From 2c081c4ef3064177bdfaaaefc7d5292e0b94ec40 Mon Sep 17 00:00:00 2001
From: Ariel Barria <olivares73@hotmail.com>
Date: Wed, 27 Mar 2013 16:04:06 -0500
Subject: [PATCH] Allow setting krb5_renew_interval with a delimiter

https://fedorahosted.org/sssd/ticket/902

changed the data type the krb5_renew_interval to string.
function krb5_string_to_deltat is used to convert and allow delimiters
---
 src/config/etc/sssd.api.d/sssd-ad.conf   |  2 +-
 src/config/etc/sssd.api.d/sssd-ipa.conf  |  2 +-
 src/config/etc/sssd.api.d/sssd-krb5.conf |  2 +-
 src/man/sssd-krb5.5.xml                  | 26 ++++++++++++++++++++++++--
 src/providers/ad/ad_opts.h               |  2 +-
 src/providers/ipa/ipa_opts.h             |  2 +-
 src/providers/krb5/krb5_auth.c           | 18 +++++++++++++++---
 src/providers/krb5/krb5_init_shared.c    | 16 ++++++++++++++--
 src/providers/krb5/krb5_opts.h           |  2 +-
 9 files changed, 59 insertions(+), 13 deletions(-)

diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf
index 85e34cb18f7d67ced2c0cf52a9aae6a760979d8a..dbee270e705f0c9f9d275ad6e72e104c4bd57ea9 100644
--- a/src/config/etc/sssd.api.d/sssd-ad.conf
+++ b/src/config/etc/sssd.api.d/sssd-ad.conf
@@ -115,7 +115,7 @@ ldap_pwd_policy = str, None, false
 krb5_store_password_if_offline = bool, None, false
 krb5_renewable_lifetime = str, None, false
 krb5_lifetime = str, None, false
-krb5_renew_interval = int, None, false
+krb5_renew_interval = str, None, false
 krb5_use_fast = str, None, false
 krb5_fast_principal = str, None, false
 
diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index e9c7b232677e2cf5c65be39f35e786fd5cbb1aa2..a165bc23afdfb6e691acddbb07c74d4e4672bb14 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -136,7 +136,7 @@ ldap_pwd_policy = str, None, false
 krb5_store_password_if_offline = bool, None, false
 krb5_renewable_lifetime = str, None, false
 krb5_lifetime = str, None, false
-krb5_renew_interval = int, None, false
+krb5_renew_interval = str, None, false
 krb5_use_fast = str, None, false
 krb5_fast_principal = str, None, false
 
diff --git a/src/config/etc/sssd.api.d/sssd-krb5.conf b/src/config/etc/sssd.api.d/sssd-krb5.conf
index 3a36f5efb5e9ee8733489580dbf0a7d08aa0acc9..6534282f999e13d3a3f27d122e8defe1e267e69c 100644
--- a/src/config/etc/sssd.api.d/sssd-krb5.conf
+++ b/src/config/etc/sssd.api.d/sssd-krb5.conf
@@ -15,7 +15,7 @@ krb5_validate = bool, None, false
 krb5_store_password_if_offline = bool, None, false
 krb5_renewable_lifetime = str, None, false
 krb5_lifetime = str, None, false
-krb5_renew_interval = int, None, false
+krb5_renew_interval = str, None, false
 krb5_use_fast = str, None, false
 krb5_fast_principal = str, None, false
 krb5_canonicalize = bool, None, false
diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
index 3a1906cf68b5c57b8f63fe8e9e86a5e06672ba43..80ea9c76486d357ef2e29d2acf98db96d7a2bbc7 100644
--- a/src/man/sssd-krb5.5.xml
+++ b/src/man/sssd-krb5.5.xml
@@ -351,12 +351,34 @@
                 </varlistentry>
 
                 <varlistentry>
-                    <term>krb5_renew_interval (integer)</term>
+                    <term>krb5_renew_interval (string)</term>
                     <listitem>
                         <para>
                             The time in seconds between two checks if the TGT
                             should be renewed. TGTs are renewed if about half
-                            of their lifetime is exceeded.
+                            of their lifetime is exceeded, given as an integer
+                            immediately followed by a time unit:
+                        </para>
+                        <para>
+                            <emphasis>s</emphasis> for seconds
+                        </para>
+                        <para>
+                            <emphasis>m</emphasis> for minutes
+                        </para>
+                        <para>
+                            <emphasis>h</emphasis> for hours
+                        </para>
+                        <para>
+                            <emphasis>d</emphasis> for days.
+                        </para>
+                        <para>
+                            If there is no unit given, <emphasis>s</emphasis> is
+                            assumed.
+                        </para>
+                        <para>
+                            NOTE: It is not possible to mix units.  To set
+                            the renewable lifetime to one and a half hours,
+                            use '90m' instead of '1h30m'.
                         </para>
                         <para>
                              If this option is not set or is 0 the automatic
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index 285672226fc839d6f05b15cc518178b9eaec0e90..09aee7e27cca0e1104e65ab3fd6b7c9bf623ada6 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -138,7 +138,7 @@ struct dp_option ad_def_krb5_opts[] = {
     { "krb5_store_password_if_offline", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
-    { "krb5_renew_interval", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER },
+    { "krb5_renew_interval", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_use_fast", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_fast_principal", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index cb6f40e8b5006cc00c1084d3df9566aa51e7fd2e..970d05b3921463f33c860f70c2a5b75f6b5f4e7d 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -259,7 +259,7 @@ struct dp_option ipa_def_krb5_opts[] = {
     { "krb5_store_password_if_offline", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
-    { "krb5_renew_interval", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER },
+    { "krb5_renew_interval", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_use_fast", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_fast_principal", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index 6c0f429fbb30aae8ee2c4e4973aa0e0590ec169a..00025bfc156eaf641217194c6301f4d70a773a73 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -827,6 +827,9 @@ static void krb5_auth_done(struct tevent_req *subreq)
     struct krb5_child_response *res;
     const char *store_ccname;
     struct fo_server *search_srv;
+    krb5_deltat renew_interval_delta;
+    char *renew_interval_str;
+    time_t renew_interval_time = 0;
 
     ret = handle_child_recv(subreq, pd, &buf, &len);
     talloc_zfree(subreq);
@@ -1072,9 +1075,18 @@ static void krb5_auth_done(struct tevent_req *subreq)
         DEBUG(1, ("krb5_save_ccname failed.\n"));
         goto done;
     }
-
-    if (res->msg_status == ERR_OK &&
-        (dp_opt_get_int(kr->krb5_ctx->opts, KRB5_RENEW_INTERVAL) > 0) &&
+    renew_interval_str = dp_opt_get_string(kr->krb5_ctx->opts,
+                         KRB5_RENEW_INTERVAL);
+    if (renew_interval_str != NULL) {
+        ret = krb5_string_to_deltat(renew_interval_str, &renew_interval_delta);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                 ("Reading krb5_renew_interval failed.\n"));
+            renew_interval_delta = 0;
+        }
+        renew_interval_time = renew_interval_delta;
+    }
+    if (res->msg_status == ERR_OK && renew_interval_time > 0 &&
         (pd->cmd == SSS_PAM_AUTHENTICATE ||
          pd->cmd == SSS_CMD_RENEW ||
          pd->cmd == SSS_PAM_CHAUTHTOK) &&
diff --git a/src/providers/krb5/krb5_init_shared.c b/src/providers/krb5/krb5_init_shared.c
index 0dac5fa69af36e06189ce62392471700d4939572..c9eec2f8751c3e5e92d6c85fb84e161ad56d9c98 100644
--- a/src/providers/krb5/krb5_init_shared.c
+++ b/src/providers/krb5/krb5_init_shared.c
@@ -30,7 +30,9 @@ errno_t krb5_child_init(struct krb5_ctx *krb5_auth_ctx,
 {
     errno_t ret;
     FILE *debug_filep;
-    time_t renew_intv;
+    time_t renew_intv = 0;
+    krb5_deltat renew_interval_delta;
+    char *renew_interval_str;
 
     if (dp_opt_get_bool(krb5_auth_ctx->opts, KRB5_STORE_PASSWORD_IF_OFFLINE)) {
         ret = init_delayed_online_authentication(krb5_auth_ctx, bectx,
@@ -40,8 +42,18 @@ errno_t krb5_child_init(struct krb5_ctx *krb5_auth_ctx,
             goto done;
         }
     }
+    renew_interval_str = dp_opt_get_string(krb5_auth_ctx->opts,
+                         KRB5_RENEW_INTERVAL);
+    if (renew_interval_str != NULL) {
+        ret = krb5_string_to_deltat(renew_interval_str, &renew_interval_delta);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                 ("Reading krb5_renew_interval failed.\n"));
+            renew_interval_delta = 0;
+        }
+        renew_intv = renew_interval_delta;
+    }
 
-    renew_intv = dp_opt_get_int(krb5_auth_ctx->opts, KRB5_RENEW_INTERVAL);
     if (renew_intv > 0) {
         ret = init_renew_tgt(krb5_auth_ctx, bectx, bectx->ev, renew_intv);
         if (ret != EOK) {
diff --git a/src/providers/krb5/krb5_opts.h b/src/providers/krb5/krb5_opts.h
index f29fbaaf7962e32f64373bf358c544a3d29ad918..8ac29532b27fcc43f73a9c30d7ec82c8c5dc080c 100644
--- a/src/providers/krb5/krb5_opts.h
+++ b/src/providers/krb5/krb5_opts.h
@@ -39,7 +39,7 @@ struct dp_option default_krb5_opts[] = {
     { "krb5_store_password_if_offline", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
-    { "krb5_renew_interval", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER },
+    { "krb5_renew_interval", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_use_fast", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_fast_principal", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
-- 
1.7.11.7

