From 3f32e79858f268ce6501de44e5158e8c12f688dd Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Wed, 22 Mar 2017 13:01:18 +0100
Subject: [PATCH 72/72] KRB5: Authenticate users in a non-POSIX domain using a
MEMORY ccache
Related to:
https://pagure.io/SSSD/sssd/issue/3310
The following changes were done to the Kerberos authentication code
in order to support authentication in a non-POSIX environment:
- delayed authentication is disabled in non-POSIX domains
- when a user logs in in a non-POSIX domain, SSSD uses a
MEMORY:$username ccache and destroys is then krb5_child finishes
so that just the numeric result is used
- krb5_child doesn't drop privileges in this configuration because
there is nothing to drop privileges to
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
src/providers/krb5/krb5_auth.c | 62 ++++++++++++++++------
src/providers/krb5/krb5_auth.h | 2 +
src/providers/krb5/krb5_child.c | 32 +++++++++--
src/providers/krb5/krb5_child_handler.c | 15 +++++-
.../krb5/krb5_delayed_online_authentication.c | 7 +++
src/providers/krb5/krb5_init.c | 3 ++
6 files changed, 99 insertions(+), 22 deletions(-)
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index c2d6d7eeacc1f766024c4d629f25fd0f0be24e5e..2faf18d17a735476c20f9cc27b15be4a39cadc5c 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -42,6 +42,8 @@
#include "providers/krb5/krb5_utils.h"
#include "providers/krb5/krb5_ccache.h"
+#define NON_POSIX_CCNAME_FMT "MEMORY:sssd_nonposix_dummy_%u"
+
static int krb5_mod_ccname(TALLOC_CTX *mem_ctx,
struct sysdb_ctx *sysdb,
struct sss_domain_info *domain,
@@ -200,6 +202,7 @@ errno_t krb5_setup(TALLOC_CTX *mem_ctx,
talloc_set_destructor((TALLOC_CTX *) kr, krb5_cleanup);
kr->pd = pd;
+ kr->dom = dom;
kr->krb5_ctx = krb5_ctx;
ret = get_krb_primary(krb5_ctx->name_to_primary,
@@ -275,8 +278,11 @@ static void krb5_auth_cache_creds(struct krb5_ctx *krb5_ctx,
return;
}
- ret = add_user_to_delayed_online_authentication(krb5_ctx, pd, uid);
- if (ret != EOK) {
+ ret = add_user_to_delayed_online_authentication(krb5_ctx, domain, pd, uid);
+ if (ret == ENOTSUP) {
+ /* This error is not fatal */
+ DEBUG(SSSDBG_MINOR_FAILURE, "Delayed authentication not supported\n");
+ } else if (ret != EOK) {
/* This error is not fatal */
DEBUG(SSSDBG_CRIT_FAILURE,
"add_user_to_delayed_online_authentication failed.\n");
@@ -291,21 +297,43 @@ static errno_t krb5_auth_prepare_ccache_name(struct krb5child_req *kr,
{
const char *ccname_template;
- ccname_template = dp_opt_get_cstring(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL);
+ switch (kr->dom->type) {
+ case DOM_TYPE_POSIX:
+ ccname_template = dp_opt_get_cstring(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL);
- kr->ccname = expand_ccname_template(kr, kr, ccname_template,
- kr->krb5_ctx->illegal_path_re, true,
- be_ctx->domain->case_sensitive);
- if (kr->ccname == NULL) {
- DEBUG(SSSDBG_CRIT_FAILURE, "expand_ccname_template failed.\n");
- return ENOMEM;
- }
+ kr->ccname = expand_ccname_template(kr, kr, ccname_template,
+ kr->krb5_ctx->illegal_path_re, true,
+ be_ctx->domain->case_sensitive);
+ if (kr->ccname == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "expand_ccname_template failed.\n");
+ return ENOMEM;
+ }
- kr->old_ccname = ldb_msg_find_attr_as_string(user_msg,
- SYSDB_CCACHE_FILE, NULL);
- if (kr->old_ccname == NULL) {
- DEBUG(SSSDBG_TRACE_LIBS,
- "No ccache file for user [%s] found.\n", kr->pd->user);
+ kr->old_ccname = ldb_msg_find_attr_as_string(user_msg,
+ SYSDB_CCACHE_FILE, NULL);
+ if (kr->old_ccname == NULL) {
+ DEBUG(SSSDBG_TRACE_LIBS,
+ "No ccache file for user [%s] found.\n", kr->pd->user);
+ }
+ break;
+ case DOM_TYPE_APPLICATION:
+ DEBUG(SSSDBG_TRACE_FUNC,
+ "Domain type application, will use in-memory ccache\n");
+ /* We don't care about using cryptographic randomness, just
+ * a non-predictable ccname, so using rand() here is fine
+ */
+ kr->ccname = talloc_asprintf(kr,
+ NON_POSIX_CCNAME_FMT,
+ rand() % UINT_MAX);
+ if (kr->ccname == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");
+ return ENOMEM;
+ }
+
+ break;
+ default:
+ DEBUG(SSSDBG_FATAL_FAILURE, "Unsupported domain type\n");
+ return EINVAL;
}
return EOK;
@@ -617,7 +645,7 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
kr->uid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
res->msgs[0],
SYSDB_UIDNUM, 0);
- if (kr->uid == 0) {
+ if (kr->uid == 0 && state->domain->type == DOM_TYPE_POSIX) {
DEBUG(SSSDBG_CONF_SETTINGS,
"UID for user [%s] not known.\n", pd->user);
ret = ENOENT;
@@ -627,7 +655,7 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
kr->gid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
res->msgs[0],
SYSDB_GIDNUM, 0);
- if (kr->gid == 0) {
+ if (kr->gid == 0 && state->domain->type == DOM_TYPE_POSIX) {
DEBUG(SSSDBG_CONF_SETTINGS,
"GID for user [%s] not known.\n", pd->user);
ret = ENOENT;
diff --git a/src/providers/krb5/krb5_auth.h b/src/providers/krb5/krb5_auth.h
index 75ad916e79b29043120543ab3c4c1bd27e09d913..8ad3aeff21e58f9055ae144eaa450992c6391ba6 100644
--- a/src/providers/krb5/krb5_auth.h
+++ b/src/providers/krb5/krb5_auth.h
@@ -50,6 +50,7 @@
struct krb5child_req {
struct pam_data *pd;
struct krb5_ctx *krb5_ctx;
+ struct sss_domain_info *dom;
const char *ccname;
const char *old_ccname;
@@ -118,6 +119,7 @@ parse_krb5_child_response(TALLOC_CTX *mem_ctx, uint8_t *buf, ssize_t len,
struct krb5_child_response **_res);
errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
+ struct sss_domain_info *domain,
struct pam_data *pd,
uid_t uid);
errno_t init_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index a4128dda6b0861a95dba223047d66c4158b1afb6..cbbc892bee0365892ac66d3654c974d325166b60 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -80,6 +80,7 @@ struct krb5_req {
char *ccname;
char *keytab;
bool validate;
+ bool posix_domain;
bool send_pac;
bool use_enterprise_princ;
char *fast_ccname;
@@ -102,6 +103,16 @@ struct krb5_req {
static krb5_context krb5_error_ctx;
#define KRB5_CHILD_DEBUG(level, error) KRB5_DEBUG(level, krb5_error_ctx, error)
+static errno_t k5c_become_user(uid_t uid, gid_t gid, bool is_posix)
+{
+ if (is_posix == false) {
+ DEBUG(SSSDBG_TRACE_FUNC,
+ "Will not drop privileges for a non-POSIX user\n");
+ return EOK;
+ }
+ return become_user(uid, gid);
+}
+
static krb5_error_code set_lifetime_options(struct cli_opts *cli_opts,
krb5_get_init_creds_opt *options)
{
@@ -1561,6 +1572,15 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr,
DEBUG(SSSDBG_CONF_SETTINGS, "TGT validation is disabled.\n");
}
+ /* In a non-POSIX environment, we only care about the return code from
+ * krb5_child, so let's not even attempt to create the ccache
+ */
+ if (kr->posix_domain == false) {
+ DEBUG(SSSDBG_TRACE_LIBS,
+ "Finished authentication in a non-POSIX domain\n");
+ goto done;
+ }
+
/* If kr->ccname is cache collection (DIR:/...), we want to work
* directly with file ccache (DIR::/...), but cache collection
* should be returned back to back end.
@@ -2146,6 +2166,7 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
size_t p = 0;
uint32_t len;
uint32_t validate;
+ uint32_t posix_domain;
uint32_t send_pac;
uint32_t use_enterprise_princ;
struct pam_data *pd;
@@ -2167,6 +2188,8 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
SAFEALIGN_COPY_UINT32_CHECK(&kr->gid, buf + p, size, &p);
SAFEALIGN_COPY_UINT32_CHECK(&validate, buf + p, size, &p);
kr->validate = (validate == 0) ? false : true;
+ SAFEALIGN_COPY_UINT32_CHECK(&posix_domain, buf + p, size, &p);
+ kr->posix_domain = (posix_domain == 0) ? false : true;
SAFEALIGN_COPY_UINT32_CHECK(offline, buf + p, size, &p);
SAFEALIGN_COPY_UINT32_CHECK(&send_pac, buf + p, size, &p);
kr->send_pac = (send_pac == 0) ? false : true;
@@ -2331,6 +2354,7 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
krb5_context ctx,
uid_t fast_uid,
gid_t fast_gid,
+ bool posix_domain,
struct cli_opts *cli_opts,
const char *primary,
const char *realm,
@@ -2420,7 +2444,7 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
/* Try to carry on */
}
- kerr = become_user(fast_uid, fast_gid);
+ kerr = k5c_become_user(fast_uid, fast_gid, posix_domain);
if (kerr != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed: %d\n", kerr);
exit(1);
@@ -2572,7 +2596,7 @@ static int k5c_setup_fast(struct krb5_req *kr, bool demand)
}
kerr = check_fast_ccache(kr, kr->ctx, kr->fast_uid, kr->fast_gid,
- kr->cli_opts,
+ kr->posix_domain, kr->cli_opts,
fast_principal, fast_principal_realm,
kr->keytab, &kr->fast_ccname);
if (kerr != 0) {
@@ -2773,7 +2797,7 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
* the user who is logging in. The same applies to the offline case
* the user who is logging in. The same applies to the offline case.
*/
- kerr = become_user(kr->uid, kr->gid);
+ kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
if (kerr != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed.\n");
return kerr;
@@ -3075,7 +3099,7 @@ int main(int argc, const char *argv[])
if ((sss_authtok_get_type(kr->pd->authtok) != SSS_AUTHTOK_TYPE_SC_PIN
&& sss_authtok_get_type(kr->pd->authtok)
!= SSS_AUTHTOK_TYPE_SC_KEYPAD)) {
- kerr = become_user(kr->uid, kr->gid);
+ kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
if (kerr != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed.\n");
ret = EFAULT;
diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
index 680e67b089fcb32280352af24aae35af133a52f3..87e79a06e917aadb622455bccfc2e9c6769f70c2 100644
--- a/src/providers/krb5/krb5_child_handler.c
+++ b/src/providers/krb5/krb5_child_handler.c
@@ -107,6 +107,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
uint32_t validate;
uint32_t send_pac;
uint32_t use_enterprise_principal;
+ uint32_t posix_domain;
size_t username_len = 0;
errno_t ret;
@@ -131,6 +132,17 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
break;
}
+ switch (kr->dom->type) {
+ case DOM_TYPE_POSIX:
+ posix_domain = 1;
+ break;
+ case DOM_TYPE_APPLICATION:
+ posix_domain = 0;
+ break;
+ default:
+ return EINVAL;
+ }
+
if (kr->pd->cmd == SSS_CMD_RENEW || kr->is_offline) {
use_enterprise_principal = false;
} else {
@@ -151,7 +163,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
kr->pd->cmd == SSS_CMD_RENEW ||
kr->pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM ||
kr->pd->cmd == SSS_PAM_CHAUTHTOK) {
- buf->size += 4*sizeof(uint32_t) + strlen(kr->ccname) + strlen(keytab) +
+ buf->size += 5*sizeof(uint32_t) + strlen(kr->ccname) + strlen(keytab) +
sss_authtok_get_size(kr->pd->authtok);
buf->size += sizeof(uint32_t);
@@ -182,6 +194,7 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->uid, &rp);
SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->gid, &rp);
SAFEALIGN_COPY_UINT32(&buf->data[rp], &validate, &rp);
+ SAFEALIGN_COPY_UINT32(&buf->data[rp], &posix_domain, &rp);
SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->is_offline, &rp);
SAFEALIGN_COPY_UINT32(&buf->data[rp], &send_pac, &rp);
SAFEALIGN_COPY_UINT32(&buf->data[rp], &use_enterprise_principal, &rp);
diff --git a/src/providers/krb5/krb5_delayed_online_authentication.c b/src/providers/krb5/krb5_delayed_online_authentication.c
index bf2ef775573ba6bad79a99ad43b5d9748516e794..1cb7eade0e4cb9afbc4d031a07b3519ba08456d6 100644
--- a/src/providers/krb5/krb5_delayed_online_authentication.c
+++ b/src/providers/krb5/krb5_delayed_online_authentication.c
@@ -234,6 +234,7 @@ static void delayed_online_authentication_callback(void *private_data)
}
errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
+ struct sss_domain_info *domain,
struct pam_data *pd,
uid_t uid)
{
@@ -242,6 +243,12 @@ errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
hash_value_t value;
struct pam_data *new_pd;
+ if (domain->type != DOM_TYPE_POSIX) {
+ DEBUG(SSSDBG_MINOR_FAILURE,
+ "Domain type does not support delayed authentication\n");
+ return ENOTSUP;
+ }
+
if (krb5_ctx->deferred_auth_ctx == NULL) {
DEBUG(SSSDBG_CRIT_FAILURE,
"Missing context for delayed online authentication.\n");
diff --git a/src/providers/krb5/krb5_init.c b/src/providers/krb5/krb5_init.c
index 12c8dfcc49af75de619ec0858aaff81504698273..66ae68fb4773af3987f2062246bc6493107c74d5 100644
--- a/src/providers/krb5/krb5_init.c
+++ b/src/providers/krb5/krb5_init.c
@@ -136,6 +136,9 @@ errno_t sssm_krb5_init(TALLOC_CTX *mem_ctx,
return ENOMEM;
}
+ /* Only needed to generate random ccache names for non-POSIX domains */
+ srand(time(NULL) * getpid());
+
ret = sss_krb5_get_options(ctx, be_ctx->cdb, be_ctx->conf_path, &ctx->opts);
if (ret != EOK) {
DEBUG(SSSDBG_CRIT_FAILURE, "Unable to get krb5 options [%d]: %s\n",
--
2.9.3