[gssapi-openssh.git] / openssh / gss-serv-gsi.c

/*
 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#ifdef GSSAPI
#ifdef GSI

#include "auth.h"
#include "auth-pam.h"
#include "xmalloc.h"
#include "log.h"
#include "servconf.h"

#include "ssh-gss.h"

extern ServerOptions options;

#include <globus_gss_assist.h>

static int ssh_gssapi_gsi_userok(ssh_gssapi_client *client, char *name);
static int ssh_gssapi_gsi_localname(ssh_gssapi_client *client, char **user);
static void ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client);

ssh_gssapi_mech gssapi_gsi_mech = {
	"dZuIebMjgUqaxvbF7hDbAw==",
	"GSI",
	{9, "\x2B\x06\x01\x04\x01\x9B\x50\x01\x01"},
	NULL,
	&ssh_gssapi_gsi_userok,
	&ssh_gssapi_gsi_localname,
	&ssh_gssapi_gsi_storecreds
};

/*
 * Check if this user is OK to login under GSI. User has been authenticated
 * as identity in global 'client_name.value' and is trying to log in as passed
 * username in 'name'.
 *
 * Returns non-zero if user is authorized, 0 otherwise.
 */
static int
ssh_gssapi_gsi_userok(ssh_gssapi_client *client, char *name)
{
    int authorized = 0;
    globus_result_t res;
#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
    char lname[256] = "";
#endif
    
#ifdef GLOBUS_GSI_GSS_ASSIST_MODULE
    if (globus_module_activate(GLOBUS_GSI_GSS_ASSIST_MODULE) != 0) {
	return 0;
    }
#endif

/* use new globus_gss_assist_map_and_authorize() interface if available */
#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
    debug("calling globus_gss_assist_map_and_authorize()");
    if (GLOBUS_SUCCESS !=
        (res = globus_gss_assist_map_and_authorize(client->context, "ssh",
                                                   name, lname, 256))) {
        debug("%s", globus_error_print_chain(globus_error_get(res)));
    } else if (strcmp(name, lname) != 0) {
        debug("GSI user maps to %s, not %s", lname, name);
    } else {
        authorized = 1;
    }
#else
    debug("calling globus_gss_assist_userok()");
    if (GLOBUS_SUCCESS !=
        (res = (globus_gss_assist_userok(client->displayname.value,
                                         name)))) {
        debug("%s", globus_error_print_chain(globus_error_get(res)));
    } else {
        authorized = 1;
    }
#endif
    
    logit("GSI user %s is%s authorized as target user %s",
	(char *) client->displayname.value, (authorized ? "" : " not"), name);
    
    return authorized;
}

/*
 * Return the local username associated with the GSI credentials.
 */
int
ssh_gssapi_gsi_localname(ssh_gssapi_client *client, char **user)
{
    globus_result_t res;
#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
    char lname[256] = "";
#endif

#ifdef GLOBUS_GSI_GSS_ASSIST_MODULE
    if (globus_module_activate(GLOBUS_GSI_GSS_ASSIST_MODULE) != 0) {
	return 0;
    }
#endif

/* use new globus_gss_assist_map_and_authorize() interface if available */
#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
    debug("calling globus_gss_assist_map_and_authorize()");
    if (GLOBUS_SUCCESS !=
        (res = globus_gss_assist_map_and_authorize(client->context, "ssh",
                                                   NULL, lname, 256))) {
        debug("%s", globus_error_print_chain(globus_error_get(res)));
        logit("failed to map GSI user %s", (char *)client->displayname.value);
        return 0;
    }
    *user = strdup(lname);
#else
    debug("calling globus_gss_assist_gridmap()");
    if (GLOBUS_SUCCESS !=
        (res = globus_gss_assist_gridmap(client->displayname.value, user))) {
        debug("%s", globus_error_print_chain(globus_error_get(res)));
        logit("failed to map GSI user %s", (char *)client->displayname.value);
        return 0;
    }
#endif

    logit("GSI user %s mapped to target user %s",
          (char *) client->displayname.value, *user);

    return 1;
}

/*
 * Export GSI credentials to disk.
 */
static void
ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client)
{
	OM_uint32	major_status;
	OM_uint32	minor_status;
	gss_buffer_desc	export_cred = GSS_C_EMPTY_BUFFER;
	char *		p;
	
	if (!client || !client->creds) {
	    return;
	}

	major_status = gss_export_cred(&minor_status,
				       client->creds,
				       GSS_C_NO_OID,
				       1,
				       &export_cred);
	if (GSS_ERROR(major_status) && major_status != GSS_S_UNAVAILABLE) {
	    Gssctxt *ctx;
	    ssh_gssapi_build_ctx(&ctx);
	    ctx->major = major_status;
	    ctx->minor = minor_status;
	    ssh_gssapi_set_oid(ctx, &gssapi_gsi_mech.oid);
	    ssh_gssapi_error(ctx);
	    ssh_gssapi_delete_ctx(&ctx);
	    return;
	}
	
	p = strchr((char *) export_cred.value, '=');
	if (p == NULL) {
	    logit("Failed to parse exported credentials string '%.100s'",
		(char *)export_cred.value);
	    gss_release_buffer(&minor_status, &export_cred);
	    return;
	}
	*p++ = '\0';
	if (strcmp((char *)export_cred.value,"X509_USER_DELEG_PROXY") == 0) {
	    client->store.envvar = strdup("X509_USER_PROXY");
	} else {
	    client->store.envvar = strdup((char *)export_cred.value);
	}
	client->store.envval = strdup(p);
#ifdef USE_PAM
	if (options.use_pam)
	    do_pam_putenv(client->store.envvar, client->store.envval);
#endif
	if (strncmp(p, "FILE:", 5) == 0) {
	    p += 5;
	}
	if (access(p, R_OK) == 0) {
	    client->store.filename = strdup(p);
	}
	gss_release_buffer(&minor_status, &export_cred);
}

#endif /* GSI */
#endif /* GSSAPI */
Commit	Line	Data
f4b9ce42	1	/*
	2	* Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
	14	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	15	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	16	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	17	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	18	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	19	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	20	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	21	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	22	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	23	*/
	24
	25	#include "includes.h"
	26
	27	#ifdef GSSAPI
	28	#ifdef GSI
	29
	30	#include "auth.h"
	31	#include "auth-pam.h"
	32	#include "xmalloc.h"
	33	#include "log.h"
	34	#include "servconf.h"
	35
	36	#include "ssh-gss.h"
	37
3b7a7049	38	extern ServerOptions options;
3b7a7049	39
f4b9ce42	40	#include <globus_gss_assist.h>
f4b9ce42	41
0ef028e1	42	static int ssh_gssapi_gsi_userok(ssh_gssapi_client client, char name);
	43	static int ssh_gssapi_gsi_localname(ssh_gssapi_client client, char *user);
	44	static void ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client);
	45
0ef028e1	46	ssh_gssapi_mech gssapi_gsi_mech = {
	47	"dZuIebMjgUqaxvbF7hDbAw==",
	48	"GSI",
	49	{9, "\x2B\x06\x01\x04\x01\x9B\x50\x01\x01"},
	50	NULL,
	51	&ssh_gssapi_gsi_userok,
	52	&ssh_gssapi_gsi_localname,
	53	&ssh_gssapi_gsi_storecreds
	54	};
	55
f4b9ce42	56	/*
	57	* Check if this user is OK to login under GSI. User has been authenticated
	58	* as identity in global 'client_name.value' and is trying to log in as passed
	59	* username in 'name'.
	60	*
	61	* Returns non-zero if user is authorized, 0 otherwise.
	62	*/
	63	static int
	64	ssh_gssapi_gsi_userok(ssh_gssapi_client client, char name)
	65	{
	66	int authorized = 0;
87c01c94	67	globus_result_t res;
	68	#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
	69	char lname[256] = "";
	70	#endif
f4b9ce42	71
0ef028e1	72	#ifdef GLOBUS_GSI_GSS_ASSIST_MODULE
	73	if (globus_module_activate(GLOBUS_GSI_GSS_ASSIST_MODULE) != 0) {
	74	return 0;
	75	}
	76	#endif
	77
87c01c94	78	/* use new globus_gss_assist_map_and_authorize() interface if available */
	79	#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
	80	debug("calling globus_gss_assist_map_and_authorize()");
	81	if (GLOBUS_SUCCESS !=
	82	(res = globus_gss_assist_map_and_authorize(client->context, "ssh",
	83	name, lname, 256))) {
	84	debug("%s", globus_error_print_chain(globus_error_get(res)));
	85	} else if (strcmp(name, lname) != 0) {
	86	debug("GSI user maps to %s, not %s", lname, name);
	87	} else {
	88	authorized = 1;
	89	}
	90	#else
	91	debug("calling globus_gss_assist_userok()");
	92	if (GLOBUS_SUCCESS !=
	93	(res = (globus_gss_assist_userok(client->displayname.value,
	94	name)))) {
	95	debug("%s", globus_error_print_chain(globus_error_get(res)));
	96	} else {
	97	authorized = 1;
	98	}
	99	#endif
f4b9ce42	100
7cac2b65	101	logit("GSI user %s is%s authorized as target user %s",
7cac2b65	102	(char *) client->displayname.value, (authorized ? "" : " not"), name);
f4b9ce42	103
	104	return authorized;
	105	}
	106
	107	/*
0ef028e1	108	* Return the local username associated with the GSI credentials.
	109	*/
	110	int
	111	ssh_gssapi_gsi_localname(ssh_gssapi_client client, char *user)
	112	{
87c01c94	113	globus_result_t res;
	114	#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
	115	char lname[256] = "";
	116	#endif
	117
0ef028e1	118	#ifdef GLOBUS_GSI_GSS_ASSIST_MODULE
	119	if (globus_module_activate(GLOBUS_GSI_GSS_ASSIST_MODULE) != 0) {
	120	return 0;
	121	}
	122	#endif
87c01c94	123
	124	/* use new globus_gss_assist_map_and_authorize() interface if available */
	125	#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
	126	debug("calling globus_gss_assist_map_and_authorize()");
	127	if (GLOBUS_SUCCESS !=
	128	(res = globus_gss_assist_map_and_authorize(client->context, "ssh",
	129	NULL, lname, 256))) {
	130	debug("%s", globus_error_print_chain(globus_error_get(res)));
	131	logit("failed to map GSI user %s", (char *)client->displayname.value);
	132	return 0;
	133	}
	134	*user = strdup(lname);
	135	#else
	136	debug("calling globus_gss_assist_gridmap()");
	137	if (GLOBUS_SUCCESS !=
	138	(res = globus_gss_assist_gridmap(client->displayname.value, user))) {
	139	debug("%s", globus_error_print_chain(globus_error_get(res)));
	140	logit("failed to map GSI user %s", (char *)client->displayname.value);
	141	return 0;
	142	}
	143	#endif
	144
	145	logit("GSI user %s mapped to target user %s",
	146	(char ) client->displayname.value, user);
	147
	148	return 1;
0ef028e1	149	}
	150
	151	/*
	152	* Export GSI credentials to disk.
f4b9ce42	153	*/
	154	static void
	155	ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client)
	156	{
	157	OM_uint32 major_status;
	158	OM_uint32 minor_status;
0ef028e1	159	gss_buffer_desc export_cred = GSS_C_EMPTY_BUFFER;
0ef028e1	160	char * p;
f4b9ce42	161
0ef028e1	162	if (!client \|\| !client->creds) {
	163	return;
	164	}
f4b9ce42	165
0ef028e1	166	major_status = gss_export_cred(&minor_status,
	167	client->creds,
	168	GSS_C_NO_OID,
	169	1,
	170	&export_cred);
	171	if (GSS_ERROR(major_status) && major_status != GSS_S_UNAVAILABLE) {
	172	Gssctxt *ctx;
	173	ssh_gssapi_build_ctx(&ctx);
	174	ctx->major = major_status;
	175	ctx->minor = minor_status;
	176	ssh_gssapi_set_oid(ctx, &gssapi_gsi_mech.oid);
	177	ssh_gssapi_error(ctx);
	178	ssh_gssapi_delete_ctx(&ctx);
	179	return;
	180	}
	181
	182	p = strchr((char *) export_cred.value, '=');
	183	if (p == NULL) {
7cac2b65	184	logit("Failed to parse exported credentials string '%.100s'",
0ef028e1	185	(char *)export_cred.value);
	186	gss_release_buffer(&minor_status, &export_cred);
	187	return;
	188	}
	189	*p++ = '\0';
	190	if (strcmp((char *)export_cred.value,"X509_USER_DELEG_PROXY") == 0) {
	191	client->store.envvar = strdup("X509_USER_PROXY");
	192	} else {
	193	client->store.envvar = strdup((char *)export_cred.value);
	194	}
	195	client->store.envval = strdup(p);
f4b9ce42	196	#ifdef USE_PAM
308180eb	197	if (options.use_pam)
308180eb	198	do_pam_putenv(client->store.envvar, client->store.envval);
f4b9ce42	199	#endif
0ef028e1	200	if (strncmp(p, "FILE:", 5) == 0) {
	201	p += 5;
	202	}
	203	if (access(p, R_OK) == 0) {
	204	client->store.filename = strdup(p);
	205	}
	206	gss_release_buffer(&minor_status, &export_cred);
f4b9ce42	207	}
f4b9ce42	208
f4b9ce42	209	#endif /* GSI */
f4b9ce42	210	#endif /* GSSAPI */