[gnome-online-accounts] kerberos: Support refreshing smartcard authenticated kerberos tickets
- From: Debarshi Ray <debarshir src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [gnome-online-accounts] kerberos: Support refreshing smartcard authenticated kerberos tickets
- Date: Mon, 4 May 2015 18:15:31 +0000 (UTC)
commit f8399a24042d937a6d355b9e76a581aafd3b4068
Author: Ray Strode <rstrode redhat com>
Date: Tue Oct 21 10:46:50 2014 -0400
kerberos: Support refreshing smartcard authenticated kerberos tickets
Right now gnome-online-accounts doesn't manage smartcard based
kerberos credentials very well. The sign-in button just fails.
This commit adds support for tickets granted through smartcards.
Note, at the moment we don't provide a way to add new smartcard based
accounts, merely, manage existing ones that are added implicitly by
logging in with a smartcard, or by explicit kinit.
https://bugzilla.gnome.org/show_bug.cgi?id=739594
src/goabackend/goakerberosprovider.c | 43 ++++++++++++++++
src/goaidentity/goaidentitymanager.c | 2 +
src/goaidentity/goaidentitymanager.h | 2 +
src/goaidentity/goaidentityservice.c | 19 ++++++-
src/goaidentity/goakerberosidentity.c | 71 +++++++++++++++++++++++++-
src/goaidentity/goakerberosidentity.h | 2 +
src/goaidentity/goakerberosidentitymanager.c | 14 ++++-
7 files changed, 146 insertions(+), 7 deletions(-)
---
diff --git a/src/goabackend/goakerberosprovider.c b/src/goabackend/goakerberosprovider.c
index 46f7903..a9e8245 100644
--- a/src/goabackend/goakerberosprovider.c
+++ b/src/goabackend/goakerberosprovider.c
@@ -355,6 +355,7 @@ on_secret_keys_exchanged_for_sign_in (GoaKerberosProvider *self,
{
const char *identifier;
const char *password;
+ const char *preauth_source;
GCancellable *cancellable;
GError *error;
GVariantBuilder details;
@@ -372,6 +373,7 @@ on_secret_keys_exchanged_for_sign_in (GoaKerberosProvider *self,
cancellable = g_object_get_data (G_OBJECT (operation_result), "cancellable");
password = g_object_get_data (G_OBJECT (operation_result), "password");
+ preauth_source = g_object_get_data (G_OBJECT (operation_result), "preauthentication-source");
identifier = g_simple_async_result_get_source_tag (operation_result);
g_variant_builder_init (&details, G_VARIANT_TYPE ("a{ss}"));
@@ -388,6 +390,11 @@ on_secret_keys_exchanged_for_sign_in (GoaKerberosProvider *self,
g_free (secret);
}
+ if (preauth_source != NULL)
+ {
+ g_variant_builder_add (&details, "{ss}", "preauthentication-source", preauth_source);
+ }
+
goa_identity_service_manager_call_sign_in (self->identity_manager,
identifier,
g_variant_builder_end (&details),
@@ -523,6 +530,7 @@ static void
sign_in_identity (GoaKerberosProvider *self,
const char *identifier,
const char *password,
+ const char *preauth_source,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data)
@@ -545,6 +553,11 @@ sign_in_identity (GoaKerberosProvider *self,
(gpointer)
password);
+ g_object_set_data_full (G_OBJECT (operation_result),
+ "preauthentication-source",
+ g_strdup (preauth_source),
+ g_free);
+
ensure_identity_manager (self,
cancellable,
(GAsyncReadyCallback)
@@ -676,8 +689,11 @@ get_ticket_sync (GoaKerberosProvider *self,
GVariant *credentials;
GError *lookup_error;
GoaAccount *account;
+ GoaTicketing *ticketing;
+ GVariant *details;
const char *identifier;
const char *password;
+ const char *preauth_source;
SignInRequest request;
gboolean ret;
@@ -685,6 +701,13 @@ get_ticket_sync (GoaKerberosProvider *self,
account = goa_object_peek_account (object);
identifier = goa_account_get_identity (account);
+
+ ticketing = goa_object_get_ticketing (GOA_OBJECT (object));
+ details = goa_ticketing_get_details (ticketing);
+
+ preauth_source = NULL;
+ g_variant_lookup (details, "preauthentication-source", "&s", &preauth_source);
+
password = NULL;
lookup_error = NULL;
@@ -727,6 +750,7 @@ get_ticket_sync (GoaKerberosProvider *self,
sign_in_identity (self,
identifier,
password,
+ preauth_source,
cancellable,
(GAsyncReadyCallback)
on_account_signed_in,
@@ -743,6 +767,8 @@ get_ticket_sync (GoaKerberosProvider *self,
ret = TRUE;
out:
+ g_clear_object (&ticketing);
+
if (credentials != NULL)
g_variant_unref (credentials);
@@ -840,6 +866,9 @@ build_object (GoaProvider *provider,
{
if (ticketing == NULL)
{
+ char *preauthentication_source;
+ GVariantBuilder details;
+
ticketing = goa_ticketing_skeleton_new ();
g_signal_connect (ticketing,
@@ -849,6 +878,13 @@ build_object (GoaProvider *provider,
goa_object_skeleton_set_ticketing (object, ticketing);
+ g_variant_builder_init (&details, G_VARIANT_TYPE ("a{ss}"));
+
+ preauthentication_source = g_key_file_get_string (key_file, group, "PreauthenticationSource", NULL);
+ if (preauthentication_source)
+ g_variant_builder_add (&details, "{ss}", "preauthentication-source", preauthentication_source);
+
+ g_object_set (G_OBJECT (ticketing), "details", g_variant_builder_end (&details), NULL);
}
}
else if (ticketing != NULL)
@@ -1259,12 +1295,18 @@ on_system_prompt_answered_for_initial_sign_in (GcrPrompt *prompt,
GError *error;
const char *principal;
const char *password;
+ const char *preauth_source;
GcrSecretExchange *secret_exchange;
self = GOA_KERBEROS_PROVIDER (g_async_result_get_source_object (G_ASYNC_RESULT (operation_result)));
principal = g_object_get_data (G_OBJECT (operation_result), "principal");
cancellable = g_object_get_data (G_OBJECT (operation_result), "cancellable");
+ /* We currently don't prompt the user to choose a preauthentication source during initial sign in
+ * so we assume there's no preauthentication source
+ */
+ preauth_source = NULL;
+
error = NULL;
password = gcr_prompt_password_finish (prompt, result, &error);
@@ -1298,6 +1340,7 @@ on_system_prompt_answered_for_initial_sign_in (GcrPrompt *prompt,
sign_in_identity (self,
principal,
password,
+ preauth_source,
cancellable,
(GAsyncReadyCallback)
on_initial_sign_in_done,
diff --git a/src/goaidentity/goaidentitymanager.c b/src/goaidentity/goaidentitymanager.c
index 40d2225..22dcd97 100644
--- a/src/goaidentity/goaidentitymanager.c
+++ b/src/goaidentity/goaidentitymanager.c
@@ -202,6 +202,7 @@ void
goa_identity_manager_sign_identity_in (GoaIdentityManager *self,
const char *identifier,
gconstpointer initial_password,
+ const char *preauth_source,
GoaIdentitySignInFlags flags,
GoaIdentityInquiryFunc inquiry_func,
gpointer inquiry_data,
@@ -212,6 +213,7 @@ goa_identity_manager_sign_identity_in (GoaIdentityManager *self,
GOA_IDENTITY_MANAGER_GET_IFACE (self)->sign_identity_in (self,
identifier,
initial_password,
+ preauth_source,
flags,
inquiry_func,
inquiry_data,
diff --git a/src/goaidentity/goaidentitymanager.h b/src/goaidentity/goaidentitymanager.h
index 89e6b6e..755053a 100644
--- a/src/goaidentity/goaidentitymanager.h
+++ b/src/goaidentity/goaidentitymanager.h
@@ -77,6 +77,7 @@ struct _GoaIdentityManagerInterface
void (* sign_identity_in) (GoaIdentityManager *identity_manager,
const char *identifier,
gconstpointer initial_password,
+ const char *preauth_source,
GoaIdentitySignInFlags flags,
GoaIdentityInquiryFunc inquiry_func,
gpointer inquiry_data,
@@ -140,6 +141,7 @@ GList *goa_identity_manager_list_identities_finish (GoaIdentityManager *identit
void goa_identity_manager_sign_identity_in (GoaIdentityManager *identity_manager,
const char *identifier,
gconstpointer initial_password,
+ const char *preauth_source,
GoaIdentitySignInFlags flags,
GoaIdentityInquiryFunc inquiry_func,
gpointer inquiry_data,
diff --git a/src/goaidentity/goaidentityservice.c b/src/goaidentity/goaidentityservice.c
index 06fb946..38bbde6 100644
--- a/src/goaidentity/goaidentityservice.c
+++ b/src/goaidentity/goaidentityservice.c
@@ -60,6 +60,7 @@ static void
sign_in (GoaIdentityService *self,
const char *identifier,
gconstpointer initial_password,
+ const char *preauth_source,
GoaIdentitySignInFlags flags,
GCancellable *cancellable,
GAsyncReadyCallback callback,
@@ -312,7 +313,8 @@ static void
read_sign_in_details (GoaIdentityServiceManager *manager,
GVariant *details,
GoaIdentitySignInFlags *flags,
- char **secret_key)
+ char **secret_key,
+ char **preauth_source)
{
GVariantIter iter;
char *key;
@@ -324,6 +326,8 @@ read_sign_in_details (GoaIdentityServiceManager *manager,
{
if (g_strcmp0 (key, "initial-password") == 0)
*secret_key = g_strdup (value);
+ else if (g_strcmp0 (key, "preauthentication-source") == 0)
+ *preauth_source = g_strdup (value);
else if (g_strcmp0 (key, "disallow-renewal") == 0
&& g_strcmp0 (value, "true") == 0)
*flags |= GOA_IDENTITY_SIGN_IN_FLAGS_DISALLOW_RENEWAL;
@@ -346,13 +350,15 @@ goa_identity_service_handle_sign_in (GoaIdentityServiceManager *manager,
GSimpleAsyncResult *operation_result;
GoaIdentitySignInFlags flags;
char *secret_key;
+ char *preauth_source;
gconstpointer initial_password;
GCancellable *cancellable;
secret_key = NULL;
+ preauth_source = NULL;
initial_password = NULL;
- read_sign_in_details (manager, details, &flags, &secret_key);
+ read_sign_in_details (manager, details, &flags, &secret_key, &preauth_source);
if (secret_key != NULL)
{
@@ -397,12 +403,14 @@ goa_identity_service_handle_sign_in (GoaIdentityServiceManager *manager,
sign_in (self,
identifier,
initial_password,
+ preauth_source,
flags,
cancellable,
(GAsyncReadyCallback)
on_sign_in_done,
operation_result);
+ g_free (preauth_source);
g_object_unref (cancellable);
return TRUE;
@@ -868,6 +876,7 @@ add_temporary_account (GoaIdentityService *self,
GoaIdentity *identity)
{
char *realm;
+ char *preauth_source;
const char *principal;
char *principal_for_display;
GSimpleAsyncResult *operation_result;
@@ -894,12 +903,15 @@ add_temporary_account (GoaIdentityService *self,
identity);
realm = goa_kerberos_identity_get_realm_name (GOA_KERBEROS_IDENTITY (identity));
+ preauth_source = goa_kerberos_identity_get_preauthentication_source (GOA_KERBEROS_IDENTITY (identity));
g_variant_builder_init (&credentials, G_VARIANT_TYPE_VARDICT);
g_variant_builder_init (&details, G_VARIANT_TYPE ("a{ss}"));
g_variant_builder_add (&details, "{ss}", "Realm", realm);
g_variant_builder_add (&details, "{ss}", "IsTemporary", "true");
+ if (preauth_source != NULL)
+ g_variant_builder_add (&details, "{ss}", "PreauthenticationSource", preauth_source);
g_variant_builder_add (&details, "{ss}", "TicketingEnabled", "true");
@@ -925,6 +937,7 @@ add_temporary_account (GoaIdentityService *self,
on_account_added,
operation_result);
g_free (realm);
+ g_free (preauth_source);
g_free (principal_for_display);
}
@@ -1261,6 +1274,7 @@ static void
sign_in (GoaIdentityService *self,
const char *identifier,
gconstpointer initial_password,
+ const char *preauth_source,
GoaIdentitySignInFlags flags,
GCancellable *cancellable,
GAsyncReadyCallback callback,
@@ -1288,6 +1302,7 @@ sign_in (GoaIdentityService *self,
goa_identity_manager_sign_identity_in (self->priv->identity_manager,
identifier,
initial_password,
+ preauth_source,
flags,
(GoaIdentityInquiryFunc)
on_identity_inquiry,
diff --git a/src/goaidentity/goakerberosidentity.c b/src/goaidentity/goakerberosidentity.c
index d501a59..4370a09 100644
--- a/src/goaidentity/goakerberosidentity.c
+++ b/src/goaidentity/goakerberosidentity.c
@@ -47,6 +47,8 @@ struct _GoaKerberosIdentityPrivate
char *identifier;
guint identifier_idle_id;
+ char *preauth_identity_source;
+
krb5_timestamp expiration_time;
guint expiration_time_idle_id;
@@ -106,6 +108,8 @@ goa_kerberos_identity_dispose (GObject *object)
G_LOCK (identity_lock);
clear_alarms (self);
+ g_clear_pointer (&self->priv->preauth_identity_source,
+ g_free);
G_UNLOCK (identity_lock);
G_OBJECT_CLASS (goa_kerberos_identity_parent_class)->dispose (object);
@@ -406,6 +410,12 @@ goa_kerberos_identity_get_realm_name (GoaKerberosIdentity *self)
return realm_name;
}
+char *
+goa_kerberos_identity_get_preauthentication_source (GoaKerberosIdentity *self)
+{
+ return g_strdup (self->priv->preauth_identity_source);
+}
+
static const char *
goa_kerberos_identity_get_identifier (GoaIdentity *identity)
{
@@ -454,6 +464,44 @@ credentials_validate_existence (GoaKerberosIdentity *self,
return TRUE;
}
+static gboolean
+snoop_preauth_identity_from_credentials (GoaKerberosIdentity *self,
+ krb5_creds *credentials,
+ char **identity_source)
+{
+ GRegex *regex;
+ GMatchInfo *match_info = NULL;
+ gboolean identity_source_exposed = FALSE;
+
+ if (!krb5_is_config_principal (self->priv->kerberos_context, credentials->server))
+ return FALSE;
+
+ regex = g_regex_new ("\"X509_user_identity\":\"(?P<identity_source>[^\"]*)\"",
+ G_REGEX_MULTILINE | G_REGEX_CASELESS | G_REGEX_RAW,
+ 0,
+ NULL);
+
+ if (regex == NULL)
+ return FALSE;
+
+ g_regex_match_full (regex, credentials->ticket.data, credentials->ticket.length, 0, 0, &match_info, NULL);
+
+ if (match_info != NULL && g_match_info_matches (match_info))
+ {
+ if (identity_source)
+ {
+ g_free (*identity_source);
+ *identity_source = g_match_info_fetch_named (match_info, "identity_source");
+ }
+ identity_source_exposed = TRUE;
+ }
+
+ g_match_info_free (match_info);
+ g_regex_unref (regex);
+
+ return identity_source_exposed;
+}
+
static krb5_timestamp
get_current_time (GoaKerberosIdentity *self)
{
@@ -565,6 +613,7 @@ credentials_are_expired (GoaKerberosIdentity *self,
static VerificationLevel
verify_identity (GoaKerberosIdentity *self,
+ char **preauth_identity_source,
GError **error)
{
krb5_principal principal = NULL;
@@ -627,6 +676,10 @@ verify_identity (GoaKerberosIdentity *self,
else
verification_level = VERIFICATION_LEVEL_EXISTS;
}
+ else
+ {
+ snoop_preauth_identity_from_credentials (self, &credentials, preauth_identity_source);
+ }
krb5_free_cred_contents (self->priv->kerberos_context, &credentials);
@@ -933,7 +986,7 @@ goa_kerberos_identity_initable_init (GInitable *initable,
verification_error = NULL;
self->priv->cached_verification_level =
- verify_identity (self, &verification_error);
+ verify_identity (self, &self->priv->preauth_identity_source, &verification_error);
switch (self->priv->cached_verification_level)
{
@@ -1140,6 +1193,7 @@ gboolean
goa_kerberos_identity_sign_in (GoaKerberosIdentity *self,
const char *principal_name,
gconstpointer initial_password,
+ const char *preauth_source,
GoaIdentitySignInFlags flags,
GoaIdentityInquiryFunc inquiry_func,
gpointer inquiry_data,
@@ -1211,6 +1265,13 @@ goa_kerberos_identity_sign_in (GoaKerberosIdentity *self,
if ((flags & GOA_IDENTITY_SIGN_IN_FLAGS_DISALLOW_RENEWAL) == 0)
krb5_get_init_creds_opt_set_renew_life (options, G_MAXINT);
+ if (preauth_source != NULL)
+ {
+ krb5_get_init_creds_opt_set_pa (self->priv->kerberos_context,
+ options,
+ "X509_user_identity", preauth_source);
+ }
+
/* Poke glibc in case the network changed
*/
res_init ();
@@ -1301,6 +1362,7 @@ goa_kerberos_identity_update (GoaKerberosIdentity *self,
GoaKerberosIdentity *new_identity)
{
VerificationLevel verification_level;
+ char *preauth_identity_source = NULL;
if (self->priv->credentials_cache != NULL)
krb5_cc_close (self->priv->kerberos_context, self->priv->credentials_cache);
@@ -1313,13 +1375,18 @@ goa_kerberos_identity_update (GoaKerberosIdentity *self,
update_identifier (self, new_identity);
G_UNLOCK (identity_lock);
- verification_level = verify_identity (self, NULL);
+ verification_level = verify_identity (self, &preauth_identity_source, NULL);
if (verification_level == VERIFICATION_LEVEL_SIGNED_IN)
reset_alarms (self);
else
clear_alarms (self);
+ G_LOCK (identity_lock);
+ g_free (self->priv->preauth_identity_source);
+ self->priv->preauth_identity_source = preauth_identity_source;
+ G_UNLOCK (identity_lock);
+
if (verification_level != self->priv->cached_verification_level)
{
if (self->priv->cached_verification_level == VERIFICATION_LEVEL_SIGNED_IN &&
diff --git a/src/goaidentity/goakerberosidentity.h b/src/goaidentity/goakerberosidentity.h
index 1e24796..8d2860a 100644
--- a/src/goaidentity/goakerberosidentity.h
+++ b/src/goaidentity/goakerberosidentity.h
@@ -66,6 +66,7 @@ GoaIdentity *goa_kerberos_identity_new (krb5_context kerberos_context,
gboolean goa_kerberos_identity_sign_in (GoaKerberosIdentity *self,
const char *principal_name,
gconstpointer initial_password,
+ const char *preauth_source,
GoaIdentitySignInFlags flags,
GoaIdentityInquiryFunc inquiry_func,
gpointer inquiry_data,
@@ -81,5 +82,6 @@ gboolean goa_kerberos_identity_erase (GoaKerberosIdentity *self,
char *goa_kerberos_identity_get_principal_name (GoaKerberosIdentity *self);
char *goa_kerberos_identity_get_realm_name (GoaKerberosIdentity *self);
+char *goa_kerberos_identity_get_preauthentication_source (GoaKerberosIdentity *self);
G_END_DECLS
#endif /* __GOA_KERBEROS_IDENTITY_H__ */
diff --git a/src/goaidentity/goakerberosidentitymanager.c b/src/goaidentity/goakerberosidentitymanager.c
index c9796ad..a1898c9 100644
--- a/src/goaidentity/goakerberosidentitymanager.c
+++ b/src/goaidentity/goakerberosidentitymanager.c
@@ -81,6 +81,7 @@ typedef struct
{
const char *identifier;
gconstpointer initial_password;
+ char *preauth_source;
GoaIdentitySignInFlags sign_in_flags;
GoaIdentityInquiry *inquiry;
GoaIdentityInquiryFunc inquiry_func;
@@ -151,10 +152,14 @@ operation_free (Operation *operation)
if (operation->type != OPERATION_TYPE_SIGN_IN &&
operation->type != OPERATION_TYPE_GET_IDENTITY)
- g_clear_object (&operation->identity);
+ {
+ g_clear_object (&operation->identity);
+ }
else
- g_clear_pointer (&operation->identifier, g_free);
-
+ {
+ g_clear_pointer (&operation->identifier, g_free);
+ g_clear_pointer (&operation->preauth_source, g_free);
+ }
g_clear_object (&operation->result);
g_slice_free (Operation, operation);
@@ -863,6 +868,7 @@ sign_in_identity (GoaKerberosIdentityManager *self,
if (!goa_kerberos_identity_sign_in (GOA_KERBEROS_IDENTITY (identity),
operation->identifier,
operation->initial_password,
+ operation->preauth_source,
operation->sign_in_flags,
(GoaIdentityInquiryFunc)
on_kerberos_identity_inquiry,
@@ -1178,6 +1184,7 @@ static void
goa_kerberos_identity_manager_sign_identity_in (GoaIdentityManager *manager,
const char *identifier,
gconstpointer initial_password,
+ const char *preauth_source,
GoaIdentitySignInFlags flags,
GoaIdentityInquiryFunc inquiry_func,
gpointer inquiry_data,
@@ -1201,6 +1208,7 @@ goa_kerberos_identity_manager_sign_identity_in (GoaIdentityManager *manager,
* for duration of operation
*/
operation->initial_password = initial_password;
+ operation->preauth_source = g_strdup (preauth_source);
operation->sign_in_flags = flags;
operation->inquiry_func = inquiry_func;
operation->inquiry_data = inquiry_data;
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]
