~ubuntu-branches/ubuntu/wily/dovecot/wily

k5_principal_is_authorized(struct auth_request *request, const char *name)

{

        const char *value, *const *authorized_names, *const *tmp;

 

        value = auth_fields_find(request->extra_fields, "k5principals");

        if (value == NULL)

                return FALSE;

 

        authorized_names = t_strsplit_spaces(value, ",");

        for (tmp = authorized_names; *tmp != NULL; tmp++) {

                if (strcmp(*tmp, name) == 0) {

                        auth_request_log_debug(request, "gssapi",

                                "authorized by k5principals field: %s", name);

                        return TRUE;

                }

        }

        return FALSE;

}

 

static bool

        bool authorized = FALSE;

                /* See if the principal is in the list of authorized

                 * principals for the user */

                authorized = k5_principal_is_authorized(&request->auth_request,

                                                        princ_display_name);

 

                   specified (UNIX) user */

                if (!authorized)

                        authorized = krb5_kuserok(ctx, princ, login_user);

 

        return authorized;

                              "(authn_name=%s, authz_name=%s)", request->auth_request.original_username, login_user);

static void

gssapi_credentials_callback(enum passdb_result result,

                            const unsigned char *credentials ATTR_UNUSED,

                            size_t size ATTR_UNUSED,

                            struct auth_request *request)

{

        struct gssapi_auth_request *gssapi_request =

                (struct gssapi_auth_request *)request;

 

        /* We don't care much whether the lookup succeeded or not because GSSAPI

         * does not strictly require a passdb. But if a passdb is configured,

         * now the k5principals field will have been filled in. */

        switch (result) {

        case PASSDB_RESULT_INTERNAL_FAILURE:

                auth_request_internal_failure(request);

                return;

        case PASSDB_RESULT_USER_DISABLED:

        case PASSDB_RESULT_PASS_EXPIRED:

                /* user is explicitly disabled, don't allow it to log in */

                auth_request_fail(request);

                return;

        case PASSDB_RESULT_SCHEME_NOT_AVAILABLE:

        case PASSDB_RESULT_USER_UNKNOWN:

        case PASSDB_RESULT_PASSWORD_MISMATCH:

        case PASSDB_RESULT_OK:

                break;

        }

 

        if (mech_gssapi_userok(gssapi_request, request->user) == 0)

                auth_request_success(request, NULL, 0);

        else

                auth_request_fail(request);

}

 

        /* Set username early, so that the credential lookup is for the

         * authorizing user. This means the username in subsequent log

         * messagess will be the authorization name, not the authentication

         * name, which may mean that future log messages should be adjusted

         * to log the right thing. */

        /* Continue in callback once auth_request is populated with passdb

           information. */

        auth_request->passdb_success = TRUE; /* default to success */

        auth_request_lookup_credentials(&request->auth_request, "",

                                        gssapi_credentials_callback);