svn commit: samba r11220 - in branches/SAMBA_4_0/source/auth: credentials kerberos

abartlet at samba.org abartlet at samba.org
Thu Oct 20 10:28:18 GMT 2005


Author: abartlet
Date: 2005-10-20 10:28:16 +0000 (Thu, 20 Oct 2005)
New Revision: 11220

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=11220

Log:
Add the ability to handle the salt prinicpal as part of the
credentials.  This works with the setup/secrets.ldif change from the
previous patch, and pretty much just re-invents the keytab.

Needed for kpasswdd work.

Andrew Bartlett

Modified:
   branches/SAMBA_4_0/source/auth/credentials/credentials.c
   branches/SAMBA_4_0/source/auth/credentials/credentials.h
   branches/SAMBA_4_0/source/auth/credentials/credentials_files.c
   branches/SAMBA_4_0/source/auth/credentials/credentials_krb5.c
   branches/SAMBA_4_0/source/auth/kerberos/kerberos_util.c


Changeset:
Modified: branches/SAMBA_4_0/source/auth/credentials/credentials.c
===================================================================
--- branches/SAMBA_4_0/source/auth/credentials/credentials.c	2005-10-20 10:25:51 UTC (rev 11219)
+++ branches/SAMBA_4_0/source/auth/credentials/credentials.c	2005-10-20 10:28:16 UTC (rev 11220)
@@ -51,6 +51,7 @@
 
 	cred->old_password = NULL;
 	cred->smb_krb5_context = NULL;
+	cred->salt_principal = NULL;
 
 	return cred;
 }

Modified: branches/SAMBA_4_0/source/auth/credentials/credentials.h
===================================================================
--- branches/SAMBA_4_0/source/auth/credentials/credentials.h	2005-10-20 10:25:51 UTC (rev 11219)
+++ branches/SAMBA_4_0/source/auth/credentials/credentials.h	2005-10-20 10:28:16 UTC (rev 11220)
@@ -57,6 +57,7 @@
 	const char *domain;
 	const char *realm;
 	const char *principal;
+	const char *salt_principal;
 
 	struct samr_Password *nt_hash;
 

Modified: branches/SAMBA_4_0/source/auth/credentials/credentials_files.c
===================================================================
--- branches/SAMBA_4_0/source/auth/credentials/credentials_files.c	2005-10-20 10:25:51 UTC (rev 11219)
+++ branches/SAMBA_4_0/source/auth/credentials/credentials_files.c	2005-10-20 10:28:16 UTC (rev 11220)
@@ -182,6 +182,7 @@
 		"secureChannelType",
 		"ntPwdHash",
 		"msDS-KeyVersionNumber",
+		"saltPrincipal",
 		NULL
 	};
 	
@@ -191,6 +192,7 @@
 	const char *domain;
 	const char *realm;
 	enum netr_SchannelType sct;
+	const char *salt_principal;
 	
 	/* ok, we are going to get it now, don't recurse back here */
 	cred->machine_account_pending = False;
@@ -209,13 +211,13 @@
 			       &msgs, attrs,
 			       "%s", filter);
 	if (ldb_ret == 0) {
-		DEBUG(1, ("Could not find join record to domain: %s\n",
-			  cli_credentials_get_domain(cred)));
+		DEBUG(1, ("Could not find entry to match filter: %s\n",
+			  filter));
 		talloc_free(mem_ctx);
 		return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 	} else if (ldb_ret != 1) {
-		DEBUG(1, ("Found more than one (%d) join records to domain: %s\n",
-			  ldb_ret, cli_credentials_get_domain(cred)));
+		DEBUG(1, ("Found more than one (%d) entry to match filter: %s\n",
+			  ldb_ret, filter));
 		talloc_free(mem_ctx);
 		return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 	}
@@ -231,6 +233,9 @@
 		talloc_free(mem_ctx);
 		return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 	}
+
+	salt_principal = ldb_msg_find_string(msgs[0], "saltPrincipal", NULL);
+	cli_credentials_set_salt_principal(cred, salt_principal);
 	
 	sct = ldb_msg_find_int(msgs[0], "secureChannelType", 0);
 	if (sct) { 

Modified: branches/SAMBA_4_0/source/auth/credentials/credentials_krb5.c
===================================================================
--- branches/SAMBA_4_0/source/auth/credentials/credentials_krb5.c	2005-10-20 10:25:51 UTC (rev 11219)
+++ branches/SAMBA_4_0/source/auth/credentials/credentials_krb5.c	2005-10-20 10:28:16 UTC (rev 11220)
@@ -299,3 +299,12 @@
 	return cred->kvno;
 }
 
+const char *cli_credentials_get_salt_principal(struct cli_credentials *cred) 
+{
+	return cred->salt_principal;
+}
+
+void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal) 
+{
+	cred->salt_principal = talloc_strdup(cred, principal);
+}

Modified: branches/SAMBA_4_0/source/auth/kerberos/kerberos_util.c
===================================================================
--- branches/SAMBA_4_0/source/auth/kerberos/kerberos_util.c	2005-10-20 10:25:51 UTC (rev 11219)
+++ branches/SAMBA_4_0/source/auth/kerberos/kerberos_util.c	2005-10-20 10:28:16 UTC (rev 11220)
@@ -50,38 +50,44 @@
 	char *machine_username;
 	char *salt_body;
 	char *lower_realm;
+	char *salt_principal;
 	struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
 	if (!mem_ctx) {
 		return ENOMEM;
 	}
-	
-	machine_username = talloc_strdup(mem_ctx, cli_credentials_get_username(machine_account));
 
-	if (!machine_username) {
-		talloc_free(mem_ctx);
+	salt_principal = cli_credentials_get_salt_principal(machine_account);
+	if (salt_principal) {
+		ret = krb5_parse_name(smb_krb5_context->krb5_context, salt_principal, salt_princ); 
+	} else {
+		machine_username = talloc_strdup(mem_ctx, cli_credentials_get_username(machine_account));
+		
+		if (!machine_username) {
+			talloc_free(mem_ctx);
+			return ENOMEM;
+		}
+		
+		if (machine_username[strlen(machine_username)-1] == '$') {
+			machine_username[strlen(machine_username)-1] = '\0';
+		}
+		lower_realm = strlower_talloc(mem_ctx, cli_credentials_get_realm(machine_account));
+		if (!lower_realm) {
+			talloc_free(mem_ctx);
+			return ENOMEM;
+		}
+		
+		salt_body = talloc_asprintf(mem_ctx, "%s.%s", machine_username, 
+					    lower_realm);
+		if (!salt_body) {
+			talloc_free(mem_ctx);
 		return ENOMEM;
-	}
+		}
+		
+		ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ, 
+					  cli_credentials_get_realm(machine_account), 
+					  "host", salt_body, NULL);
+	} 
 
-	if (machine_username[strlen(machine_username)-1] == '$') {
-		machine_username[strlen(machine_username)-1] = '\0';
-	}
-	lower_realm = strlower_talloc(mem_ctx, cli_credentials_get_realm(machine_account));
-	if (!lower_realm) {
-		talloc_free(mem_ctx);
-		return ENOMEM;
-	}
-
-	salt_body = talloc_asprintf(mem_ctx, "%s.%s", machine_username, 
-				    lower_realm);
-	if (!salt_body) {
-		talloc_free(mem_ctx);
-		return ENOMEM;
-	}
-	
-	ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ, 
-				  cli_credentials_get_realm(machine_account), 
-				  "host", salt_body, NULL);
-
 	if (ret == 0) {
 		mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
 		mem_ctx->principal = *salt_princ;



More information about the samba-cvs mailing list