From a27c925d3857d2d2de6b2523174b01a41b919c62 Mon Sep 17 00:00:00 2001
From: Jan Zeleny <jzeleny@redhat.com>
Date: Fri, 18 Mar 2011 10:53:51 -0400
Subject: [PATCH 1/2] Modify principal selection for keytab authentication

Currently we construct the principal as host/fqdn@REALM. The problem
with this is that this principal doesn't have to be in the keytab. In
that case the provider fails to start. It is better to scan the keytab
and find the most suitable principal to use. Only in case no suitable
principal is found the backend should fail to start.

The second issue solved by this patch is that the realm we are
authenticating the machine to can be in general different from the realm
our users are part of (in case of cross Kerberos trust).

The patch adds new configuration option SDAP_SASL_REALM.

https://fedorahosted.org/sssd/ticket/781
---
 src/config/SSSDConfig.py                   |    1 +
 src/man/sssd-ldap.5.xml                    |    5 +-
 src/providers/ipa/ipa_common.c             |   57 ++++++----
 src/providers/ipa/ipa_common.h             |    2 +-
 src/providers/ldap/ldap_child.c            |   13 ++-
 src/providers/ldap/ldap_common.c           |    1 +
 src/providers/ldap/sdap.h                  |    1 +
 src/providers/ldap/sdap_async_connection.c |    9 +-
 src/providers/ldap/sdap_child_helpers.c    |    9 +-
 src/util/sss_krb5.c                        |  174 +++++++++++++++++++++++-----
 src/util/sss_krb5.h                        |    7 +
 11 files changed, 220 insertions(+), 59 deletions(-)

diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index 9c61f06f56dbf8101605582babb85298f30eb802..7645e08ff245310aeb91f0ca1853601fdb3d2293 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -133,6 +133,7 @@ option_strings = {
     'ldap_tls_reqcert' : _('Require TLS certificate verification'),
     'ldap_sasl_mech' : _('Specify the sasl mechanism to use'),
     'ldap_sasl_authid' : _('Specify the sasl authorization id to use'),
+    'ldap_sasl_realm' : _('Specify the sasl authorization realm to use'),
     'ldap_krb5_keytab' : _('Kerberos service keytab'),
     'ldap_krb5_init_creds' : _('Use Kerberos auth for LDAP connection'),
     'ldap_referrals' : _('Follow LDAP referrals'),
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 58665eb4e1325cdcebc24965486991ddd1762413..3e4a033fbeebcc478fcb69b26d4a62ad7198dd39 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -982,10 +982,11 @@
                         <para>
                             Specify the SASL authorization id to use.
                             When GSSAPI is used, this represents the Kerberos
-                            principal used for authentication to the directory.
+                            principal used for authentication to the directory
+                            (without the REALM part).
                         </para>
                         <para>
-                            Default: host/machine.fqdn@REALM
+                            Default: host/machine.fqdn
                         </para>
                     </listitem>
                 </varlistentry>
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 579b8b60e8df2f57ab17014561fa61ce933a4ead..5fee3b548f6deb073e72802402faf3a9e2c3f190 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -28,6 +28,7 @@
 
 #include "providers/ipa/ipa_common.h"
 #include "providers/ldap/sdap_async_private.h"
+#include "util/sss_krb5.h"
 
 struct dp_option ipa_basic_opts[] = {
     { "ipa_domain", DP_OPT_STRING, NULL_STRING, NULL_STRING },
@@ -69,6 +70,7 @@ struct dp_option ipa_def_ldap_opts[] = {
     { "ldap_id_use_start_tls", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_sasl_mech", DP_OPT_STRING, { "GSSAPI" } , NULL_STRING },
     { "ldap_sasl_authid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_sasl_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_krb5_init_creds", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     /* use the same parm name as the krb5 module so we set it only once */
@@ -261,7 +263,7 @@ int ipa_get_id_options(struct ipa_options *ipa_opts,
                        struct sdap_options **_opts)
 {
     TALLOC_CTX *tmpctx;
-    char *hostname;
+    char *primary;
     char *basedn;
     char *realm;
     char *value;
@@ -321,26 +323,6 @@ int ipa_get_id_options(struct ipa_options *ipa_opts,
                   dp_opt_get_string(ipa_opts->id->basic, SDAP_SEARCH_BASE)));
     }
 
-    /* set the ldap_sasl_authid if the ipa_hostname override was specified */
-    if (NULL == dp_opt_get_string(ipa_opts->id->basic, SDAP_SASL_AUTHID)) {
-        hostname = dp_opt_get_string(ipa_opts->basic, IPA_HOSTNAME);
-        if (hostname) {
-            value = talloc_asprintf(tmpctx, "host/%s", hostname);
-            if (!value) {
-                ret = ENOMEM;
-                goto done;
-            }
-            ret = dp_opt_set_string(ipa_opts->id->basic,
-                                    SDAP_SASL_AUTHID, value);
-            if (ret != EOK) {
-                goto done;
-            }
-        }
-        DEBUG(6, ("Option %s set to %s\n",
-                  ipa_opts->id->basic[SDAP_SASL_AUTHID].opt_name,
-                  dp_opt_get_string(ipa_opts->id->basic, SDAP_SASL_AUTHID)));
-    }
-
     /* set krb realm */
     if (NULL == dp_opt_get_string(ipa_opts->id->basic, SDAP_KRB5_REALM)) {
         realm = dp_opt_get_string(ipa_opts->basic, IPA_KRB5_REALM);
@@ -360,6 +342,39 @@ int ipa_get_id_options(struct ipa_options *ipa_opts,
                   dp_opt_get_string(ipa_opts->id->basic, SDAP_KRB5_REALM)));
     }
 
+    if (NULL == dp_opt_get_string(ipa_opts->id->basic, SDAP_SASL_AUTHID) ||
+        NULL == dp_opt_get_string(ipa_opts->id->basic, SDAP_SASL_REALM)) {
+        ret = select_principal_from_keytab(tmpctx,
+                                           dp_opt_get_string(ipa_opts->auth,
+                                                             KRB5_KEYTAB),
+                                           dp_opt_get_string(ipa_opts->id->basic,
+                                                             IPA_HOSTNAME),
+                                           dp_opt_get_string(ipa_opts->id->basic,
+                                                             IPA_KRB5_REALM),
+                                           &primary, &realm);
+        if (ret == EOK) {
+            ret = dp_opt_set_string(ipa_opts->id->basic,
+                                    SDAP_SASL_AUTHID, primary);
+            if (ret != EOK) {
+                goto done;
+            }
+            DEBUG(6, ("Option %s set to %s\n",
+                      ipa_opts->id->basic[SDAP_SASL_AUTHID].opt_name,
+                      dp_opt_get_string(ipa_opts->id->basic, SDAP_SASL_AUTHID)));
+
+            ret = dp_opt_set_string(ipa_opts->id->basic,
+                                    SDAP_SASL_REALM, realm);
+            if (ret != EOK) {
+                goto done;
+            }
+            DEBUG(6, ("Option %s set to %s\n",
+                      ipa_opts->id->basic[SDAP_SASL_REALM].opt_name,
+                      dp_opt_get_string(ipa_opts->id->basic, SDAP_SASL_REALM)));
+        } else if (ret != ENOENT) {
+            goto done;
+        }
+    }
+
     /* fix schema to IPAv1 for now */
     ipa_opts->id->schema_type = SDAP_SCHEMA_IPA_V1;
 
diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index 588aa63e412dc2ba006714729bb4710a4075ff25..922806234f76bad4b0d88907302c1e8a1d2f1020 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -35,7 +35,7 @@ struct ipa_service {
 /* the following defines are used to keep track of the options in the ldap
  * module, so that if they change and ipa is not updated correspondingly
  * this will trigger a runtime abort error */
-#define IPA_OPTS_BASIC_TEST 48
+#define IPA_OPTS_BASIC_TEST 49
 
 /* the following define is used to keep track of the options in the krb5
  * module, so that if they change and ipa is not updated correspondingly
diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c
index f4be18571a1a584270f6079173349eb92085fc4f..429331fb768a6f3272b49857ebb91c62dcfccdfb 100644
--- a/src/providers/ldap/ldap_child.c
+++ b/src/providers/ldap/ldap_child.c
@@ -188,16 +188,23 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
         }
     } else {
         char hostname[512];
+        char *final_realm;
+        char *final_primary;
 
         ret = gethostname(hostname, 511);
         if (ret == -1) {
-            krberr = KRB5KRB_ERR_GENERIC;
+            ret = errno;
             goto done;
         }
         hostname[511] = '\0';
 
-        full_princ = talloc_asprintf(memctx, "host/%s@%s",
-                                     hostname, realm_name);
+        ret = select_principal_from_keytab(memctx, hostname, realm_name,
+                                           keytab_name, &final_primary,
+                                           &final_realm);
+        if (ret) goto done;
+        full_princ = talloc_asprintf(memctx, "%s@%s", final_primary, final_realm);
+        talloc_free(final_primary);
+        talloc_free(final_realm);
     }
     if (!full_princ) {
         krberr = KRB5KRB_ERR_GENERIC;
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index ce6d41d5872a6dd474aff4bab8e2920688abda92..e44596716f9e0a5bf65c783d4eee72adef7424d6 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -63,6 +63,7 @@ struct dp_option default_basic_opts[] = {
     { "ldap_id_use_start_tls", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_sasl_mech", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_sasl_authid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_sasl_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_krb5_init_creds", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     /* use the same parm name as the krb5 module so we set it only once */
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index e74a87b1cbf7d5d58d33ccab0cea3e76b16f3d63..148044f69953d124dd34c41820137712ed01a3d5 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -182,6 +182,7 @@ enum sdap_basic_opt {
     SDAP_ID_TLS,
     SDAP_SASL_MECH,
     SDAP_SASL_AUTHID,
+    SDAP_SASL_REALM,
     SDAP_KRB5_KEYTAB,
     SDAP_KRB5_KINIT,
     SDAP_KRB5_KDC,
diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c
index d2eadfa6a025180915f477aff237c512dfa26e29..af1dc059bcc8667f7d79f68ed27ee7c76247de6f 100644
--- a/src/providers/ldap/sdap_async_connection.c
+++ b/src/providers/ldap/sdap_async_connection.c
@@ -1318,6 +1318,12 @@ static void sdap_cli_kinit_step(struct tevent_req *req)
     struct sdap_cli_connect_state *state = tevent_req_data(req,
                                              struct sdap_cli_connect_state);
     struct tevent_req *subreq;
+    const char *realm;
+
+    realm = dp_opt_get_string(state->opts->basic, SDAP_SASL_REALM);
+    if (!realm) {
+        realm = dp_opt_get_string(state->opts->basic, SDAP_KRB5_REALM);
+    }
 
     subreq = sdap_kinit_send(state, state->ev,
                              state->be,
@@ -1329,8 +1335,7 @@ static void sdap_cli_kinit_step(struct tevent_req *req)
                                                    SDAP_KRB5_KEYTAB),
                         dp_opt_get_string(state->opts->basic,
                                                    SDAP_SASL_AUTHID),
-                        dp_opt_get_string(state->opts->basic,
-                                                   SDAP_KRB5_REALM),
+                        realm,
                         dp_opt_get_int(state->opts->basic,
                                                    SDAP_KRB5_TICKET_LIFETIME));
     if (!subreq) {
diff --git a/src/providers/ldap/sdap_child_helpers.c b/src/providers/ldap/sdap_child_helpers.c
index 5a15e661e3ca014e511dc5647dd199d9839100a8..d0f6caeb2ea71340406b39ed086a47a44414d85a 100644
--- a/src/providers/ldap/sdap_child_helpers.c
+++ b/src/providers/ldap/sdap_child_helpers.c
@@ -458,6 +458,12 @@ int setup_child(struct sdap_id_ctx *ctx)
     const char *mech;
     unsigned v;
     FILE *debug_filep;
+    const char *realm;
+
+    realm = dp_opt_get_string(ctx->opts->basic, SDAP_SASL_REALM);
+    if (!realm) {
+        realm = dp_opt_get_string(ctx->opts->basic, SDAP_KRB5_REALM);
+    }
 
     mech = dp_opt_get_string(ctx->opts->basic,
                              SDAP_SASL_MECH);
@@ -468,8 +474,7 @@ int setup_child(struct sdap_id_ctx *ctx)
     if (mech && (strcasecmp(mech, "GSSAPI") == 0)) {
         ret = sss_krb5_verify_keytab(dp_opt_get_string(ctx->opts->basic,
                                                        SDAP_SASL_AUTHID),
-                                     dp_opt_get_string(ctx->opts->basic,
-                                                       SDAP_KRB5_REALM),
+                                     realm,
                                      dp_opt_get_string(ctx->opts->basic,
                                                        SDAP_KRB5_KEYTAB));
 
diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c
index 3f63a9e27282f63346d15bd734ba9d7da73c7d50..1484ed60f5fca98c130c13b6e655b1a155537d2b 100644
--- a/src/util/sss_krb5.c
+++ b/src/util/sss_krb5.c
@@ -26,6 +26,130 @@
 #include "util/util.h"
 #include "util/sss_krb5.h"
 
+errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
+                                     const char *hostname,
+                                     const char *desired_realm,
+                                     const char *keytab_name,
+                                     char **_primary,
+                                     char **_realm)
+{
+    krb5_error_code kerr = 0;
+    krb5_context krb_ctx;
+    krb5_keytab keytab;
+    krb5_principal client_princ = NULL;
+    TALLOC_CTX *tmp_ctx;
+    char *primary = NULL;
+    char *realm = NULL;
+    int i = 0;
+    errno_t ret;
+    char *principal_string;
+    char *separator;
+
+    /**
+     * Priority of lookup:
+     * - foobar$@REALM (AD domain)
+     * - host/our.hostname@REALM
+     * - host/foobar@REALM
+     * - host/foo@BAR
+     * - pick the first principal in the keytab
+     */
+    const char *primary_patterns[] = {"%s$", "*$", "host/%s", "host/*", "host/*", NULL};
+    const char *realm_patterns[] = {"%s", "%s", "%s", "%s", NULL, NULL};
+
+    DEBUG(5, ("trying to select the most appropriate principal from keytab\n"));
+    tmp_ctx = talloc_new(NULL);
+    if (!tmp_ctx) {
+        DEBUG(1, ("talloc_new failed\n"));
+        return ENOMEM;
+    }
+
+    kerr = krb5_init_context(&krb_ctx);
+    if (kerr) {
+        DEBUG(2, ("Failed to init kerberos context\n"));
+        ret = EFAULT;
+        goto done;
+    }
+
+    if (keytab_name != NULL) {
+        kerr = krb5_kt_resolve(krb_ctx, keytab_name, &keytab);
+    } else {
+        kerr = krb5_kt_default(krb_ctx, &keytab);
+    }
+    if (kerr) {
+        DEBUG(0, ("Failed to read keytab file: %s\n",
+                  sss_krb5_get_error_message(krb_ctx, kerr)));
+        ret = EFAULT;
+        goto done;
+    }
+
+    if (!desired_realm) {
+        desired_realm = "*";
+    }
+    if (!hostname) {
+        hostname = "*";
+    }
+
+    do {
+        if (primary_patterns[i]) {
+            primary = talloc_asprintf(tmp_ctx, primary_patterns[i], hostname);
+        } else {
+            primary = NULL;
+        }
+        if (realm_patterns[i]) {
+            realm = talloc_asprintf(tmp_ctx, realm_patterns[i], desired_realm);
+        } else {
+            realm = NULL;
+        }
+
+        kerr = find_principal_in_keytab(krb_ctx, keytab, primary, realm,
+                                        &client_princ);
+        talloc_zfree(primary);
+        talloc_zfree(realm);
+        if (kerr == 0) {
+            break;
+        }
+        if (client_princ != NULL) {
+            krb5_free_principal(krb_ctx, client_princ);
+            client_princ = NULL;
+        }
+        i++;
+    } while(primary_patterns[i-1] != NULL || realm_patterns[i-1] != NULL);
+
+    if (kerr == 0) {
+        kerr = krb5_unparse_name(krb_ctx, client_princ, &principal_string);
+        if (kerr) {
+            DEBUG(1, ("krb5_unparse_name failed"));
+            ret = EFAULT;
+            goto done;
+        }
+        separator = strchr(principal_string, '@');
+        if (separator) {
+           *separator = '\0';
+           *_realm = talloc_strdup(mem_ctx, separator+1);
+        } else {
+           *_realm = NULL;
+        }
+        *_primary = talloc_strdup(mem_ctx, principal_string);
+
+        DEBUG(5, ("Selected principal: %s@%s\n", *_primary, *_realm));
+        ret = EOK;
+    } else {
+        DEBUG(3, ("No suitable principal found in keytab\n"));
+        ret = ENOENT;
+    }
+
+done:
+    if (keytab) krb5_kt_close(krb_ctx, keytab);
+    if (krb_ctx) krb5_free_context(krb_ctx);
+    if (client_princ != NULL) {
+        krb5_free_principal(krb_ctx, client_princ);
+        client_princ = NULL;
+    }
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+
 int sss_krb5_verify_keytab(const char *principal,
                            const char *realm_str,
                            const char *keytab_name)
@@ -96,6 +220,8 @@ int sss_krb5_verify_keytab(const char *principal,
         }
     } else {
         char hostname[512];
+        char *final_realm;
+        char *final_primary;
 
         ret = gethostname(hostname, 511);
         if (ret == -1) {
@@ -104,8 +230,13 @@ int sss_krb5_verify_keytab(const char *principal,
         }
         hostname[511] = '\0';
 
-        full_princ = talloc_asprintf(tmp_ctx, "host/%s@%s",
-                                     hostname, realm_name);
+        ret = select_principal_from_keytab(tmp_ctx, hostname, realm_name,
+                                           keytab_name, &final_primary,
+                                           &final_realm);
+        if (ret) goto done;
+        full_princ = talloc_asprintf(tmp_ctx, "%s@%s", final_primary, final_realm);
+        talloc_free(final_primary);
+        talloc_free(final_realm);
     }
     if (!full_princ) {
         ret = ENOMEM;
@@ -209,18 +340,16 @@ static bool match_principal(krb5_context ctx,
                      const char *pattern_realm)
 {
     krb5_data *realm_data;
-    krb5_data *component_data;
-    char *primary_compose;
+    char *primary = NULL;
     char *primary_str = NULL;
-    int primary_compose_len = 0;
     int primary_str_len = 0;
     int tmp_len;
-    int i = 0;
     int len_diff;
 
     int mode = MODE_NORMAL;
     TALLOC_CTX *tmp_ctx;
     bool ret;
+    char *tmp_ptr;
 
     realm_data = krb5_princ_realm(ctx, principal);
 
@@ -243,32 +372,20 @@ static bool match_principal(krb5_context ctx,
             primary_str_len = tmp_len-1;
         }
 
-        while ((component_data = krb5_princ_component(ctx, principal, i++)) != NULL) {
-            if (!primary_compose) {
-                primary_compose = talloc_asprintf(tmp_ctx, "%.*s",
-                                                  component_data->length,
-                                                  component_data->data);
-            } else {
-                primary_compose = talloc_asprintf_append(primary_compose, "/%.*s",
-                                                         component_data->length,
-                                                         component_data->data);
-            }
-            if (!primary_compose) {
-                DEBUG(1, ("talloc_asprintf_append failed\n"));
-                ret = false;
-                goto done;
-            }
-            primary_compose_len += component_data->length+1;
+        krb5_unparse_name(ctx, principal, &primary);
+        tmp_ptr = strchr(primary, '@');
+        if (tmp_ptr) {
+            *tmp_ptr = '\0';
         }
-        len_diff = primary_compose_len-primary_str_len;
+
+        len_diff = strlen(primary)-primary_str_len;
 
         if ((mode == MODE_NORMAL &&
-                strcmp(primary_compose, pattern_primary) != 0) ||
+                strcmp(primary, pattern_primary) != 0) ||
             (mode == MODE_PREFIX &&
-                strncmp(primary_compose, primary_str, primary_str_len) != 0) ||
+                strncmp(primary, primary_str, primary_str_len) != 0) ||
             (mode == MODE_POSTFIX &&
-                strcmp(primary_compose+len_diff, primary_str) != 0)) {
-            talloc_free(primary_compose);
+                strcmp(primary+len_diff, primary_str) != 0)) {
             ret = false;
             goto done;
         }
@@ -282,6 +399,7 @@ static bool match_principal(krb5_context ctx,
     }
 
 done:
+    free(primary);
     talloc_free(tmp_ctx);
     return ret;
 }
@@ -331,7 +449,7 @@ krb5_error_code find_principal_in_keytab(krb5_context ctx,
 
     if (!principal_found) {
         kerr = KRB5_KT_NOTFOUND;
-        DEBUG(1, ("No principal from realm [%s] found in keytab.\n", pattern_realm));
+        DEBUG(1, ("No principal matching %s@%s found in keytab.\n", pattern_primary, pattern_realm));
         goto done;
     }
 
diff --git a/src/util/sss_krb5.h b/src/util/sss_krb5.h
index f25f3285b2cac8b37fde73985775c276c6ea589d..1ae84a3beba2d9938f38d4be5092cb16d64257f2 100644
--- a/src/util/sss_krb5.h
+++ b/src/util/sss_krb5.h
@@ -64,6 +64,13 @@ krb5_error_code find_principal_in_keytab(krb5_context ctx,
                                          const char *pattern_realm,
                                          krb5_principal *princ);
 
+errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
+                                     const char *hostname,
+                                     const char *desired_realm,
+                                     const char *keytab_name,
+                                     char **_primary,
+                                     char **_realm);
+
 #ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_EXPIRE_CALLBACK
 typedef void krb5_expire_callback_func(krb5_context context, void *data,
                                              krb5_timestamp password_expiration,
-- 
1.7.4.1

