2 Unix SMB/CIFS implementation.
4 Handle user credentials (as regards krb5)
6 Copyright (C) Jelmer Vernooij 2005
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "system/kerberos.h"
26 #include "system/gssapi.h"
27 #include "auth/kerberos/kerberos.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/credentials/credentials_internal.h"
30 #include "auth/credentials/credentials_proto.h"
31 #include "auth/credentials/credentials_krb5.h"
32 #include "auth/kerberos/kerberos_credentials.h"
33 #include "auth/kerberos/kerberos_srv_keytab.h"
34 #include "auth/kerberos/kerberos_util.h"
35 #include "auth/kerberos/pac_utils.h"
36 #include "param/param.h"
38 static void cli_credentials_invalidate_client_gss_creds(
39 struct cli_credentials
*cred
,
40 enum credentials_obtained obtained
);
42 _PUBLIC_
int cli_credentials_get_krb5_context(struct cli_credentials
*cred
,
43 struct loadparm_context
*lp_ctx
,
44 struct smb_krb5_context
**smb_krb5_context
)
47 if (cred
->smb_krb5_context
) {
48 *smb_krb5_context
= cred
->smb_krb5_context
;
52 ret
= smb_krb5_init_context(cred
, lp_ctx
,
53 &cred
->smb_krb5_context
);
55 cred
->smb_krb5_context
= NULL
;
58 *smb_krb5_context
= cred
->smb_krb5_context
;
62 /* For most predictable behaviour, this needs to be called directly after the cli_credentials_init(),
63 * otherwise we may still have references to the old smb_krb5_context in a credential cache etc
65 _PUBLIC_ NTSTATUS
cli_credentials_set_krb5_context(struct cli_credentials
*cred
,
66 struct smb_krb5_context
*smb_krb5_context
)
68 if (smb_krb5_context
== NULL
) {
69 talloc_unlink(cred
, cred
->smb_krb5_context
);
70 cred
->smb_krb5_context
= NULL
;
74 if (!talloc_reference(cred
, smb_krb5_context
)) {
75 return NT_STATUS_NO_MEMORY
;
77 cred
->smb_krb5_context
= smb_krb5_context
;
81 static int cli_credentials_set_from_ccache(struct cli_credentials
*cred
,
82 struct ccache_container
*ccache
,
83 enum credentials_obtained obtained
,
84 const char **error_string
)
91 if (cred
->ccache_obtained
> obtained
) {
95 ret
= krb5_cc_get_principal(ccache
->smb_krb5_context
->krb5_context
,
96 ccache
->ccache
, &princ
);
99 (*error_string
) = talloc_asprintf(cred
, "failed to get principal from ccache: %s\n",
100 smb_get_krb5_error_message(ccache
->smb_krb5_context
->krb5_context
,
105 ret
= krb5_unparse_name(ccache
->smb_krb5_context
->krb5_context
, princ
, &name
);
107 (*error_string
) = talloc_asprintf(cred
, "failed to unparse principal from ccache: %s\n",
108 smb_get_krb5_error_message(ccache
->smb_krb5_context
->krb5_context
,
113 cli_credentials_set_principal(cred
, name
, obtained
);
117 krb5_free_principal(ccache
->smb_krb5_context
->krb5_context
, princ
);
119 /* set the ccache_obtained here, as it just got set to UNINITIALISED by the calls above */
120 cred
->ccache_obtained
= obtained
;
125 /* Free a memory ccache */
126 static int free_mccache(struct ccache_container
*ccc
)
128 krb5_cc_destroy(ccc
->smb_krb5_context
->krb5_context
, ccc
->ccache
);
133 /* Free a disk-based ccache */
134 static int free_dccache(struct ccache_container
*ccc
) {
135 krb5_cc_close(ccc
->smb_krb5_context
->krb5_context
, ccc
->ccache
);
140 _PUBLIC_
int cli_credentials_set_ccache(struct cli_credentials
*cred
,
141 struct loadparm_context
*lp_ctx
,
143 enum credentials_obtained obtained
,
144 const char **error_string
)
147 krb5_principal princ
;
148 struct ccache_container
*ccc
;
149 if (cred
->ccache_obtained
> obtained
) {
153 ccc
= talloc(cred
, struct ccache_container
);
155 (*error_string
) = error_message(ENOMEM
);
159 ret
= cli_credentials_get_krb5_context(cred
, lp_ctx
,
160 &ccc
->smb_krb5_context
);
162 (*error_string
) = error_message(ret
);
166 if (!talloc_reference(ccc
, ccc
->smb_krb5_context
)) {
168 (*error_string
) = error_message(ENOMEM
);
173 ret
= krb5_cc_resolve(ccc
->smb_krb5_context
->krb5_context
, name
, &ccc
->ccache
);
175 (*error_string
) = talloc_asprintf(cred
, "failed to read krb5 ccache: %s: %s\n",
177 smb_get_krb5_error_message(ccc
->smb_krb5_context
->krb5_context
,
183 ret
= krb5_cc_default(ccc
->smb_krb5_context
->krb5_context
, &ccc
->ccache
);
185 (*error_string
) = talloc_asprintf(cred
, "failed to read default krb5 ccache: %s\n",
186 smb_get_krb5_error_message(ccc
->smb_krb5_context
->krb5_context
,
193 talloc_set_destructor(ccc
, free_dccache
);
195 ret
= krb5_cc_get_principal(ccc
->smb_krb5_context
->krb5_context
, ccc
->ccache
, &princ
);
198 krb5_free_principal(ccc
->smb_krb5_context
->krb5_context
, princ
);
199 ret
= cli_credentials_set_from_ccache(cred
, ccc
, obtained
, error_string
);
202 (*error_string
) = error_message(ret
);
207 cred
->ccache_obtained
= obtained
;
208 talloc_steal(cred
, ccc
);
210 cli_credentials_invalidate_client_gss_creds(cred
, cred
->ccache_obtained
);
217 * Indicate the we failed to log in to this service/host with these
218 * credentials. The caller passes an unsigned int which they
219 * initialise to the number of times they would like to retry.
221 * This method is used to support re-trying with freshly fetched
222 * credentials in case a server is rebuilt while clients have
223 * non-expired tickets. When the client code gets a logon failure they
224 * throw away the existing credentials for the server and retry.
226 _PUBLIC_
bool cli_credentials_failed_kerberos_login(struct cli_credentials
*cred
,
227 const char *principal
,
230 struct ccache_container
*ccc
;
231 krb5_creds creds
, creds2
;
234 if (principal
== NULL
) {
235 /* no way to delete if we don't know the principal */
241 /* not a kerberos connection */
246 /* We have already tried discarding the credentials */
252 ret
= krb5_parse_name(ccc
->smb_krb5_context
->krb5_context
, principal
, &creds
.server
);
257 ret
= krb5_cc_retrieve_cred(ccc
->smb_krb5_context
->krb5_context
, ccc
->ccache
, KRB5_TC_MATCH_SRV_NAMEONLY
, &creds
, &creds2
);
259 /* don't retry - we didn't find these credentials to remove */
260 krb5_free_cred_contents(ccc
->smb_krb5_context
->krb5_context
, &creds
);
264 ret
= krb5_cc_remove_cred(ccc
->smb_krb5_context
->krb5_context
, ccc
->ccache
, KRB5_TC_MATCH_SRV_NAMEONLY
, &creds
);
265 krb5_free_cred_contents(ccc
->smb_krb5_context
->krb5_context
, &creds
);
266 krb5_free_cred_contents(ccc
->smb_krb5_context
->krb5_context
, &creds2
);
268 /* don't retry - we didn't find these credentials to
269 * remove. Note that with the current backend this
270 * never happens, as it always returns 0 even if the
271 * creds don't exist, which is why we do a separate
272 * krb5_cc_retrieve_cred() above.
280 static int cli_credentials_new_ccache(struct cli_credentials
*cred
,
281 struct loadparm_context
*lp_ctx
,
283 struct ccache_container
**_ccc
,
284 const char **error_string
)
286 bool must_free_cc_name
= false;
288 struct ccache_container
*ccc
= talloc(cred
, struct ccache_container
);
293 ret
= cli_credentials_get_krb5_context(cred
, lp_ctx
,
294 &ccc
->smb_krb5_context
);
297 (*error_string
) = talloc_asprintf(cred
, "Failed to get krb5_context: %s",
301 if (!talloc_reference(ccc
, ccc
->smb_krb5_context
)) {
303 (*error_string
) = strerror(ENOMEM
);
308 must_free_cc_name
= true;
310 if (lpcfg_parm_bool(lp_ctx
, NULL
, "credentials", "krb5_cc_file", false)) {
311 ccache_name
= talloc_asprintf(ccc
, "FILE:/tmp/krb5_cc_samba_%u_%p",
312 (unsigned int)getpid(), ccc
);
314 ccache_name
= talloc_asprintf(ccc
, "MEMORY:%p",
320 (*error_string
) = strerror(ENOMEM
);
325 ret
= krb5_cc_resolve(ccc
->smb_krb5_context
->krb5_context
, ccache_name
,
328 (*error_string
) = talloc_asprintf(cred
, "failed to resolve a krb5 ccache (%s): %s\n",
330 smb_get_krb5_error_message(ccc
->smb_krb5_context
->krb5_context
,
332 talloc_free(ccache_name
);
337 if (strncasecmp(ccache_name
, "MEMORY:", 7) == 0) {
338 talloc_set_destructor(ccc
, free_mccache
);
340 talloc_set_destructor(ccc
, free_dccache
);
343 if (must_free_cc_name
) {
344 talloc_free(ccache_name
);
352 _PUBLIC_
int cli_credentials_get_named_ccache(struct cli_credentials
*cred
,
353 struct tevent_context
*event_ctx
,
354 struct loadparm_context
*lp_ctx
,
356 struct ccache_container
**ccc
,
357 const char **error_string
)
360 enum credentials_obtained obtained
;
362 if (cred
->machine_account_pending
) {
363 cli_credentials_set_machine_account(cred
, lp_ctx
);
366 if (cred
->ccache_obtained
>= cred
->ccache_threshold
&&
367 cred
->ccache_obtained
> CRED_UNINITIALISED
) {
369 bool expired
= false;
370 ret
= smb_krb5_cc_get_lifetime(cred
->ccache
->smb_krb5_context
->krb5_context
,
371 cred
->ccache
->ccache
, &lifetime
);
372 if (ret
== KRB5_CC_END
) {
373 /* If we have a particular ccache set, without
374 * an initial ticket, then assume there is a
376 } else if (ret
== 0) {
378 DEBUG(3, ("Ticket in credentials cache for %s expired, will refresh\n",
379 cli_credentials_get_principal(cred
, cred
)));
381 } else if (lifetime
< 300) {
382 DEBUG(3, ("Ticket in credentials cache for %s will shortly expire (%u secs), will refresh\n",
383 cli_credentials_get_principal(cred
, cred
), (unsigned int)lifetime
));
387 (*error_string
) = talloc_asprintf(cred
, "failed to get ccache lifetime: %s\n",
388 smb_get_krb5_error_message(cred
->ccache
->smb_krb5_context
->krb5_context
,
393 DEBUG(5, ("Ticket in credentials cache for %s will expire in %u secs\n",
394 cli_credentials_get_principal(cred
, cred
), (unsigned int)lifetime
));
401 if (cli_credentials_is_anonymous(cred
)) {
402 (*error_string
) = "Cannot get anonymous kerberos credentials";
406 ret
= cli_credentials_new_ccache(cred
, lp_ctx
, ccache_name
, ccc
, error_string
);
411 ret
= kinit_to_ccache(cred
, cred
, (*ccc
)->smb_krb5_context
, event_ctx
, (*ccc
)->ccache
, &obtained
, error_string
);
416 ret
= cli_credentials_set_from_ccache(cred
, *ccc
,
417 obtained
, error_string
);
420 cred
->ccache_obtained
= cred
->principal_obtained
;
424 cli_credentials_invalidate_client_gss_creds(cred
, cred
->ccache_obtained
);
428 _PUBLIC_
int cli_credentials_get_ccache(struct cli_credentials
*cred
,
429 struct tevent_context
*event_ctx
,
430 struct loadparm_context
*lp_ctx
,
431 struct ccache_container
**ccc
,
432 const char **error_string
)
434 return cli_credentials_get_named_ccache(cred
, event_ctx
, lp_ctx
, NULL
, ccc
, error_string
);
437 /* We have good reason to think the ccache in these credentials is invalid - blow it away */
438 static void cli_credentials_unconditionally_invalidate_client_gss_creds(struct cli_credentials
*cred
)
440 if (cred
->client_gss_creds_obtained
> CRED_UNINITIALISED
) {
441 talloc_unlink(cred
, cred
->client_gss_creds
);
442 cred
->client_gss_creds
= NULL
;
444 cred
->client_gss_creds_obtained
= CRED_UNINITIALISED
;
447 void cli_credentials_invalidate_client_gss_creds(struct cli_credentials
*cred
,
448 enum credentials_obtained obtained
)
450 /* If the caller just changed the username/password etc, then
451 * any cached credentials are now invalid */
452 if (obtained
>= cred
->client_gss_creds_obtained
) {
453 if (cred
->client_gss_creds_obtained
> CRED_UNINITIALISED
) {
454 talloc_unlink(cred
, cred
->client_gss_creds
);
455 cred
->client_gss_creds
= NULL
;
457 cred
->client_gss_creds_obtained
= CRED_UNINITIALISED
;
459 /* Now that we know that the data is 'this specified', then
460 * don't allow something less 'known' to be returned as a
461 * ccache. Ie, if the username is on the command line, we
462 * don't want to later guess to use a file-based ccache */
463 if (obtained
> cred
->client_gss_creds_threshold
) {
464 cred
->client_gss_creds_threshold
= obtained
;
468 /* We have good reason to think this CCACHE is invalid. Blow it away */
469 static void cli_credentials_unconditionally_invalidate_ccache(struct cli_credentials
*cred
)
471 if (cred
->ccache_obtained
> CRED_UNINITIALISED
) {
472 talloc_unlink(cred
, cred
->ccache
);
475 cred
->ccache_obtained
= CRED_UNINITIALISED
;
477 cli_credentials_unconditionally_invalidate_client_gss_creds(cred
);
480 _PUBLIC_
void cli_credentials_invalidate_ccache(struct cli_credentials
*cred
,
481 enum credentials_obtained obtained
)
483 /* If the caller just changed the username/password etc, then
484 * any cached credentials are now invalid */
485 if (obtained
>= cred
->ccache_obtained
) {
486 if (cred
->ccache_obtained
> CRED_UNINITIALISED
) {
487 talloc_unlink(cred
, cred
->ccache
);
490 cred
->ccache_obtained
= CRED_UNINITIALISED
;
492 /* Now that we know that the data is 'this specified', then
493 * don't allow something less 'known' to be returned as a
494 * ccache. i.e, if the username is on the command line, we
495 * don't want to later guess to use a file-based ccache */
496 if (obtained
> cred
->ccache_threshold
) {
497 cred
->ccache_threshold
= obtained
;
500 cli_credentials_invalidate_client_gss_creds(cred
,
504 static int free_gssapi_creds(struct gssapi_creds_container
*gcc
)
507 (void)gss_release_cred(&min_stat
, &gcc
->creds
);
511 _PUBLIC_
int cli_credentials_get_client_gss_creds(struct cli_credentials
*cred
,
512 struct tevent_context
*event_ctx
,
513 struct loadparm_context
*lp_ctx
,
514 struct gssapi_creds_container
**_gcc
,
515 const char **error_string
)
518 OM_uint32 maj_stat
, min_stat
;
519 struct gssapi_creds_container
*gcc
;
520 struct ccache_container
*ccache
;
521 #ifdef SAMBA4_USES_HEIMDAL
522 gss_buffer_desc empty_buffer
= GSS_C_EMPTY_BUFFER
;
524 krb5_enctype
*etypes
= NULL
;
526 if (cred
->client_gss_creds_obtained
>= cred
->client_gss_creds_threshold
&&
527 cred
->client_gss_creds_obtained
> CRED_UNINITIALISED
) {
528 bool expired
= false;
529 OM_uint32 lifetime
= 0;
530 gss_cred_usage_t usage
= 0;
531 maj_stat
= gss_inquire_cred(&min_stat
, cred
->client_gss_creds
->creds
,
532 NULL
, &lifetime
, &usage
, NULL
);
533 if (maj_stat
== GSS_S_CREDENTIALS_EXPIRED
) {
534 DEBUG(3, ("Credentials for %s expired, must refresh credentials cache\n", cli_credentials_get_principal(cred
, cred
)));
536 } else if (maj_stat
== GSS_S_COMPLETE
&& lifetime
< 300) {
537 DEBUG(3, ("Credentials for %s will expire shortly (%u sec), must refresh credentials cache\n", cli_credentials_get_principal(cred
, cred
), lifetime
));
539 } else if (maj_stat
!= GSS_S_COMPLETE
) {
540 *error_string
= talloc_asprintf(cred
, "inquiry of credential lifefime via GSSAPI gss_inquire_cred failed: %s\n",
541 gssapi_error_string(cred
, maj_stat
, min_stat
, NULL
));
545 cli_credentials_unconditionally_invalidate_client_gss_creds(cred
);
547 DEBUG(5, ("GSSAPI credentials for %s will expire in %u secs\n",
548 cli_credentials_get_principal(cred
, cred
), (unsigned int)lifetime
));
550 *_gcc
= cred
->client_gss_creds
;
555 ret
= cli_credentials_get_ccache(cred
, event_ctx
, lp_ctx
,
556 &ccache
, error_string
);
558 if (cli_credentials_get_kerberos_state(cred
) == CRED_MUST_USE_KERBEROS
) {
559 DEBUG(1, ("Failed to get kerberos credentials (kerberos required): %s\n", *error_string
));
561 DEBUG(4, ("Failed to get kerberos credentials: %s\n", *error_string
));
566 gcc
= talloc(cred
, struct gssapi_creds_container
);
568 (*error_string
) = error_message(ENOMEM
);
572 maj_stat
= gss_krb5_import_cred(&min_stat
, ccache
->ccache
, NULL
, NULL
,
574 if ((maj_stat
== GSS_S_FAILURE
) && (min_stat
== (OM_uint32
)KRB5_CC_END
|| min_stat
== (OM_uint32
) KRB5_CC_NOTFOUND
)) {
575 /* This CCACHE is no good. Ensure we don't use it again */
576 cli_credentials_unconditionally_invalidate_ccache(cred
);
578 /* Now try again to get a ccache */
579 ret
= cli_credentials_get_ccache(cred
, event_ctx
, lp_ctx
,
580 &ccache
, error_string
);
582 DEBUG(1, ("Failed to re-get CCACHE for GSSAPI client: %s\n", error_message(ret
)));
586 maj_stat
= gss_krb5_import_cred(&min_stat
, ccache
->ccache
, NULL
, NULL
,
598 (*error_string
) = talloc_asprintf(cred
, "gss_krb5_import_cred failed: %s", error_message(ret
));
604 * transfer the enctypes from the smb_krb5_context to the gssapi layer
606 * We use 'our' smb_krb5_context to do the AS-REQ and it is possible
607 * to configure the enctypes via the krb5.conf.
609 * And the gss_init_sec_context() creates it's own krb5_context and
610 * the TGS-REQ had all enctypes in it and only the ones configured
611 * and used for the AS-REQ, so it wasn't possible to disable the usage
614 min_stat
= get_kerberos_allowed_etypes(ccache
->smb_krb5_context
->krb5_context
,
617 OM_uint32 num_ktypes
;
619 for (num_ktypes
= 0; etypes
[num_ktypes
]; num_ktypes
++);
621 maj_stat
= gss_krb5_set_allowable_enctypes(&min_stat
, gcc
->creds
,
632 (*error_string
) = talloc_asprintf(cred
, "gss_krb5_set_allowable_enctypes failed: %s", error_message(ret
));
637 #ifdef SAMBA4_USES_HEIMDAL /* MIT lacks GSS_KRB5_CRED_NO_CI_FLAGS_X */
639 /* don't force GSS_C_CONF_FLAG and GSS_C_INTEG_FLAG */
640 maj_stat
= gss_set_cred_option(&min_stat
, &gcc
->creds
,
641 GSS_KRB5_CRED_NO_CI_FLAGS_X
,
650 (*error_string
) = talloc_asprintf(cred
, "gss_set_cred_option failed: %s", error_message(ret
));
654 cred
->client_gss_creds_obtained
= cred
->ccache_obtained
;
655 talloc_set_destructor(gcc
, free_gssapi_creds
);
656 cred
->client_gss_creds
= gcc
;
662 Set a gssapi cred_id_t into the credentials system. (Client case)
664 This grabs the credentials both 'intact' and getting the krb5
665 ccache out of it. This routine can be generalised in future for
666 the case where we deal with GSSAPI mechs other than krb5.
668 On sucess, the caller must not free gssapi_cred, as it now belongs
669 to the credentials system.
672 int cli_credentials_set_client_gss_creds(struct cli_credentials
*cred
,
673 struct loadparm_context
*lp_ctx
,
674 gss_cred_id_t gssapi_cred
,
675 enum credentials_obtained obtained
,
676 const char **error_string
)
679 OM_uint32 maj_stat
, min_stat
;
680 struct ccache_container
*ccc
;
681 struct gssapi_creds_container
*gcc
;
682 if (cred
->client_gss_creds_obtained
> obtained
) {
686 gcc
= talloc(cred
, struct gssapi_creds_container
);
688 (*error_string
) = error_message(ENOMEM
);
692 ret
= cli_credentials_new_ccache(cred
, lp_ctx
, NULL
, &ccc
, error_string
);
697 maj_stat
= gss_krb5_copy_ccache(&min_stat
,
698 gssapi_cred
, ccc
->ccache
);
706 (*error_string
) = error_message(ENOMEM
);
711 ret
= cli_credentials_set_from_ccache(cred
, ccc
, obtained
, error_string
);
714 cred
->ccache_obtained
= obtained
;
716 gcc
->creds
= gssapi_cred
;
717 talloc_set_destructor(gcc
, free_gssapi_creds
);
719 /* set the clinet_gss_creds_obtained here, as it just
720 got set to UNINITIALISED by the calls above */
721 cred
->client_gss_creds_obtained
= obtained
;
722 cred
->client_gss_creds
= gcc
;
727 /* Get the keytab (actually, a container containing the krb5_keytab)
728 * attached to this context. If this hasn't been done or set before,
729 * it will be generated from the password.
731 _PUBLIC_
int cli_credentials_get_keytab(struct cli_credentials
*cred
,
732 struct loadparm_context
*lp_ctx
,
733 struct keytab_container
**_ktc
)
736 struct keytab_container
*ktc
;
737 struct smb_krb5_context
*smb_krb5_context
;
738 const char *keytab_name
;
742 if (cred
->keytab_obtained
>= (MAX(cred
->principal_obtained
,
743 cred
->username_obtained
))) {
744 *_ktc
= cred
->keytab
;
748 if (cli_credentials_is_anonymous(cred
)) {
752 ret
= cli_credentials_get_krb5_context(cred
, lp_ctx
,
758 mem_ctx
= talloc_new(cred
);
763 ret
= smb_krb5_create_memory_keytab(mem_ctx
,
764 smb_krb5_context
->krb5_context
,
765 cli_credentials_get_password(cred
),
766 cli_credentials_get_username(cred
),
767 cli_credentials_get_realm(cred
),
768 cli_credentials_get_kvno(cred
),
769 &keytab
, &keytab_name
);
771 talloc_free(mem_ctx
);
775 ret
= smb_krb5_get_keytab_container(mem_ctx
, smb_krb5_context
,
776 keytab
, keytab_name
, &ktc
);
778 talloc_free(mem_ctx
);
782 cred
->keytab_obtained
= (MAX(cred
->principal_obtained
,
783 cred
->username_obtained
));
785 /* We make this keytab up based on a password. Therefore
786 * match-by-key is acceptable, we can't match on the wrong
788 ktc
->password_based
= true;
790 talloc_steal(cred
, ktc
);
792 *_ktc
= cred
->keytab
;
793 talloc_free(mem_ctx
);
797 /* Given the name of a keytab (presumably in the format
798 * FILE:/etc/krb5.keytab), open it and attach it */
800 _PUBLIC_
int cli_credentials_set_keytab_name(struct cli_credentials
*cred
,
801 struct loadparm_context
*lp_ctx
,
802 const char *keytab_name
,
803 enum credentials_obtained obtained
)
806 struct keytab_container
*ktc
;
807 struct smb_krb5_context
*smb_krb5_context
;
810 if (cred
->keytab_obtained
>= obtained
) {
814 ret
= cli_credentials_get_krb5_context(cred
, lp_ctx
, &smb_krb5_context
);
819 mem_ctx
= talloc_new(cred
);
824 ret
= smb_krb5_get_keytab_container(mem_ctx
, smb_krb5_context
,
825 NULL
, keytab_name
, &ktc
);
830 cred
->keytab_obtained
= obtained
;
832 talloc_steal(cred
, ktc
);
834 talloc_free(mem_ctx
);
839 /* Get server gss credentials (in gsskrb5, this means the keytab) */
841 _PUBLIC_
int cli_credentials_get_server_gss_creds(struct cli_credentials
*cred
,
842 struct loadparm_context
*lp_ctx
,
843 struct gssapi_creds_container
**_gcc
)
846 OM_uint32 maj_stat
, min_stat
;
847 struct gssapi_creds_container
*gcc
;
848 struct keytab_container
*ktc
;
849 struct smb_krb5_context
*smb_krb5_context
;
851 krb5_principal princ
;
852 const char *error_string
;
853 enum credentials_obtained obtained
;
855 mem_ctx
= talloc_new(cred
);
860 ret
= cli_credentials_get_krb5_context(cred
, lp_ctx
, &smb_krb5_context
);
865 ret
= principal_from_credentials(mem_ctx
, cred
, smb_krb5_context
, &princ
, &obtained
, &error_string
);
867 DEBUG(1,("cli_credentials_get_server_gss_creds: making krb5 principal failed (%s)\n",
869 talloc_free(mem_ctx
);
873 if (cred
->server_gss_creds_obtained
>= (MAX(cred
->keytab_obtained
, obtained
))) {
874 talloc_free(mem_ctx
);
875 *_gcc
= cred
->server_gss_creds
;
879 ret
= cli_credentials_get_keytab(cred
, lp_ctx
, &ktc
);
881 DEBUG(1, ("Failed to get keytab for GSSAPI server: %s\n", error_message(ret
)));
885 gcc
= talloc(cred
, struct gssapi_creds_container
);
887 talloc_free(mem_ctx
);
891 if (ktc
->password_based
|| obtained
< CRED_SPECIFIED
) {
892 /* This creates a GSSAPI cred_id_t for match-by-key with only the keytab set */
893 maj_stat
= gss_krb5_import_cred(&min_stat
, NULL
, NULL
, ktc
->keytab
,
896 /* This creates a GSSAPI cred_id_t with the principal and keytab set, matching by name */
897 maj_stat
= gss_krb5_import_cred(&min_stat
, NULL
, princ
, ktc
->keytab
,
908 cred
->server_gss_creds_obtained
= cred
->keytab_obtained
;
909 talloc_set_destructor(gcc
, free_gssapi_creds
);
910 cred
->server_gss_creds
= gcc
;
913 talloc_free(mem_ctx
);
921 _PUBLIC_
void cli_credentials_set_kvno(struct cli_credentials
*cred
,
928 * Return Kerberos KVNO
931 _PUBLIC_
int cli_credentials_get_kvno(struct cli_credentials
*cred
)
937 const char *cli_credentials_get_salt_principal(struct cli_credentials
*cred
)
939 return cred
->salt_principal
;
942 _PUBLIC_
void cli_credentials_set_salt_principal(struct cli_credentials
*cred
, const char *principal
)
944 talloc_free(cred
->salt_principal
);
945 cred
->salt_principal
= talloc_strdup(cred
, principal
);
948 /* The 'impersonate_principal' is used to allow one Kerberos principal
949 * (and it's associated keytab etc) to impersonate another. The
950 * ability to do this is controlled by the KDC, but it is generally
951 * permitted to impersonate anyone to yourself. This allows any
952 * member of the domain to get the groups of a user. This is also
953 * known as S4U2Self */
955 _PUBLIC_
const char *cli_credentials_get_impersonate_principal(struct cli_credentials
*cred
)
957 return cred
->impersonate_principal
;
961 * The 'self_service' is the service principal that
962 * represents the same object (by its objectSid)
963 * as the client principal (typically our machine account).
964 * When trying to impersonate 'impersonate_principal' with
967 _PUBLIC_
const char *cli_credentials_get_self_service(struct cli_credentials
*cred
)
969 return cred
->self_service
;
972 _PUBLIC_
void cli_credentials_set_impersonate_principal(struct cli_credentials
*cred
,
973 const char *principal
,
974 const char *self_service
)
976 talloc_free(cred
->impersonate_principal
);
977 cred
->impersonate_principal
= talloc_strdup(cred
, principal
);
978 talloc_free(cred
->self_service
);
979 cred
->self_service
= talloc_strdup(cred
, self_service
);
980 cli_credentials_set_kerberos_state(cred
, CRED_MUST_USE_KERBEROS
);
984 * when impersonating for S4U2proxy we need to set the target principal.
985 * Similarly, we may only be authorized to do general impersonation to
986 * some particular services.
988 * Likewise, password changes typically require a ticket to kpasswd/realm directly, not via a TGT
990 * NULL means that tickets will be obtained for the krbtgt service.
993 const char *cli_credentials_get_target_service(struct cli_credentials
*cred
)
995 return cred
->target_service
;
998 _PUBLIC_
void cli_credentials_set_target_service(struct cli_credentials
*cred
, const char *target_service
)
1000 talloc_free(cred
->target_service
);
1001 cred
->target_service
= talloc_strdup(cred
, target_service
);