From owner-svn-src-stable-8@FreeBSD.ORG Mon May 17 14:27:41 2010 Return-Path: Delivered-To: svn-src-stable-8@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4FBE3106567F; Mon, 17 May 2010 14:27:41 +0000 (UTC) (envelope-from mm@FreeBSD.org) Received: from svn.freebsd.org (unknown [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 341EC8FC14; Mon, 17 May 2010 14:27:41 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o4HERfmM049265; Mon, 17 May 2010 14:27:41 GMT (envelope-from mm@svn.freebsd.org) Received: (from mm@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o4HERfpS049262; Mon, 17 May 2010 14:27:41 GMT (envelope-from mm@svn.freebsd.org) Message-Id: <201005171427.o4HERfpS049262@svn.freebsd.org> From: Martin Matuska Date: Mon, 17 May 2010 14:27:41 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org X-SVN-Group: stable-8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r208193 - stable/8/lib/libpam/modules/pam_krb5 X-BeenThere: svn-src-stable-8@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 8-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 May 2010 14:27:41 -0000 Author: mm Date: Mon May 17 14:27:40 2010 New Revision: 208193 URL: http://svn.freebsd.org/changeset/base/208193 Log: MFC r207553, r207555, r207651: Implement the no_user_check option to pam_krb5. This option is available in the Linux implementation of pam_krb5 and allows to authorize a user not known to the local system. Ccache is not used as we don't have a secure uid/gid for the cache file. Usable for authentication of external kerberos users (e.g Active Directory) via PAM from applications like Cyrus saslauthd, PHP or perl. PR: bin/146186 Approved by: deplhij (mentor) Modified: stable/8/lib/libpam/modules/pam_krb5/pam_krb5.8 stable/8/lib/libpam/modules/pam_krb5/pam_krb5.c Directory Properties: stable/8/lib/libpam/ (props changed) Modified: stable/8/lib/libpam/modules/pam_krb5/pam_krb5.8 ============================================================================== --- stable/8/lib/libpam/modules/pam_krb5/pam_krb5.8 Mon May 17 14:20:26 2010 (r208192) +++ stable/8/lib/libpam/modules/pam_krb5/pam_krb5.8 Mon May 17 14:27:40 2010 (r208193) @@ -1,7 +1,7 @@ .\" .\" $Id: pam_krb5.5,v 1.5 2000/01/05 00:59:56 fcusack Exp $ .\" $FreeBSD$ -.Dd January 15, 1999 +.Dd May 3, 2010 .Dt PAM_KRB5 8 .Os .Sh NAME @@ -108,6 +108,10 @@ and .Ql %p , to designate the current process ID; can be used in .Ar name . +.It Cm no_user_check +Do not verify if a user exists on the local system. This option implies the +.Cm no_ccache +option because there is no secure local uid/gid for the cache file. .El .Ss Kerberos 5 Account Management Module The Kerberos 5 account management component Modified: stable/8/lib/libpam/modules/pam_krb5/pam_krb5.c ============================================================================== --- stable/8/lib/libpam/modules/pam_krb5/pam_krb5.c Mon May 17 14:20:26 2010 (r208192) +++ stable/8/lib/libpam/modules/pam_krb5/pam_krb5.c Mon May 17 14:27:40 2010 (r208193) @@ -89,6 +89,7 @@ static void compat_free_data_contents(kr #define PAM_OPT_DEBUG "debug" #define PAM_OPT_FORWARDABLE "forwardable" #define PAM_OPT_NO_CCACHE "no_ccache" +#define PAM_OPT_NO_USER_CHECK "no_user_check" #define PAM_OPT_REUSE_CCACHE "reuse_ccache" /* @@ -194,34 +195,39 @@ pam_sm_authenticate(pam_handle_t *pamh, PAM_LOG("Got password"); - /* Verify the local user exists (AFTER getting the password) */ - if (strchr(user, '@')) { - /* get a local account name for this principal */ - krbret = krb5_aname_to_localname(pam_context, princ, - sizeof(luser), luser); - if (krbret != 0) { - PAM_VERBOSE_ERROR("Kerberos 5 error"); - PAM_LOG("Error krb5_aname_to_localname(): %s", - krb5_get_err_text(pam_context, krbret)); - retval = PAM_USER_UNKNOWN; - goto cleanup2; + if (openpam_get_option(pamh, PAM_OPT_NO_USER_CHECK)) + PAM_LOG("Skipping local user check"); + else { + + /* Verify the local user exists (AFTER getting the password) */ + if (strchr(user, '@')) { + /* get a local account name for this principal */ + krbret = krb5_aname_to_localname(pam_context, princ, + sizeof(luser), luser); + if (krbret != 0) { + PAM_VERBOSE_ERROR("Kerberos 5 error"); + PAM_LOG("Error krb5_aname_to_localname(): %s", + krb5_get_err_text(pam_context, krbret)); + retval = PAM_USER_UNKNOWN; + goto cleanup2; + } + + retval = pam_set_item(pamh, PAM_USER, luser); + if (retval != PAM_SUCCESS) + goto cleanup2; + + PAM_LOG("PAM_USER Redone"); } - retval = pam_set_item(pamh, PAM_USER, luser); - if (retval != PAM_SUCCESS) + pwd = getpwnam(user); + if (pwd == NULL) { + retval = PAM_USER_UNKNOWN; goto cleanup2; + } - PAM_LOG("PAM_USER Redone"); - } - - pwd = getpwnam(user); - if (pwd == NULL) { - retval = PAM_USER_UNKNOWN; - goto cleanup2; + PAM_LOG("Done getpwnam()"); } - PAM_LOG("Done getpwnam()"); - /* Get a TGT */ memset(&creds, 0, sizeof(krb5_creds)); krbret = krb5_get_init_creds_password(pam_context, &creds, princ, @@ -366,7 +372,8 @@ pam_sm_setcred(pam_handle_t *pamh, int f return (PAM_SERVICE_ERR); /* If a persistent cache isn't desired, stop now. */ - if (openpam_get_option(pamh, PAM_OPT_NO_CCACHE)) + if (openpam_get_option(pamh, PAM_OPT_NO_CCACHE) || + openpam_get_option(pamh, PAM_OPT_NO_USER_CHECK)) return (PAM_SUCCESS); PAM_LOG("Establishing credentials");