/*********************************************************************** * * Copyright (C) 2006 Novell, Inc. All Rights Reserved. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; version 2.1 * of the License. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Library Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, Novell, Inc. * * To contact Novell about this file by physical or electronic mail, * you may find current contact information at www.novell.com. * * Author: Juan Carlos Luciani * ***********************************************************************/ //===[ Include files ]===================================================== #include "internal.h" //===[ Type definitions ]================================================== //===[ Function prototypes ]=============================================== //===[ Global variables ]================================================== // Mechanism OID gss_OID g_mechOid = GSS_C_NULL_OID; //++======================================================================= void LogGssStatuses( IN char *operation, IN OM_uint32 majorGssStatus, IN OM_uint32 minorGssStatus) // // Arguments: // // Returns: // // Description: // // L2 //=======================================================================-- { OM_uint32 gssMajStat; OM_uint32 gssMinStat; gss_buffer_desc msg = GSS_C_EMPTY_BUFFER; OM_uint32 gssMsgCtx; // Trace the messages associated with the major status gssMsgCtx = 0; while (1) { gssMajStat = gss_display_status(&gssMinStat, majorGssStatus, GSS_C_GSS_CODE, g_mechOid, &gssMsgCtx, &msg); if (gssMajStat != GSS_S_COMPLETE) { DbgTrace(0, "-LogGssStatuses- Error obtaining display status\n", 0); break; } // Trace this message DbgTrace(0, "-LogGssStatuses- GSS-API error %s: ", operation); DbgTrace(0, "%s\n", (char *)msg.value); if (msg.length != 0) gss_release_buffer(&gssMinStat, &msg); if (!gssMsgCtx) break; } // Trace the messages associated with the minor status gssMsgCtx = 0; while (1) { gssMajStat = gss_display_status(&gssMinStat, minorGssStatus, GSS_C_MECH_CODE, g_mechOid, &gssMsgCtx, &msg); if (gssMajStat != GSS_S_COMPLETE) { DbgTrace(0, "-LogGssStatuses- Error obtaining display status\n", 0); break; } // Trace this message DbgTrace(0, "-LogGssStatuses- GSS-API error %s: ", operation); DbgTrace(0, "%s\n", (char *)msg.value); if (msg.length != 0) gss_release_buffer(&gssMinStat, &msg); if (!gssMsgCtx) break; } } //++======================================================================= CasaStatus SSCS_CALL AuthTokenIf_GetAuthToken( IN const void *pIfInstance, IN const char *pContext, IN const char *pMechInfo, INOUT char *pTokenBuf, INOUT int *pTokenBufLen) // // Arguments: // pIfInstance - // Pointer to interface object. // // pServiceConfigIf - // Pointer to service config object to which the client is trying to // authenticate. // // pContext - // Pointer to null terminated string containing mechanism specific // context information. Another name for context is Authentication // Realm. // // pMechInfo - // Pointer to null terminated string containing mechanism specific // information. This is information is provided by the server to // aid the mechanism to generate an authentication token. For // example, the mechanism information for a Kerberos mechanism // may be the service principal name to which the user will be // authenticating. // // pTokenBuf - // Pointer to buffer that will receive the authentication // token. The length of this buffer is specified by the // pTokenBufLen parameter. Note that the the authentication // token will be in the form of a NULL terminated string. // // pTokenBufLen - // Pointer to integer that contains the length of the // buffer pointed at by pTokenBuf. Upon return of the // function, the integer will contain the actual length // of the authentication token if the function successfully // completes or the buffer length required if the function // fails because the buffer pointed at by pUserNameBuf is // not large enough. // // Returns: // Casa Status // // Description: // Get authentication token to authenticate user to specified service. // // L2 //=======================================================================-- { CasaStatus retStatus; char const *pKrbServiceName = pMechInfo; OM_uint32 gssMajStat; OM_uint32 gssMinStat; gss_buffer_desc gssBuffer; gss_name_t gssServiceName; DbgTrace(1, "-AuthTokenIf_GetAuthToken- Start\n", 0); // Validate input parameters if (pIfInstance == NULL || pContext == NULL || pMechInfo == NULL || pTokenBufLen == NULL || (pTokenBuf == NULL && *pTokenBufLen != 0)) { DbgTrace(0, "-AuthTokenIf_GetAuthToken- Invalid input parameter\n", 0); retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR, CASA_FACILITY_KRB5TOKEN, CASA_STATUS_INVALID_PARAMETER); goto exit; } // Import the service principal name into something that // GSS-API can understand based on its form. gssBuffer.value = (void*) pKrbServiceName; gssBuffer.length = strlen(pKrbServiceName) + 1; if (strchr(pKrbServiceName, '@') != NULL) { // The name is of the form "servicename@hostname" gssMajStat = gss_import_name(&gssMinStat, &gssBuffer, (gss_OID) GSS_C_NT_HOSTBASED_SERVICE, &gssServiceName); } else { // The name is of the form "servicename" gssMajStat = gss_import_name(&gssMinStat, &gssBuffer, (gss_OID) GSS_C_NT_USER_NAME, &gssServiceName); } // Proceed based on the result of the name import operation if (gssMajStat == GSS_S_COMPLETE) { // Establish a context gss_ctx_id_t gssContext = GSS_C_NO_CONTEXT; gss_buffer_desc gssSendToken = {0}; OM_uint32 gssRetFlags; gssMajStat = gss_init_sec_context(&gssMinStat, GSS_C_NO_CREDENTIAL, &gssContext, gssServiceName, g_mechOid, 0, // Flags 0, NULL, // no channel bindings GSS_C_NO_BUFFER, // no token from peer NULL, // ignore mech type &gssSendToken, &gssRetFlags, NULL); // ignore time rec // Proceed based on the result of the gss_init_sec_context operation if (gssMajStat == GSS_S_COMPLETE && gssSendToken.length != 0) { char *pEncodedToken; int encodedTokenLen; // The security context was initialized, now return the token to the // caller after base64 encoding it. retStatus = EncodeData(gssSendToken.value, gssSendToken.length, &pEncodedToken, &encodedTokenLen); if (CASA_SUCCESS(retStatus)) { // Verify that the caller provided a buffer that is big enough if (encodedTokenLen > *pTokenBufLen) { // At least one of the supplied buffers is not big enough DbgTrace(1, "-AuthTokenIf_GetAuthToken- Insufficient buffer space provided\n", 0); retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR, CASA_FACILITY_KRB5TOKEN, CASA_STATUS_BUFFER_OVERFLOW); } else { // The buffer provided is large enough, copy the data and return the actual size. memcpy((void*) pTokenBuf, pEncodedToken, encodedTokenLen +1); // Success retStatus = CASA_STATUS_SUCCESS; } // Return the actual size or the size required *pTokenBufLen = encodedTokenLen; // Free the buffer containing the encoded token free(pEncodedToken); } else { DbgTrace(1, "-AuthTokenIf_GetAuthToken- Encoding failed\n", 0); } } else { DbgTrace(0, "-AuthTokenIf_GetAuthToken- Error initing sec context\n", 0); LogGssStatuses("initializing context", gssMajStat, gssMinStat); retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR, CASA_FACILITY_KRB5TOKEN, CASA_STATUS_UNSUCCESSFUL); } // Release send token buffer if necessary if (gssSendToken.length != 0) gss_release_buffer(&gssMinStat, &gssSendToken); // Free context if necessary if (gssContext != GSS_C_NO_CONTEXT) gss_delete_sec_context(&gssMinStat, &gssContext, GSS_C_NO_BUFFER); // Release the buffer associated with the service name gss_release_name(&gssMinStat, &gssServiceName); } else { DbgTrace(0, "-AuthTokenIf_GetAuthToken- Error importing service name\n", 0); LogGssStatuses("importing service name", gssMajStat, gssMinStat); retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR, CASA_FACILITY_KRB5TOKEN, CASA_STATUS_OBJECT_NOT_FOUND); } exit: DbgTrace(1, "-AuthTokenIf_GetAuthToken- End, retStatus = %08X\n", retStatus); return retStatus; } //++======================================================================= int InitializeLibrary(void) // // Arguments: // // Returns: // // Abstract: // // Notes: // // L2 //=======================================================================-- { int retStatus = 0; DbgTrace(1, "-InitializeLibrary- Start\n", 0); // Nothing to do at this time. DbgTrace(1, "-InitializeLibrary- End, retStatus = %08X\n", retStatus); return retStatus; } //++======================================================================= //++======================================================================= //++=======================================================================