From 36ce6bb6d73ae0da4dbae30fa2d21a2e62e9ac12 Mon Sep 17 00:00:00 2001
From: Jan Zeleny <jzeleny@redhat.com>
Date: Tue, 1 Nov 2011 10:19:04 -0400
Subject: [PATCH 2/2] Support to request canonicalization in LDAP/IPA provider

https://fedorahosted.org/sssd/ticket/957
---
 src/config/etc/sssd.api.d/sssd-ipa.conf    |    1 +
 src/config/etc/sssd.api.d/sssd-ldap.conf   |    1 +
 src/man/sssd-ldap.5.xml                    |   14 ++++++++++++++
 src/providers/ipa/ipa_common.c             |    1 +
 src/providers/ipa/ipa_common.h             |    2 +-
 src/providers/ldap/ldap_child.c            |    8 ++++++++
 src/providers/ldap/ldap_common.c           |    1 +
 src/providers/ldap/sdap.h                  |    1 +
 src/providers/ldap/sdap_async.h            |    1 +
 src/providers/ldap/sdap_async_connection.c |   15 +++++++++++++++
 10 files changed, 44 insertions(+), 1 deletions(-)

diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index b5264bacec003c7807abcf0343d11bf8365a158c..9ea45285ec93c4afe0ea2210c5a27a68de894b3f 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -27,6 +27,7 @@ krb5_server = str, None, false
 krb5_realm = str, None, false
 krb5_auth_timeout = int, None, false
 krb5_kpasswd = str, None, false
+krb5_canonicalize = bool, None, false
 ldap_krb5_keytab = str, None, false
 ldap_krb5_init_creds = bool, None, false
 ldap_entry_usn = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index 78a7fa34b8bc10279a8d6e4268fba3914d606395..f76ce19a158f1f78f626aed75b178b292e61dc16 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -19,6 +19,7 @@ ldap_sasl_authid = str, None, false
 krb5_kdcip = str, None, false
 krb5_server = str, None, false
 krb5_realm = str, None, false
+krb5_canonicalize = bool, None, false
 ldap_krb5_keytab = str, None, false
 ldap_krb5_init_creds = bool, None, false
 ldap_entry_usn = str, None, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 1e1958e71d3ba597fe9974ff04ba4ff137f9ed3b..8c1bfefa964e29f516a212a849e68cc2861565b7 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1203,6 +1203,20 @@
                 </varlistentry>
 
                 <varlistentry>
+                    <term>krb5_canonicalize (boolean)</term>
+                    <listitem>
+                        <para>
+                            Specifies if the host and user pricipal should be
+                            canonicalized.
+                        </para>
+
+                        <para>
+                            Default: false
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
                     <term>ldap_pwd_policy (string)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index be67dec9acfd8a59e6024ad98e4a3a8e691abc54..82cc1a9ce507644f1f004a78931ffb15fddf4d8d 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -78,6 +78,7 @@ struct dp_option ipa_def_ldap_opts[] = {
     /* use the same parm name as the krb5 module so we set it only once */
     { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "krb5_canonicalize", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     { "ldap_pwd_policy", DP_OPT_STRING, { "none" } , NULL_STRING },
     { "ldap_referrals", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER },
diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index 20074b45b521febb854fbbaa359fafea2f24c64c..40c5e53205285d761a43f6f0a77764006a5d79ca 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -35,7 +35,7 @@ struct ipa_service {
 /* the following defines are used to keep track of the options in the ldap
  * module, so that if they change and ipa is not updated correspondingly
  * this will trigger a runtime abort error */
-#define IPA_OPTS_BASIC_TEST 52
+#define IPA_OPTS_BASIC_TEST 53
 
 /* the following define is used to keep track of the options in the krb5
  * module, so that if they change and ipa is not updated correspondingly
diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c
index b0051fa9177ca84e671d2d1829533910da6bb0c9..c13812ebc661ffb4f171ba13938fd4390c32089d 100644
--- a/src/providers/ldap/ldap_child.c
+++ b/src/providers/ldap/ldap_child.c
@@ -139,6 +139,7 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
     char *realm_name = NULL;
     char *full_princ = NULL;
     char *default_realm = NULL;
+    char *tmp_str = NULL;
     krb5_context context = NULL;
     krb5_keytab keytab = NULL;
     krb5_ccache ccache = NULL;
@@ -147,6 +148,7 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
     krb5_get_init_creds_opt options;
     krb5_error_code krberr;
     krb5_timestamp kdc_time_offset;
+    int canonicalize = 0;
     int kdc_time_offset_usec;
     int ret;
 
@@ -253,6 +255,12 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
     krb5_get_init_creds_opt_set_proxiable(&options, 0);
     krb5_get_init_creds_opt_set_tkt_life(&options, lifetime);
 
+    tmp_str = getenv("KRB5_CANONICALIZE");
+    if (tmp_str != NULL && strcasecmp(tmp_str, "true") == 0) {
+        canonicalize = 1;
+    }
+    krb5_get_init_creds_opt_set_canonicalize(&options, canonicalize);
+
     krberr = krb5_get_init_creds_keytab(context, &my_creds, kprinc,
                                         keytab, 0, NULL, &options);
 
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index aad42bac91537a3743013d5f77ce207fe9ab58d3..de5abcc7214b9742bc8066a0227f57acb4774291 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -69,6 +69,7 @@ struct dp_option default_basic_opts[] = {
     /* use the same parm name as the krb5 module so we set it only once */
     { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "krb5_canonicalize", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     { "ldap_pwd_policy", DP_OPT_STRING, { "none" }, NULL_STRING },
     { "ldap_referrals", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER },
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 7d704b55f1bb8082746763e3b379c38d015a6378..a93f51c861435cd8ab6fefd1a678b29ad4eaf7c1 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -183,6 +183,7 @@ enum sdap_basic_opt {
     SDAP_KRB5_KINIT,
     SDAP_KRB5_KDC,
     SDAP_KRB5_REALM,
+    SDAP_KRB5_CANONICALIZE,
     SDAP_PWD_POLICY,
     SDAP_REFERRALS,
     SDAP_ACCOUNT_CACHE_EXPIRATION,
diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h
index 8714e2bad7589b93c21530644c64d66aea84ffea..e6fd1e34aef5d533ed974c852f7d8247e5927ce0 100644
--- a/src/providers/ldap/sdap_async.h
+++ b/src/providers/ldap/sdap_async.h
@@ -87,6 +87,7 @@ struct tevent_req *sdap_kinit_send(TALLOC_CTX *memctx,
                                    const char *keytab,
                                    const char *principal,
                                    const char *realm,
+                                   bool canonicalize,
                                    int lifetime);
 
 int sdap_kinit_recv(struct tevent_req *req,
diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c
index c69b9bce0f4649e76138168a4883c138ff5c721f..ace40db085d48a98850763bae41aa3624972b2a1 100644
--- a/src/providers/ldap/sdap_async_connection.c
+++ b/src/providers/ldap/sdap_async_connection.c
@@ -784,6 +784,7 @@ struct tevent_req *sdap_kinit_send(TALLOC_CTX *memctx,
                                    const char *keytab,
                                    const char *principal,
                                    const char *realm,
+                                   bool canonicalize,
                                    int lifetime)
 {
     struct tevent_req *req;
@@ -821,6 +822,18 @@ struct tevent_req *sdap_kinit_send(TALLOC_CTX *memctx,
         }
     }
 
+    if (canonicalize) {
+        ret = setenv("KRB5_CANONICALIZE", "true", 1);
+    } else {
+        ret = setenv("KRB5_CANONICALIZE", "false", 1);
+    }
+    if (ret == -1) {
+        DEBUG(2, ("Failed to set KRB5_CANONICALIZE to %s\n",
+                  ((canonicalize)?"true":"false")));
+        talloc_free(req);
+        return NULL;
+    }
+
     subreq = sdap_kinit_next_kdc(req);
     if (!subreq) {
         talloc_free(req);
@@ -1400,6 +1413,8 @@ static void sdap_cli_kinit_step(struct tevent_req *req)
                         dp_opt_get_string(state->opts->basic,
                                                    SDAP_SASL_AUTHID),
                         realm,
+                        dp_opt_get_string(state->opts->basic,
+                                                   SDAP_KRB5_CANONICALIZE),
                         dp_opt_get_int(state->opts->basic,
                                                    SDAP_KRB5_TICKET_LIFETIME));
     if (!subreq) {
-- 
1.7.6.2

