Add MIT kerberos tracing capability
authorSwen Schillig <swen@linux.ibm.com>
Wed, 5 Dec 2018 09:29:44 +0000 (10:29 +0100)
committerChristof Schmitt <cs@samba.org>
Wed, 19 Dec 2018 20:49:29 +0000 (21:49 +0100)
HEIMDAL kerberos offers already tracing via a logging facility
through smb_krb5_init_context().
MIT kerberos offers to register a callback via krb5_set_trace_callback
with which tracing information can be routed to a common logging facility.
This is now integrated into smb_krb5_init_context_basic() offering
the same functionality for both kerberos fragrances.

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
lib/krb5_wrap/krb5_samba.c
lib/krb5_wrap/krb5_samba.h
source4/auth/kerberos/krb5_init_context.c

index b242510..3ea053b 100644 (file)
@@ -3571,6 +3571,45 @@ failed:
        return retval;
 }
 
+#ifndef SAMBA4_USES_HEIMDAL /* MITKRB5 tracing callback */
+static void smb_krb5_trace_cb(krb5_context ctx,
+                             const krb5_trace_info *info,
+                             void *data)
+{
+       if (info != NULL) {
+               DBGC_DEBUG(DBGC_KERBEROS, "%s", info->message);
+       }
+}
+#endif
+
+krb5_error_code smb_krb5_init_context_common(krb5_context *_krb5_context)
+{
+       krb5_error_code ret;
+       krb5_context krb5_ctx;
+
+       initialize_krb5_error_table();
+
+       ret = krb5_init_context(&krb5_ctx);
+       if (ret) {
+               DBG_ERR("Krb5 context initialization failed (%s)\n",
+                        error_message(ret));
+               return ret;
+       }
+
+       /* The MIT Kerberos build relies on using the system krb5.conf file.
+        * If you really want to use another file please set KRB5_CONFIG
+        * accordingly. */
+#ifndef SAMBA4_USES_HEIMDAL
+       ret = krb5_set_trace_callback(krb5_ctx, smb_krb5_trace_cb, NULL);
+       if (ret) {
+               DBG_ERR("Failed to set MIT kerberos trace callback! (%s)\n",
+                       error_message(ret));
+       }
+#endif
+       *_krb5_context = krb5_ctx;
+       return 0;
+}
+
 #else /* HAVE_KRB5 */
 /* This saves a few linking headaches */
 int ads_krb5_cli_get_ticket(TALLOC_CTX *mem_ctx,
index ebbcba9..b6ee04f 100644 (file)
@@ -143,6 +143,8 @@ krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
                                      krb5_const_principal principal,
                                      char **unix_name);
 
+krb5_error_code smb_krb5_init_context_common(krb5_context *_krb5_context);
+
 krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc);
 
 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
index 7e75d43..fff261d 100644 (file)
@@ -478,12 +478,8 @@ smb_krb5_init_context_basic(TALLOC_CTX *tmp_ctx,
 #endif
        krb5_context krb5_ctx;
 
-       initialize_krb5_error_table();
-
-       ret = krb5_init_context(&krb5_ctx);
+       ret = smb_krb5_init_context_common(&krb5_ctx);
        if (ret) {
-               DEBUG(1,("krb5_init_context failed (%s)\n",
-                        error_message(ret)));
                return ret;
        }