Move kerberos_kinit_keyblock_cc to krb5samba lib

Make it also work with MIT where krb5_get_in_tkt_with_keyblock is not
available.

diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index ffbd8d42ad770a640d4bf5cfdc9fad7bcbdd75b8..c853b7558d68d7275a5633a40e1f7846bfcba435 100644 (file)
--- a/lib/krb5_wrap/krb5_samba.c
+++ b/lib/krb5_wrap/krb5_samba.c
@@ -1555,6 +1555,97 @@ krb5_error_code smb_krb5_get_creds(const char *server_s,
        return ret;
 }
 
+/*
+  simulate a kinit, putting the tgt in the given credentials cache.
+  Orignally by remus@snapserver.com
+
+  This version is built to use a keyblock, rather than needing the
+  original password.
+
+  The impersonate_principal is the principal if NULL, or the principal
+  to impersonate
+
+  The target_service defaults to the krbtgt if NULL, but could be
+   kpasswd/realm or the local service (if we are doing s4u2self)
+*/
+krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
+                                          krb5_principal principal,
+                                          krb5_keyblock *keyblock,
+                                          const char *target_service,
+                                          krb5_get_init_creds_opt *krb_options,
+                                          time_t *expire_time,
+                                          time_t *kdc_time)
+{
+       krb5_error_code code = 0;
+       krb5_creds my_creds;
+
+#if defined(HAVE_KRB5_GET_INIT_CREDS_KEYBLOCK)
+       code = krb5_get_init_creds_keyblock(ctx, &my_creds, principal,
+                                           keyblock, 0, target_service,
+                                           krb_options);
+#elif defined(HAVE_KRB5_GET_INIT_CREDS_KEYTAB)
+{
+#define SMB_CREDS_KEYTAB "MEMORY:tmp_smb_creds_XXXXXX"
+       char tmp_name[sizeof(SMB_CREDS_KEYTAB)];
+       krb5_keytab_entry entry;
+       krb5_keytab keytab;
+
+       memset(&entry, 0, sizeof(entry));
+       entry.principal = principal;
+       *(KRB5_KT_KEY(&entry)) = *keyblock;
+
+       memcpy(tmp_name, SMB_CREDS_KEYTAB, sizeof(SMB_CREDS_KEYTAB));
+       mktemp(tmp_name);
+       if (tmp_name[0] == 0) {
+               return KRB5_KT_BADNAME;
+       }
+       code = krb5_kt_resolve(ctx, tmp_name, &keytab);
+       if (code) {
+               return code;
+       }
+
+       code = krb5_kt_add_entry(ctx, keytab, &entry);
+       if (code) {
+               (void)krb5_kt_close(ctx, keytab);
+               goto done;
+       }
+
+       code = krb5_get_init_creds_keytab(ctx, &my_creds, principal,
+                                         keytab, 0, target_service,
+                                         krb_options);
+       (void)krb5_kt_close(ctx, keytab);
+}
+#else
+#error krb5_get_init_creds_keyblock not available!
+#endif
+       if (code) {
+               return code;
+       }
+
+       code = krb5_cc_initialize(ctx, cc, principal);
+       if (code) {
+               goto done;
+       }
+
+       code = krb5_cc_store_cred(ctx, cc, &my_creds);
+       if (code) {
+               goto done;
+       }
+
+       if (expire_time) {
+               *expire_time = (time_t) my_creds.times.endtime;
+       }
+
+       if (kdc_time) {
+               *kdc_time = (time_t) my_creds.times.starttime;
+       }
+
+       code = 0;
+done:
+       krb5_free_cred_contents(ctx, &my_creds);
+       return code;
+}
+
 /*
  * smb_krb5_principal_get_realm
  *

diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
index 6a0f9dc2fdc6ecedc981aafb0cc9e63180503d42..771c43de44b0ee30a17e9c75cb17fad527cb56f6 100644 (file)
--- a/lib/krb5_wrap/krb5_samba.h
+++ b/lib/krb5_wrap/krb5_samba.h
@@ -198,6 +198,13 @@ krb5_error_code smb_krb5_get_creds(const char *server_s,
                                   const char *cc,
                                   const char *impersonate_princ_s,
                                   krb5_creds **creds_p);
+krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
+                                          krb5_principal principal,
+                                          krb5_keyblock *keyblock,
+                                          const char *target_service,
+                                          krb5_get_init_creds_opt *krb_options,
+                                          time_t *expire_time,
+                                          time_t *kdc_time);
 char *smb_krb5_principal_get_realm(krb5_context context,
                                   krb5_principal principal);
 

diff --git a/source3/configure.in b/source3/configure.in
index 0253e076dce5389e7b6928a07aacc329b8389207..8790ea713b980b8a257bddae6f030d1b0f038772 100644 (file)
--- a/source3/configure.in
+++ b/source3/configure.in
@@ -3614,6 +3614,7 @@ if test x"$with_ads_support" != x"no"; then
   AC_CHECK_FUNC_EXT(krb5_get_credentials_for_user, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(krb5_get_host_realm, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(krb5_free_host_realm, $KRB5_LIBS)
+  AC_CHECK_FUNC_EXT(krb5_get_init_creds_keytab, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(gss_krb5_import_cred, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(gss_get_name_attribute, $KRB5_LIBS)
   AC_CHECK_FUNC_EXT(gsskrb5_extract_authz_data_from_sec_context, $KRB5_LIBS)

diff --git a/source4/auth/kerberos/kerberos.c b/source4/auth/kerberos/kerberos.c
index 0fc9d143abdbe00a92ad4568cbab635f25c0d7fc..b4e989d2aea143209ca605131310f4e63642dfe1 100644 (file)
--- a/source4/auth/kerberos/kerberos.c
+++ b/source4/auth/kerberos/kerberos.c
@@ -27,54 +27,6 @@
 
 #ifdef HAVE_KRB5
 
-/*
-  simulate a kinit, putting the tgt in the given credentials cache. 
-  Orignally by remus@snapserver.com
- 
-  This version is built to use a keyblock, rather than needing the
-  original password.
-
-  The impersonate_principal is the principal if NULL, or the principal to impersonate
-
-  The target_service defaults to the krbtgt if NULL, but could be kpasswd/realm or the local service (if we are doing s4u2self)
-*/
- krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, 
-                                           krb5_principal principal, krb5_keyblock *keyblock,
-                                           const char *target_service,
-                                           krb5_get_init_creds_opt *krb_options,
-                                           time_t *expire_time, time_t *kdc_time)
-{
-       krb5_error_code code = 0;
-       krb5_creds my_creds;
-
-       if ((code = krb5_get_init_creds_keyblock(ctx, &my_creds, principal, keyblock,
-                                                0, target_service, krb_options))) {
-               return code;
-       }
-       
-       if ((code = krb5_cc_initialize(ctx, cc, principal))) {
-               krb5_free_cred_contents(ctx, &my_creds);
-               return code;
-       }
-       
-       if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
-               krb5_free_cred_contents(ctx, &my_creds);
-               return code;
-       }
-       
-       if (expire_time) {
-               *expire_time = (time_t) my_creds.times.endtime;
-       }
-
-       if (kdc_time) {
-               *kdc_time = (time_t) my_creds.times.starttime;
-       }
-
-       krb5_free_cred_contents(ctx, &my_creds);
-       
-       return 0;
-}
-
 /*
   simulate a kinit, putting the tgt in the given credentials cache. 
   Orignally by remus@snapserver.com

diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
index cc02aee27f5fe48612d7866c66d9ad92ca3d320a..018f6b80b10e2a09cf63bb90e6a3bfaf99132698 100644 (file)
--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
@@ -74,13 +74,6 @@ const krb5_data *krb5_princ_component(krb5_context context, krb5_principal princ
 #endif
 
 /* Samba wrapper function for krb5 functionality. */
-krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
-                                          krb5_principal principal, const char *password,
-                                          krb5_principal impersonate_principal,
-                                          const char *self_service,
-                                          const char *target_service,
-                                          krb5_get_init_creds_opt *krb_options,
-                                          time_t *expire_time, time_t *kdc_time);
 krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
                                           krb5_principal principal, krb5_keyblock *keyblock,
                                           const char *target_service,

diff --git a/source4/heimdal_build/wscript_configure b/source4/heimdal_build/wscript_configure
old mode 100644 (file)
new mode 100755 (executable)
index 1c03b34..6383880
--- a/source4/heimdal_build/wscript_configure
+++ b/source4/heimdal_build/wscript_configure
@@ -114,6 +114,7 @@ conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC', 1)
 conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_FREE', 1)
 conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR', 1)
 conf.define('HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST', 1)
+conf.define('HAVE_KRB5_GET_INIT_CREDS_KEYBLOCK', 1)
 conf.define('HAVE_KRB5_GET_PW_SALT', 1)
 conf.define('HAVE_KRB5_GET_RENEWED_CREDS', 1)
 conf.define('HAVE_KRB5_KEYBLOCK_KEYVALUE', 1)

diff --git a/wscript_configure_krb5 b/wscript_configure_krb5
index 2fb1c586fd256270e1f48fb4e98ef0f2f52b00c8..1faa212e5fbd18767fa26cd8153819484e9c557b 100644 (file)
--- a/wscript_configure_krb5
+++ b/wscript_configure_krb5
@@ -57,7 +57,8 @@ conf.CHECK_FUNCS('''
        krb5_get_init_creds_opt_free krb5_get_init_creds_opt_get_error
        krb5_enctype_to_string krb5_fwd_tgt_creds krb5_auth_con_set_req_cksumtype
        krb5_get_creds_opt_alloc krb5_get_creds_opt_set_impersonate krb5_get_creds
-       krb5_get_credentials_for_user krb5_get_host_realm krb5_free_host_realm''',
+       krb5_get_credentials_for_user krb5_get_host_realm krb5_free_host_realm
+       krb5_get_init_creds_keyblock krb5_get_init_creds_keytab''',
      lib='krb5 k5crypto')
 conf.CHECK_DECLS('''krb5_get_credentials_for_user
                     krb5_auth_con_set_req_cksumtype''',