|
 |
10fa70 |
From fdd97fe6c9f0a3a6ff8d2580ca9f3c46826449b7 Mon Sep 17 00:00:00 2001
|
|
|
10fa70 |
From: Robbie Harwood <rharwood@redhat.com>
|
|
|
10fa70 |
Date: Wed, 26 Feb 2020 18:27:17 -0500
|
|
|
10fa70 |
Subject: [PATCH] Refresh manually acquired creds from client keytab
|
|
|
10fa70 |
|
|
|
10fa70 |
If a client keytab is present but credentials are acquired manually,
|
|
|
10fa70 |
the credentials would not be refreshed because no refresh_time config
|
|
|
10fa70 |
var is set in the cache. Change kg_cred_time_to_refresh() to attempt
|
|
|
10fa70 |
a refresh from the client keytab on any credentials which will expire
|
|
|
10fa70 |
in the next 30 seconds.
|
|
|
10fa70 |
|
|
|
10fa70 |
[ghudson@mit.edu: adjused code and added test case]
|
|
|
10fa70 |
|
|
|
10fa70 |
ticket: 7976
|
|
|
10fa70 |
(cherry picked from commit 729896467e3c77904666019d6cbbda583ae49b95)
|
|
|
10fa70 |
(cherry picked from commit 685aada9eae420cb5156ca7b71c2c7614c0b6e2c)
|
|
|
10fa70 |
---
|
|
|
10fa70 |
src/lib/gssapi/krb5/acquire_cred.c | 14 +++++++++++---
|
|
|
10fa70 |
src/tests/gssapi/t_client_keytab.py | 18 ++++++++++++++++++
|
|
|
10fa70 |
2 files changed, 29 insertions(+), 3 deletions(-)
|
|
|
10fa70 |
|
|
|
10fa70 |
diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c
|
|
|
10fa70 |
index acc1868f8..4062f4741 100644
|
|
|
10fa70 |
--- a/src/lib/gssapi/krb5/acquire_cred.c
|
|
|
10fa70 |
+++ b/src/lib/gssapi/krb5/acquire_cred.c
|
|
|
10fa70 |
@@ -557,15 +557,23 @@ set_refresh_time(krb5_context context, krb5_ccache ccache,
|
|
|
10fa70 |
krb5_boolean
|
|
|
10fa70 |
kg_cred_time_to_refresh(krb5_context context, krb5_gss_cred_id_rec *cred)
|
|
|
10fa70 |
{
|
|
|
10fa70 |
- krb5_timestamp now;
|
|
|
10fa70 |
+ krb5_timestamp now, soon;
|
|
|
10fa70 |
|
|
|
10fa70 |
if (krb5_timeofday(context, &now))
|
|
|
10fa70 |
return FALSE;
|
|
|
10fa70 |
+ soon = ts_incr(now, 30);
|
|
|
10fa70 |
if (cred->refresh_time != 0 && !ts_after(cred->refresh_time, now)) {
|
|
|
10fa70 |
- set_refresh_time(context, cred->ccache,
|
|
|
10fa70 |
- ts_incr(cred->refresh_time, 30));
|
|
|
10fa70 |
+ set_refresh_time(context, cred->ccache, soon);
|
|
|
10fa70 |
return TRUE;
|
|
|
10fa70 |
}
|
|
|
10fa70 |
+
|
|
|
10fa70 |
+ /* If the creds will expire soon, try to refresh even if they weren't
|
|
|
10fa70 |
+ * acquired with a client keytab. */
|
|
|
10fa70 |
+ if (ts_after(soon, cred->expire)) {
|
|
|
10fa70 |
+ set_refresh_time(context, cred->ccache, soon);
|
|
|
10fa70 |
+ return TRUE;
|
|
|
10fa70 |
+ }
|
|
|
10fa70 |
+
|
|
|
10fa70 |
return FALSE;
|
|
|
10fa70 |
}
|
|
|
10fa70 |
|
|
|
10fa70 |
diff --git a/src/tests/gssapi/t_client_keytab.py b/src/tests/gssapi/t_client_keytab.py
|
|
|
10fa70 |
index e474a27c7..7847b3ecd 100755
|
|
|
10fa70 |
--- a/src/tests/gssapi/t_client_keytab.py
|
|
|
10fa70 |
+++ b/src/tests/gssapi/t_client_keytab.py
|
|
|
10fa70 |
@@ -124,4 +124,22 @@ realm.kinit(realm.user_princ, password('user'))
|
|
|
10fa70 |
realm.run(['./t_ccselect', phost], env=bad_cktname,
|
|
|
10fa70 |
expected_msg=realm.user_princ)
|
|
|
10fa70 |
|
|
|
10fa70 |
+mark('refresh of manually acquired creds')
|
|
|
10fa70 |
+
|
|
|
10fa70 |
+# Test 17: no name/ccache specified, manually acquired creds which
|
|
|
10fa70 |
+# will expire soon. Verify that creds are refreshed using the current
|
|
|
10fa70 |
+# client name, with refresh_time set in the refreshed ccache.
|
|
|
10fa70 |
+realm.kinit('bob', password('bob'), ['-l', '15s'])
|
|
|
10fa70 |
+realm.run(['./t_ccselect', phost], expected_msg='bob')
|
|
|
10fa70 |
+realm.run([klist, '-C'], expected_msg='refresh_time = ')
|
|
|
10fa70 |
+
|
|
|
10fa70 |
+# Test 18: no name/ccache specified, manually acquired creds with a
|
|
|
10fa70 |
+# client principal not present in the client keytab. A refresh is
|
|
|
10fa70 |
+# attempted but fails, and an expired ticket error results.
|
|
|
10fa70 |
+realm.kinit(realm.admin_princ, password('admin'), ['-l', '-1s'])
|
|
|
10fa70 |
+msgs = ('Getting initial credentials for user/admin@KRBTEST.COM',
|
|
|
10fa70 |
+ '/Matching credential not found')
|
|
|
10fa70 |
+realm.run(['./t_ccselect', phost], expected_code=1,
|
|
|
10fa70 |
+ expected_msg='Ticket expired', expected_trace=msgs)
|
|
|
10fa70 |
+
|
|
|
10fa70 |
success('Client keytab tests')
|