auth/kerberos: Create common helper to get the verified PAC from GSSAPI
[samba.git] / auth / kerberos / gssapi_pac.c
1 /*
2    Unix SMB/CIFS implementation.
3    kerberos authorization data (PAC) utility library
4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2011
5    Copyright (C) Simo Sorce 2010.
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #ifdef HAVE_KRB5
23
24 #include "libcli/auth/krb5_wrap.h"
25
26 /* The Heimdal OID for getting the PAC */
27 #define EXTRACT_PAC_AUTHZ_DATA_FROM_SEC_CONTEXT_OID_LENGTH 8
28 /*                                                      EXTRACTION OID             AUTHZ ID */
29 #define EXTRACT_PAC_AUTHZ_DATA_FROM_SEC_CONTEXT_OID "\x2a\x85\x70\x2b\x0d\x03" "\x81\x00"
30
31 static gss_OID_desc pac_data_oid = {
32         EXTRACT_PAC_AUTHZ_DATA_FROM_SEC_CONTEXT_OID_LENGTH,
33         (void *)EXTRACT_PAC_AUTHZ_DATA_FROM_SEC_CONTEXT_OID
34 };
35
36 NTSTATUS gssapi_obtain_pac_blob(TALLOC_CTX *mem_ctx,
37                                 gss_ctx_id_t gssapi_context,
38                                 gss_name_t gss_client_name,
39                                 DATA_BLOB *pac_blob)
40 {
41         OM_uint32 gss_maj, gss_min;
42         gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
43         gss_buffer_desc pac_buffer;
44         gss_buffer_desc pac_display_buffer;
45         gss_buffer_desc pac_name = {
46                 .value = "urn:mspac:",
47                 .length = sizeof("urn:mspac:")-1
48         };
49         NTSTATUS status;
50         int more = -1;
51         int authenticated = false;
52         int complete = false;
53
54 #ifdef HAVE_GSS_GET_NAME_ATTRIBUTE
55         gss_maj = gss_get_name_attribute(
56                 &gss_min, gss_client_name, &pac_name,
57                 &authenticated, &complete,
58                 &pac_buffer, &pac_display_buffer, &more);
59
60         if (gss_maj != 0) {
61                 DEBUG(0, ("obtaining PAC via GSSAPI gss_get_name_attribute failed: %s\n",
62                           gssapi_error_string(mem_ctx, gss_maj, gss_min, gss_mech_krb5)));
63                 return NT_STATUS_ACCESS_DENIED;
64         } else if (authenticated && complete) {
65                 /* The PAC blob is returned directly */
66                 *pac_blob = data_blob_talloc(mem_ctx, pac_buffer.value,
67                                             pac_buffer.length);
68
69                 if (!pac_blob->data) {
70                         status = NT_STATUS_NO_MEMORY;
71                 } else {
72                         status = NT_STATUS_OK;
73                 }
74
75                 gss_maj = gss_release_buffer(&gss_min, &pac_buffer);
76                 gss_maj = gss_release_buffer(&gss_min, &pac_display_buffer);
77                 return status;
78         } else {
79                 DEBUG(0, ("obtaining PAC via GSSAPI failed: authenticated: %s, complete: %s, more: %s\n",
80                           authenticated ? "true" : "false",
81                           complete ? "true" : "false",
82                           more ? "true" : "false"));
83                 return NT_STATUS_ACCESS_DENIED;
84         }
85
86 #endif
87         /* If we didn't have the routine to get a verified, validated
88          * PAC (supplied only by MIT at the time of writing), then try
89          * with the Heimdal OID (fetches the PAC directly and always
90          * validates) */
91         gss_maj = gss_inquire_sec_context_by_oid(
92                                 &gss_min, gssapi_context,
93                                 &pac_data_oid, &set);
94
95         /* First check for the error MIT gives for an unknown OID */
96         if (gss_maj == GSS_S_UNAVAILABLE) {
97                 DEBUG(1, ("unable to obtain a PAC against this GSSAPI library.  "
98                           "GSSAPI secured connections are available only with Heimdal or MIT Kerberos >= 1.8\n"));
99         } else if (gss_maj != 0) {
100                 DEBUG(2, ("obtaining PAC via GSSAPI gss_inqiure_sec_context_by_oid (Heimdal OID) failed: %s\n",
101                           gssapi_error_string(mem_ctx, gss_maj, gss_min, gss_mech_krb5)));
102         } else {
103                 if (set == GSS_C_NO_BUFFER_SET) {
104                         DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
105                                   "data in results.\n"));
106                         return NT_STATUS_INTERNAL_ERROR;
107                 }
108
109                 /* The PAC blob is returned directly */
110                 *pac_blob = data_blob_talloc(mem_ctx, set->elements[0].value,
111                                             set->elements[0].length);
112                 if (!pac_blob->data) {
113                         status = NT_STATUS_NO_MEMORY;
114                 } else {
115                         status = NT_STATUS_OK;
116                 }
117
118                 gss_maj = gss_release_buffer_set(&gss_min, &set);
119                 return status;
120         }
121         return NT_STATUS_ACCESS_DENIED;
122 }
123 #endif