pam_modules/krb5_migrate/krb5_migrate_authenticate.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <kadm5/admin.h>
#include <krb5.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <security/pam_impl.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <pwd.h>
#include <syslog.h>
#include <libintl.h>

#define	KRB5_AUTOMIGRATE_DATA	"SUNW-KRB5-AUTOMIGRATE-DATA"

static void krb5_migrate_cleanup(pam_handle_t *pamh, void *data,
				int pam_status);

/*
 * pam_sm_authenticate - Authenticate a host-based client service
 * principal to kadmind in order to permit the creation of a new user
 * principal in the client's default realm.
 */
int pam_sm_authenticate(pam_handle_t *pamh, int flags,
			int argc, const char **argv)
{
	char *user = NULL;
	char *userdata = NULL;
	char *olduserdata = NULL;
	char *password = NULL;
	int err, i;
	time_t now;

	/* pam.conf options */
	int debug = 0;
	int quiet = 0;
	int expire_pw = 0;
	char *service = NULL;

	/* krb5-specific defines */
	kadm5_ret_t retval = 0;
	krb5_context context = NULL;
	kadm5_config_params params;
	krb5_principal svcprinc;
	char *svcprincstr = NULL;
	krb5_principal userprinc;
	char *userprincstr = NULL;
	int strlength = 0;
	kadm5_principal_ent_rec kadm5_userprinc;
	char *kadmin_princ = NULL;
	char *def_realm = NULL;
	void *handle = NULL;
	long mask = 0;

	for (i = 0; i < argc; i++) {
		if (strcmp(argv[i], "debug") == 0) {
			debug = 1;
		} else if (strcmp(argv[i], "quiet") == 0) {
			quiet = 1;
		} else if (strcmp(argv[i], "expire_pw") == 0) {
			expire_pw = 1;
		} else if ((strstr(argv[i], "client_service=") != NULL) &&
		    (strcmp((strstr(argv[i], "=") + 1), "") != 0)) {
			service = strdup(strstr(argv[i], "=") + 1);
		} else {
			__pam_log(LOG_AUTH | LOG_ERR,
			    "PAM-KRB5-AUTOMIGRATE (auth): unrecognized "
			    "option %s", argv[i]);
		}
	}

	if (flags & PAM_SILENT)
		quiet = 1;

	err = pam_get_item(pamh, PAM_USER, (void**)&user);
	if (err != PAM_SUCCESS) {
		goto cleanup;
	}

	/*
	 * Check if user name is *not* NULL
	 */
	if (user == NULL || (user[0] == '\0')) {
		if (debug)
			__pam_log(LOG_AUTH | LOG_DEBUG,
			    "PAM-KRB5-AUTOMIGRATE (auth): user empty or null");
		goto cleanup;
	}

	/*
	 * Can't tolerate memory failure later on. Get a copy
	 * before any work is done.
	 */
	if ((userdata = strdup(user)) == NULL) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "PAM-KRB5-AUTOMIGRATE (auth): Out of memory");
		goto cleanup;
	}

	/*
	 * Grok the user password
	 */
	err = pam_get_item(pamh, PAM_AUTHTOK, (void **)&password);
	if (err != PAM_SUCCESS) {
		goto cleanup;
	}

	if (password == NULL || (password[0] == '\0')) {
		if (debug)
			__pam_log(LOG_AUTH | LOG_DEBUG,
			    "PAM-KRB5-AUTOMIGRATE (auth): "
			    "authentication token is empty or null");
		goto cleanup;
	}


	/*
	 * Now, lets do the all krb5/kadm5 setup for the principal addition
	 */
	if (retval = krb5_init_secure_context(&context)) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "PAM-KRB5-AUTOMIGRATE (auth): Error initializing "
		    "krb5: %s", error_message(retval));
		goto cleanup;
	}

	(void) memset((char *)&params, 0, sizeof (params));
	(void) memset(&kadm5_userprinc, 0, sizeof (kadm5_userprinc));

	if (def_realm == NULL && krb5_get_default_realm(context, &def_realm)) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "PAM-KRB5-AUTOMIGRATE (auth): Error while obtaining "
		    "default krb5 realm");
		goto cleanup;
	}

	params.mask |= KADM5_CONFIG_REALM;
	params.realm = def_realm;

	if (kadm5_get_adm_host_srv_name(context, def_realm,
	    &kadmin_princ)) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "PAM-KRB5-AUTOMIGRATE (auth): Error while obtaining "
		    "host based service name for realm %s\n", def_realm);
		goto cleanup;
	}

	if (retval = krb5_sname_to_principal(context, NULL,
	    (service != NULL) ? service : "host", KRB5_NT_SRV_HST, &svcprinc)) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "PAM-KRB5-AUTOMIGRATE (auth): Error while creating "
		    "krb5 host service principal: %s",
		    error_message(retval));
		goto cleanup;
	}

	if (retval = krb5_unparse_name(context, svcprinc,
	    &svcprincstr)) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "PAM-KRB5-AUTOMIGRATE (auth): Error while "
		    "unparsing principal name: %s", error_message(retval));
		krb5_free_principal(context, svcprinc);
		goto cleanup;
	}

	krb5_free_principal(context, svcprinc);

	/*
	 * Initialize the kadm5 connection using the default keytab
	 */
	retval = kadm5_init_with_skey(svcprincstr, NULL,
	    kadmin_princ, &params, KADM5_STRUCT_VERSION, KADM5_API_VERSION_2,
	    NULL, &handle);
	if (retval) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "PAM-KRB5-AUTOMIGRATE (auth): Error while "
		    "doing kadm5_init_with_skey: %s", error_message(retval));
		goto cleanup;
	}


	/*
	 * The RPCSEC_GSS connection has been established; Lets check to see
	 * if the corresponding user principal exists in the KDC database.
	 * If not, lets create a new one.
	 */

	strlength = strlen(user) + strlen(def_realm) + 2;
	if ((userprincstr = malloc(strlength)) == NULL)
		goto cleanup;
	(void) strlcpy(userprincstr, user, strlength);
	(void) strlcat(userprincstr, "@", strlength);
	(void) strlcat(userprincstr, def_realm, strlength);


	if (retval = krb5_parse_name(context, userprincstr,
	    &userprinc)) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "PAM-KRB5-AUTOMIGRATE (auth): Error while "
		    "parsing user principal name: %s",
		    error_message(retval));
		goto cleanup;
	}

	retval = kadm5_get_principal(handle, userprinc, &kadm5_userprinc,
	    KADM5_PRINCIPAL_NORMAL_MASK);

	krb5_free_principal(context, userprinc);

	if (retval) {
		switch (retval) {
		case KADM5_AUTH_GET:
			if (debug)
				__pam_log(LOG_AUTH | LOG_DEBUG,
				    "PAM-KRB5-AUTOMIGRATE (auth): %s does "
				    "not have the GET privilege "
				    "for kadm5_get_principal: %s",
				    svcprincstr, error_message(retval));
			break;

		case KADM5_UNK_PRINC:
		default:
			break;
		}
		/*
		 * We will try & add this principal anyways, continue on ...
		 */
		(void) memset(&kadm5_userprinc, 0, sizeof (kadm5_userprinc));
	} else {
		/*
		 * Principal already exists in the KDC database, quit now
		 */
		if (debug)
			__pam_log(LOG_AUTH | LOG_DEBUG,
			    "PAM-KRB5-AUTOMIGRATE (auth): Principal %s "
			    "already exists in Kerberos KDC database",
			    userprincstr);
		goto cleanup;
	}


	if (retval = krb5_parse_name(context, userprincstr,
	    &(kadm5_userprinc.principal))) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "PAM-KRB5-AUTOMIGRATE (auth): Error while "
		    "parsing user principal name: %s",
		    error_message(retval));
		goto cleanup;
	}

	if (expire_pw) {
		(void) time(&now);
		/*
		 * The local system time could actually be later than the
		 * system time of the KDC we are authenticating to.  We expire
		 * w/the local system time minus clockskew so that we are
		 * assured that it is expired on this login, not the next.
		 */
		now -= context->clockskew;
		kadm5_userprinc.pw_expiration = now;
		mask |= KADM5_PW_EXPIRATION;
	}

	mask |= KADM5_PRINCIPAL;
	retval = kadm5_create_principal(handle, &kadm5_userprinc,
	    mask, password);
	if (retval) {
		switch (retval) {
		case KADM5_AUTH_ADD:
			if (debug)
				__pam_log(LOG_AUTH | LOG_DEBUG,
				    "PAM-KRB5-AUTOMIGRATE (auth): %s does "
				    "not have the ADD privilege "
				    "for kadm5_create_principal: %s",
				    svcprincstr, error_message(retval));
			break;

		default:
			__pam_log(LOG_AUTH | LOG_ERR,
			    "PAM-KRB5-AUTOMIGRATE (auth): Generic error"
			    "while doing kadm5_create_principal: %s",
			    error_message(retval));
			break;
		}
		goto cleanup;
	}

	/*
	 * Success, new user principal has been added !
	 */
	if (!quiet) {
		char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];

		(void) snprintf(messages[0], sizeof (messages[0]),
		    dgettext(TEXT_DOMAIN, "\nUser `%s' has been "
		    "automatically migrated to the Kerberos realm %s\n"),
		    user, def_realm);
		(void) __pam_display_msg(pamh, PAM_TEXT_INFO, 1,
		    messages, NULL);
	}
	if (debug)
		__pam_log(LOG_AUTH | LOG_DEBUG,
		    "PAM-KRB5-AUTOMIGRATE (auth): User %s "
		    "has been added to the Kerberos KDC database",
		    userprincstr);

	/*
	 * Since this is a new krb5 principal, do a pam_set_data()
	 * for possible use by the acct_mgmt routine of pam_krb5(5)
	 */
	if (pam_get_data(pamh, KRB5_AUTOMIGRATE_DATA,
	    (const void **)&olduserdata) == PAM_SUCCESS) {
		/*
		 * We created a princ in a previous run on the same handle and
		 * it must have been for a different PAM_USER / princ name,
		 * otherwise we couldn't succeed here, unless that princ
		 * got deleted.
		 */
		if (olduserdata != NULL)
			free(olduserdata);
	}
	if (pam_set_data(pamh, KRB5_AUTOMIGRATE_DATA, userdata,
	    krb5_migrate_cleanup) != PAM_SUCCESS) {
		free(userdata);
	}

cleanup:
	if (service)
		free(service);
	if (kadmin_princ)
		free(kadmin_princ);
	if (svcprincstr)
		free(svcprincstr);
	if (userprincstr)
		free(userprincstr);
	if (def_realm)
		free(def_realm);
	(void) kadm5_free_principal_ent(handle, &kadm5_userprinc);
	(void) kadm5_destroy((void *)handle);
	if (context != NULL)
		krb5_free_context(context);

	return (PAM_IGNORE);
}

/*ARGSUSED*/
static void
krb5_migrate_cleanup(pam_handle_t *pamh, void *data, int pam_status) {
	if (data != NULL)
		free((char *)data);
}

/*ARGSUSED*/
int
pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
	return (PAM_IGNORE);
}