s4:credentials Add the functions needed to do S4U2Self with cli_credentials

A torture test to demonstrate will be added soon.

Andrew Bartlett

diff --git a/source4/auth/credentials/credentials.c b/source4/auth/credentials/credentials.c
index 358ee1b85e6553e93fb200315b35eb9efc689746..5f2658d5bd5eabb6f3e9af50121ed1a2cfe1231d 100644 (file)
--- a/source4/auth/credentials/credentials.c
+++ b/source4/auth/credentials/credentials.c
@@ -63,6 +63,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
        cred->realm = NULL;
        cred->principal = NULL;
        cred->salt_principal = NULL;
+       cred->impersonate_principal = NULL;
+       cred->target_service = NULL;
 
        cred->bind_dn = NULL;
 

diff --git a/source4/auth/credentials/credentials.h b/source4/auth/credentials/credentials.h
index 33de8341c704e606751b666058bbd2325d729a7e..ab4ee2f217858ac64787995a5c1a2722ec6db8fd 100644 (file)
--- a/source4/auth/credentials/credentials.h
+++ b/source4/auth/credentials/credentials.h
@@ -77,6 +77,8 @@ struct cli_credentials {
        const char *realm;
        const char *principal;
        char *salt_principal;
+       char *impersonate_principal;
+       char *target_service;
 
        const char *bind_dn;
 
@@ -268,6 +270,11 @@ bool cli_credentials_parse_password_fd(struct cli_credentials *credentials,
 void cli_credentials_invalidate_ccache(struct cli_credentials *cred, 
                                       enum credentials_obtained obtained);
 void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal);
+void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal);
+void cli_credentials_set_target_service(struct cli_credentials *cred, const char *principal);
+const char *cli_credentials_get_salt_principal(struct cli_credentials *cred);
+const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred);
+const char *cli_credentials_get_target_service(struct cli_credentials *cred);
 enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds);
 NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred, 
                                     struct tevent_context *event_ctx,

diff --git a/source4/auth/credentials/credentials_krb5.c b/source4/auth/credentials/credentials_krb5.c
index d8ce0e58e2f2b2bdf5216827348c3b867740081a..1e0db3cb36f35a775bf1e4d2414179df01b5b1de 100644 (file)
--- a/source4/auth/credentials/credentials_krb5.c
+++ b/source4/auth/credentials/credentials_krb5.c
@@ -802,4 +802,42 @@ _PUBLIC_ void cli_credentials_set_salt_principal(struct cli_credentials *cred, c
        cred->salt_principal = talloc_strdup(cred, principal);
 }
 
+/* The 'impersonate_principal' is used to allow on Kerberos principal
+ * (and it's associated keytab etc) to impersonate another.  The
+ * ability to do this is controlled by the KDC, but it is generally
+ * permitted to impersonate anyone to yourself.  This allows any
+ * member of the domain to get the groups of a user.  This is also
+ * known as S4U2Self */
+
+const char *cli_credentials_get_impersonate_principal(struct cli_credentials *cred)
+{
+       return cred->impersonate_principal;
+}
+
+_PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials *cred, const char *principal)
+{
+       talloc_free(cred->impersonate_principal);
+       cred->impersonate_principal = talloc_strdup(cred, principal);
+}
+
+/* when impersonating for S4U2Self we need to set the target principal
+ * to ourself, as otherwise we would need additional rights.
+ * Similarly, we may only be authorized to do general impersonation to
+ * some particular services.
+ *
+ * Likewise, password changes typically require a ticket to kpasswd/realm directly, not via a TGT
+ *
+ * NULL means that tickets will be obtained for the krbtgt service.
+*/
+
+const char *cli_credentials_get_target_service(struct cli_credentials *cred)
+{
+       return cred->target_service;
+}
+
+_PUBLIC_ void cli_credentials_set_target_service(struct cli_credentials *cred, const char *target_service)
+{
+       talloc_free(cred->target_service);
+       cred->target_service = talloc_strdup(cred, target_service);
+}
 

diff --git a/source4/auth/kerberos/kerberos.c b/source4/auth/kerberos/kerberos.c
index d4549ee88a001932d877fa19a50259fdd68f577d..42757640f24b0c73a949de2863c12755f71e4185 100644 (file)
--- a/source4/auth/kerberos/kerberos.c
+++ b/source4/auth/kerberos/kerberos.c
@@ -33,10 +33,15 @@
  
   This version is built to use a keyblock, rather than needing the
   original password.
+
+  The impersonate_principal is the principal if NULL, or the principal to impersonate
+
+  The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self)
 */
  krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, 
-                               krb5_principal principal, krb5_keyblock *keyblock,
-                               time_t *expire_time, time_t *kdc_time)
+                                           krb5_principal principal, krb5_keyblock *keyblock,
+                                           const char *target_service,
+                                           time_t *expire_time, time_t *kdc_time)
 {
        krb5_error_code code = 0;
        krb5_creds my_creds;
@@ -49,7 +54,7 @@
        krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options);
 
        if ((code = krb5_get_init_creds_keyblock(ctx, &my_creds, principal, keyblock,
-                                                0, NULL, options))) {
+                                                0, target_service, options))) {
                return code;
        }
        
@@ -82,36 +87,49 @@
 /*
   simulate a kinit, putting the tgt in the given credentials cache. 
   Orignally by remus@snapserver.com
+
+  The impersonate_principal is the principal if NULL, or the principal to impersonate
+
+  The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self)
+
 */
  krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc, 
                                            krb5_principal principal, const char *password,
+                                           krb5_principal impersonate_principal, const char *target_service,
                                            time_t *expire_time, time_t *kdc_time)
 {
        krb5_error_code code = 0;
        krb5_creds my_creds;
-       krb5_get_init_creds_opt *options;
+       krb5_creds *impersonate_creds;
+       krb5_get_init_creds_opt *init_options;
+       krb5_get_creds_opt options;
 
-       if ((code = krb5_get_init_creds_opt_alloc(ctx, &options))) {
+       if ((code = krb5_get_init_creds_opt_alloc(ctx, &init_options))) {
                return code;
        }
 
-       krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, options);
+       krb5_get_init_creds_opt_set_default_flags(ctx, NULL, NULL, init_options);
 
+       /* If we are not impersonating, then get this ticket for the
+        * target service, otherwise a krbtgt, and get the next ticket
+        * for the target */
        if ((code = krb5_get_init_creds_password(ctx, &my_creds, principal, password, 
-                                                NULL, 
-                                                NULL, 0, NULL, options))) {
-               krb5_get_init_creds_opt_free(ctx, options);
+                                                NULL, NULL,
+                                                0,
+                                                impersonate_principal ? NULL : target_service,
+                                                init_options))) {
+               krb5_get_init_creds_opt_free(ctx, init_options);
                return code;
        }
-       
+
        if ((code = krb5_cc_initialize(ctx, cc, principal))) {
-               krb5_get_init_creds_opt_free(ctx, options);
+               krb5_get_init_creds_opt_free(ctx, init_options);
                krb5_free_cred_contents(ctx, &my_creds);
                return code;
        }
        
        if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
-               krb5_get_init_creds_opt_free(ctx, options);
+               krb5_get_init_creds_opt_free(ctx, init_options);
                krb5_free_cred_contents(ctx, &my_creds);
                return code;
        }
@@ -124,9 +142,44 @@
                *kdc_time = (time_t) my_creds.times.starttime;
        }
 
-       krb5_get_init_creds_opt_free(ctx, options);
+       krb5_get_init_creds_opt_free(ctx, init_options);
        krb5_free_cred_contents(ctx, &my_creds);
        
+       if (code == 0 && impersonate_principal) {
+               krb5_principal target_princ;
+               if ((code = krb5_get_creds_opt_alloc(ctx, &options))) {
+                       return code;
+               }
+
+               if ((code = krb5_get_creds_opt_set_impersonate(ctx, options, impersonate_principal))) {
+                       krb5_get_creds_opt_free(ctx, options);
+                       return code;
+               }
+
+               if ((code = krb5_parse_name(ctx, target_service, &target_princ))) {
+                       krb5_get_creds_opt_free(ctx, options);
+                       return code;
+               }
+
+               if ((code = krb5_principal_set_realm(ctx, target_princ, krb5_principal_get_realm(ctx, principal)))) {
+                       krb5_get_creds_opt_free(ctx, options);
+                       krb5_free_principal(ctx, target_princ);
+                       return code;
+               }
+
+               if ((code = krb5_get_creds(ctx, options, cc, target_princ, &impersonate_creds))) {
+                       krb5_free_principal(ctx, target_princ);
+                       krb5_get_creds_opt_free(ctx, options);
+                       return code;
+               }
+
+               krb5_free_principal(ctx, target_princ);
+
+               code = krb5_cc_store_cred(ctx, cc, impersonate_creds);
+               krb5_get_creds_opt_free(ctx, options);
+               krb5_free_creds(ctx, impersonate_creds);
+       }
+
        return 0;
 }
 

diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
index 498da0f9c2aec28c0fac7b7fce52ef86cdd37a20..992b509dbf70d95ea894e0252fd601fd4950af61 100644 (file)
--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
@@ -88,11 +88,13 @@ krb5_error_code ads_krb5_mk_req(krb5_context context,
                                krb5_ccache ccache, 
                                krb5_data *outbuf);
 bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
-int kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc, 
-                              krb5_principal principal, const char *password, 
-                              time_t *expire_time, time_t *kdc_time);
-int kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, 
+krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
+                                          krb5_principal principal, const char *password,
+                                          krb5_principal impersonate_principal, const char *target_service,
+                                          time_t *expire_time, time_t *kdc_time);
+krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
                               krb5_principal principal, krb5_keyblock *keyblock,
+                              const char *target_service,
                               time_t *expire_time, time_t *kdc_time);
 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
                                                        krb5_principal host_princ,
@@ -107,6 +109,11 @@ char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TAL
                                 struct smb_krb5_context *smb_krb5_context,
                                 krb5_ccache ccache,
                                 const char **error_string);
+krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
+                                                      struct cli_credentials *credentials,
+                                                      struct smb_krb5_context *smb_krb5_context,
+                                                      krb5_principal *princ,
+                                                      const char **error_string);
 krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx, 
                                           struct cli_credentials *credentials, 
                                           struct smb_krb5_context *smb_krb5_context,

diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
index 494f36dec7aad0b864e0756ba03d6e67f578e125..44d97b7f08f787d6cca1e6910f7c430cf558b69c 100644 (file)
--- a/source4/auth/kerberos/kerberos_util.c
+++ b/source4/auth/kerberos/kerberos_util.c
@@ -40,6 +40,42 @@ static krb5_error_code free_principal(struct principal_container *pc)
        return 0;
 }
 
+
+static krb5_error_code parse_principal(TALLOC_CTX *parent_ctx,
+                                      const char *princ_string,
+                                      struct smb_krb5_context *smb_krb5_context,
+                                      krb5_principal *princ,
+                                      const char **error_string)
+{
+       int ret;
+       struct principal_container *mem_ctx;
+       if (princ_string == NULL) {
+                *princ = NULL;
+                return 0;
+       }
+
+       ret = krb5_parse_name(smb_krb5_context->krb5_context,
+                             princ_string, princ);
+
+       if (ret) {
+               (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
+               return ret;
+       }
+
+       mem_ctx = talloc(parent_ctx, struct principal_container);
+       if (!mem_ctx) {
+               (*error_string) = error_message(ENOMEM);
+               return ENOMEM;
+       }
+
+       /* This song-and-dance effectivly puts the principal
+        * into talloc, so we can't loose it. */
+       mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+       mem_ctx->principal = *princ;
+       talloc_set_destructor(mem_ctx, free_principal);
+       return 0;
+}
+
 static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, 
                                                       struct cli_credentials *machine_account, 
                                                       struct smb_krb5_context *smb_krb5_context,
@@ -50,6 +86,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
        char *salt_body;
        char *lower_realm;
        const char *salt_principal;
+       const char *error_string;
        struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
        if (!mem_ctx) {
                return ENOMEM;
@@ -57,7 +94,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
 
        salt_principal = cli_credentials_get_salt_principal(machine_account);
        if (salt_principal) {
-               ret = krb5_parse_name(smb_krb5_context->krb5_context, salt_principal, salt_princ); 
+               ret = parse_principal(parent_ctx, salt_principal, smb_krb5_context, salt_princ, &error_string);
        } else {
                machine_username = talloc_strdup(mem_ctx, cli_credentials_get_username(machine_account));
                
@@ -85,15 +122,15 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
                ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ, 
                                          cli_credentials_get_realm(machine_account), 
                                          "host", salt_body, NULL);
+               if (ret == 0) {
+                       /* This song-and-dance effectivly puts the principal
+                        * into talloc, so we can't loose it. */
+                       mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
+                       mem_ctx->principal = *salt_princ;
+                       talloc_set_destructor(mem_ctx, free_principal);
+               }
        } 
 
-       if (ret == 0) {
-               /* This song-and-dance effectivly puts the principal
-                * into talloc, so we can't loose it. */
-               mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
-               mem_ctx->principal = *salt_princ;
-               talloc_set_destructor(mem_ctx, free_principal);
-       }
        return ret;
 }
 
@@ -110,36 +147,36 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
 {
        krb5_error_code ret;
        const char *princ_string;
-       struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
+       TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
        if (!mem_ctx) {
                (*error_string) = error_message(ENOMEM);
                return ENOMEM;
        }
-       
        princ_string = cli_credentials_get_principal(credentials, mem_ctx);
-
-       /* A NULL here has meaning, as the gssapi server case will
-        * then use the principal from the client */
        if (!princ_string) {
-               talloc_free(mem_ctx);
-               princ = NULL;
-               return 0;
+               (*error_string) = error_message(ENOMEM);
+               return ENOMEM;
        }
 
-       ret = krb5_parse_name(smb_krb5_context->krb5_context,
-                             princ_string, princ);
+       ret = parse_principal(parent_ctx, princ_string,
+                             smb_krb5_context, princ, error_string);
+       talloc_free(mem_ctx);
+       return ret;
+}
 
-       if (ret) {
-               (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
-               return ret;
-       }
+/* Obtain the principal set on this context.  Requires a
+ * smb_krb5_context because we are doing krb5 principal parsing with
+ * the library routines.  The returned princ is placed in the talloc
+ * system by means of a destructor (do *not* free). */
 
-       /* This song-and-dance effectivly puts the principal
-        * into talloc, so we can't loose it. */
-       mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
-       mem_ctx->principal = *princ;
-       talloc_set_destructor(mem_ctx, free_principal);
-       return 0;
+ krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
+                                                       struct cli_credentials *credentials,
+                                                       struct smb_krb5_context *smb_krb5_context,
+                                                       krb5_principal *princ,
+                                                       const char **error_string)
+{
+       return parse_principal(parent_ctx, cli_credentials_get_impersonate_principal(credentials),
+                              smb_krb5_context, princ, error_string);
 }
 
 /**
@@ -154,9 +191,10 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
                                 const char **error_string)
 {
        krb5_error_code ret;
-       const char *password;
+       const char *password, *target_service;
        time_t kdc_time = 0;
        krb5_principal princ;
+       krb5_principal impersonate_principal;
        int tries;
        TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 
@@ -171,14 +209,26 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
                return ret;
        }
 
+       ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string);
+       if (ret) {
+               talloc_free(mem_ctx);
+               return ret;
+       }
+
+       target_service = cli_credentials_get_target_service(credentials);
+
        password = cli_credentials_get_password(credentials);
 
        tries = 2;
        while (tries--) {
                if (password) {
                        ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, ccache, 
-                                                        princ, 
-                                                        password, NULL, &kdc_time);
+                                                        princ, password,
+                                                        impersonate_principal, target_service,
+                                                        NULL, &kdc_time);
+               } else if (impersonate_principal) {
+                       (*error_string) = "INTERNAL error: Cannot impersonate principal with just a keyblock.  A password must be specified in the credentials";
+                       return EINVAL;
                } else {
                        /* No password available, try to use a keyblock instead */
                        
@@ -197,8 +247,9 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
                        
                        if (ret == 0) {
                                ret = kerberos_kinit_keyblock_cc(smb_krb5_context->krb5_context, ccache, 
-                                                                princ,
-                                                                &keyblock, NULL, &kdc_time);
+                                                                princ, &keyblock,
+                                                                target_service,
+                                                                NULL, &kdc_time);
                                krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &keyblock);
                        }
                }