[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: mod_auth_kerb and heimdal: is there a way to remove the @MY.RELM from the end of a user name when the user is authenticated?
On May 1, 2008, at 5:43 PM, Scott Grizzard wrote:
> Here's the problem:
>
> We use Trac to manage our software development. Currently, we use
> mod_authnz_ldap to authenticate the users against the ldap directory
> before they can access the intranet. Trac uses the username
> returned by
> Apache as the user that is "logged in".
>
> We have migrated on to Heimdal, and a want to use mod_auth_kerb to do
> authentication for Trac (and subversion).
>
> The issue that I am having is this: when I authenticate using
> mod_auth_kerb, the username passed to apache, and then to trac, is
> "username@MY.RELM" instead of just "username". Is there any way to
> tell
> apache to only return the first portion of the principle name without
> returning the relm name.
The mod_auth_kerb list is a better place for this question. Here's a
relevant message from earlier this year:
On Jan 8, 2008, at 9:18 PM, Rob Riggs wrote:
> Hi all,
>
> This is the result of the discussion we had a couple of weeks ago.
> This patch adds a "Krb5AuthToLocal" directive (defaults to off) that
> will enable Kerberos V5 auth_to_local mapping in the mod_auth_kerb
> module. This patch is against the patched mod_auth_kerb that is
> part of Fedora 8.
>
> I would like to strongly encourage its adoption into the mainline of
> mod_auth_kerb. This patch is released to the public domain.
>
> Kindest Regards,
>
> Rob
> --- mod_auth_kerb-5.3/src/mod_auth_kerb.c.auth_to_local 2008-01-08
> 21:41:16.000000000 -0700
> +++ mod_auth_kerb-5.3/src/mod_auth_kerb.c 2008-01-08
> 21:47:30.000000000 -0700
> @@ -168,6 +168,7 @@
> char *krb_5_keytab;
> int krb_method_gssapi;
> int krb_method_k5pass;
> + int krb5_auth_to_local;
> #endif
> #ifdef KRB4
> char *krb_4_srvtab;
> @@ -230,6 +231,9 @@
>
> command("KrbMethodK5Passwd", ap_set_flag_slot, krb_method_k5pass,
> FLAG, "Enable Kerberos V5 password authentication."),
> +
> + command("Krb5AuthToLocal", ap_set_flag_slot, krb5_auth_to_local,
> + FLAG, "Enable Kerberos V5 auth_to_local mapping."),
> #endif
>
> #ifdef KRB4
> @@ -298,6 +302,7 @@
> #ifdef KRB5
> ((kerb_auth_config *)rec)->krb_method_k5pass = 1;
> ((kerb_auth_config *)rec)->krb_method_gssapi = 1;
> + ((kerb_auth_config *)rec)->krb5_auth_to_local = 0;
> #endif
> #ifdef KRB4
> ((kerb_auth_config *)rec)->krb_method_k4pass = 1;
> @@ -722,6 +727,78 @@
> }
>
> static int
> +do_krb5_an_to_ln(request_rec *r, const kerb_auth_config *conf,
> MK_POOL *p)
> +{
> + const int lname_size = 1024;
> +
> + krb5_context kcontext;
> + krb5_principal princ;
> + krb5_error_code code;
> + char lname[lname_size];
> + int ret;
> +
> + if (!conf->krb5_auth_to_local) {
> + return OK;
> + }
> +
> + ret = HTTP_INTERNAL_SERVER_ERROR;
> +
> + code = krb5_init_context(&kcontext);
> + if (code) {
> + log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
> + "Cannot initialize Kerberos5 context (%d)", code);
> + return HTTP_INTERNAL_SERVER_ERROR;
> + }
> +
> + code = krb5_parse_name(kcontext, MK_USER, &princ);
> + if (code) {
> + log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
> + "krb5_parse_name() failed for name %s: %s",
> + MK_USER,
> + krb5_get_err_text(kcontext, code));
> + krb5_free_context(kcontext);
> + return HTTP_INTERNAL_SERVER_ERROR;
> + }
> +
> + code = krb5_aname_to_localname(kcontext, princ, sizeof(lname),
> lname);
> + if (code) {
> + if (code != KRB5_LNAME_NOTRANS) {
> + log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
> + "krb5_aname_to_localname() failed: %s",
> + krb5_get_err_text(kcontext, code));
> + /* fall through */
> + }
> + else {
> + log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r,
> + "krb5_aname_to_localname() found no "
> + "mapping for principal %s",
> + MK_USER);
> + /* fall through */
> + }
> + }
> + else {
> + /* Does this belong in an authz handler? */
> + if (!krb5_kuserok(kcontext, princ, lname)) {
> + log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r,
> + "krb5_kuserok(%s, %s) == false",
> + MK_USER, lname);
> + ret = HTTP_UNAUTHORIZED;
> + }
> + else {
> + log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r,
> + "doing auth_to_local: %s -> %s",
> + MK_USER, lname);
> + MK_USER = apr_pstrdup(p, lname);
> + ret = OK;
> + }
> + }
> + krb5_free_principal(kcontext, princ);
> + krb5_free_context(kcontext);
> +
> + return ret;
> +}
> +
> +static int
> krb5_cache_cleanup(void *data)
> {
> krb5_context context;
> @@ -1468,11 +1545,17 @@
>
> #ifdef KRB5
> if (use_krb5 && conf->krb_method_gssapi &&
> - strcasecmp(auth_type, MECH_NEGOTIATE) == 0) {
> - ret = authenticate_user_gss(r, conf, auth_line,
> &negotiate_ret_value);
> + strcasecmp(auth_type, MECH_NEGOTIATE) == 0) {
> + ret = authenticate_user_gss(r, conf, auth_line,
> &negotiate_ret_value);
> + if (ret == OK) {
> + ret = do_krb5_an_to_ln(r, conf, r->connection->pool);
> + }
> } else if (use_krb5 && conf->krb_method_k5pass &&
> - strcasecmp(auth_type, "Basic") == 0) {
> - ret = authenticate_user_krb5pwd(r, conf, auth_line);
> + strcasecmp(auth_type, "Basic") == 0) {
> + ret = authenticate_user_krb5pwd(r, conf, auth_line);
> + if (ret == OK) {
> + ret = do_krb5_an_to_ln(r, conf, r->pool);
> + }
> }
> #endif
>
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace_______________________________________________
> modauthkerb-help mailing list
> modauthkerb-help@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/modauthkerb-help
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu