From b11d891a50c2f70e3c02b880e0199583b8df186c Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Thu, 31 May 2018 16:16:08 +0200

Subject: [PATCH] Find NetBIOS name in keytab while leaving

If realmd is used with Samba as membership software, i.e. Samba's net

utility, the NetBIOS name must be known when leaving a domain. The most

reliable way to find it is by searching the keytab for NAME$@REALM type

entries and use the NAME as the NetBIOS name.

Related to https://bugzilla.redhat.com/show_bug.cgi?id=1370457

---

 service/realm-kerberos.c     | 64 ++++++++++++++++++++++++++++++++++++

 service/realm-kerberos.h     |  2 ++

 service/realm-samba-enroll.c | 17 ++++++++--

 3 files changed, 80 insertions(+), 3 deletions(-)

diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c

index 54d1ed7..d6d109f 100644

--- a/service/realm-kerberos.c

+++ b/service/realm-kerberos.c

@@ -1130,3 +1130,67 @@ realm_kerberos_flush_keytab (const gchar *realm_name,

 	return ret;

 }

+

+gchar *

+realm_kerberos_get_netbios_name_from_keytab (const gchar *realm_name)

+{

+	krb5_error_code code;

+	krb5_keytab keytab = NULL;

+	krb5_context ctx;

+	krb5_kt_cursor cursor = NULL;

+	krb5_keytab_entry entry;

+	krb5_principal realm_princ = NULL;

+	gchar *princ_name = NULL;

+	gchar *netbios_name = NULL;

+	krb5_data *name_data;

+

+	code = krb5_init_context (&ctx;;

+	if (code != 0) {

+		return NULL;

+	}

+

+	princ_name = g_strdup_printf ("user@%s", realm_name);

+	code = krb5_parse_name (ctx, princ_name, &realm_princ);

+	g_free (princ_name);

+

+	if (code == 0) {

+		code = krb5_kt_default (ctx, &keytab);

+	}

+

+	if (code == 0) {

+		code = krb5_kt_start_seq_get (ctx, keytab, &cursor);

+	}

+

+	if (code == 0) {

+		while (!krb5_kt_next_entry (ctx, keytab, &entry, &cursor) && netbios_name == NULL) {

+			if (krb5_realm_compare (ctx, realm_princ, entry.principal)) {

+				name_data = krb5_princ_component (ctx, entry.principal, 0);

+				if (name_data != NULL

+				                && name_data->length > 0

+				                && name_data->data[name_data->length - 1] == '$') {

+					netbios_name = g_strndup (name_data->data, name_data->length - 1);

+					if (netbios_name == NULL) {

+						code = krb5_kt_free_entry (ctx, &entry);

+						warn_if_krb5_failed (ctx, code);

+						break;

+					}

+				}

+			}

+			code = krb5_kt_free_entry (ctx, &entry);

+			warn_if_krb5_failed (ctx, code);

+		}

+	}

+

+	code = krb5_kt_end_seq_get (ctx, keytab, &cursor);

+	warn_if_krb5_failed (ctx, code);

+

+	code = krb5_kt_close (ctx, keytab);

+	warn_if_krb5_failed (ctx, code);

+

+	krb5_free_principal (ctx, realm_princ);

+

+	krb5_free_context (ctx);

+

+	return netbios_name;

+

+}

diff --git a/service/realm-kerberos.h b/service/realm-kerberos.h

index 0447e4d..58cfe07 100644

--- a/service/realm-kerberos.h

+++ b/service/realm-kerberos.h

@@ -88,6 +88,8 @@ gchar *             realm_kerberos_format_login          (RealmKerberos *self,

 gboolean            realm_kerberos_flush_keytab                (const gchar *realm_name,

                                                                 GError **error);

+gchar *             realm_kerberos_get_netbios_name_from_keytab (const gchar *realm_name);

+

 const gchar *       realm_kerberos_get_name                    (RealmKerberos *self);

 const gchar *       realm_kerberos_get_realm_name              (RealmKerberos *self);

diff --git a/service/realm-samba-enroll.c b/service/realm-samba-enroll.c

index 76e7b79..f5edca3 100644

--- a/service/realm-samba-enroll.c

+++ b/service/realm-samba-enroll.c

@@ -85,7 +85,8 @@ static JoinClosure *

 join_closure_init (GTask *task,

                    RealmDisco *disco,

                    GVariant *options,

-                   GDBusMethodInvocation *invocation)

+                   GDBusMethodInvocation *invocation,

+                   gboolean do_join)

 {

 	JoinClosure *join;

 	gchar *workgroup;

@@ -93,6 +94,7 @@ join_closure_init (GTask *task,

 	int temp_fd;

 	const gchar *explicit_computer_name = NULL;

 	const gchar *authid = NULL;

+	gchar *name_from_keytab = NULL;

 	join = g_new0 (JoinClosure, 1);

 	join->disco = realm_disco_ref (disco);

@@ -106,6 +108,14 @@ join_closure_init (GTask *task,

 	else if (disco->explicit_netbios)

 		authid = disco->explicit_netbios;

+	/* try to get the NetBIOS name from the keytab while leaving the domain */

+	if (explicit_computer_name == NULL && !do_join) {

+		name_from_keytab = realm_kerberos_get_netbios_name_from_keytab(disco->kerberos_realm);

+		if (name_from_keytab != NULL) {

+			authid = name_from_keytab;

+		}

+	}

+

 	join->config = realm_ini_config_new (REALM_INI_NO_WATCH | REALM_INI_PRIVATE);

 	realm_ini_config_set (join->config, REALM_SAMBA_CONFIG_GLOBAL,

 	                      "security", "ads",

@@ -151,6 +161,7 @@ join_closure_init (GTask *task,

 		g_warning ("Couldn't create temp file in: %s", g_get_tmp_dir ());

 	}

+	g_free (name_from_keytab);

 	return join;

 }

@@ -393,7 +404,7 @@ realm_samba_enroll_join_async (RealmDisco *disco,

 	g_return_if_fail (cred != NULL);

 	task = g_task_new (NULL, NULL, callback, user_data);

-	join = join_closure_init (task, disco, options, invocation);

+	join = join_closure_init (task, disco, options, invocation, TRUE);

 	explicit_computer_name = realm_options_computer_name (options, disco->domain_name);

 	if (explicit_computer_name != NULL) {

 		realm_diagnostics_info (invocation, "Joining using a manual netbios name: %s",

@@ -462,7 +473,7 @@ realm_samba_enroll_leave_async (RealmDisco *disco,

 	JoinClosure *join;

 	task = g_task_new (NULL, NULL, callback, user_data);

-	join = join_closure_init (task, disco, options, invocation);

+	join = join_closure_init (task, disco, options, invocation, FALSE);

 	switch (cred->type) {

 	case REALM_CREDENTIAL_PASSWORD:

-- 

2.17.1