sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-08 05:57:51 +03:00
Code

s3-gensec: Add hook to allow gensec to know if kerberos is permitted

Browse Source 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Andrew Bartlett 2012-01-12 21:16:36 +11:00 committed by Stefan Metzmacher
parent 45ec777e0e
commit 67279780dd
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
source3/auth/auth_generic.c
View File

@ -30,6 +30,7 @@
#include "libcli/auth/krb5_wrap.h" #include "libcli/auth/krb5_wrap.h"
#endif #endif
#include "librpc/crypto/gse.h" #include "librpc/crypto/gse.h"
#include "auth/credentials/credentials.h"
static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx, static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx,
TALLOC_CTX *mem_ctx, TALLOC_CTX *mem_ctx,
@ -175,6 +176,7 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
struct gensec_settings *gensec_settings; struct gensec_settings *gensec_settings;
struct loadparm_context *lp_ctx; struct loadparm_context *lp_ctx;
struct cli_credentials *server_credentials;
struct auth4_context *auth4_context = talloc_zero(tmp_ctx, struct auth4_context); struct auth4_context *auth4_context = talloc_zero(tmp_ctx, struct auth4_context);
if (auth4_context == NULL) { if (auth4_context == NULL) {
DEBUG(10, ("failed to allocate auth4_context failed\n")); DEBUG(10, ("failed to allocate auth4_context failed\n"));
@ -209,6 +211,24 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
gensec_settings->backends[1] = &gensec_gse_krb5_security_ops; gensec_settings->backends[1] = &gensec_gse_krb5_security_ops;
#endif #endif
/*
* This is anonymous for now, because we just use it
* to set the kerberos state at the moment
*/
server_credentials = cli_credentials_init_anon(tmp_ctx);
if (!server_credentials) {
DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
return NT_STATUS_NO_MEMORY;
}
cli_credentials_set_conf(server_credentials, lp_ctx);
if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS);
} else {
cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS);
}
nt_status = gensec_server_start(tmp_ctx, gensec_settings, nt_status = gensec_server_start(tmp_ctx, gensec_settings,
auth4_context, &gensec_security); auth4_context, &gensec_security);
@ -216,7 +236,11 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
TALLOC_FREE(tmp_ctx); TALLOC_FREE(tmp_ctx);
return nt_status; return nt_status;
} }
gensec_set_credentials(gensec_security, server_credentials);
talloc_unlink(tmp_ctx, lp_ctx); talloc_unlink(tmp_ctx, lp_ctx);
talloc_unlink(tmp_ctx, server_credentials);
talloc_unlink(tmp_ctx, gensec_settings); talloc_unlink(tmp_ctx, gensec_settings);
talloc_unlink(tmp_ctx, auth4_context); talloc_unlink(tmp_ctx, auth4_context);
} }