[SCM] Samba Shared Repository - branch v4-1-test updated

Karolin Seeger kseeger at samba.org
Mon Oct 7 04:22:04 MDT 2013


The branch, v4-1-test has been updated
       via  82d6a43 doc: Update documentation of pam_winbind krb5 support.
       via  5a55cb6 s3-winbind: Add support for the kernel krb5 keyring buffer.
       via  58038f6 s3-winbind: Don't set a default directory for DIR.
       via  996415f Revert "Support UPN_DNS_INFO in the PAC"
      from  76c4a51 Merge tag 'samba-4.1.0rc4' into v4-1-test

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v4-1-test


- Log -----------------------------------------------------------------
commit 82d6a4354d3b4a6cc9e70ccfb21d7b604bed179b
Author: Andreas Schneider <asn at samba.org>
Date:   Tue Sep 10 09:43:32 2013 +0200

    doc: Update documentation of pam_winbind krb5 support.
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Guenther Deschner <gd at samba.org>
    
    Autobuild-User(master): Günther Deschner <gd at samba.org>
    Autobuild-Date(master): Tue Sep 10 15:35:20 CEST 2013 on sn-devel-104
    
    The last 3 patches address bug #10132 - pam_winbindd should support the KEYRING
    ccache type.
    
    Autobuild-User(v4-1-test): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(v4-1-test): Mon Oct  7 12:21:29 CEST 2013 on sn-devel-104

commit 5a55cb636fa50e96000ea6a00960cc34e00e26a1
Author: Andreas Schneider <asn at samba.org>
Date:   Tue Sep 10 09:30:04 2013 +0200

    s3-winbind: Add support for the kernel krb5 keyring buffer.
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Guenther Deschner <gd at samba.org>

commit 58038f6b26b5363f07d6e4a3fac6db461f9bca2c
Author: Andreas Schneider <asn at samba.org>
Date:   Tue Sep 10 09:28:50 2013 +0200

    s3-winbind: Don't set a default directory for DIR.
    
    There is not default so you should always have to specify a directory in
    the config file.
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Guenther Deschner <gd at samba.org>

commit 996415fa84d22021fcbd7db8fa21bb8dbacca125
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Oct 3 15:14:58 2013 +0200

    Revert "Support UPN_DNS_INFO in the PAC"
    
    This reverts commit a6be8a97f705247c1b1cbb0595887d8924740a71.
    
    We fail (often) to parse a krb5pac type 12 buffer due to the incomplete change
    which came in via a6be8a97f705247c1b1cbb0595887d8924740a71. This change came
    into master and has only been released in RCs so no regression to published
    4.0.x releases. We should revert this for 4.1 for now until we can make it work
    in all cases (see work on this in
    https://git.samba.org/?p=gd/samba/.git;a=shortlog;h=refs/heads/master-krb5pac_type12).
    Without this revert the entire PAC parsing may fail which can effect serious
    implications (krb5 smb session setup not working).
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10178
    
    Signed-off-by: Günther Deschner <gd at samba.org>
    Reviewed-by: Stefan Metzmacher <metze at samba.org>
    
    Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
    Autobuild-Date(master): Thu Oct  3 17:08:46 CEST 2013 on sn-devel-104
    (cherry picked from commit 8b51eabf319689d45ce1f8492c4372b49eecb794)

-----------------------------------------------------------------------

Summary of changes:
 docs-xml/manpages/pam_winbind.conf.5.xml |   26 +++++++++++++++++---------
 librpc/idl/krb5pac.idl                   |   16 +++++++---------
 source3/winbindd/winbindd_pam.c          |    4 ++--
 3 files changed, 26 insertions(+), 20 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/pam_winbind.conf.5.xml b/docs-xml/manpages/pam_winbind.conf.5.xml
index be7f684..725e809 100644
--- a/docs-xml/manpages/pam_winbind.conf.5.xml
+++ b/docs-xml/manpages/pam_winbind.conf.5.xml
@@ -106,16 +106,24 @@
 		<term>krb5_ccache_type = [type]</term>
 		<listitem><para>
 
-		When pam_winbind is configured to try kerberos authentication by
-		enabling the <parameter>krb5_auth</parameter> option, it can
-		store the retrieved Ticket Granting Ticket (TGT) in a credential
-		cache. The type of credential cache can be controlled with this
-		option.  The supported values are: <parameter>FILE</parameter>
-		and <parameter>DIR</parameter> (when the DIR type is supported
-		by the system's Kerberos library). In case of FILE a credential
+		When pam_winbind is configured to try kerberos authentication
+		by enabling the <parameter>krb5_auth</parameter> option, it can
+		store the retrieved Ticket Granting Ticket (TGT) in a
+		credential cache. The type of credential cache can be
+		controlled with this option.  The supported values are:
+		<parameter>KEYRING</parameter> (when supported by the system's
+		Kerberos library and Kernel), <parameter>FILE</parameter> and
+		<parameter>DIR</parameter> (when the DIR type is supported by
+		the system's Kerberos library). In case of FILE a credential
 		cache in the form of /tmp/krb5cc_UID will be created -  in case
-		of DIR it will be located under the /run/user/UID/krb5cc
-		directory.  UID is replaced with the numeric user id.</para>
+		of DIR you NEED to specify a directory. UID is replaced with
+		the numeric user id.</para>
+
+		<para>When using the KEYRING type, the supported mechanism is
+		<quote>KEYRING:persistent:UID</quote>, which uses the Linux
+		kernel keyring to store credentials on a per-UID basis. This is
+		the recommended choice on latest Linux distributions, as it is
+		the most secure and predictable method.</para>
 
 		<para>It is also possible to define custom filepaths and use the "%u"
 		pattern in order to substitue the numeric user id.
diff --git a/librpc/idl/krb5pac.idl b/librpc/idl/krb5pac.idl
index 0fce16b..8a6540c 100644
--- a/librpc/idl/krb5pac.idl
+++ b/librpc/idl/krb5pac.idl
@@ -37,20 +37,18 @@ interface krb5pac
 		[size_is(num_transited_services)] lsa_String *transited_services;
 	} PAC_CONSTRAINED_DELEGATION;
 
-	typedef [public,bitmap32bit] bitmap {
-		UDI_ACCT_HAS_NO_UPN	= 0x00000001 /* 1= User account has no UPN */
-	} upn_dns_info_flags;
-
 	typedef struct {
 		[value(2*strlen_m(upn_name))] uint16 upn_size;
 		uint16 upn_offset;
 		[value(2*strlen_m(domain_name))] uint16 domain_size;
 		uint16 domain_offset;
-		upn_dns_info_flags flags;
-		uint32 padding;
+		uint16 unknown3; /* 0x01 */
+		uint16 unknown4;
+		uint32 unknown5;
 		[charset(UTF16)] uint8 upn_name[upn_size+2];
 		[charset(UTF16)] uint8 domain_name[domain_size+2];
-	} PAC_UPN_DNS_INFO;
+		uint32 unknown6; /* padding */
+	} PAC_UNKNOWN_12;
 
 	typedef [public] struct {
 		PAC_LOGON_INFO *info;
@@ -66,7 +64,7 @@ interface krb5pac
 		PAC_TYPE_KDC_CHECKSUM = 7,
 		PAC_TYPE_LOGON_NAME = 10,
 		PAC_TYPE_CONSTRAINED_DELEGATION = 11,
-		PAC_TYPE_UPN_DNS_INFO = 12
+		PAC_TYPE_UNKNOWN_12 = 12
 	} PAC_TYPE;
 
 	typedef struct {
@@ -80,12 +78,12 @@ interface krb5pac
 		[case(PAC_TYPE_LOGON_NAME)]	PAC_LOGON_NAME logon_name;
 		[case(PAC_TYPE_CONSTRAINED_DELEGATION)][subcontext(0xFFFFFC01)]
 			PAC_CONSTRAINED_DELEGATION_CTR constrained_delegation;
-		[case(PAC_TYPE_UPN_DNS_INFO)]	PAC_UPN_DNS_INFO upn_dns_info;
 		/* when new PAC info types are added they are supposed to be done
 		   in such a way that they are backwards compatible with existing
 		   servers. This makes it safe to just use a [default] for
 		   unknown types, which lets us ignore the data */
 		[default]	[subcontext(0)] DATA_BLOB_REM unknown;
+		/* [case(PAC_TYPE_UNKNOWN_12)]	PAC_UNKNOWN_12 unknown; */
 	} PAC_INFO;
 
 	typedef [public,nopush,nopull,noprint] struct {
diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
index 7b67154..c356686 100644
--- a/source3/winbindd/winbindd_pam.c
+++ b/source3/winbindd/winbindd_pam.c
@@ -492,9 +492,9 @@ static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 			gen_cc = talloc_asprintf(
 				mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
 		}
-		if (strequal(type, "DIR")) {
+		if (strequal(type, "KEYRING")) {
 			gen_cc = talloc_asprintf(
-				mem_ctx, "DIR:/run/user/%d/krb5cc", uid);
+				mem_ctx, "KEYRING:persistent:%d", uid);
 		}
 
 		if (strnequal(type, "FILE:/", 6) ||


-- 
Samba Shared Repository


More information about the samba-cvs mailing list