2004-06-19 08:15:41 +00:00
/*
Unix SMB / CIFS implementation .
simple kerberos5 routines for active directory
Copyright ( C ) Andrew Tridgell 2001
Copyright ( C ) Luke Howard 2002 - 2003
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
2007-07-10 02:07:03 +00:00
the Free Software Foundation ; either version 3 of the License , or
2004-06-19 08:15:41 +00:00
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
2007-07-10 02:07:03 +00:00
along with this program . If not , see < http : //www.gnu.org/licenses/>.
2004-06-19 08:15:41 +00:00
*/
2011-03-19 00:44:56 +01:00
# ifndef _AUTH_KERBEROS_H_
# define _AUTH_KERBEROS_H_
2004-06-19 08:15:41 +00:00
# if defined(HAVE_KRB5)
2005-09-17 01:11:50 +00:00
# include "auth/kerberos/krb5_init_context.h"
2006-03-14 15:03:25 +00:00
# include "librpc/gen_ndr/krb5pac.h"
2011-04-20 12:05:27 +10:00
# include "libcli/auth/krb5_wrap.h"
2006-03-14 15:03:25 +00:00
2011-02-08 16:53:13 +11:00
struct auth_user_info_dc ;
2006-11-07 00:48:36 +00:00
struct cli_credentials ;
2005-06-04 22:27:33 +00:00
2005-08-29 04:30:22 +00:00
struct ccache_container {
struct smb_krb5_context * smb_krb5_context ;
krb5_ccache ccache ;
} ;
2005-06-04 11:17:05 +00:00
2005-10-20 03:47:55 +00:00
struct keytab_container {
struct smb_krb5_context * smb_krb5_context ;
krb5_keytab keytab ;
} ;
2004-12-05 16:29:27 +00:00
/* not really ASN.1, but RFC 1964 */
2005-10-30 10:39:52 +00:00
# define TOK_ID_KRB_AP_REQ ((const uint8_t *)"\x01\x00")
# define TOK_ID_KRB_AP_REP ((const uint8_t *)"\x02\x00")
# define TOK_ID_KRB_ERROR ((const uint8_t *)"\x03\x00")
# define TOK_ID_GSS_GETMIC ((const uint8_t *)"\x01\x01")
# define TOK_ID_GSS_WRAP ((const uint8_t *)"\x02\x01")
2004-12-05 16:29:27 +00:00
2004-07-11 10:47:41 +00:00
# ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE
# define KRB5_KEY_TYPE(k) ((k)->keytype)
# define KRB5_KEY_LENGTH(k) ((k)->keyvalue.length)
# define KRB5_KEY_DATA(k) ((k)->keyvalue.data)
# else
# define KRB5_KEY_TYPE(k) ((k)->enctype)
# define KRB5_KEY_LENGTH(k) ((k)->length)
# define KRB5_KEY_DATA(k) ((k)->contents)
# endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
2010-06-28 23:14:23 +10:00
# define ENC_ALL_TYPES (ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 | \
ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256 )
2004-06-19 08:15:41 +00:00
# ifndef HAVE_KRB5_SET_DEFAULT_TGS_KTYPES
krb5_error_code krb5_set_default_tgs_ktypes ( krb5_context ctx , const krb5_enctype * enc ) ;
# endif
# if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
krb5_error_code krb5_auth_con_setuseruserkey ( krb5_context context , krb5_auth_context auth_context , krb5_keyblock * keyblock ) ;
# endif
2004-08-12 07:37:49 +00:00
# if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
const krb5_data * krb5_princ_component ( krb5_context context , krb5_principal principal , int i ) ;
# endif
2004-06-19 08:15:41 +00:00
/* Samba wrapper function for krb5 functionality. */
2010-03-03 13:24:52 +11:00
krb5_error_code kerberos_kinit_password_cc ( krb5_context ctx , krb5_ccache cc ,
krb5_principal principal , const char * password ,
2011-06-20 20:28:44 +02:00
krb5_principal impersonate_principal ,
const char * self_service ,
const char * target_service ,
2010-09-16 14:13:29 +10:00
krb5_get_init_creds_opt * krb_options ,
2010-03-03 13:24:52 +11:00
time_t * expire_time , time_t * kdc_time ) ;
krb5_error_code kerberos_kinit_keyblock_cc ( krb5_context ctx , krb5_ccache cc ,
2010-09-16 14:13:29 +10:00
krb5_principal principal , krb5_keyblock * keyblock ,
const char * target_service ,
krb5_get_init_creds_opt * krb_options ,
time_t * expire_time , time_t * kdc_time ) ;
2011-04-20 12:05:27 +10:00
NTSTATUS kerberos_pac_logon_info ( TALLOC_CTX * mem_ctx ,
DATA_BLOB blob ,
krb5_context context ,
const krb5_keyblock * krbtgt_keyblock ,
const krb5_keyblock * service_keyblock ,
krb5_const_principal client_principal ,
time_t tgs_authtime ,
struct PAC_LOGON_INFO * * logon_info ) ;
r10066: This is the second in my patches to work on Samba4's kerberos support,
with an aim to make the code simpiler and more correct.
Gone is the old (since the very early Samba 3.0 krb5 days) 'iterate over
all keytypes)' code in gensec_krb5, we now follow the approach used in
gensec_gssapi, and use a keytab.
I have also done a lot of work in the GSSAPI code, to try and reduce
the diff between us and upstream heimdal. It was becoming hard to
track patches in this code, and I also want this patch (the DCE_STYLE
support) to be in a 'manageable' state for when lha considers it for
merging. (metze assures me it still has memory leak problems, but
I've started to address some of that).
This patch also includes a simple update of other code to current
heimdal, as well as changes we need for better PAC verification.
On the PAC side of things we now match windows member servers by
checking the name and authtime on an incoming PAC. Not generating these
right was the cause of the PAC pain, and so now both the main code and
torture test validate this behaviour.
One thing doesn't work with this patch:
- the sealing of RPC pipes with kerberos, Samba -> Samba seems
broken. I'm pretty sure this is related to AES, and the need to break
apart the gss_wrap interface.
Andrew Bartlett
(This used to be commit a3aba57c00a9c5318f4706db55d03f64e8bea60c)
2005-09-07 21:52:50 +00:00
krb5_error_code kerberos_encode_pac ( TALLOC_CTX * mem_ctx ,
2005-08-05 00:41:53 +00:00
struct PAC_DATA * pac_data ,
krb5_context context ,
2006-11-11 15:11:21 +00:00
const krb5_keyblock * krbtgt_keyblock ,
const krb5_keyblock * service_keyblock ,
DATA_BLOB * pac ) ;
r10066: This is the second in my patches to work on Samba4's kerberos support,
with an aim to make the code simpiler and more correct.
Gone is the old (since the very early Samba 3.0 krb5 days) 'iterate over
all keytypes)' code in gensec_krb5, we now follow the approach used in
gensec_gssapi, and use a keytab.
I have also done a lot of work in the GSSAPI code, to try and reduce
the diff between us and upstream heimdal. It was becoming hard to
track patches in this code, and I also want this patch (the DCE_STYLE
support) to be in a 'manageable' state for when lha considers it for
merging. (metze assures me it still has memory leak problems, but
I've started to address some of that).
This patch also includes a simple update of other code to current
heimdal, as well as changes we need for better PAC verification.
On the PAC side of things we now match windows member servers by
checking the name and authtime on an incoming PAC. Not generating these
right was the cause of the PAC pain, and so now both the main code and
torture test validate this behaviour.
One thing doesn't work with this patch:
- the sealing of RPC pipes with kerberos, Samba -> Samba seems
broken. I'm pretty sure this is related to AES, and the need to break
apart the gss_wrap interface.
Andrew Bartlett
(This used to be commit a3aba57c00a9c5318f4706db55d03f64e8bea60c)
2005-09-07 21:52:50 +00:00
krb5_error_code kerberos_create_pac ( TALLOC_CTX * mem_ctx ,
2011-02-08 16:53:13 +11:00
struct auth_user_info_dc * user_info_dc ,
r10066: This is the second in my patches to work on Samba4's kerberos support,
with an aim to make the code simpiler and more correct.
Gone is the old (since the very early Samba 3.0 krb5 days) 'iterate over
all keytypes)' code in gensec_krb5, we now follow the approach used in
gensec_gssapi, and use a keytab.
I have also done a lot of work in the GSSAPI code, to try and reduce
the diff between us and upstream heimdal. It was becoming hard to
track patches in this code, and I also want this patch (the DCE_STYLE
support) to be in a 'manageable' state for when lha considers it for
merging. (metze assures me it still has memory leak problems, but
I've started to address some of that).
This patch also includes a simple update of other code to current
heimdal, as well as changes we need for better PAC verification.
On the PAC side of things we now match windows member servers by
checking the name and authtime on an incoming PAC. Not generating these
right was the cause of the PAC pain, and so now both the main code and
torture test validate this behaviour.
One thing doesn't work with this patch:
- the sealing of RPC pipes with kerberos, Samba -> Samba seems
broken. I'm pretty sure this is related to AES, and the need to break
apart the gss_wrap interface.
Andrew Bartlett
(This used to be commit a3aba57c00a9c5318f4706db55d03f64e8bea60c)
2005-09-07 21:52:50 +00:00
krb5_context context ,
2006-11-11 15:11:21 +00:00
const krb5_keyblock * krbtgt_keyblock ,
const krb5_keyblock * service_keyblock ,
r10066: This is the second in my patches to work on Samba4's kerberos support,
with an aim to make the code simpiler and more correct.
Gone is the old (since the very early Samba 3.0 krb5 days) 'iterate over
all keytypes)' code in gensec_krb5, we now follow the approach used in
gensec_gssapi, and use a keytab.
I have also done a lot of work in the GSSAPI code, to try and reduce
the diff between us and upstream heimdal. It was becoming hard to
track patches in this code, and I also want this patch (the DCE_STYLE
support) to be in a 'manageable' state for when lha considers it for
merging. (metze assures me it still has memory leak problems, but
I've started to address some of that).
This patch also includes a simple update of other code to current
heimdal, as well as changes we need for better PAC verification.
On the PAC side of things we now match windows member servers by
checking the name and authtime on an incoming PAC. Not generating these
right was the cause of the PAC pain, and so now both the main code and
torture test validate this behaviour.
One thing doesn't work with this patch:
- the sealing of RPC pipes with kerberos, Samba -> Samba seems
broken. I'm pretty sure this is related to AES, and the need to break
apart the gss_wrap interface.
Andrew Bartlett
(This used to be commit a3aba57c00a9c5318f4706db55d03f64e8bea60c)
2005-09-07 21:52:50 +00:00
krb5_principal client_principal ,
time_t tgs_authtime ,
DATA_BLOB * pac ) ;
2005-11-02 00:31:22 +00:00
2006-03-07 12:08:58 +00:00
# include "auth/kerberos/proto.h"
2004-06-19 08:15:41 +00:00
# endif /* HAVE_KRB5 */
2011-03-19 00:44:56 +01:00
# endif /* _AUTH_KERBEROS_H_ */
