source/libsmb/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #include "includes.h"
  22
  23 #ifdef HAVE_KRB5
  24 /*
  25   we can't use krb5_mk_req because w2k wants the service to be in a particular format
  26 */
  27 static krb5_error_code krb5_mk_req2(krb5_context context,
  28                                     krb5_auth_context *auth_context,
  29                                     const krb5_flags ap_req_options,
  30                                     const char *principal,
  31                                     krb5_ccache ccache,
  32                                     krb5_data *outbuf)
  33 {
  34         krb5_error_code           retval;
  35         krb5_principal    server;
  36         krb5_creds              * credsp;
  37         krb5_creds                creds;
  38         krb5_data in_data;
  39
  40         retval = krb5_parse_name(context, principal, &server);
  41         if (retval) {
  42                 DEBUG(1,("Failed to parse principal %s\n", principal));
  43                 return retval;
  44         }
  45
  46         /* obtain ticket & session key */
  47         memset((char *)&creds, 0, sizeof(creds));
  48         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
  49                 DEBUG(1,("krb5_copy_principal failed (%s)\n",
  50                          error_message(retval)));
  51                 goto cleanup_princ;
  52         }
  53
  54         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
  55                 DEBUG(1,("krb5_cc_get_principal failed (%s)\n",
  56                          error_message(retval)));
  57                 goto cleanup_creds;
  58         }
  59
  60         if ((retval = krb5_get_credentials(context, 0,
  61                                            ccache, &creds, &credsp))) {
  62                 DEBUG(1,("krb5_get_credentials failed for %s (%s)\n",
  63                          principal, error_message(retval)));
  64                 goto cleanup_creds;
  65         }
  66
  67         in_data.length = 0;
  68         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
  69                                       &in_data, credsp, outbuf);
  70         if (retval) {
  71                 DEBUG(1,("krb5_mk_req_extended failed (%s)\n",
  72                          error_message(retval)));
  73         }
  74
  75         krb5_free_creds(context, credsp);
  76
  77 cleanup_creds:
  78         krb5_free_cred_contents(context, &creds);
  79
  80 cleanup_princ:
  81         krb5_free_principal(context, server);
  82
  83         return retval;
  84 }
  85
  86 /*
  87   get a kerberos5 ticket for the given service
  88 */
  89 DATA_BLOB krb5_get_ticket(char *principal)
  90 {
  91         krb5_error_code retval;
  92         krb5_data packet;
  93         krb5_ccache ccdef;
  94         krb5_context context;
  95         krb5_auth_context auth_context = NULL;
  96         DATA_BLOB ret;
  97         krb5_enctype enc_types[] = {ENCTYPE_DES_CBC_MD5, ENCTYPE_NULL};
  98
  99         retval = krb5_init_context(&context);
 100         if (retval) {
 101                 DEBUG(1,("krb5_init_context failed (%s)\n",
 102                          error_message(retval)));
 103                 goto failed;
 104         }
 105
 106         if ((retval = krb5_cc_default(context, &ccdef))) {
 107                 DEBUG(1,("krb5_cc_default failed (%s)\n",
 108                          error_message(retval)));
 109                 goto failed;
 110         }
 111
 112         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 113                 DEBUG(1,("krb5_set_default_tgs_ktypes failed (%s)\n",
 114                          error_message(retval)));
 115                 goto failed;
 116         }
 117
 118         if ((retval = krb5_mk_req2(context,
 119                                    &auth_context,
 120                                    0,
 121                                    principal,
 122                                    ccdef, &packet))) {
 123                 goto failed;
 124         }
 125
 126         ret = data_blob(packet.data, packet.length);
 127 /* Hmm, heimdal dooesn't have this - what's the correct call? */
 128 /*      krb5_free_data_contents(context, &packet); */
 129         krb5_free_context(context);
 130         return ret;
 131
 132 failed:
 133         krb5_free_context(context);
 134         return data_blob(NULL, 0);
 135 }
 136
 137
 138 #else /* HAVE_KRB5 */
 139  /* this saves a few linking headaches */
 140  DATA_BLOB krb5_get_ticket(char *principal)
 141  {
 142          DEBUG(0,("NO KERBEROS SUPPORT\n"));
 143          return data_blob(NULL, 0);
 144  }
 145 #endif