>From 56452e4a92df0891b86621d50ae737ada77bad45 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 19 Nov 2012 10:43:07 +0100 Subject: [PATCH 3/3] LDAP: Make it possible to use full principal in ldap_sasl_authid again When the guessing of principals was introduced, we changed the existing behaviour and instead of allowing both host/hostname@REALM and host/hostname, only the latter worked and the realm was always appended from the (then undocumented) ldap_sasl_realm option. This patch changes the behaviour to be more backwards-compatible -- if the ldap_sasl_authid contains the @-sign, then the ldap_sasl_realm is not always appended. The strict requirement of checking the requested authid/realm against the one found in keytab was also kind of relaxed because it didn't really work. For example when hostname was requested and the keytab matched host/hostname first, the code blew up. https://fedorahosted.org/sssd/ticket/1635 --- src/man/sssd-ldap.5.xml | 5 +++++ src/providers/ldap/ldap_common.c | 36 ++++++++++++++++++++++++++---------- 2 files changed, 31 insertions(+), 10 deletions(-) diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml index 2d62c11f232c4f1fd15b547b9ac3f4cfb7c0e170..b1be45fe2eb7c5900bcaca83d5d2ccb2335c8600 100644 --- a/src/man/sssd-ldap.5.xml +++ b/src/man/sssd-ldap.5.xml @@ -1418,6 +1418,9 @@ Specify the SASL authorization id to use. When GSSAPI is used, this represents the Kerberos principal used for authentication to the directory. + This option can either contain the full principal (for + example host/myhost@EXAMPLE.COM) or just the principal name + (for example host/myhost). Default: host/hostname@REALM @@ -1431,6 +1434,8 @@ Specify the SASL realm to use. When not specified, this option defaults to the value of krb5_realm. + If the ldap_sasl_authid contains the realm as well, + this option is ignored. Default: the value of krb5_realm. diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index 07e9c5d4fd09358e4157bf189703f7f7266bf164..f8b921adfe0aabc8f7ab70caab4b0201f7959c46 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -1009,6 +1009,7 @@ sdap_set_sasl_options(struct sdap_options *id_opts, TALLOC_CTX *tmp_ctx; char *sasl_primary; char *desired_primary; + char *primary_realm; char *sasl_realm; char *desired_realm; bool primary_requested = true; @@ -1024,12 +1025,23 @@ sdap_set_sasl_options(struct sdap_options *id_opts, desired_primary = default_primary; } - desired_realm = dp_opt_get_string(id_opts->basic, SDAP_SASL_REALM); - if (!desired_realm) { - realm_requested = false; - desired_realm = default_realm; + if ((primary_realm = strchr(desired_primary, '@'))) { + *primary_realm = '\0'; + desired_realm = primary_realm+1; + DEBUG(SSSDBG_TRACE_INTERNAL, + ("authid contains realm [%s]\n", desired_realm)); + } else { + desired_realm = dp_opt_get_string(id_opts->basic, SDAP_SASL_REALM); + if (!desired_realm) { + realm_requested = false; + desired_realm = default_realm; + } } + DEBUG(SSSDBG_CONF_SETTINGS, ("Will look for %s@%s in %s\n", + desired_primary, desired_realm, + keytab_path ? keytab_path : "default keytab")); + ret = select_principal_from_keytab(tmp_ctx, desired_primary, desired_realm, keytab_path, @@ -1038,12 +1050,16 @@ sdap_set_sasl_options(struct sdap_options *id_opts, goto done; } - if ((primary_requested && strcmp(desired_primary, sasl_primary) != 0) || - (realm_requested && strcmp(desired_realm, sasl_realm) != 0)) { - DEBUG(SSSDBG_CRIT_FAILURE, - ("Configured SASL auth ID/realm not found in keytab.\n")); - ret = ENOENT; - goto done; + if (primary_requested && strcmp(desired_primary, sasl_primary) != 0) { + DEBUG(SSSDBG_MINOR_FAILURE, + ("Configured SASL auth ID not found in keytab. " + "Requested %s, found %s\n", desired_primary, sasl_primary)); + } + + if (realm_requested && strcmp(desired_realm, sasl_realm) != 0) { + DEBUG(SSSDBG_MINOR_FAILURE, + ("Configured SASL realm not found in keytab. " + "Requested %s, found %s\n", desired_realm, sasl_realm)); } ret = dp_opt_set_string(id_opts->basic, -- 1.8.0