[SSSD] [PATCH] Search for SHORTNAME$@REALM instead of fqdn$@REALM by default
Jakub Hrozek
jhrozek at redhat.com
Sun Jan 6 13:15:06 UTC 2013
The code used to work pretty much by accident pre-1.9 because we used to
search for wildcard "*$@REALM" first before any specific search.
We need to fix the search because currently anyone upgrading from the
previous release would have to change their config to include
ldap_sasl_authid.
-------------- next part --------------
>From e74cdc015a84ec10ec3f46ca64a4d91a3d80ffbb Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sat, 5 Jan 2013 21:16:05 +0100
Subject: [PATCH] Search for SHORTNAME$@REALM instead of fqdn$@REALM by default
The search was intended for the AD provider mostly, but keytabs coming
from AD via samba don't contain fqdn$@REALM but rather uppercased
SHORTNAME$@REALM
https://fedorahosted.org/sssd/ticket/1740
---
src/util/sss_krb5.c | 38 +++++++++++++++++++++++++++++++++++---
1 file changed, 35 insertions(+), 3 deletions(-)
diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c
index 1b8dc79b293aba845e37f7e73d8d5b73f608cd05..bb61d10938a74d768c31869cae79fa1e348d3693 100644
--- a/src/util/sss_krb5.c
+++ b/src/util/sss_krb5.c
@@ -26,6 +26,35 @@
#include "util/util.h"
#include "util/sss_krb5.h"
+static char *
+get_primary(TALLOC_CTX *mem_ctx, const char *pattern, const char *hostname)
+{
+ char *primary;
+ char *dot;
+ char *c;
+ char *shortname;
+
+ if (strcmp(pattern, "%S$") == 0) {
+ shortname = talloc_strdup(mem_ctx, hostname);
+ if (!shortname) return NULL;
+
+ dot = strchr(shortname, '.');
+ if (dot) {
+ *dot = '\0';
+ }
+
+ for (c=shortname; *c != '\0'; ++c) {
+ *c = toupper(*c);
+ }
+
+ primary = talloc_asprintf(mem_ctx, "%s$", shortname);
+ talloc_free(shortname);
+ return primary;
+ }
+
+ return talloc_asprintf(mem_ctx, pattern, hostname);
+}
+
errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
const char *hostname,
const char *desired_realm,
@@ -48,16 +77,19 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
int realm_len;
/**
+ * The %s conversion is passed as-is, the %S conversion is translated to
+ * "short host name"
+ *
* Priority of lookup:
* - our.hostname at REALM or host/our.hostname at REALM depending on the input
- * - our.hostname$@REALM (AD domain)
+ * - SHORT.HOSTNAME$@REALM (AD domain)
* - host/our.hostname at REALM
* - foobar$@REALM (AD domain)
* - host/foobar at REALM
* - host/foo at BAR
* - pick the first principal in the keytab
*/
- const char *primary_patterns[] = {"%s", "%s$", "host/%s", "*$", "host/*",
+ const char *primary_patterns[] = {"%s", "%S$", "host/%s", "*$", "host/*",
"host/*", NULL};
const char *realm_patterns[] = {"%s", "%s", "%s", "%s", "%s",
NULL, NULL};
@@ -99,7 +131,7 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
do {
if (primary_patterns[i]) {
- primary = talloc_asprintf(tmp_ctx, primary_patterns[i], hostname);
+ primary = get_primary(tmp_ctx, primary_patterns[i], hostname);
if (primary == NULL) {
ret = ENOMEM;
goto done;
--
1.8.0.2
More information about the sssd-devel
mailing list