|
 |
2fc102 |
From b86041a3760faa9273f1df879e8bfa38fbbb84aa Mon Sep 17 00:00:00 2001
|
|
|
2fc102 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
2fc102 |
Date: Fri, 21 Mar 2014 12:14:11 +0100
|
|
|
2fc102 |
Subject: [PATCH 115/117] krb5-child: extract lifetime settings into
|
|
|
2fc102 |
set_lifetime_options()
|
|
|
2fc102 |
|
|
|
2fc102 |
Additionally the lifetime option flags are unset if there are no
|
|
|
2fc102 |
explicit settings to make sure the defaults from krb5.conf are used even
|
|
|
2fc102 |
if other values were set manually in between.
|
|
|
2fc102 |
|
|
|
2fc102 |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
2fc102 |
---
|
|
|
2fc102 |
src/providers/krb5/krb5_child.c | 89 +++++++++++++++++++++++++----------------
|
|
|
2fc102 |
1 file changed, 55 insertions(+), 34 deletions(-)
|
|
|
2fc102 |
|
|
|
2fc102 |
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
|
|
|
2fc102 |
index 7f07efc161d0242e64bd67e13dec9a3faa9f2e30..7ea111e108e189c6839feec0f1108175c0291605 100644
|
|
|
2fc102 |
--- a/src/providers/krb5/krb5_child.c
|
|
|
2fc102 |
+++ b/src/providers/krb5/krb5_child.c
|
|
|
2fc102 |
@@ -65,6 +65,57 @@ struct krb5_req {
|
|
|
2fc102 |
static krb5_context krb5_error_ctx;
|
|
|
2fc102 |
#define KRB5_CHILD_DEBUG(level, error) KRB5_DEBUG(level, krb5_error_ctx, error)
|
|
|
2fc102 |
|
|
|
2fc102 |
+static krb5_error_code set_lifetime_options(krb5_get_init_creds_opt *options)
|
|
|
2fc102 |
+{
|
|
|
2fc102 |
+ char *lifetime_str;
|
|
|
2fc102 |
+ krb5_error_code kerr;
|
|
|
2fc102 |
+ krb5_deltat lifetime;
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ lifetime_str = getenv(SSSD_KRB5_RENEWABLE_LIFETIME);
|
|
|
2fc102 |
+ if (lifetime_str == NULL) {
|
|
|
2fc102 |
+ DEBUG(SSSDBG_CONF_SETTINGS, ("Cannot read [%s] from environment.\n",
|
|
|
2fc102 |
+ SSSD_KRB5_RENEWABLE_LIFETIME));
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ /* Unset option flag to make sure defaults from krb5.conf are used. */
|
|
|
2fc102 |
+ options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE);
|
|
|
2fc102 |
+ } else {
|
|
|
2fc102 |
+ kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
|
|
|
2fc102 |
+ if (kerr != 0) {
|
|
|
2fc102 |
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
2fc102 |
+ ("krb5_string_to_deltat failed for [%s].\n",
|
|
|
2fc102 |
+ lifetime_str));
|
|
|
2fc102 |
+ KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
|
|
|
2fc102 |
+ return kerr;
|
|
|
2fc102 |
+ }
|
|
|
2fc102 |
+ DEBUG(SSSDBG_CONF_SETTINGS, ("%s is set to [%s]\n",
|
|
|
2fc102 |
+ SSSD_KRB5_RENEWABLE_LIFETIME, lifetime_str));
|
|
|
2fc102 |
+ krb5_get_init_creds_opt_set_renew_life(options, lifetime);
|
|
|
2fc102 |
+ }
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ lifetime_str = getenv(SSSD_KRB5_LIFETIME);
|
|
|
2fc102 |
+ if (lifetime_str == NULL) {
|
|
|
2fc102 |
+ DEBUG(SSSDBG_CONF_SETTINGS, ("Cannot read [%s] from environment.\n",
|
|
|
2fc102 |
+ SSSD_KRB5_LIFETIME));
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ /* Unset option flag to make sure defaults from krb5.conf are used. */
|
|
|
2fc102 |
+ options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_TKT_LIFE);
|
|
|
2fc102 |
+ } else {
|
|
|
2fc102 |
+ kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
|
|
|
2fc102 |
+ if (kerr != 0) {
|
|
|
2fc102 |
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
2fc102 |
+ ("krb5_string_to_deltat failed for [%s].\n",
|
|
|
2fc102 |
+ lifetime_str));
|
|
|
2fc102 |
+ KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
|
|
|
2fc102 |
+ return kerr;
|
|
|
2fc102 |
+ }
|
|
|
2fc102 |
+ DEBUG(SSSDBG_CONF_SETTINGS,
|
|
|
2fc102 |
+ ("%s is set to [%s]\n", SSSD_KRB5_LIFETIME, lifetime_str));
|
|
|
2fc102 |
+ krb5_get_init_creds_opt_set_tkt_life(options, lifetime);
|
|
|
2fc102 |
+ }
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ return 0;
|
|
|
2fc102 |
+}
|
|
|
2fc102 |
+
|
|
|
2fc102 |
static void set_changepw_options(krb5_context ctx,
|
|
|
2fc102 |
krb5_get_init_creds_opt *options)
|
|
|
2fc102 |
{
|
|
|
2fc102 |
@@ -1744,9 +1795,7 @@ static int k5c_setup_fast(struct krb5_req *kr, bool demand)
|
|
|
2fc102 |
static int k5c_setup(struct krb5_req *kr, uint32_t offline)
|
|
|
2fc102 |
{
|
|
|
2fc102 |
krb5_error_code kerr;
|
|
|
2fc102 |
- char *lifetime_str;
|
|
|
2fc102 |
char *use_fast_str;
|
|
|
2fc102 |
- krb5_deltat lifetime;
|
|
|
2fc102 |
int parse_flags;
|
|
|
2fc102 |
|
|
|
2fc102 |
kr->realm = getenv(SSSD_KRB5_REALM);
|
|
|
2fc102 |
@@ -1825,38 +1874,10 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
|
|
|
2fc102 |
krb5_get_init_creds_opt_set_change_password_prompt(kr->options, 0);
|
|
|
2fc102 |
#endif
|
|
|
2fc102 |
|
|
|
2fc102 |
- lifetime_str = getenv(SSSD_KRB5_RENEWABLE_LIFETIME);
|
|
|
2fc102 |
- if (lifetime_str == NULL) {
|
|
|
2fc102 |
- DEBUG(SSSDBG_CONF_SETTINGS, ("Cannot read [%s] from environment.\n",
|
|
|
2fc102 |
- SSSD_KRB5_RENEWABLE_LIFETIME));
|
|
|
2fc102 |
- } else {
|
|
|
2fc102 |
- kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
|
|
|
2fc102 |
- if (kerr != 0) {
|
|
|
2fc102 |
- DEBUG(1, ("krb5_string_to_deltat failed for [%s].\n",
|
|
|
2fc102 |
- lifetime_str));
|
|
|
2fc102 |
- KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
|
|
|
2fc102 |
- return kerr;
|
|
|
2fc102 |
- }
|
|
|
2fc102 |
- DEBUG(SSSDBG_CONF_SETTINGS, ("%s is set to [%s]\n",
|
|
|
2fc102 |
- SSSD_KRB5_RENEWABLE_LIFETIME, lifetime_str));
|
|
|
2fc102 |
- krb5_get_init_creds_opt_set_renew_life(kr->options, lifetime);
|
|
|
2fc102 |
- }
|
|
|
2fc102 |
-
|
|
|
2fc102 |
- lifetime_str = getenv(SSSD_KRB5_LIFETIME);
|
|
|
2fc102 |
- if (lifetime_str == NULL) {
|
|
|
2fc102 |
- DEBUG(SSSDBG_CONF_SETTINGS, ("Cannot read [%s] from environment.\n",
|
|
|
2fc102 |
- SSSD_KRB5_LIFETIME));
|
|
|
2fc102 |
- } else {
|
|
|
2fc102 |
- kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
|
|
|
2fc102 |
- if (kerr != 0) {
|
|
|
2fc102 |
- DEBUG(1, ("krb5_string_to_deltat failed for [%s].\n",
|
|
|
2fc102 |
- lifetime_str));
|
|
|
2fc102 |
- KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
|
|
|
2fc102 |
- return kerr;
|
|
|
2fc102 |
- }
|
|
|
2fc102 |
- DEBUG(SSSDBG_CONF_SETTINGS,
|
|
|
2fc102 |
- ("%s is set to [%s]\n", SSSD_KRB5_LIFETIME, lifetime_str));
|
|
|
2fc102 |
- krb5_get_init_creds_opt_set_tkt_life(kr->options, lifetime);
|
|
|
2fc102 |
+ kerr = set_lifetime_options(kr->options);
|
|
|
2fc102 |
+ if (kerr != 0) {
|
|
|
2fc102 |
+ DEBUG(SSSDBG_OP_FAILURE, ("set_lifetime_options failed.\n"));
|
|
|
2fc102 |
+ return kerr;
|
|
|
2fc102 |
}
|
|
|
2fc102 |
|
|
|
2fc102 |
if (!offline) {
|
|
|
2fc102 |
--
|
|
|
2fc102 |
1.8.5.3
|
|
|
2fc102 |
|