>From a81942df12b5dcf3afe60aeca6fa8d6b1dfd1adb Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Fri, 15 May 2015 14:13:40 +0200 Subject: [PATCH 28/29] AD: Add ad_create_1way_trust_options Related: https://fedorahosted.org/sssd/ticket/2638 For one-way trusts we can assume that AD domain is the same as the Kerberis realm. On the other hand, SASL realm and keytab path are specified, unline two-way trusts that use the system keytab. Includes a unit test. --- src/providers/ad/ad_common.c | 97 +++++++++++++++++++++++++++++++++------ src/providers/ad/ad_common.h | 6 +++ src/tests/cmocka/test_ad_common.c | 74 +++++++++++++++++++++++++++++ 3 files changed, 162 insertions(+), 15 deletions(-) diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c index 22af7cbd2689f8a12a712d78f617f56420daab10..130cdeb613aae3843f7453a478815daaae6aab77 100644 --- a/src/providers/ad/ad_common.c +++ b/src/providers/ad/ad_common.c @@ -135,35 +135,102 @@ ad_create_default_options(TALLOC_CTX *mem_ctx) return ad_options; } -struct ad_options * -ad_create_2way_trust_options(TALLOC_CTX *mem_ctx, - const char *realm, - const char *ad_domain, - const char *hostname) +static errno_t +set_common_ad_trust_opts(struct ad_options *ad_options, + const char *realm, + const char *ad_domain, + const char *hostname) { - struct ad_options *ad_options; errno_t ret; - ad_options = ad_create_default_options(mem_ctx); - if (ad_options == NULL) return NULL; - ret = dp_opt_set_string(ad_options->basic, AD_KRB5_REALM, realm); if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, "Cannot set AD domain\n"); - talloc_free(ad_options); - return NULL; + DEBUG(SSSDBG_OP_FAILURE, "Cannot set AD krb5 realm\n"); + return ret; } ret = dp_opt_set_string(ad_options->basic, AD_DOMAIN, ad_domain); if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, "Cannot set AD domain\n"); - talloc_free(ad_options); - return NULL; + return ret; } ret = dp_opt_set_string(ad_options->basic, AD_HOSTNAME, hostname); if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, "Cannot set AD domain\n"); + DEBUG(SSSDBG_OP_FAILURE, "Cannot set AD hostname\n"); + return ret; + } + + return EOK; +} + +struct ad_options * +ad_create_2way_trust_options(TALLOC_CTX *mem_ctx, + const char *realm, + const char *ad_domain, + const char *hostname) +{ + struct ad_options *ad_options; + errno_t ret; + + ad_options = ad_create_default_options(mem_ctx); + if (ad_options == NULL) return NULL; + + ret = set_common_ad_trust_opts(ad_options, realm, ad_domain, hostname); + if (ret != EOK) { + talloc_free(ad_options); + return NULL; + } + + ret = ad_set_sdap_options(ad_options, ad_options->id); + if (ret != EOK) { + talloc_free(ad_options); + return NULL; + } + + return ad_options; +} + +struct ad_options * +ad_create_1way_trust_options(TALLOC_CTX *mem_ctx, + const char *ad_domain, + const char *hostname, + const char *keytab, + const char *sasl_authid) +{ + struct ad_options *ad_options; + const char *realm; + errno_t ret; + + ad_options = ad_create_default_options(mem_ctx); + if (ad_options == NULL) return NULL; + + realm = get_uppercase_realm(ad_options, ad_domain); + if (!realm) { + talloc_free(ad_options); + return NULL; + } + + ret = set_common_ad_trust_opts(ad_options, realm, + ad_domain, hostname); + if (ret != EOK) { + talloc_free(ad_options); + return NULL; + } + + /* Set AD_KEYTAB to the special 1way keytab */ + ret = dp_opt_set_string(ad_options->basic, AD_KEYTAB, keytab); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, "Cannot set trust keytab\n"); + talloc_free(ad_options); + return NULL; + } + + /* Set SDAP_SASL_AUTHID to the trust principal */ + ret = dp_opt_set_string(ad_options->id->basic, + SDAP_SASL_AUTHID, sasl_authid); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, "Cannot set SASL authid\n"); talloc_free(ad_options); return NULL; } diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h index 0766b4dc93dbbebd934daaa5e3d3bf4c13a0a518..817f5b42cad7cad6a88244fd43bd91a4358d56c0 100644 --- a/src/providers/ad/ad_common.h +++ b/src/providers/ad/ad_common.h @@ -110,6 +110,12 @@ struct ad_options *ad_create_2way_trust_options(TALLOC_CTX *mem_ctx, const char *ad_domain, const char *hostname); +struct ad_options *ad_create_1way_trust_options(TALLOC_CTX *mem_ctx, + const char *ad_domain, + const char *hostname, + const char *keytab, + const char *sasl_authid); + errno_t ad_failover_init(TALLOC_CTX *mem_ctx, struct be_ctx *ctx, const char *primary_servers, diff --git a/src/tests/cmocka/test_ad_common.c b/src/tests/cmocka/test_ad_common.c index c541b87db8e6de4a010383859f0335d78c675201..985a05fae5a4d09ab102ed611c7d03ca8e4d955b 100644 --- a/src/tests/cmocka/test_ad_common.c +++ b/src/tests/cmocka/test_ad_common.c @@ -44,6 +44,13 @@ #define KEYTAB_TEST_PRINC TEST_AUTHID"@"REALMNAME #define KEYTAB_PATH TEST_DIR"/keytab_test.keytab" +#define ONEWAY_DOMNAME "ONEWAY" +#define ONEWAY_HOST_NAME "ad."ONEWAY_DOMNAME + +#define ONEWAY_KEYTAB_PATH TEST_DIR"/oneway_test.keytab" +#define ONEWAY_AUTHID "host/"ONEWAY_HOST_NAME +#define ONEWAY_TEST_PRINC ONEWAY_AUTHID"@"ONEWAY_DOMNAME + static bool call_real_sasl_options; krb5_error_code __wrap_krb5_kt_default(krb5_context context, krb5_keytab *id) @@ -116,6 +123,70 @@ static int test_ad_common_teardown(void **state) return 0; } +static void test_ad_create_1way_trust_options(void **state) +{ + struct ad_common_test_ctx *test_ctx = talloc_get_type(*state, + struct ad_common_test_ctx); + const char *s; + + call_real_sasl_options = true; + /* Make sure this is not the keytab that __wrap_krb5_kt_default uses */ + mock_keytab_with_contents(test_ctx, ONEWAY_KEYTAB_PATH, ONEWAY_TEST_PRINC); + + test_ctx->ad_ctx->ad_options = ad_create_1way_trust_options( + test_ctx->ad_ctx, + ONEWAY_DOMNAME, + ONEWAY_HOST_NAME, + ONEWAY_KEYTAB_PATH, + ONEWAY_AUTHID); + assert_non_null(test_ctx->ad_ctx->ad_options); + + assert_int_equal(test_ctx->ad_ctx->ad_options->id->schema_type, + SDAP_SCHEMA_AD); + + s = dp_opt_get_string(test_ctx->ad_ctx->ad_options->basic, + AD_KRB5_REALM); + assert_non_null(s); + assert_string_equal(s, ONEWAY_DOMNAME); + + s = dp_opt_get_string(test_ctx->ad_ctx->ad_options->basic, + AD_DOMAIN); + assert_non_null(s); + assert_string_equal(s, ONEWAY_DOMNAME); + + s = dp_opt_get_string(test_ctx->ad_ctx->ad_options->basic, + AD_HOSTNAME); + assert_non_null(s); + assert_string_equal(s, ONEWAY_HOST_NAME); + + s = dp_opt_get_string(test_ctx->ad_ctx->ad_options->basic, + AD_KEYTAB); + assert_non_null(s); + assert_string_equal(s, ONEWAY_KEYTAB_PATH); + + s = dp_opt_get_string(test_ctx->ad_ctx->ad_options->id->basic, + SDAP_KRB5_KEYTAB); + assert_non_null(s); + + s = dp_opt_get_string(test_ctx->ad_ctx->ad_options->id->basic, + SDAP_SASL_REALM); + assert_non_null(s); + assert_string_equal(s, ONEWAY_DOMNAME); + + s = dp_opt_get_string(test_ctx->ad_ctx->ad_options->id->basic, + SDAP_KRB5_REALM); + assert_non_null(s); + assert_string_equal(s, ONEWAY_DOMNAME); + + s = dp_opt_get_string(test_ctx->ad_ctx->ad_options->id->basic, + SDAP_SASL_AUTHID); + assert_non_null(s); + assert_string_equal(s, ONEWAY_AUTHID); + + talloc_free(test_ctx->ad_ctx->ad_options); + + unlink(ONEWAY_KEYTAB_PATH); +} static void test_ad_create_2way_trust_options(void **state) { struct ad_common_test_ctx *test_ctx = talloc_get_type(*state, @@ -342,6 +413,9 @@ int main(int argc, const char *argv[]) const struct CMUnitTest tests[] = { cmocka_unit_test(test_ad_create_default_options), + cmocka_unit_test_setup_teardown(test_ad_create_1way_trust_options, + test_ad_common_setup, + test_ad_common_teardown), cmocka_unit_test_setup_teardown(test_ad_create_2way_trust_options, test_ad_common_setup, test_ad_common_teardown), -- 2.1.0