From fffe3169bb490c4b010b168c639aa6f9b2ec0c52 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>

Date: Thu, 10 Dec 2020 22:05:30 +0100

Subject: [PATCH 26/27] pam: add pam_gssapi_check_upn option

:config: Added `pam_gssapi_check_upn` to enforce authentication

  only with principal that can be associated with target user.

Reviewed-by: Robbie Harwood <rharwood@redhat.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/confdb/confdb.c                  | 10 ++++++++++

 src/confdb/confdb.h                  |  2 ++

 src/config/SSSDConfig/sssdoptions.py |  1 +

 src/config/SSSDConfigTest.py         |  6 ++++--

 src/config/cfg_rules.ini             |  3 +++

 src/config/etc/sssd.api.conf         |  2 ++

 src/db/sysdb_subdomains.c            | 12 ++++++++++++

 src/man/sssd.conf.5.xml              | 26 ++++++++++++++++++++++++++

 src/responder/pam/pamsrv.c           |  9 +++++++++

 src/responder/pam/pamsrv.h           |  1 +

 10 files changed, 70 insertions(+), 2 deletions(-)

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c

index 7f1956d6d..2881ce5da 100644

--- a/src/confdb/confdb.c

+++ b/src/confdb/confdb.c

@@ -1593,6 +1593,16 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,

         }

     }

+    tmp = ldb_msg_find_attr_as_string(res->msgs[0], CONFDB_PAM_GSSAPI_CHECK_UPN,

+                                      NULL);

+    if (tmp != NULL) {

+        domain->gssapi_check_upn = talloc_strdup(domain, tmp);

+        if (domain->gssapi_check_upn == NULL) {

+            ret = ENOMEM;

+            goto done;

+        }

+    }

+

     domain->has_views = false;

     domain->view_name = NULL;

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h

index 7a3bc8bb5..036f9ecad 100644

--- a/src/confdb/confdb.h

+++ b/src/confdb/confdb.h

@@ -145,6 +145,7 @@

 #define CONFDB_PAM_P11_URI "p11_uri"

 #define CONFDB_PAM_INITGROUPS_SCHEME "pam_initgroups_scheme"

 #define CONFDB_PAM_GSSAPI_SERVICES "pam_gssapi_services"

+#define CONFDB_PAM_GSSAPI_CHECK_UPN "pam_gssapi_check_upn"

 /* SUDO */

 #define CONFDB_SUDO_CONF_ENTRY "config/sudo"

@@ -435,6 +436,7 @@ struct sss_domain_info {

     /* List of PAM services that are allowed to authenticate with GSSAPI. */

     char **gssapi_services;

+    char *gssapi_check_upn; /* true | false | NULL */

 };

 /**

diff --git a/src/config/SSSDConfig/sssdoptions.py b/src/config/SSSDConfig/sssdoptions.py

index f59fe8d9f..5da52a937 100644

--- a/src/config/SSSDConfig/sssdoptions.py

+++ b/src/config/SSSDConfig/sssdoptions.py

@@ -105,6 +105,7 @@ class SSSDOptions(object):

         'p11_uri': _('PKCS#11 URI to restrict the selection of devices for Smartcard authentication'),

         'pam_initgroups_scheme' : _('When shall the PAM responder force an initgroups request'),

         'pam_gssapi_services' : _('List of PAM services that are allowed to authenticate with GSSAPI.'),

+        'pam_gssapi_check_upn' : _('Whether to match authenticated UPN with target user'),

         # [sudo]

         'sudo_timed': _('Whether to evaluate the time-based attributes in sudo rules'),

diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py

index 21fffe1b6..ea4e4f6c9 100755

--- a/src/config/SSSDConfigTest.py

+++ b/src/config/SSSDConfigTest.py

@@ -654,7 +654,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):

             're_expression',

             'cached_auth_timeout',

             'auto_private_groups',

-            'pam_gssapi_services']

+            'pam_gssapi_services',

+            'pam_gssapi_check_upn']

         self.assertTrue(type(options) == dict,

                         "Options should be a dictionary")

@@ -1032,7 +1033,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):

             're_expression',

             'cached_auth_timeout',

             'auto_private_groups',

-            'pam_gssapi_services']

+            'pam_gssapi_services',

+            'pam_gssapi_check_upn']

         self.assertTrue(type(options) == dict,

                         "Options should be a dictionary")

diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini

index c6dfd5648..6642c6321 100644

--- a/src/config/cfg_rules.ini

+++ b/src/config/cfg_rules.ini

@@ -140,6 +140,7 @@ option = p11_wait_for_card_timeout

 option = p11_uri

 option = pam_initgroups_scheme

 option = pam_gssapi_services

+option = pam_gssapi_check_upn

 [rule/allowed_sudo_options]

 validator = ini_allowed_options

@@ -439,6 +440,7 @@ option = full_name_format

 option = re_expression

 option = auto_private_groups

 option = pam_gssapi_services

+option = pam_gssapi_check_upn

 #Entry cache timeouts

 option = entry_cache_user_timeout

@@ -834,6 +836,7 @@ option = ad_site

 option = use_fully_qualified_names

 option = auto_private_groups

 option = pam_gssapi_services

+option = pam_gssapi_check_upn

 [rule/sssd_checks]

 validator = sssd_checks

diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf

index f46f3c46d..d3cad7380 100644

--- a/src/config/etc/sssd.api.conf

+++ b/src/config/etc/sssd.api.conf

@@ -81,6 +81,7 @@ p11_wait_for_card_timeout = int, None, false

 p11_uri = str, None, false

 pam_initgroups_scheme = str, None, false

 pam_gssapi_services = str, None, false

+pam_gssapi_check_upn = bool, None, false

 [sudo]

 # sudo service

@@ -201,6 +202,7 @@ full_name_format = str, None, false

 re_expression = str, None, false

 auto_private_groups = str, None, false

 pam_gssapi_services = str, None, false

+pam_gssapi_check_upn = bool, None, false

 #Entry cache timeouts

 entry_cache_user_timeout = int, None, false

diff --git a/src/db/sysdb_subdomains.c b/src/db/sysdb_subdomains.c

index bfc6df0f5..03ba12164 100644

--- a/src/db/sysdb_subdomains.c

+++ b/src/db/sysdb_subdomains.c

@@ -254,6 +254,18 @@ check_subdom_config_file(struct confdb_ctx *confdb,

         goto done;

     }

+    /* allow to set pam_gssapi_check_upn */

+    ret = confdb_get_string(confdb, subdomain, sd_conf_path,

+                            CONFDB_PAM_GSSAPI_CHECK_UPN,

+                            subdomain->parent->gssapi_check_upn,

+                            &subdomain->gssapi_check_upn);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE,

+              "Failed to get %s option for the subdomain: %s\n",

+              CONFDB_PAM_GSSAPI_CHECK_UPN, subdomain->name);

+        goto done;

+    }

+

     ret = EOK;

 done:

     talloc_free(tmp_ctx);

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml

index db9dd4677..d637e2eaa 100644

--- a/src/man/sssd.conf.5.xml

+++ b/src/man/sssd.conf.5.xml

@@ -1735,6 +1735,31 @@ pam_gssapi_services = sudo, sudo-i

                         </para>

                     </listitem>

                 </varlistentry>

+                <varlistentry>

+                    <term>pam_gssapi_check_upn</term>

+                    <listitem>

+                        <para>

+                            If True, SSSD will require that the Kerberos user

+                            principal that successfully authenticated through

+                            GSSAPI can be associated with the user who is being

+                            authenticated. Authentication will fail if the check

+                            fails.

+                        </para>

+                        <para>

+                            If False, every user that is able to obtained

+                            required service ticket will be authenticated.

+                        </para>

+                        <para>

+                            Note: This option can also be set per-domain which

+                            overwrites the value in [pam] section. It can also

+                            be set for trusted domain which overwrites the value

+                            in the domain section.

+                        </para>

+                        <para>

+                            Default: True

+                        </para>

+                    </listitem>

+                </varlistentry>

             </variablelist>

         </refsect2>

@@ -3810,6 +3835,7 @@ ldap_user_extra_attrs = phone:telephoneNumber

             <para>ad_site,</para>

             <para>use_fully_qualified_names</para>

             <para>pam_gssapi_services</para>

+            <para>pam_gssapi_check_upn</para>

         <para>

             For more details about these options see their individual description

             in the manual page.

diff --git a/src/responder/pam/pamsrv.c b/src/responder/pam/pamsrv.c

index 0492569c7..0db2824ff 100644

--- a/src/responder/pam/pamsrv.c

+++ b/src/responder/pam/pamsrv.c

@@ -348,6 +348,15 @@ static int pam_process_init(TALLOC_CTX *mem_ctx,

         }

     }

+    ret = confdb_get_bool(pctx->rctx->cdb, CONFDB_PAM_CONF_ENTRY,

+                          CONFDB_PAM_GSSAPI_CHECK_UPN, true,

+                          &pctx->gssapi_check_upn);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_FATAL_FAILURE, "Failed to read %s [%d]: %s\n",

+              CONFDB_PAM_GSSAPI_CHECK_UPN, ret, sss_strerror(ret));

+        goto done;

+    }

+

     /* The responder is initialized. Now tell it to the monitor. */

     ret = sss_monitor_service_init(rctx, rctx->ev, SSS_BUS_PAM,

                                    SSS_PAM_SBUS_SERVICE_NAME,

diff --git a/src/responder/pam/pamsrv.h b/src/responder/pam/pamsrv.h

index 730dee288..bf4dd75b0 100644

--- a/src/responder/pam/pamsrv.h

+++ b/src/responder/pam/pamsrv.h

@@ -65,6 +65,7 @@ struct pam_ctx {

     /* List of PAM services that are allowed to authenticate with GSSAPI. */

     char **gssapi_services;

+    bool gssapi_check_upn;

 };

 struct pam_auth_req {

-- 

2.21.3