[SSSD] [PATCHES] KDC proxy related fixes

Sumit Bose sbose at redhat.com
Fri Jul 31 16:19:00 UTC 2015


On Fri, Jul 31, 2015 at 11:34:23AM +0200, Sumit Bose wrote:
> Hi,
> 
> it turned out that some of the current SSSD behaviour does not fit well
> if a KDC proxy is configured, see
> https://fedorahosted.org/sssd/ticket/2652 and
> https://fedorahosted.org/sssd/ticket/2700 for details.
> 
> The first patch in this series introduces a new call which checks if a
> KDC proxy is configured as suggested in the tickets. The other two
> patches aim to fix the respective ticket.
> 
> bye,
> Sumit

Please find attached a new version of the patches. They fix a memory
leak found by Christian in the first patch and contain a different
version of the third patch because the original version didn't fix the
issue Alexander was seeing. There is only a minor change compared to the
version Alexander tested, krb5.conf is not checked unconditionally but
only if the state is offline.

There was another comment by Christian on irc. Currently the patches
only check the kdc config entry. In theory if would be possible that for
the kdc a direct connection is used while the admin_server is configured
via a proxy. Since this is expected to be an un-common configuration I
hope it can be added later. To solve this I think
sss_krb5_realm_has_proxy() should get a second option indication if kdc
or admin_server should be checked. Depending on the type of request,
(pre-)auth or change password, or info file, kdcinfo or kpasswdinfo,
sss_krb5_realm_has_proxy() should be called with the matching option.

bye,
Sumit
-------------- next part --------------
From 907bf732bc42c8a9ad558a46415eb73d31368196 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 30 Jul 2015 16:52:42 +0200
Subject: [PATCH 1/3] krb5 utils: add sss_krb5_realm_has_proxy()

---
 src/tests/krb5_proxy_check_test_data.conf |  8 +++++
 src/tests/krb5_utils-tests.c              | 17 +++++++++
 src/util/sss_krb5.c                       | 57 +++++++++++++++++++++++++++++++
 src/util/sss_krb5.h                       |  2 ++
 4 files changed, 84 insertions(+)
 create mode 100644 src/tests/krb5_proxy_check_test_data.conf

diff --git a/src/tests/krb5_proxy_check_test_data.conf b/src/tests/krb5_proxy_check_test_data.conf
new file mode 100644
index 0000000000000000000000000000000000000000..eb74dbfa47d643668688d5c789b5962698c3d17c
--- /dev/null
+++ b/src/tests/krb5_proxy_check_test_data.conf
@@ -0,0 +1,8 @@
+[realms]
+  REALM = {
+    kdc = hello
+  }
+
+  REALM_PROXY = {
+    kdc = https://hello
+  }
diff --git a/src/tests/krb5_utils-tests.c b/src/tests/krb5_utils-tests.c
index 650ed48592768c214156d5274e654a447be98e36..9a25b09cdc136651a7117327036dd51b8ff23606 100644
--- a/src/tests/krb5_utils-tests.c
+++ b/src/tests/krb5_utils-tests.c
@@ -684,6 +684,22 @@ START_TEST(test_parse_krb5_map_user)
 }
 END_TEST
 
+START_TEST(test_sss_krb5_realm_has_proxy)
+{
+    krb5_error_code kerr;
+    long perr;
+
+    fail_unless(sss_krb5_realm_has_proxy(NULL) == false);
+
+    setenv("KRB5_CONFIG", "/dev/null", 1);
+    fail_unless(sss_krb5_realm_has_proxy("REALM") == false);
+
+    setenv("KRB5_CONFIG", ABS_SRC_DIR"/src/tests/krb5_proxy_check_test_data.conf", 1);
+    fail_unless(sss_krb5_realm_has_proxy("REALM") == false);
+    fail_unless(sss_krb5_realm_has_proxy("REALM_PROXY") == true);
+}
+END_TEST
+
 Suite *krb5_utils_suite (void)
 {
     Suite *s = suite_create ("krb5_utils");
@@ -723,6 +739,7 @@ Suite *krb5_utils_suite (void)
     TCase *tc_krb5_helpers = tcase_create("Helper functions");
     tcase_add_test(tc_krb5_helpers, test_compare_principal_realm);
     tcase_add_test(tc_krb5_helpers, test_parse_krb5_map_user);
+    tcase_add_test(tc_krb5_helpers, test_sss_krb5_realm_has_proxy);
     suite_add_tcase(s, tc_krb5_helpers);
 
     return s;
diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c
index e5c2121da575b174c8b6a9a90835f2c97f807f37..38e379cf95bb4772ca11daa513a80b2e480c88c4 100644
--- a/src/util/sss_krb5.c
+++ b/src/util/sss_krb5.c
@@ -20,6 +20,7 @@
 #include <stdio.h>
 #include <errno.h>
 #include <talloc.h>
+#include <profile.h>
 
 #include "config.h"
 
@@ -1069,3 +1070,59 @@ krb5_error_code sss_krb5_kt_have_content(krb5_context context,
     return 0;
 #endif
 }
+
+#define KDC_PROXY_INDICATOR "https://"
+#define KDC_PROXY_INDICATOR_LEN (sizeof(KDC_PROXY_INDICATOR) - 1)
+
+bool sss_krb5_realm_has_proxy(const char *realm)
+{
+    krb5_context context;
+    krb5_error_code kerr;
+    struct _profile_t *profile = NULL;
+    const char  *profile_path[4] = {"realms", NULL, "kdc", NULL};
+    char **list = NULL;
+    bool res = false;
+    size_t c;
+
+    if (realm == NULL) {
+        return false;
+    }
+
+    kerr = krb5_init_context(&context);
+    if (kerr != 0) {
+        DEBUG(SSSDBG_OP_FAILURE, "krb5_init_context failed.\n");
+        return false;
+    }
+
+    kerr = krb5_get_profile(context, &profile);
+    if (kerr != 0) {
+        DEBUG(SSSDBG_OP_FAILURE, "krb5_get_profile failed.\n");
+        goto done;
+    }
+
+    profile_path[1] = realm;
+
+    kerr = profile_get_values(profile, profile_path, &list);
+    if (kerr != 0) {
+        DEBUG(SSSDBG_OP_FAILURE, "profile_get_values failed.\n");
+        goto done;
+    }
+
+    for (c = 0; list[c] != NULL; c++) {
+        if (strncasecmp(KDC_PROXY_INDICATOR, list[c],
+                        KDC_PROXY_INDICATOR_LEN) == 0) {
+            DEBUG(SSSDBG_TRACE_ALL,
+                  "Found KDC Proxy indicator [%s] in [%s].\n",
+                  KDC_PROXY_INDICATOR, list[c]);
+            res = true;
+            break;
+        }
+    }
+
+done:
+    profile_free_list(list);
+    profile_release(profile);
+    krb5_free_context(context);
+
+    return res;
+}
diff --git a/src/util/sss_krb5.h b/src/util/sss_krb5.h
index 462dbbe0bda8969432c8ac2f062a0123c1f098f0..fdaeb49314764e096448f342a054dc6938f0c248 100644
--- a/src/util/sss_krb5.h
+++ b/src/util/sss_krb5.h
@@ -189,4 +189,6 @@ sss_krb5_get_primary(TALLOC_CTX *mem_ctx,
 
 krb5_error_code sss_krb5_kt_have_content(krb5_context context,
                                          krb5_keytab keytab);
+
+bool sss_krb5_realm_has_proxy(const char *realm);
 #endif /* __SSS_KRB5_H__ */
-- 
2.1.0

-------------- next part --------------
From 8dd0558573e0d4c09c1e50ebdbc50c3f3bab9256 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 31 Jul 2015 11:05:48 +0200
Subject: [PATCH 2/3] krb5: do not create kdcinfo file if proxy configuration
 exists

Resolves https://fedorahosted.org/sssd/ticket/2652
---
 src/providers/krb5/krb5_common.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index 81d4048b63dba98706bbef1936df7f10f79e1ae5..be6c9e3540ad470307f4edb168f0ff6cc581632f 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -428,6 +428,13 @@ errno_t write_krb5info_file(const char *realm, const char *server,
         return EINVAL;
     }
 
+    if (sss_krb5_realm_has_proxy(realm)) {
+        DEBUG(SSSDBG_CONF_SETTINGS,
+              "KDC Proxy available for realm [%s], no kdcinfo file created.\n",
+              realm);
+        return EOK;
+    }
+
     if (strcmp(service, SSS_KRB5KDC_FO_SRV) == 0) {
         name_tmpl = KDCINFO_TMPL;
     } else if (strcmp(service, SSS_KRB5KPASSWD_FO_SRV) == 0) {
-- 
2.1.0

-------------- next part --------------
From accb48919654049ec51a864b89ac2a99cb40b5d2 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 31 Jul 2015 11:06:54 +0200
Subject: [PATCH 3/3] krb5: assume online state if KDC proxy is configured

If a KDC proxy is configured a request in the KRB5 provider will assume
online state even if the backend is offline without changing the state
of the backend.

Resolves https://fedorahosted.org/sssd/ticket/2700
---
 src/providers/krb5/krb5_auth.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index 1c55ec3fca15db9ea717e590c5743f8365ec8c0d..d35df13994a3e16feff90592bec16d7a8f30b70a 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -754,6 +754,12 @@ static void krb5_auth_resolve_done(struct tevent_req *subreq)
         kr->is_offline = be_is_offline(state->be_ctx);
     }
 
+    if (kr->is_offline
+            && sss_krb5_realm_has_proxy(dp_opt_get_cstring(kr->krb5_ctx->opts,
+                                        KRB5_REALM))) {
+        kr->is_offline = false;
+    }
+
     subreq = handle_child_send(state, state->ev, kr);
     if (subreq == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, "handle_child_send failed.\n");
-- 
2.1.0



More information about the sssd-devel mailing list