Merge 1.8.0~pre4 packaging into master
[pkg-k5-afs_openafs.git] / src / kauth / katoken.c
blob9d9bfd34df4ef0a2d23e1f6ab28ad78153411aaf
1 /*
2 * Copyright 2000, International Business Machines Corporation and others.
3 * All Rights Reserved.
5 * This software has been released under the terms of the IBM Public
6 * License. For details, see the LICENSE file in the top-level source
7 * directory or online at http://www.openafs.org/dl/license10.html
8 */
10 /* These routines provide an interface to the token cache maintained by the
11 kernel. Principally it handles cache misses by requesting the desired token
12 from the AuthServer. */
14 #include <afsconfig.h>
15 #include <afs/param.h>
16 #include <afs/stds.h>
18 #include <roken.h>
19 #include <afs/opr.h>
21 #include <rx/xdr.h>
22 #include <afs/pthread_glock.h>
23 #include <afs/cellconfig.h>
24 #include <afs/auth.h>
25 #include <lock.h>
26 #include <ubik.h>
28 #include "kauth.h"
29 #include "kautils.h"
32 afs_int32
33 ka_GetAuthToken(char *name, char *instance, char *cell,
34 struct ktc_encryptionKey * key, afs_int32 lifetime,
35 afs_int32 * pwexpires)
37 afs_int32 code;
38 struct ubik_client *conn;
39 afs_int32 now = time(0);
40 struct ktc_token token;
41 char cellname[MAXKTCREALMLEN];
42 char realm[MAXKTCREALMLEN];
43 struct ktc_principal client, server;
45 LOCK_GLOBAL_MUTEX;
46 code = ka_ExpandCell(cell, cellname, 0 /*local */ );
47 if (code) {
48 UNLOCK_GLOBAL_MUTEX;
49 return code;
51 cell = cellname;
53 /* get an unauthenticated connection to desired cell */
54 code = ka_AuthServerConn(cell, KA_AUTHENTICATION_SERVICE, 0, &conn);
55 if (code) {
56 UNLOCK_GLOBAL_MUTEX;
57 return code;
59 code =
60 ka_Authenticate(name, instance, cell, conn,
61 KA_TICKET_GRANTING_SERVICE, key, now, now + lifetime,
62 &token, pwexpires);
63 if (code) {
64 UNLOCK_GLOBAL_MUTEX;
65 return code;
67 code = ubik_ClientDestroy(conn);
68 if (code) {
69 UNLOCK_GLOBAL_MUTEX;
70 return code;
73 code = ka_CellToRealm(cell, realm, 0 /*local */ );
74 if (code) {
75 UNLOCK_GLOBAL_MUTEX;
76 return code;
78 strcpy(client.name, name);
79 strcpy(client.instance, instance);
80 strncpy(client.cell, cell, sizeof(client.cell));
81 strcpy(server.name, KA_TGS_NAME);
82 strcpy(server.instance, realm);
83 strcpy(server.cell, cell);
84 code = ktc_SetToken(&server, &token, &client, 0);
85 UNLOCK_GLOBAL_MUTEX;
86 return code;
89 afs_int32
90 ka_GetServerToken(char *name, char *instance, char *cell, Date lifetime,
91 struct ktc_token * token, int new, int dosetpag)
93 afs_int32 code;
94 struct ubik_client *conn;
95 afs_int32 now = time(0);
96 struct ktc_token auth_token;
97 struct ktc_token cell_token;
98 struct ktc_principal server, auth_server, client;
99 char *localCell = ka_LocalCell();
100 char cellname[MAXKTCREALMLEN];
101 char realm[MAXKTCREALMLEN];
102 char authDomain[MAXKTCREALMLEN];
103 int local;
105 LOCK_GLOBAL_MUTEX;
106 code = ka_ExpandCell(cell, cellname, 0 /*local */ );
107 if (code) {
108 UNLOCK_GLOBAL_MUTEX;
109 return code;
111 cell = cellname;
113 strcpy(server.name, name);
114 strcpy(server.instance, instance);
115 lcstring(server.cell, cell, sizeof(server.cell));
116 if (!new) {
117 code =
118 ktc_GetToken(&server, token, sizeof(struct ktc_token), &client);
119 if (!code) {
120 UNLOCK_GLOBAL_MUTEX;
121 return 0;
125 code = ka_CellToRealm(cell, realm, &local);
126 if (code) {
127 UNLOCK_GLOBAL_MUTEX;
128 return code;
131 /* get TGS ticket for proper realm */
132 strcpy(auth_server.name, KA_TGS_NAME);
133 strcpy(auth_server.instance, realm);
134 lcstring(auth_server.cell, realm, sizeof(auth_server.cell));
135 strcpy(authDomain, realm);
136 code =
137 ktc_GetToken(&auth_server, &auth_token, sizeof(auth_token), &client);
138 if (code && !local) { /* try for remotely authenticated ticket */
139 strcpy(auth_server.cell, localCell);
140 strcpy(authDomain, "");
141 code =
142 ktc_GetToken(&auth_server, &auth_token, sizeof(auth_token),
143 &client);
146 if (code && local) {
147 UNLOCK_GLOBAL_MUTEX;
148 return code;
149 } else if (code) {
150 /* here we invoke the inter-cell mechanism */
152 /* get local auth ticket */
153 ucstring(auth_server.instance, localCell,
154 sizeof(auth_server.instance));
155 strcpy(auth_server.cell, localCell);
156 code =
157 ktc_GetToken(&auth_server, &cell_token, sizeof(cell_token),
158 &client);
159 if (code) {
160 UNLOCK_GLOBAL_MUTEX;
161 return code;
163 /* get a connection to the local cell */
164 if ((code =
165 ka_AuthServerConn(localCell, KA_TICKET_GRANTING_SERVICE, 0,
166 &conn))) {
167 UNLOCK_GLOBAL_MUTEX;
168 return code;
170 /* get foreign auth ticket */
171 if ((code =
172 ka_GetToken(KA_TGS_NAME, realm, localCell, client.name,
173 client.instance, conn, now, now + lifetime,
174 &cell_token, "" /* local auth domain */ ,
175 &auth_token))) {
176 UNLOCK_GLOBAL_MUTEX;
177 return code;
179 code = ubik_ClientDestroy(conn);
180 if (code) {
181 UNLOCK_GLOBAL_MUTEX;
182 return code;
184 conn = 0;
186 /* save foreign auth ticket */
187 strcpy(auth_server.instance, realm);
188 lcstring(auth_server.cell, localCell, sizeof(auth_server.cell));
189 ucstring(authDomain, localCell, sizeof(authDomain));
190 if ((code = ktc_SetToken(&auth_server, &auth_token, &client, 0))) {
191 UNLOCK_GLOBAL_MUTEX;
192 return code;
196 if ((code =
197 ka_AuthServerConn(cell, KA_TICKET_GRANTING_SERVICE, 0, &conn))) {
198 UNLOCK_GLOBAL_MUTEX;
199 return code;
201 if ((code =
202 ka_GetToken(name, instance, cell, client.name, client.instance, conn,
203 now, now + lifetime, &auth_token, authDomain, token))) {
204 UNLOCK_GLOBAL_MUTEX;
205 return code;
207 code = ubik_ClientDestroy(conn);
208 if (code) {
209 UNLOCK_GLOBAL_MUTEX;
210 return code;
213 if ((code =
214 ktc_SetToken(&server, token, &client,
215 dosetpag ? AFS_SETTOK_SETPAG : 0))) {
216 UNLOCK_GLOBAL_MUTEX;
217 return code;
219 UNLOCK_GLOBAL_MUTEX;
220 return 0;
223 afs_int32
224 ka_GetAdminToken(char *name, char *instance, char *cell,
225 struct ktc_encryptionKey * key, afs_int32 lifetime,
226 struct ktc_token * token, int new)
228 int code;
229 struct ubik_client *conn;
230 afs_int32 now = time(0);
231 struct ktc_principal server, client;
232 struct ktc_token localToken;
233 char cellname[MAXKTCREALMLEN];
235 LOCK_GLOBAL_MUTEX;
236 code = ka_ExpandCell(cell, cellname, 0 /*local */ );
237 if (code) {
238 UNLOCK_GLOBAL_MUTEX;
239 return code;
241 cell = cellname;
243 if (token == 0)
244 token = &localToken; /* in case caller doesn't want token */
246 strcpy(server.name, KA_ADMIN_NAME);
247 strcpy(server.instance, KA_ADMIN_INST);
248 strncpy(server.cell, cell, sizeof(server.cell));
249 if (!new) {
250 code =
251 ktc_GetToken(&server, token, sizeof(struct ktc_token), &client);
252 if (code == 0) {
253 UNLOCK_GLOBAL_MUTEX;
254 return 0;
258 if ((name == 0) || (key == 0)) {
259 /* just lookup in cache don't get new one */
260 UNLOCK_GLOBAL_MUTEX;
261 return KANOTICKET;
264 /* get an unauthenticated connection to desired cell */
265 code = ka_AuthServerConn(cell, KA_AUTHENTICATION_SERVICE, 0, &conn);
266 if (code) {
267 UNLOCK_GLOBAL_MUTEX;
268 return code;
270 code =
271 ka_Authenticate(name, instance, cell, conn, KA_MAINTENANCE_SERVICE,
272 key, now, now + lifetime, token, 0);
273 (void)ubik_ClientDestroy(conn);
274 if (code) {
275 UNLOCK_GLOBAL_MUTEX;
276 return code;
279 strcpy(client.name, name);
280 strcpy(client.instance, instance);
281 strncpy(client.cell, cell, sizeof(client.cell));
282 code = ktc_SetToken(&server, token, &client, 0);
283 UNLOCK_GLOBAL_MUTEX;
284 return code;
288 afs_int32
289 ka_VerifyUserToken(char *name, char *instance, char *cell,
290 struct ktc_encryptionKey * key)
292 afs_int32 code;
293 struct ubik_client *conn;
294 afs_int32 now = time(0);
295 struct ktc_token token;
296 char cellname[MAXKTCREALMLEN];
297 afs_int32 pwexpires;
299 LOCK_GLOBAL_MUTEX;
300 code = ka_ExpandCell(cell, cellname, 0 /*local */ );
301 if (code) {
302 UNLOCK_GLOBAL_MUTEX;
303 return code;
306 cell = cellname;
308 /* get an unauthenticated connection to desired cell */
309 code = ka_AuthServerConn(cell, KA_AUTHENTICATION_SERVICE, 0, &conn);
310 if (code) {
311 UNLOCK_GLOBAL_MUTEX;
312 return code;
315 code =
316 ka_Authenticate(name, instance, cell, conn,
317 KA_TICKET_GRANTING_SERVICE, key, now,
318 now + MAXKTCTICKETLIFETIME, &token, &pwexpires);
319 if (code) {
320 UNLOCK_GLOBAL_MUTEX;
321 return code;
323 code = ubik_ClientDestroy(conn);
324 UNLOCK_GLOBAL_MUTEX;
325 return code;