[SSSD] [PATCH] Search for SHORTNAME$@REALM instead of fqdn$@REALM by default

Jakub Hrozek jhrozek at redhat.com
Sun Jan 6 13:15:06 UTC 2013


The code used to work pretty much by accident pre-1.9 because we used to
search for wildcard "*$@REALM" first before any specific search.

We need to fix the search because currently anyone upgrading from the
previous release would have to change their config to include
ldap_sasl_authid.
-------------- next part --------------
>From e74cdc015a84ec10ec3f46ca64a4d91a3d80ffbb Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sat, 5 Jan 2013 21:16:05 +0100
Subject: [PATCH] Search for SHORTNAME$@REALM instead of fqdn$@REALM by default

The search was intended for the AD provider mostly, but keytabs coming
from AD via samba don't contain fqdn$@REALM but rather uppercased
SHORTNAME$@REALM

https://fedorahosted.org/sssd/ticket/1740
---
 src/util/sss_krb5.c | 38 +++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c
index 1b8dc79b293aba845e37f7e73d8d5b73f608cd05..bb61d10938a74d768c31869cae79fa1e348d3693 100644
--- a/src/util/sss_krb5.c
+++ b/src/util/sss_krb5.c
@@ -26,6 +26,35 @@
 #include "util/util.h"
 #include "util/sss_krb5.h"
 
+static char *
+get_primary(TALLOC_CTX *mem_ctx, const char *pattern, const char *hostname)
+{
+    char *primary;
+    char *dot;
+    char *c;
+    char *shortname;
+
+    if (strcmp(pattern, "%S$") == 0) {
+        shortname = talloc_strdup(mem_ctx, hostname);
+        if (!shortname) return NULL;
+
+        dot = strchr(shortname, '.');
+        if (dot) {
+            *dot = '\0';
+        }
+
+        for (c=shortname; *c != '\0'; ++c) {
+            *c = toupper(*c);
+        }
+
+        primary = talloc_asprintf(mem_ctx, "%s$", shortname);
+        talloc_free(shortname);
+        return primary;
+    }
+
+    return talloc_asprintf(mem_ctx, pattern, hostname);
+}
+
 errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
                                      const char *hostname,
                                      const char *desired_realm,
@@ -48,16 +77,19 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
     int realm_len;
 
     /**
+     * The %s conversion is passed as-is, the %S conversion is translated to
+     * "short host name"
+     *
      * Priority of lookup:
      * - our.hostname at REALM or host/our.hostname at REALM depending on the input
-     * - our.hostname$@REALM (AD domain)
+     * - SHORT.HOSTNAME$@REALM (AD domain)
      * - host/our.hostname at REALM
      * - foobar$@REALM (AD domain)
      * - host/foobar at REALM
      * - host/foo at BAR
      * - pick the first principal in the keytab
      */
-    const char *primary_patterns[] = {"%s", "%s$", "host/%s", "*$", "host/*",
+    const char *primary_patterns[] = {"%s", "%S$", "host/%s", "*$", "host/*",
                                       "host/*", NULL};
     const char *realm_patterns[] =   {"%s", "%s",  "%s",      "%s", "%s",
                                       NULL,     NULL};
@@ -99,7 +131,7 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
 
     do {
         if (primary_patterns[i]) {
-            primary = talloc_asprintf(tmp_ctx, primary_patterns[i], hostname);
+            primary = get_primary(tmp_ctx, primary_patterns[i], hostname);
             if (primary == NULL) {
                 ret = ENOMEM;
                 goto done;
-- 
1.8.0.2



More information about the sssd-devel mailing list