d89a649ff21225089d2fc6533b617bf17a02cb57
[samba.git] / auth / kerberos / gssapi_pac.c
1 /*
2    Unix SMB/CIFS implementation.
3    kerberos authorization data (PAC) utility library
4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2011
5    Copyright (C) Simo Sorce 2010.
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #ifdef HAVE_KRB5
23
24 #include "libcli/auth/krb5_wrap.h"
25
26 /* The Heimdal OID for getting the PAC */
27 #define EXTRACT_PAC_AUTHZ_DATA_FROM_SEC_CONTEXT_OID_LENGTH 8
28 /*                                                      EXTRACTION OID             AUTHZ ID */
29 #define EXTRACT_PAC_AUTHZ_DATA_FROM_SEC_CONTEXT_OID "\x2a\x85\x70\x2b\x0d\x03" "\x81\x00"
30
31 static gss_OID_desc pac_data_oid = {
32         EXTRACT_PAC_AUTHZ_DATA_FROM_SEC_CONTEXT_OID_LENGTH,
33         (void *)EXTRACT_PAC_AUTHZ_DATA_FROM_SEC_CONTEXT_OID
34 };
35
36 NTSTATUS gssapi_obtain_pac_blob(TALLOC_CTX *mem_ctx,
37                                 gss_ctx_id_t gssapi_context,
38                                 gss_name_t gss_client_name,
39                                 DATA_BLOB *pac_blob)
40 {
41         NTSTATUS status;
42         OM_uint32 gss_maj, gss_min;
43 #ifdef HAVE_GSS_GET_NAME_ATTRIBUTE
44         gss_buffer_desc pac_buffer;
45         gss_buffer_desc pac_display_buffer;
46         gss_buffer_desc pac_name = {
47                 .value = "urn:mspac:",
48                 .length = sizeof("urn:mspac:")-1
49         };
50         int more = -1;
51         int authenticated = false;
52         int complete = false;
53
54         gss_maj = gss_get_name_attribute(
55                 &gss_min, gss_client_name, &pac_name,
56                 &authenticated, &complete,
57                 &pac_buffer, &pac_display_buffer, &more);
58
59         if (gss_maj != 0) {
60                 DEBUG(0, ("obtaining PAC via GSSAPI gss_get_name_attribute failed: %s\n",
61                           gssapi_error_string(mem_ctx, gss_maj, gss_min, gss_mech_krb5)));
62                 return NT_STATUS_ACCESS_DENIED;
63         } else if (authenticated && complete) {
64                 /* The PAC blob is returned directly */
65                 *pac_blob = data_blob_talloc(mem_ctx, pac_buffer.value,
66                                             pac_buffer.length);
67
68                 if (!pac_blob->data) {
69                         status = NT_STATUS_NO_MEMORY;
70                 } else {
71                         status = NT_STATUS_OK;
72                 }
73
74                 gss_maj = gss_release_buffer(&gss_min, &pac_buffer);
75                 gss_maj = gss_release_buffer(&gss_min, &pac_display_buffer);
76                 return status;
77         } else {
78                 DEBUG(0, ("obtaining PAC via GSSAPI failed: authenticated: %s, complete: %s, more: %s\n",
79                           authenticated ? "true" : "false",
80                           complete ? "true" : "false",
81                           more ? "true" : "false"));
82                 return NT_STATUS_ACCESS_DENIED;
83         }
84
85 #elif defined(HAVE_GSS_INQUIRE_SEC_CONTEXT_BY_OID)
86
87         gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
88
89         /* If we didn't have the routine to get a verified, validated
90          * PAC (supplied only by MIT at the time of writing), then try
91          * with the Heimdal OID (fetches the PAC directly and always
92          * validates) */
93         gss_maj = gss_inquire_sec_context_by_oid(
94                                 &gss_min, gssapi_context,
95                                 &pac_data_oid, &set);
96
97         /* First check for the error MIT gives for an unknown OID */
98         if (gss_maj == GSS_S_UNAVAILABLE) {
99                 DEBUG(1, ("unable to obtain a PAC against this GSSAPI library.  "
100                           "GSSAPI secured connections are available only with Heimdal or MIT Kerberos >= 1.8\n"));
101         } else if (gss_maj != 0) {
102                 DEBUG(2, ("obtaining PAC via GSSAPI gss_inqiure_sec_context_by_oid (Heimdal OID) failed: %s\n",
103                           gssapi_error_string(mem_ctx, gss_maj, gss_min, gss_mech_krb5)));
104         } else {
105                 if (set == GSS_C_NO_BUFFER_SET) {
106                         DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
107                                   "data in results.\n"));
108                         return NT_STATUS_INTERNAL_ERROR;
109                 }
110
111                 /* The PAC blob is returned directly */
112                 *pac_blob = data_blob_talloc(mem_ctx, set->elements[0].value,
113                                             set->elements[0].length);
114                 if (!pac_blob->data) {
115                         status = NT_STATUS_NO_MEMORY;
116                 } else {
117                         status = NT_STATUS_OK;
118                 }
119
120                 gss_maj = gss_release_buffer_set(&gss_min, &set);
121                 return status;
122         }
123 #else
124         DEBUG(1, ("unable to obtain a PAC against this GSSAPI library.  "
125                   "GSSAPI secured connections are available only with Heimdal or MIT Kerberos >= 1.8\n"));
126 #endif
127         return NT_STATUS_ACCESS_DENIED;
128 }
129 #endif