];                                     \
+   if (LEVEL == 0 || DebugLevel >= LEVEL)                \
+   {                                                     \
+      _snprintf(printBuff, sizeof(printBuff), X, Y);     \
+      fprintf(stderr, "CASA_AuthTokenValidate %s", printBuff);    \
+   }                                                     \
+}
+/*#define DbgTrace(LEVEL, X, Y) {                                                        \
+   if (LEVEL == 0 || DebugLevel >= LEVEL)                                              \
+   {                                                                                   \
+      openlog("CASA_AuthTokenValidate", LOG_CONS | LOG_NOWAIT | LOG_ODELAY, LOG_USER); \
+      syslog(LOG_USER | LOG_INFO, X, Y);                                               \
+      closelog();                                                                      \
+   }                                                                                   \
+}*/
+
+
+//
+// Deal with function name mapping issues
+// 
+#define _snprintf snprintf
+
+//
+// Module synchronization
+// 
+extern pthread_mutex_t  g_hModuleMutex;
+
+#define AcquireModuleMutex    pthread_mutex_lock(&g_hModuleMutex)
+#define ReleaseModuleMutex    pthread_mutex_unlock(&g_hModuleMutex)
+
+
+//===[ Inlines functions   ]===============================================
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global externals ]==================================================
+
+//===[ External prototypes ]===============================================
+
+//=========================================================================
+

auth_token/server/AuthTokenValidate/principal.c

@@ -0,0 +1,482 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+
+//===[ Include files ]=====================================================
+
+#include "internal.h"
+
+//===[ Type definitions ]==================================================
+
+//
+// Config Interface instance data
+// 
+typedef struct _PrincipalIfInstance
+{
+   int            refCount;
+   IdenTokenIf    *pIdenTokenIf;
+   PrincipalIf    principalIf;
+
+} PrincipalIfInstance, *PPrincipalIfInstance;
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+// PrincipalIf variables
+static
+int               g_numPrincipalIfObjs = 0;
+
+// Synchronization mutex
+static
+HANDLE            g_principalIfMutex = NULL;
+
+
+//++=======================================================================
+static
+int SSCS_CALL
+AddReference(
+   IN       const void  *pIfInstance)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Interface reference count.
+//                           
+// Description:
+//    Increases interface reference count.
+//
+// L2
+//=======================================================================--
+{
+   int                  refCount;
+   PrincipalIfInstance  *pPrincipalIfInstance = CONTAINING_RECORD(pIfInstance, PrincipalIfInstance, principalIf);
+
+   DbgTrace(2, "-AddReference- Start\n", 0);
+
+   // Increment the reference count on the object
+   PlatAcquireMutex(g_principalIfMutex);
+   pPrincipalIfInstance->refCount ++;
+   refCount = pPrincipalIfInstance->refCount;
+   PlatReleaseMutex(g_principalIfMutex);
+
+   DbgTrace(2, "-AddReference- End, refCount = %08X\n", refCount);
+
+   return refCount;
+}
+
+
+//++=======================================================================
+static
+void SSCS_CALL
+ReleaseReference(
+   IN       const void  *pIfInstance)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+// Returns:
+//    Nothing.
+//                           
+// Description:
+//    Decreases interface reference count. The interface is deallocated if
+//    the reference count becomes zero.
+//
+// L2
+//=======================================================================--
+{
+   bool                 freeObj = false;
+   PrincipalIfInstance  *pPrincipalIfInstance = CONTAINING_RECORD(pIfInstance, PrincipalIfInstance, principalIf);
+
+   DbgTrace(2, "-ReleaseReference- Start\n", 0);
+
+   // Decrement the reference count on the object and determine if it needs to
+   // be released.
+   PlatAcquireMutex(g_principalIfMutex);
+   pPrincipalIfInstance->refCount --;
+   if (pPrincipalIfInstance->refCount == 0)
+   {
+      // The object needs to be released, forget about it.
+      freeObj = true;
+      g_numPrincipalIfObjs --;
+   }
+   PlatReleaseMutex(g_principalIfMutex);
+
+   // Free object if necessary
+   if (freeObj)
+   {
+      // Release the identity token interface associated with our instance
+      pPrincipalIfInstance->pIdenTokenIf->releaseReference(pPrincipalIfInstance->pIdenTokenIf);
+
+      // Free our instance data
+      free(pPrincipalIfInstance);
+   }
+
+   DbgTrace(2, "-ReleaseReference- End\n", 0);
+}
+
+
+//++=======================================================================
+static
+CasaStatus SSCS_CALL
+GetIdentityId(
+   IN       const void  *pIfInstance,
+   INOUT    char        *pIdentIdBuf,
+   INOUT    int         *pIdentIdLen)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pIdentIdBuf -
+//       Pointer to buffer that will receive the identity id. The returned
+//       id will be in the form of a NULL terminated string.
+//
+//    pIdentIdBufLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pIdentIdBuf. On exit it contains the length of the returned id
+//       (including the NULL terminator).
+//
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get the identity id associated with the identity token.
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus           retStatus;
+   PrincipalIfInstance  *pPrincipalIfInstance = CONTAINING_RECORD(pIfInstance, PrincipalIfInstance, principalIf);
+
+   DbgTrace(2, "-GetIdentityId- Start\n", 0);
+
+   // Just call into the identity token
+   retStatus = pPrincipalIfInstance->pIdenTokenIf->getIdentityId(pPrincipalIfInstance->pIdenTokenIf,
+                                                                 pIdentIdBuf,
+                                                                 pIdentIdLen);
+
+   DbgTrace(2, "-GetIdentityId- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+static
+CasaStatus SSCS_CALL
+GetSourceName(
+   IN       const void  *pIfInstance,
+   INOUT    char        *pSourceNameBuf,
+   INOUT    int         *pSourceNameLen)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pSourceNameBuf -
+//       Pointer to buffer that will receive the name associated with the
+//       identity information source. The returned name will be in the form
+//       of a NULL terminated string.
+//
+//    pSourceNameBufLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pSourceNameBuf. On exit it contains the length of the returned
+//       name (including the NULL terminator).
+//
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get the name of the identity source associated with the identity token.
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus           retStatus;
+   PrincipalIfInstance  *pPrincipalIfInstance = CONTAINING_RECORD(pIfInstance, PrincipalIfInstance, principalIf);
+
+   DbgTrace(2, "-GetSourceName- Start\n", 0);
+
+   // Just call into the identity token
+   retStatus = pPrincipalIfInstance->pIdenTokenIf->getSourceName(pPrincipalIfInstance->pIdenTokenIf,
+                                                                 pSourceNameBuf,
+                                                                 pSourceNameLen);
+
+   DbgTrace(2, "-GetSourceName- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+static
+CasaStatus SSCS_CALL
+GetSourceUrl(
+   IN       const void  *pIfInstance,
+   INOUT    char        *pSourceUrlBuf,
+   INOUT    int         *pSourceUrlLen)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pSourceUrlBuf -
+//       Pointer to buffer that will receive the URL associated with the
+//       identity information source. The returned URL will be in the form
+//       of a NULL terminated string.
+//
+//    pSourceUrlBufLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pSourceUrlBuf. On exit it contains the length of the returned
+//       URL (including the NULL terminator).
+//
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get the URL to the identity source associated with the identity token.
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus           retStatus;
+   PrincipalIfInstance  *pPrincipalIfInstance = CONTAINING_RECORD(pIfInstance, PrincipalIfInstance, principalIf);
+
+   DbgTrace(2, "-GetSourceUrl- Start\n", 0);
+
+   // Just call into the identity token
+   retStatus = pPrincipalIfInstance->pIdenTokenIf->getSourceUrl(pPrincipalIfInstance->pIdenTokenIf,
+                                                                pSourceUrlBuf,
+                                                                pSourceUrlLen);
+
+   DbgTrace(2, "-GetSourceUrl- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+static
+CasaStatus SSCS_CALL
+AttributeEnumerate(
+   IN       const void  *pIfInstance,
+   INOUT    int         *pEnumHandle,       
+   INOUT    char        *pAttribNameBuf,
+   INOUT    int         *pAttribNameLen,
+   INOUT    char        *pAttribValueBuf,
+   INOUT    int         *pAttribValueLen)
+//
+// Arguments:  
+//    pIfInstance -
+//       Pointer to interface object.
+//   
+//    pEnumHandle -
+//       Pointer to enumeration handle. Must be set to 0 to start an
+//       enumeration.
+//
+//    pAttribNameBuf -
+//       Pointer to buffer that will receive the identity attribute name. The
+//       returned name will be in the form of a NULL terminated string.
+//
+//    pAttribNameLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pAttribNameBuf. On exit it contains the length of the returned
+//       name (including the NULL terminator).
+//
+//    pAttribValueBuf -
+//       Pointer to buffer that will receive the identity attribute value. The
+//       returned value will be in the form of a NULL terminated string.
+//
+//    pAttribValueLen -
+//       Pointer to variable with the length of the buffer pointed by
+//       pAttribValueBuf. On exit it contains the length of the returned
+//       value (including the NULL terminator).
+//
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Enumerates through the attributes associated with the identity token.
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus           retStatus;
+   PrincipalIfInstance  *pPrincipalIfInstance = CONTAINING_RECORD(pIfInstance, PrincipalIfInstance, principalIf);
+
+   DbgTrace(2, "-AttributeEnumerate- Start\n", 0);
+
+   // Just call into the identity token
+   retStatus = pPrincipalIfInstance->pIdenTokenIf->attributeEnumerate(pPrincipalIfInstance->pIdenTokenIf,
+                                                                      pEnumHandle,
+                                                                      pAttribNameBuf,
+                                                                      pAttribNameLen,
+                                                                      pAttribValueBuf,
+                                                                      pAttribValueLen);
+
+   DbgTrace(2, "-AttributeEnumerate- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+CasaStatus
+GetPrincipalInterface(
+   IN       IdenTokenIf  *pIdenTokenIf,
+   INOUT    PrincipalIf  **ppPrincipalIf)
+//
+// Arguments:  
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Get principal interface instanced for the identity associated
+//    with specified identity token.
+//
+// L2
+//=======================================================================--
+{
+   PrincipalIfInstance  *pPrincipalIfInstance;
+   CasaStatus           retStatus;
+
+   DbgTrace(2, "-GetPrincipalInterface- Start\n", 0);
+
+   // Create a PrincipalIfInstance object for it.
+   pPrincipalIfInstance = malloc(sizeof(*pPrincipalIfInstance));
+   if (pPrincipalIfInstance)
+   {
+      // Initialize the PrincipalIf within the instance data
+      pPrincipalIfInstance->principalIf.addReference = AddReference;
+      pPrincipalIfInstance->principalIf.releaseReference = ReleaseReference;
+      pPrincipalIfInstance->principalIf.getIdentityId = GetIdentityId;
+      pPrincipalIfInstance->principalIf.getSourceName = GetSourceName;
+      pPrincipalIfInstance->principalIf.getSourceUrl = GetSourceUrl;
+      pPrincipalIfInstance->principalIf.attributeEnumerate = AttributeEnumerate;
+
+      // Keep reference to the identity token interface instance
+      pPrincipalIfInstance->pIdenTokenIf = pIdenTokenIf;
+      pIdenTokenIf->addReference(pIdenTokenIf);
+
+      // Return the PrincipalIf associated with the instance data after
+      // incrementing its reference count.
+      pPrincipalIfInstance->refCount ++;
+      *ppPrincipalIf = &pPrincipalIfInstance->principalIf;
+
+      // Bump up our interface instance count
+      PlatAcquireMutex(g_principalIfMutex);
+      g_numPrincipalIfObjs ++;
+      PlatReleaseMutex(g_principalIfMutex);
+
+      // Success
+      retStatus = CASA_STATUS_SUCCESS;
+   }
+   else
+   {
+      DbgTrace(0, "-GetPrincipalInterface- Buffer allocation failure\n", 0);
+      retStatus = CasaStatusBuild(CASA_SEVERITY_INFORMATIONAL,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INSUFFICIENT_RESOURCES);
+   }
+
+   DbgTrace(2, "-GetPrincipalInterface- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+CasaStatus
+PrincipalIfInit(void)
+//
+// Arguments:  
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Initializes the principal interface complex.
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus        retStatus;
+
+   DbgTrace(1, "-PrincipalIfInit- Start\n", 0);
+
+   // Allocate mutex
+   if ((g_principalIfMutex = PlatAllocMutex()) != NULL)
+      retStatus = CASA_STATUS_SUCCESS;
+   else
+      retStatus = CasaStatusBuild(CASA_SEVERITY_INFORMATIONAL,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INSUFFICIENT_RESOURCES);
+
+   DbgTrace(1, "-PrincipalIfInit- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+void
+PrincipalIfUninit(void)
+//
+// Arguments:  
+//   
+// Returns:
+//    Casa Status
+//                           
+// Description:
+//    Uninitializes the configuration interface complex.
+//
+// L2
+//=======================================================================--
+{
+   DbgTrace(1, "-PrincipalIfUninit- Start\n", 0);
+
+   // Free mutex if necessary
+   if (g_principalIfMutex)
+   {
+      PlatDestroyMutex(g_principalIfMutex);
+      g_principalIfMutex = NULL;
+   }
+
+   DbgTrace(1, "-PrincipalIfUninit- End\n", 0);
+}
+
+
+//++=======================================================================
+//++=======================================================================
+//++=======================================================================
+

auth_token/server/AuthTokenValidate/util.c

@@ -0,0 +1,321 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+//===[ Include files ]=====================================================
+
+#include "internal.h"
+
+//===[ Type definitions ]==================================================
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+// Tables for Base64 encoding and decoding
+static const int8_t  g_Base64[] =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static const uint8_t g_Expand64[256] =
+{
+    /* ASCII table */
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 62, 64, 64, 64, 63,
+    52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 64, 64, 64, 64, 64, 64,
+    64,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
+    15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 64, 64, 64, 64, 64,
+    64, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
+    41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64
+};
+
+
+//++=======================================================================
+CasaStatus
+EncodeData(
+   IN    const void *pData,
+   IN    const int32_t dataLen,
+   INOUT char **ppEncodedData,
+   INOUT int32_t *pEncodedDataLen)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Description:  
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus  retStatus;
+   int         encodedSize;
+
+   char        *pTmp;
+
+   DbgTrace(3, "-EncodeData- Start\n", 0);
+
+   // Determine the encoded size and allocate a buffer to hold the encoded data
+   encodedSize = ((dataLen * 4 + 2) / 3) - (dataLen % 3 ) + 4;
+   pTmp = (char*) malloc(encodedSize);
+   *ppEncodedData = pTmp;
+   if (*ppEncodedData)
+   {
+      uint8_t  *pOut, *pIn;
+      int      i;
+
+      // Setup pointers to move through the buffers
+      pIn = (uint8_t*) pData;
+      pOut = (uint8_t*) *ppEncodedData;
+
+      // Perform the encoding
+      for (i = 0; i < dataLen - 2; i += 3)
+      {
+          *pOut++ = g_Base64[(pIn[i] >> 2) & 0x3F];
+          *pOut++ = g_Base64[((pIn[i] & 0x3) << 4) |
+                          ((int32_t)(pIn[i + 1] & 0xF0) >> 4)];
+          *pOut++ = g_Base64[((pIn[i + 1] & 0xF) << 2) |
+                          ((int32_t)(pIn[i + 2] & 0xC0) >> 6)];
+          *pOut++ = g_Base64[pIn[i + 2] & 0x3F];
+      }
+      if (i < dataLen)
+      {
+          *pOut++ = g_Base64[(pIn[i] >> 2) & 0x3F];
+          if (i == (dataLen - 1))
+          {
+              *pOut++ = g_Base64[((pIn[i] & 0x3) << 4)];
+              *pOut++ = '=';
+          }
+          else
+          {
+              *pOut++ = g_Base64[((pIn[i] & 0x3) << 4) |
+                              ((int32_t)(pIn[i + 1] & 0xF0) >> 4)];
+              *pOut++ = g_Base64[((pIn[i + 1] & 0xF) << 2)];
+          }
+          *pOut++ = '=';
+      }
+      *pOut++ = '\0';
+
+      // Return the encoded data length
+      *pEncodedDataLen = (int32_t)(pOut - (uint8_t*)*ppEncodedData); 
+
+      // Success
+      retStatus = CASA_STATUS_SUCCESS;
+   }
+   else
+   {
+      DbgTrace(0, "-EncodeData- Buffer allocation failure\n", 0);
+
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INSUFFICIENT_RESOURCES);
+   }
+
+   DbgTrace(3, "-EncodeData- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+CasaStatus
+DecodeData(
+   IN    const char *pEncodedData,
+   IN    const int32_t encodedDataLen, // Does not include NULL terminator
+   INOUT void **ppData,
+   INOUT int32_t *pDataLen)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Description:  
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus  retStatus;
+   int         i, j;
+   int         decodedSize;
+
+   DbgTrace(3, "-DecodeData- Start\n", 0);
+
+   // Determine the decoded size
+   for (i = 0, j = 0; i < encodedDataLen; i++)
+       if (g_Expand64[((uint8_t*) pEncodedData)[i]] < 64)
+           j++;
+   decodedSize = (j * 3 + 3) / 4;
+
+   // Allocate buffer to hold the decoded data
+   *ppData = malloc(decodedSize);
+   if (*ppData)
+   {
+      bool  endReached = false;
+      uint8_t  c0, c1, c2, c3;
+      uint8_t  *p, *q;
+
+      // Initialize parameters that will be used during the decode operation
+      c0 = c1 = c2 = c3 = 0;
+      p = (uint8_t*) pEncodedData;
+      q = (uint8_t*) *ppData;
+
+      // Decode the data
+      //
+      // Loop through the data, piecing back information. Any newlines, and/or
+      // carriage returns need to be skipped.
+      while (j > 4)
+      {
+          while ((64 == g_Expand64[*p]) && (('\n' == *p) || ('\r' == *p)))
+              p++;
+          if (64 == g_Expand64[*p])
+          {
+              endReached = true;
+              break;
+          }
+          c0 = *(p++);
+
+          while ((64 == g_Expand64[*p]) && (('\n' == *p) || ('\r' == *p)))
+              p++;
+          if (64 == g_Expand64[*p])
+          {
+              *(q++) = (uint8_t)(g_Expand64[c0] << 2);
+              j--;
+              endReached = true;
+              break;
+          }
+          c1 = *(p++);
+
+          while ((64 == g_Expand64[*p]) && (('\n' == *p) || ('\r' == *p)))
+              p++;
+          if (64 == g_Expand64[*p])
+          {
+              *(q++) = (uint8_t)(g_Expand64[c0] << 2 | g_Expand64[c1] >> 4);
+              *(q++) = (uint8_t)(g_Expand64[c1] << 4);
+              j -= 2;
+              endReached = true;
+              break;
+          }
+          c2 = *(p++);
+
+          while ((64 == g_Expand64[*p]) && (('\n' == *p) || ('\r' == *p)))
+              p++;
+          if (64 == g_Expand64[*p])
+          {
+              *(q++) = (uint8_t)(g_Expand64[c0] << 2 | g_Expand64[c1] >> 4);
+              *(q++) = (uint8_t)(g_Expand64[c1] << 4 | g_Expand64[c2] >> 2);
+              *(q++) = (uint8_t)(g_Expand64[c2] << 6);
+              j -= 3;
+              endReached = true;
+              break;
+          }
+          c3 = *(p++);
+
+          *(q++) = (uint8_t)(g_Expand64[c0] << 2 | g_Expand64[c1] >> 4);
+          *(q++) = (uint8_t)(g_Expand64[c1] << 4 | g_Expand64[c2] >> 2);
+          *(q++) = (uint8_t)(g_Expand64[c2] << 6 | g_Expand64[c3]);
+          j -= 4;
+      }
+      if (!endReached)
+      {
+          if (j > 1)
+              *(q++) = (uint8_t)(g_Expand64[*p] << 2 | g_Expand64[p[1]] >> 4);
+          if (j > 2)
+              *(q++) = (uint8_t)(g_Expand64[p[1]] << 4 | g_Expand64[p[2]] >> 2);
+          if (j > 3)
+              *(q++) = (uint8_t)(g_Expand64[p[2]] << 6 | g_Expand64[p[3]]);
+      }
+
+      // Return the length of the decoded data
+      *pDataLen = (int32_t)(q - (uint8_t*)*ppData);
+
+      // Success
+      retStatus = CASA_STATUS_SUCCESS;
+   }
+   else
+   {
+      DbgTrace(0, "-DecodeData- Buffer allocation failure\n", 0);
+
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INSUFFICIENT_RESOURCES);
+   }
+
+   DbgTrace(3, "-DecodeData- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+int
+dtoul(
+   IN    char *cp,
+   IN    int len)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   int   n = 0;
+   int   i;
+
+   DbgTrace(2, "-dtoul- Start\n", 0);
+
+   for (i = 0; i < len; i++, cp++)
+   {
+      // Verify that we are dealing with a valid digit
+      if (*cp >= '0' && *cp <= '9')
+      {
+         n = 10 * n + (*cp - '0');
+      }
+      else
+      {
+         DbgTrace(0, "-dtoul- Found invalid digit\n", 0);
+         break;
+      }
+   }
+      
+   DbgTrace(2, "-dtoul- End, result = %d\n", n);
+
+   return n;
+}
+
+
+//++=======================================================================
+//++=======================================================================
+//++=======================================================================
+

auth_token/server/AuthTokenValidate/validate.c

@@ -0,0 +1,233 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+//===[ Include files ]=====================================================
+
+#include "internal.h"
+
+//===[ Type definitions ]==================================================
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+// Debug Level
+int   DebugLevel = 0;
+
+//
+// Initialization variables
+//
+static
+bool  g_moduleInitialized = false;
+
+
+//++=======================================================================
+CasaStatus SSCS_CALL
+ValidateAuthToken(
+   IN       const char  *pServiceName,
+   IN       const char  *pTokenBuf,
+   IN       const int   tokenBufLen,
+   INOUT    PrincipalIf **ppPrincipalIf)
+//
+// Arguments:  
+//    pServiceName -
+//       Pointer to NULL terminated string that contains the
+//       name of the service targeted by the token.
+//               
+//    pTokenBuf -
+//       Pointer to buffer that will receive the authentication
+//       token. The length of this buffer is specified by the
+//       pTokenBufLen parameter. Note that the the authentication
+//       token will be in the form of a NULL terminated string.
+//
+//    tokenBufLen -
+//       Length of the data contained within the buffer pointed
+//       at by pTokenBuf.
+//   
+//    ppPrincipalIf -
+//       Pointer to variable that will receive a pointer to a principal
+//       interface with information about the authenticated entity.
+//       IMPORTANT NOTE: The caller is responsible for releasing the
+//       interface after it is done with it to avoid a resource leak.
+//   
+// Returns:
+//    Casa status.
+//                           
+// Description:
+//    Validates authentication token.
+//
+// L2
+//=======================================================================--
+{
+   CasaStatus        retStatus;
+   char              *pDecodedTokenBuf;
+   int               decodedTokenBufLen;
+   PrincipalIf       *pPrincipalIf;
+
+   DbgTrace(1, "-ValidateAuthToken- Start\n", 0);
+
+   // Validate input parameters
+   if (pServiceName == NULL
+       || pTokenBuf == NULL
+       || tokenBufLen == 0
+       || ppPrincipalIf == NULL)
+   {
+      DbgTrace(0, "-ValidateAuthToken- Invalid input parameter\n", 0);
+
+      retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
+                                  CASA_FACILITY_AUTHTOKEN,
+                                  CASA_STATUS_INVALID_PARAMETER);
+      goto exit;
+   }
+
+   // Make sure that the module has been initialized
+   if (g_moduleInitialized == false)
+   {
+      // The module has not been initialized, synchronize access thought this section
+      // to avoid having two threads performing initialization.
+      AcquireModuleMutex;
+
+      // Assume success
+      retStatus = CASA_STATUS_SUCCESS;
+
+      // Check again in case another thread pre-empted us.
+      if (g_moduleInitialized == false)
+      {
+         // Initialize the ConfigIf complex
+         retStatus = ConfigIfInit();
+         if (CASA_SUCCESS(retStatus))
+         {
+            // Initialize the PrincipalIf complex
+            retStatus = PrincipalIfInit();
+            if (CASA_SUCCESS(retStatus))
+            {
+               g_moduleInitialized = true;
+            }
+            else
+            {
+               ConfigIfUninit();
+            }
+         }
+      }
+
+      // Stop synchronization
+      ReleaseModuleMutex;
+
+      // Exit if we failed
+      if (g_moduleInitialized == false)
+         goto exit;
+   }
+
+   // First decode the token string
+   retStatus = DecodeData(pTokenBuf,
+                          tokenBufLen,
+                          (void**) &pDecodedTokenBuf,
+                          &decodedTokenBufLen);
+   if (CASA_SUCCESS(retStatus))
+   {
+      AuthToken *pAuthToken;
+
+      // Token was decoded successfully, now create an authentication token object with it.
+      retStatus = CreateAuthToken(pDecodedTokenBuf, decodedTokenBufLen, &pAuthToken);
+      if (CASA_SUCCESS(retStatus))
+      {
+         // Now check the validity of the token
+         retStatus = CheckAuthToken(pAuthToken, pServiceName);
+         if (CASA_SUCCESS(retStatus))
+         {
+            IdenTokenProviderIf  *pIdenTokenProviderIf;
+
+            // The token was validated, now
+            // Obtain Identity Token Provider interface
+            retStatus = GetIdenTokenProviderInterface(pAuthToken->pIdenTokenType,
+                                                      &pIdenTokenProviderIf);
+            if (CASA_SUCCESS(retStatus))
+            {
+               IdenTokenIf *pIdenTokenIf;
+
+               // Use the Identity Token Provider to get an Identity Token Interface instance
+               retStatus = pIdenTokenProviderIf->getIdentityTokenIf(pIdenTokenProviderIf,
+                                                                    pAuthToken->pIdenToken,
+                                                                    pAuthToken->idenTokenLen,
+                                                                    &pIdenTokenIf);
+               if (CASA_SUCCESS(retStatus))
+               {
+                  // Now create a principal interface instance with the identity information present in
+                  // the identity token.
+                  retStatus = GetPrincipalInterface(pIdenTokenIf, &pPrincipalIf);
+                  if (CASA_SUCCESS(retStatus))
+                  {
+                     // Success, return the principal interface to the caller.
+                     *ppPrincipalIf = pPrincipalIf;
+                  }
+                  else
+                  {
+                     DbgTrace(0, "-ValidateAuthToken- Failed to instantiate principal interface\n", 0);
+                  }
+
+                  // Release identity token interface
+                  pIdenTokenIf->releaseReference(pIdenTokenIf);
+               }
+               else
+               {
+                  DbgTrace(0, "-ValidateAuthToken- Failed to instantiate identity token\n", 0);
+               }
+
+               // Release identity token provider interface
+               pIdenTokenProviderIf->releaseReference(pIdenTokenProviderIf);
+            }
+            else
+            {
+               DbgTrace(0, "-ValidateAuthToken- Failed to obtain identity token provider interface\n", 0);
+            }
+         }
+
+         // Free the AuthToken object
+         RelAuthToken(pAuthToken);
+      }
+      else
+      {
+         DbgTrace(0, "-ValidateAuthToken- Failed to create authentication token object\n", 0);
+      }
+
+      // Free the decoded token buffer
+      free(pDecodedTokenBuf);
+   }
+   else
+   {
+      DbgTrace(0, "-ValidateAuthToken- Token decode failure\n", 0);
+   }
+
+exit:
+
+   DbgTrace(1, "-ValidateAuthToken- End, retStatus = %08X\n", retStatus);
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+//++=======================================================================
+//++=======================================================================
+

auth_token/server/Makefile.am

@@ -0,0 +1,37 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+SUBDIRS = AuthTokenValidate PamSupport
+
+DIST_SUBDIRS = AuthTokenValidate PamSupport include
+
+CFILES =
+
+EXTRA_DIST = $(CFILES)
+
+.PHONY: package package-clean package-install package-uninstall
+package package-clean package-install package-uninstall:
+	$(MAKE) -C $(TARGET_OS) $@
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/PamSupport/Makefile.am

@@ -0,0 +1,37 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+SUBDIRS = $(TARGET_OS)
+
+DIST_SUBDIRS = linux
+
+CFILES =
+
+EXTRA_DIST = $(CFILES)
+
+.PHONY: package package-clean package-install package-uninstall
+package package-clean package-install package-uninstall:
+	$(MAKE) -C $(TARGET_OS) $@
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/PamSupport/README

@@ -0,0 +1,80 @@
+/***********************************************************************
+ *
+ *  README for pam_casaauthtok
+ *
+ ***********************************************************************/
+
+INTRODUCTION
+
+pam_casaauthtok is a PAM authentication module which can be configured
+to validate credentials consisting of CASA Authentication Tokens.
+
+CONFIGURATION
+
+To use pam_casaauthtok as a PAM authentication module for your service,
+add the following line to the service's PAM configuration file:
+
+auth     required       pam_casaauthtok.so
+
+pam_casaauthtok supports the following input parameters:
+
+U - This parameter tells pam_casaauthtok that it must verify that
+    the username is set to "CasaPrincipal". If the parameter is not
+    specified then pam_casaauthtok does not check the username.
+
+CLIENT PROGRAMMING NOTES
+
+Clients must specify the same service name when requesting Authentication
+Tokens from the CASA Client as the service name specified by the server
+when opening a PAM handle.
+
+SERVER PROGRAMMING NOTES
+
+Server applications validating credentials containing CASA Authentication
+tokens can obtain the following information about the authenticated identity:
+
+username - This is obtained by querying PAM using the pam_get_item() call with
+the item type set to PAM_USER. This can also be obtained by querying PAM
+using the pam_getenv() call with the variable name set to "IdentityId".  The
+username is the user's unique id within the authentication realm. When the
+authentication realm is an LDAP database, the username consists of the user's fdn.
+Note that PAM applications using pam_casaauthtok need to set username to
+"CasaPrincipal" when opening a PAM handle and then the variable is updated by
+pam_casaauthtok during the authentication process with the identity information
+of the authenticated entity.
+
+Name of the source of identity data (Authentication Realm) - This is obtained
+by querying PAM using the pam_getenv() call with the variable name set to
+"IdentityDataSourceName".
+
+URL to the source of identity data - This is obtained
+by querying PAM using the pam_getenv() call with the variable name set to
+"IdentityDataSourceUrl".
+
+Attributes of the authenticated identity - The attributes are set as environment
+variables associated with the PAM handle. The environment variable names match
+the names of the attributes. The attributes associated with the authenticated
+identity and expressed as environment variables are configured at the time that
+the service is enabled for CASA Authentication.
+
+EXAMPLE SERVER APPLICATION
+
+See test/test.c for an example application using PAM to authenticate credentials
+consisting of CASA Authentication Tokens.
+
+SECURITY CONSIDERATIONS
+
+CASA Authenticatication Tokens when compromised can be used to either impersonate
+a user or to obtain identity information about the user. Because of this it is
+important that the tokens be secured by applications making use of them. It is
+recommended that the tokens be transmitted using SSL.
+ 
+
+
+
+                
+
+
+
+
+

auth_token/server/PamSupport/TODO

@@ -0,0 +1,13 @@
+/***********************************************************************
+ *
+ *  TODO for pam_casaauthtok
+ *
+ ***********************************************************************/
+
+INTRODUCTION
+
+This file contains a list of the items still outstanding for pam_casaauthtok.
+
+OUTSTANDING ITEMS
+
+None.

auth_token/server/PamSupport/linux/Makefile.am

@@ -0,0 +1,110 @@
+#######################################################################
+#
+#  Copyright (C) 2006 Novell, Inc.
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU General Public
+#  License as published by the Free Software Foundation; either
+#  version 2 of the License, or (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public
+#  License along with this program; if not, write to the Free
+#  Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+#  Author: Juan Carlos Luciani <jluciani@novell.com>
+#
+#######################################################################
+
+if DEBUG
+TARGET_CFG = Debug
+CFLAGS += -v -w
+else
+TARGET_CFG = Release
+endif
+
+SUBDIRS =
+
+DIST_SUBDIRS =
+
+CASAROOT = ../../../..
+
+CASALIBDIR = $(CASAROOT)/$(LIB)
+
+# handle Mono secondary dependencies
+export MONO_PATH := $(MONO_PATH)
+
+PLATFORMINDEPENDENTSOURCEDIR = ..
+PLATFORMDEPENDENTSOURCEDIR = .
+
+MODULE_NAME = pam_casaauthtok
+MODULE_EXT = so
+
+CFILES = ../pam_authtoken.c
+
+CSFILES_CSC :=
+INCLUDES = -I. -I$(CASAROOT)/include
+RESOURCES =
+DEFINES = -Wno-format-extra-args -fno-strict-aliasing 
+
+CFLAGS += $(INCLUDES) $(DEFINES)
+LIBS = -lpthread -lpam -lcasa_s_authtoken
+LDFLAGS = -Bsymbolic -shared -Wl,-soname=$(MODULE_NAME).$(MODULE_EXT) -L$(CASALIBDIR)/$(TARGET_CFG) -Xlinker -rpath -Xlinker /opt/novell/CASA/lib
+
+OBJDIR = ./$(TARGET_CFG)/$(LIB)
+OBJS = $(addprefix $(OBJDIR)/, $(CFILES:%.c=%.o))
+
+EXTRA_DIST = $(CFILES)
+
+CUR_DIR := $(shell pwd)
+
+all: $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+
+#
+# Pattern based rules.
+#
+vpath %.c $(PLATFORMDEPENDENTSOURCEDIR) $(PLATFORMINDEPENDENTSOURCEDIR)
+vpath %.cpp $(PLATFORMDEPENDENTSOURCEDIR) $(PLATFORMINDEPENDENTSOURCEDIR)
+
+$(OBJDIR)/%.o: %.c
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+$(OBJDIR)/%.o: %.cpp
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+$(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT): $(OBJDIR) $(OBJS)
+	@echo [======== Linking $@ ========]
+	$(LINK) -o $@ $(LDFLAGS) $(OBJS) $(LIBS)
+	cp -f $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT) $(CASALIBDIR)/$(TARGET_CFG)/$(MODULE_NAME).$(MODULE_EXT)
+
+$(OBJDIR):
+	[ -d $(OBJDIR) ] || mkdir -p $(OBJDIR)
+	[ -d $(CASALIBDIR) ] || mkdir -p $(CASALIBDIR)
+	[ -d $(CASALIBDIR)/$(TARGET_CFG) ] || mkdir -p $(CASALIBDIR)/$(TARGET_CFG)
+
+install-exec-local: $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+	$(mkinstalldirs) $(DESTDIR)$(libdir)
+	$(INSTALL_PROGRAM) $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT) $(DESTDIR)$(libdir)/
+
+uninstall-local:
+	cd $(DESTDIR)$(libdir); rm -f $(OBJDIR)/$(MODULE_NAME).$(MODULE_EXT)
+	rmdir $(DESTDIR)$(libdir)
+
+#installcheck-local: install
+#	$(mkinstalldirs) $(DESTDIR)$(libdir)
+#	$(INSTALL_PROGRAM) $(DESTDIR)$(libdir)
+#	cd $(DESTDIR)$(libdir); $(MONO)
+
+clean-local:
+#cd $(TARGET_CFG); rm -rf *.dbg *.exe *.dll *.o *.so; cd ..; rmdir $(OBJDIR)
+	rm -rf $(TARGET_CFG)
+
+distclean-local:
+
+maintainer-clean-local:
+	rm -f Makefile.in
+

auth_token/server/PamSupport/pam_authtoken.c

@@ -0,0 +1,649 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+#define _GNU_SOURCE
+
+#include <stdarg.h>
+#include <syslog.h>
+#include <stdbool.h>
+
+#ifndef LINUX 
+#include <security/pam_appl.h>
+#endif
+
+#define PAM_SM_AUTH
+#define PAM_SM_ACCOUNT
+#define PAM_SM_PASSWORD
+#define PAM_SM_SESSION
+
+#include <security/pam_modules.h>
+#include <security/_pam_macros.h>
+
+#include <casa_s_authtoken.h>
+
+//
+// Environment variables set by module
+// 
+static char CasaIdentityIdEnvVar[] = "IdentityId= ";
+static char CasaIdentitySourceNameEnvVar[] = "IdentityDataSourceName= ";
+static char CasaIdentitySourceUrlEnvVar[] = "IdentityDataSourceUrl= ";
+
+
+/* ************************************************************************
+ * LogError()
+ *
+ * Logs error to syslog.
+ *
+ * L2
+ * ************************************************************************/
+static void
+LogError(char *pFormatStr, ... )
+{
+   va_list  args;
+
+   openlog("pam_casaauthtok", LOG_CONS | LOG_NOWAIT | LOG_ODELAY, LOG_USER);
+   va_start(args, pFormatStr);
+   vsyslog(LOG_USER | LOG_INFO, pFormatStr, args);
+   va_end(args);
+   closelog();
+}
+
+
+/* ************************************************************************
+ * pam_sm_authenticate()
+ *
+ * Service provider implementation for pam_authenticate().
+ *
+ * This is a PAM authentication management function.
+ *
+ * We are going to validate the credentials using the CASA Authentication
+ * Token Credential APIs.
+ *
+ * L2
+ * ************************************************************************/
+PAM_EXTERN int
+pam_sm_authenticate(pam_handle_t *pamh,
+                    int flags,
+                    int argc,
+                    const char **argv)
+{
+   int         retStatus = PAM_SUCCESS;
+   bool        performUsernameCheck = false;
+   int         i;
+   char        *pServicename = NULL;
+   char        *pAuthToken = NULL;
+
+   // Determine if we are supposed to perform the username check
+   // based on the arguments specified.
+   for (i = 0; i < argc; i++)
+   {
+      if (*(argv[i]) == 'U')
+      {
+         // The arguments indicate that we should check the username
+         performUsernameCheck = true;
+
+         // No need to keep going through the arguments
+         break;
+      }
+   }
+
+   // Get the servicename.
+   if (pam_get_item(pamh, PAM_SERVICE, (void*) &pServicename) == PAM_SUCCESS
+       && pServicename != NULL)
+   {
+      // We got the service name, now check if it is necessary to perform
+      // the username check.
+      if (performUsernameCheck)
+      {
+         char                 *pUsername;
+         struct pam_response  *responses = NULL;
+
+         // Obtain the username so that it can be checked.
+         // .
+         // Note that we are not calling pam_get_user() because we
+         // assume that the service has set it before calling PAM_Authenticate.
+         if (pam_get_item(pamh, PAM_USER, (void*) &pUsername) == PAM_SUCCESS
+             && pUsername != NULL)
+         {
+            // Check if the username matches the name that we are expecting
+            if (strcmp(pUsername, "CasaPrincipal") != 0)
+            {
+               LogError("Un-expected username, %s", pUsername);
+               retStatus = PAM_USER_UNKNOWN;
+            }
+         }
+         else
+         {
+            struct pam_conv *pConv;
+
+            // The username has not been set, try to obtain it from the
+            // application through the use of the conversation function.
+            if (pam_get_item(pamh, PAM_CONV, (void*) &pConv) == PAM_SUCCESS)
+            {
+               struct pam_message   msg;
+               struct pam_message   *messages = &msg;
+
+               // Obtained the conversation structure, now query the conversation
+               // function for the username.
+               msg.msg_style = PAM_PROMPT_ECHO_ON;
+               if (pConv->conv(1,
+                               (const struct pam_message **) &messages,
+                               &responses,
+                               pConv->appdata_ptr) == PAM_SUCCESS)
+               {
+                  // Check if we have a successful response
+                  if (responses[0].resp_retcode == PAM_SUCCESS
+                      && responses[0].resp)
+                  {
+                     // Check if the username matches the name that we are expecting
+                     if (strcmp(responses[0].resp, "CasaPrincipal") != 0)
+                     {
+                        LogError("Un-expected username, %s", responses[0].resp);
+                        retStatus = PAM_USER_UNKNOWN;
+                     }
+                  }
+                  else
+                  {
+                     LogError("Username not returned");
+                     retStatus = PAM_CRED_INSUFFICIENT;
+                  }
+               }
+               else
+               {
+                  LogError("Conversation function error");
+                  retStatus = PAM_AUTH_ERR;
+               }
+            }
+            else
+            {
+               LogError("Unable to obtain conversation structure");
+               retStatus = PAM_AUTH_ERR;
+            }
+         }
+
+         // Free conversation function response buffers if necessary
+         if (responses)
+         {
+            if (responses[0].resp)
+               free(responses[0].resp);
+            free(responses);
+         }
+      }
+
+      // Proceed with the authentication token check if we have not encountered any
+      // problems.
+      if (retStatus == PAM_SUCCESS)
+      {
+         struct pam_response  *responses = NULL;
+
+         // Now obtain the authentication token.
+         if (pam_get_item(pamh, PAM_AUTHTOK, (void*) &pAuthToken) != PAM_SUCCESS
+             || pAuthToken == NULL)
+         {
+            struct pam_conv *pConv;
+
+            // The authentication token has not been set, try to obtain it from the
+            // application through the use of the conversation function.
+            if (pam_get_item(pamh, PAM_CONV, (void*) &pConv) == PAM_SUCCESS)
+            {
+               struct pam_message   msg;
+               struct pam_message   *messages = &msg;
+
+               // Obtained the conversation structure, now query the conversation
+               // function for the authentication token.
+               msg.msg_style = PAM_PROMPT_ECHO_OFF;
+               if (pConv->conv(1,
+                               (const struct pam_message **) &messages,
+                               &responses,
+                               pConv->appdata_ptr) == PAM_SUCCESS)
+               {
+                  // Check if we have a successful response
+                  if (responses[0].resp_retcode == PAM_SUCCESS
+                      && responses[0].resp)
+                  {
+                     // Set the authentication token with PAM
+                     if (pam_set_item(pamh, PAM_AUTHTOK, responses[0].resp) == PAM_SUCCESS)
+                     {
+                        // Use the buffer returned by the caller as the authentication token
+                        pAuthToken = responses[0].resp;
+                     }
+                     else
+                     {
+                        LogError("Unable to set the authentication token");
+                     }
+                  }
+                  else
+                  {
+                     LogError("Token not returned");
+                  }
+               }
+               else
+               {
+                  LogError("Conversation function error");
+               }
+            }
+            else
+            {
+               LogError("Unable to obtain conversation structure");
+            }
+         }
+
+         // Check if we succeeded at obtaining the authentication token
+         if (pAuthToken)
+         {
+            CasaStatus  casaStatus;
+            PrincipalIf *pPrincipalIf;
+
+            // Validate the token
+            casaStatus = ValidateAuthToken(pServicename,
+                                           pAuthToken,
+                                           strlen(pAuthToken),
+                                           &pPrincipalIf);
+            if (CASA_SUCCESS(casaStatus))
+            {
+               int   buffLen;
+
+               // Assume success
+               retStatus = PAM_SUCCESS;
+
+               // Associate necessary environment variables with the PAM Handle
+               buffLen = 0;
+               casaStatus = pPrincipalIf->getIdentityId(pPrincipalIf,
+                                                        NULL,
+                                                        &buffLen);
+               if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
+               {
+                  char  *pBuff;
+
+                  // Allocate buffer to contain the Identity Id Environment Variable
+                  pBuff = malloc(sizeof(CasaIdentityIdEnvVar) + buffLen);
+                  if (pBuff)
+                  {
+                     // Start constructing the environment variable
+                     memcpy(pBuff, CasaIdentityIdEnvVar, sizeof(CasaIdentityIdEnvVar) - 1);
+
+                     // Read the value into our buffer
+                     if (CASA_SUCCESS(pPrincipalIf->getIdentityId(pPrincipalIf,
+                                                                  pBuff + sizeof(CasaIdentityIdEnvVar) - 1,
+                                                                  &buffLen)))
+                     {
+                        // Now set the environment variable
+                        if (pam_putenv(pamh, pBuff) != PAM_SUCCESS)
+                        {
+                           LogError("Unable to set identity id environment variable");
+                           retStatus = PAM_SYSTEM_ERR;
+                        }
+
+                        // Also set the identity id as the username
+                        if (pam_set_item(pamh, PAM_USER, pBuff + sizeof(CasaIdentityIdEnvVar) - 1) != PAM_SUCCESS)
+                        {
+                           LogError("Error setting the username");
+                        }
+                     }
+                     else
+                     {
+                        LogError("Unable to obtain identity id");
+                        retStatus = PAM_SYSTEM_ERR;
+                     }
+
+                     // Free allocated buffer
+                     free(pBuff);
+                  }
+                  else
+                  {
+                     LogError("Buffer allocation failure");
+                     retStatus = PAM_BUF_ERR;
+                  }
+               }
+               else
+               {
+                  LogError("Un-expected error obtaining identity id, %08X", casaStatus);
+                  retStatus = PAM_SYSTEM_ERR;
+               }
+
+               if (retStatus == PAM_SUCCESS)
+               {
+                  buffLen = 0;
+                  casaStatus = pPrincipalIf->getSourceName(pPrincipalIf,
+                                                           NULL,
+                                                           &buffLen);
+                  if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
+                  {
+                     char  *pBuff;
+
+                     // Allocate buffer to contain the Identity Source Name Environment Variable
+                     pBuff = malloc(sizeof(CasaIdentitySourceNameEnvVar) + buffLen);
+                     if (pBuff)
+                     {
+                        // Start constructing the environment variable
+                        memcpy(pBuff, CasaIdentitySourceNameEnvVar, sizeof(CasaIdentitySourceNameEnvVar) - 1);
+
+                        // Read the value into our buffer
+                        if (CASA_SUCCESS(pPrincipalIf->getSourceName(pPrincipalIf,
+                                                                     pBuff + sizeof(CasaIdentitySourceNameEnvVar) - 1,
+                                                                     &buffLen)))
+                        {
+                           // Now set the environment variable
+                           if (pam_putenv(pamh, pBuff) != PAM_SUCCESS)
+                           {
+                              LogError("Unable to set identity source name environment variable");
+                              retStatus = PAM_SYSTEM_ERR;
+                           }
+                        }
+                        else
+                        {
+                           LogError("Unable to obtain identity source name");
+                           retStatus = PAM_SYSTEM_ERR;
+                        }
+
+                        // Free allocated buffer
+                        free(pBuff);
+                     }
+                     else
+                     {
+                        LogError("Buffer allocation failure");
+                        retStatus = PAM_BUF_ERR;
+                     }
+                  }
+                  else
+                  {
+                     LogError("Un-expected error obtaining identity source name, %08X", casaStatus);
+                     retStatus = PAM_SYSTEM_ERR;
+                  }
+               }
+
+               if (retStatus == PAM_SUCCESS)
+               {
+                  buffLen = 0;
+                  casaStatus = pPrincipalIf->getSourceUrl(pPrincipalIf,
+                                                          NULL,
+                                                          &buffLen);
+                  if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
+                  {
+                     char  *pBuff;
+
+                     // Allocate buffer to contain the Identity Source Url Environment Variable
+                     pBuff = malloc(sizeof(CasaIdentitySourceUrlEnvVar) + buffLen);
+                     if (pBuff)
+                     {
+                        // Start constructing the environment variable
+                        memcpy(pBuff, CasaIdentitySourceUrlEnvVar, sizeof(CasaIdentitySourceUrlEnvVar) - 1);
+
+                        // Read the value into our buffer
+                        if (CASA_SUCCESS(pPrincipalIf->getSourceUrl(pPrincipalIf,
+                                                                    pBuff + sizeof(CasaIdentitySourceUrlEnvVar) - 1,
+                                                                    &buffLen)))
+                        {
+                           // Now set the environment variable
+                           if (pam_putenv(pamh, pBuff) != PAM_SUCCESS)
+                           {
+                              LogError("Unable to set identity source url environment variable");
+                              retStatus = PAM_SYSTEM_ERR;
+                           }
+                        }
+                        else
+                        {
+                           LogError("Unable to obtain identity source url");
+                           retStatus = PAM_SYSTEM_ERR;
+                        }
+
+                        // Free allocated buffer
+                        free(pBuff);
+                     }
+                     else
+                     {
+                        LogError("Buffer allocation failure");
+                        retStatus = PAM_BUF_ERR;
+                     }
+                  }
+                  else
+                  {
+                     LogError("Un-expected error obtaining identity source url, %08X", casaStatus);
+                     retStatus = PAM_SYSTEM_ERR;
+                  }
+               }
+
+               if (retStatus == PAM_SUCCESS)
+               {
+                  char  *pBuff;
+                  int   enumHandle = 0;
+                  int   buff2Len;
+
+                  while (retStatus == PAM_SUCCESS)
+                  {
+                     // Get attribute lengths
+                     buffLen = buff2Len = 0;
+                     casaStatus = pPrincipalIf->attributeEnumerate(pPrincipalIf,
+                                                                   &enumHandle,
+                                                                   NULL,
+                                                                   &buffLen,
+                                                                   NULL,
+                                                                   &buff2Len);
+                     if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
+                     {
+                        // Allocate buffer to contain the Identity attribute Environment Variable
+                        pBuff = malloc(buffLen + 2 + buff2Len);
+                        if (pBuff)
+                        {
+                           // Read the attribute into our buffer
+                           if (CASA_SUCCESS(pPrincipalIf->attributeEnumerate(pPrincipalIf,
+                                                                             &enumHandle,
+                                                                             pBuff,
+                                                                             &buffLen,
+                                                                             pBuff + buffLen + 1, // This includes the NULL terminator
+                                                                             &buff2Len)))
+                           {
+                              // Finish constructing the environment variable string
+                              *(pBuff + buffLen - 1) = '=';
+                              *(pBuff + buffLen) = ' ';
+
+                              // Now set the environment variable
+                              if (pam_putenv(pamh, pBuff) != PAM_SUCCESS)
+                              {
+                                 LogError("Unable to set identity attribute environment variable");
+                                 retStatus = PAM_SYSTEM_ERR;
+                              }
+                           }
+                           else
+                           {
+                              LogError("Unable to obtain identity attribute");
+                              retStatus = PAM_SYSTEM_ERR;
+                           }
+
+                           // Free allocated buffer
+                           free(pBuff);
+                        }
+                        else
+                        {
+                           LogError("Buffer allocation failure");
+                           retStatus = PAM_BUF_ERR;
+                        }
+                     }
+                     else
+                     {
+                        // Check if we are done going through the attributes
+                        if (CasaStatusCode(casaStatus) == CASA_STATUS_NO_MORE_ENTRIES)
+                        {
+                           // Done
+                           break;
+                        }
+                        else
+                        {
+                           LogError("Un-expected error during attribute enumeration, %08X", casaStatus);
+                           retStatus = PAM_SYSTEM_ERR;
+                        }
+                     }
+                  }
+               }
+
+               // Release the principal interface instance
+               pPrincipalIf->releaseReference(pPrincipalIf);
+            }
+            else
+            {
+               LogError("Service %s failed to authenticate with status = %08X", pServicename, casaStatus);
+               retStatus = PAM_AUTH_ERR;
+            }
+         }
+         else
+         {
+            LogError("Unable to obtain authentication token");
+            retStatus = PAM_CRED_INSUFFICIENT;
+         }
+
+         // Free conversation function response buffers if necessary
+         if (responses)
+         {
+            if (responses[0].resp)
+               free(responses[0].resp);
+            free(responses);
+         }
+      }
+   }
+   else
+   {
+      LogError("Unable to obtain servicename");
+      retStatus = PAM_SYSTEM_ERR;
+   }
+
+   return retStatus;
+}
+
+
+/* ************************************************************************
+ * pam_sm_setcred()
+ *
+ * Service provider implementation for pam_setcred().
+ *
+ * This is a PAM authentication management function.
+ *
+ * This function is here just for completedness and to protect against
+ * PAM misconfiguration.
+ *
+ * ************************************************************************/
+PAM_EXTERN int
+pam_sm_setcred(pam_handle_t *pamh,
+               int flags,
+               int argc,
+               const char **argv)
+{
+   return PAM_SUCCESS;
+}
+
+
+/* ************************************************************************
+ * pam_sm_acct_mgmt()
+ *
+ * Service provider implementation for pam_acct_mgmt().
+ *
+ * This is a PAM account management function.
+ *
+ * This function is here just for completedness and to protect against
+ * PAM misconfiguration.
+ *
+ * ************************************************************************/
+PAM_EXTERN int
+pam_sm_acct_mgmt(pam_handle_t *pamh,
+                 int flags,
+                 int argc,
+                 const char **argv)
+{
+   return PAM_SUCCESS;
+}
+
+
+/* ************************************************************************
+ * pam_sm_chauthtok()
+ *
+ * Service provider implementation for pam_chauthtok().
+ *
+ * This is a PAM password management function.
+ *
+ * This function is here just for completedness and to protect against
+ * PAM misconfiguration.
+ *
+ * ************************************************************************/
+PAM_EXTERN int
+pam_sm_chauthtok(pam_handle_t *pamh,
+                 int flags,
+                 int argc,
+                 const char **argv)
+{
+   return PAM_SUCCESS;
+}
+
+
+/* ************************************************************************
+ * pam_sm_open_session()
+ *
+ * Service provider implementation for pam_open_session().
+ *
+ * This is a PAM session management function.
+ *
+ * This function is here just for completedness and to protect against
+ * PAM misconfiguration.
+ *
+ * ************************************************************************/
+PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh,
+                                   int flags,
+                                   int argc,
+                                   const char **argv)
+{
+   return PAM_SUCCESS;
+}
+
+
+/* ************************************************************************
+ * pam_sm_close_session()
+ *
+ * Service provider implementation for pam_close_session().
+ *
+ * This is a PAM session management function.
+ *
+ * This function is here just for completedness and to protect against
+ * PAM misconfiguration.
+ *
+ * ************************************************************************/
+PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh,
+                                    int flags,
+                                    int argc,
+                                    const char **argv)
+{
+   return PAM_SUCCESS;
+}
+
+
+/* static module data */
+#ifdef PAM_STATIC
+struct pam_module _pam_casa_authtoken_modstruct = {
+   "pam_casa_authtoken",
+   pam_sm_authenticate,
+   pam_sm_setcred,
+   pam_sm_acct_mgmt,
+   pam_sm_chauthtok,
+   pam_sm_open_session,
+   pam_sm_close_session
+};
+#endif
+

auth_token/server/PamSupport/test/README

@@ -0,0 +1,32 @@
+/***********************************************************************
+ *
+ *  README for pamTest
+ *
+ ***********************************************************************/
+
+INTRODUCTION
+
+pamTest is a PAM application which tests using CASA authentication tokens
+for authentication.
+
+CONFIGURATION
+
+Place a copy of file testservice in the /etc/pam.d folder.
+
+BUILDING APPLICATION
+
+Execute script: make.sh.
+
+RUNNING APPLICATION
+
+Execute the following command: ./pamTest -s testService
+ 
+
+
+
+                
+
+
+
+
+

auth_token/server/PamSupport/test/make.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+gcc -o pamTest test.c -g -I"../../.." -I"../../../../include" -DN_PLAT_UNIX -L"../../../lib/Release" -lpam

auth_token/server/PamSupport/test/test.c

@@ -0,0 +1,520 @@
+/***********************************************************************
+ * 
+ *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; version 2.1
+ *  of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, Novell, Inc.
+ * 
+ *  To contact Novell about this file by physical or electronic mail, 
+ *  you may find current contact information at www.novell.com.
+ * 
+ *  Author: Juan Carlos Luciani <jluciani@novell.com>
+ *
+ ***********************************************************************/
+
+//===[ Include files ]=====================================================
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include <getopt.h>
+#include <errno.h>
+#include <security/pam_appl.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netdb.h>
+
+//===[ Type definitions ]==================================================
+
+typedef struct _AppUserData
+{
+   char  *pUserName;
+   char  *pAuthToken;
+
+} AppUserData, *PAppUserData;
+
+//
+// DbgTrace macro define
+//
+#define DbgTrace(LEVEL, X, Y) {                          \
+   if (LEVEL == 0)                                       \
+      printf(X, Y);                                      \
+   else if (DebugLevel >= LEVEL)                         \
+         printf(X, Y);                                   \
+}
+
+//
+// Socket Mapping definitions
+//
+#define INVALID_SOCKET -1
+#define SOCKET_ERROR -1
+#define LINGER struct linger
+#define SOCKADDR_IN struct sockaddr_in
+#define closesocket close
+
+
+//===[ Function prototypes ]===============================================
+
+//===[ Global variables ]==================================================
+
+// Usage string
+char  usage[] = "\nPamTest: usage: -s serviceName [-D DebugLevel]\n";
+
+// Debug Level
+int   DebugLevel = 3;
+
+char  *pServiceName = NULL;
+
+//++=======================================================================
+int
+Converse(int num_msg,
+         const struct pam_message **msg,
+		   struct pam_response **resp,
+         void *appdata_ptr)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+//=======================================================================--
+{
+   int                  retStatus = PAM_SUCCESS;
+   int                  replies = 0;
+   struct pam_response  *reply = NULL;
+   AppUserData          *pAppUserData = (PAppUserData) appdata_ptr;
+
+   // Initialize output parameters
+   *resp = NULL;
+
+   // Check input parameters
+   if (num_msg <= 0 || appdata_ptr == NULL)
+      return PAM_CONV_ERR;
+
+   // Allocate enough space for the replies
+   reply = malloc(sizeof(struct pam_response) * num_msg);
+   if (!reply)
+      return PAM_CONV_ERR;
+
+   // Zero the reply buffer
+   memset(reply, 0, sizeof(struct pam_response) * num_msg);
+
+   for (replies = 0;
+        replies < num_msg && retStatus == PAM_SUCCESS;
+        replies++)
+   {
+      switch (msg[replies]->msg_style)
+      {
+         case PAM_PROMPT_ECHO_ON:
+
+            // The caller wants the username
+            reply[replies].resp_retcode = PAM_SUCCESS;
+            reply[replies].resp = malloc(strlen(pAppUserData->pUserName) + 1);
+            if (reply[replies].resp)
+               strcpy(reply[replies].resp, pAppUserData->pUserName);
+            else
+            {
+               DbgTrace(0, "Converse- Buffer allocation failure\n", 0);
+               retStatus = PAM_CONV_ERR;
+            }
+            break;
+
+         case PAM_PROMPT_ECHO_OFF:
+
+            // The caller wants the authentication token
+            reply[replies].resp_retcode = PAM_SUCCESS;
+            reply[replies].resp = malloc(strlen(pAppUserData->pAuthToken) + 1);
+            if (reply[replies].resp)
+            {
+               strcpy(reply[replies].resp, pAppUserData->pAuthToken);
+            }
+            else
+            {
+               DbgTrace(0, "Converse- Buffer allocation failure\n", 0);
+               retStatus = PAM_CONV_ERR;
+            }
+            break;
+
+         case PAM_TEXT_INFO:
+         case PAM_ERROR_MSG:
+
+            // Just return success
+            reply[replies].resp_retcode = PAM_SUCCESS;
+            reply[replies].resp = NULL;
+            break;
+
+         default:
+
+            // Un-expected
+            retStatus = PAM_CONV_ERR;
+      }
+   }
+
+   // Proceed based on the status
+   if (retStatus == PAM_SUCCESS)
+   {
+      *resp = reply;
+   }
+   else
+   {
+      // Free buffers allocated for the reply
+      for (replies = 0;
+           replies < num_msg && retStatus == PAM_SUCCESS;
+           replies++)
+      {
+         if (reply[replies].resp != NULL)
+            free(reply[replies].resp);
+      }
+      free(reply);
+   }
+
+   return retStatus;
+}
+
+
+//++=======================================================================
+int
+ReadLineIntoBuffer(int connSock, char *pBuffer)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+//=======================================================================--
+{
+   int               i = 0;
+   char              c;
+   int               bytesReceived = 0;
+
+   DbgTrace(2, "ReadLineIntoBuffer- Start\n", 0);
+
+   // Receive the line
+   while ((bytesReceived = recv(connSock, &c, 1, 0)) == 1)
+   {
+      if (c == '\n')
+         break;
+      else
+      {
+         pBuffer[i] = c;
+         i ++;
+      }
+   }
+
+   // Check for a socket error
+   if (bytesReceived == 0)
+   {
+      DbgTrace(0, "ReadLineIntoBuffer- Socket error\n", 0);
+   }
+
+   DbgTrace(2, "ReadLineIntoBuffer- End, lineLength = %d\n", i);
+
+   return i;
+}
+
+
+//++=======================================================================
+void
+ProcessConnection(int connSock)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+//=======================================================================--
+{
+   char              userName[] = "CasaPrincipal";
+   char              token[4096] = {0};
+   char              helloString[100] = {0};
+   AppUserData       appUserData = {userName, token};
+   struct pam_conv   conv = {Converse, &appUserData};
+   pam_handle_t      *pamh;
+   int               pam_status;
+
+   DbgTrace(1, "ProcessConnection- Start\n", 0);
+
+   // We have received a connection
+   printf("\n\nConnection received\n");
+
+   // Receive the token
+   if (ReadLineIntoBuffer(connSock, token) == 0)
+   {
+      DbgTrace(0, "ProcessConnection- Error receiving token\n", 0);
+      goto exit;
+   }
+   //printf("Token received = %s\n", token);
+
+   // We obtained authentication token credentials to authenticate
+   // to the service, now verify the credentials using PAM_Authenticate.
+   //
+   // Open a PAM Handle
+   pam_status = pam_start(pServiceName, userName, &conv, &pamh);
+   if (pam_status == PAM_SUCCESS)
+   {
+      // Now authenticate the user
+      pam_status = pam_authenticate(pamh, PAM_DISALLOW_NULL_AUTHTOK);
+      if (pam_status == PAM_SUCCESS)
+      {
+         char  **pam_envlist;
+         char  **pam_env;
+         char  *pUsername;
+
+         DbgTrace(1, "ProcessConnection- pam_authenticate success\n", 0);
+         printf("Authentication succeeded\n");
+         printf("The DUDE is cool\n");
+
+         // Get the identity information about the DUDE
+
+         // Notice that the username may have been updated during the authentication process
+         if (pam_get_item(pamh, PAM_USER, (void*) &pUsername) == PAM_SUCCESS
+             && pUsername != NULL)
+         {
+            printf("The username of the authenticated identity is %s\n", pUsername);
+         }
+         else
+         {
+            DbgTrace(0, "ProcessConnection- pam_get_item did not return the username\n", 0);
+         }
+
+         // Show identity information obtained during the authentication process and maintained
+         // as PAM environment variables.
+         pam_envlist = pam_getenvlist(pamh);
+         if (pam_envlist != NULL)
+         {
+            // Display the environment variables and free the memory associated
+            // with them.
+            for (pam_env = pam_envlist; *pam_env != NULL; ++pam_env)
+            {
+               printf("%s\n", *pam_env);
+               free(*pam_env);
+            }
+            free(pam_envlist);
+         }
+         else
+         {
+            DbgTrace(0, "ProcessConnection- pam_getenvlist did not return any data\n", 0);
+         }
+      }
+      else
+      {
+         DbgTrace(0, "ProcessConnection- pam_authenticate failure, error = %s\n", pam_strerror(pamh, pam_status));
+         printf("The DUDE is a fake\n");
+      }
+
+      // Close the PAM Handle
+      pam_end(pamh, pam_status | PAM_DATA_SILENT);
+   }
+   else
+   {
+      DbgTrace(0, "ProcessConnection- pam_start failure, status = %08X\n", pam_status);
+   }
+
+exit:
+
+   DbgTrace(1, "ProcessConnection- End\n", 0);
+}
+
+
+//++=======================================================================
+void
+ExecuteTests(void)
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+//  Environment:
+//
+//=======================================================================--
+{
+   int                  connSock;
+   int                  listenSock;
+   struct sockaddr_in   localAddr = {0};
+   struct sockaddr_in   boundAddr = {0};
+   struct sockaddr_in   remoteAddr = {0};
+   struct linger        linger_opt = {1, 15};
+   int                  on = 1;
+   socklen_t            addrLen = sizeof(struct sockaddr_in);
+
+   DbgTrace(1, "ExecuteTests- Start\n", 0);
+
+   // Open listen socket
+   listenSock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+   if (listenSock != INVALID_SOCKET)
+   {
+      // Setup the local address structure
+      localAddr.sin_family = AF_INET;
+      localAddr.sin_addr.s_addr = htonl(INADDR_ANY);
+
+      // Set the SO_REUSEADDR option on the socket to avoid
+      // problems in case of a re-start.
+      setsockopt(listenSock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+
+      // Bind socket
+      if (!bind(listenSock, (const struct sockaddr*) &localAddr, sizeof(struct sockaddr_in)))
+      {
+         // Display the local address information
+         if (getsockname(listenSock,
+                         (struct sockaddr*) &boundAddr,
+                         &addrLen) != SOCKET_ERROR)
+         {
+            printf("Listen port = %d\n", boundAddr.sin_port);
+
+            // Now start linstening for connections
+            if (listen(listenSock, SOMAXCONN) != SOCKET_ERROR)
+            {
+               // Loop accepting connections
+               while (1)
+               {
+                  addrLen = sizeof(remoteAddr);
+                  connSock = accept(listenSock,
+                                (struct sockaddr*) &remoteAddr,
+                                &addrLen);
+                  if (connSock != INVALID_SOCKET)
+                  {
+                     ProcessConnection(connSock);
+
+                     // Close the connection socket
+                     closesocket(connSock);
+                  }
+                  else
+                  {
+                     DbgTrace(0, "ExecuteTests- - Accept failed, error = %08X\n", errno);
+                     break;
+                  }
+               }
+            }
+            else
+            {
+               DbgTrace(0, "ExecuteTests- Unable to start listening, error = %d", errno);
+            }
+         }
+         else
+         {
+            DbgTrace(0, "ExecuteTests- Unable to obtain local address information, error = %d", errno);
+         }
+      }
+      else
+      {
+         DbgTrace(0, "ExecuteTests- Unable to bind socket, error = %d", errno);
+      }
+
+      // Close the listen socket
+      closesocket(listenSock);
+   }
+   else
+   {
+      DbgTrace(0, "ExecuteTests- Unable to open socket, error = %d\n", errno);
+   }
+
+   DbgTrace(1, "ExecuteTests- End\n", 0);
+}
+
+
+//++=======================================================================
+int
+main(
+   int argc,
+   char* argv[])
+//
+//  Arguments: 
+//
+//  Returns:   
+//
+//  Abstract:  
+//
+//  Notes:
+//
+// L2
+//=======================================================================--
+{
+   int         optionsSpecified = 0;
+   bool        doneScanning = false;
+   bool        invalidOption = false;
+   int         option;
+
+   printf("**** server auth_token test ****\n");
+
+   // Scan through the options specified
+   while (!doneScanning)
+   {
+      opterr = 0;
+      option = getopt(argc, argv, "s:D:");
+
+      // Proceed based on the result
+      switch (option)
+      {
+         case 'D':
+            // Set the debug level
+            printf("DebugLevel = %s\n", optarg);
+            DebugLevel = atoi(optarg);
+            optionsSpecified++;
+            break;
+
+         case 's':
+            // Set the service name
+            printf("Service name = %s\n", optarg);
+            pServiceName = optarg;
+            optionsSpecified++;
+            break;
+
+         case '?':
+            // Invalid option detected
+            doneScanning = true;
+            invalidOption = true;
+            break;
+
+         default:
+            // Done scanning
+            doneScanning = true;
+            break;
+      }
+   }
+
+   // Do some sanity checking
+   if (!invalidOption
+       && pServiceName != NULL)
+   {
+      ExecuteTests();
+   }
+   else
+   {
+      // Invalid option detected
+      printf(usage, argv[0]);
+   }
+
+   return 0;
+
+}  /*-- main() --*/
+

auth_token/server/PamSupport/test/testservice

@@ -0,0 +1,6 @@
+#%PAM-1.0
+auth	 required	pam_casaauthtok.so U
+account  required	pam_casaauthtok.so
+password required	pam_casaauthtok.so
+session  required       pam_casaauthtok.so
+