Remove keytab configuration

Instead we'll always use the default keytab, which is /etc/krb5.keytab
or the KRB5_KTNAME environment variable.

diff --git a/src/config-vars.h b/src/config-vars.h
index fa6c53b..2c2334c 100644 (file)
--- a/src/config-vars.h
+++ b/src/config-vars.h
@@ -25,9 +25,6 @@ CONFIG_STR(notify_hook)
 CONFIG_STR(realm)
 
 CONFIG_STR(admin_principal)
-CONFIG_STR(admin_keytab)
-
 CONFIG_STR(admin_bind_userid)
-CONFIG_STR(admin_bind_keytab)
 
 CONFIG_STR(privileged_group)

diff --git a/src/kadm.c b/src/kadm.c
index 0fd05b6..3339e58 100644 (file)
--- a/src/kadm.c
+++ b/src/kadm.c
@@ -14,7 +14,7 @@ void ceo_kadm_init() {
     kadm5_config_params params;
     memset((void *) &params, 0, sizeof(params));
 
-    retval = kadm5_init_with_skey(admin_principal, admin_keytab,
+    retval = kadm5_init_with_skey(admin_principal, NULL /*admin_keytab */,
                 KADM5_ADMIN_SERVICE, &params, KADM5_STRUCT_VERSION,
                 KADM5_API_VERSION_2, &handle);
     if (retval) {

diff --git a/src/krb5.c b/src/krb5.c
index 31d07e5..5f4d4fc 100644 (file)
--- a/src/krb5.c
+++ b/src/krb5.c
@@ -1,4 +1,5 @@
 #include <stdio.h>
+
 #include <krb5.h>
 #include <syslog.h>
 
@@ -43,11 +44,10 @@ void ceo_krb5_init() {
         com_err(prog, retval, "while setting default realm");
 }
 
-void ceo_krb5_auth(char *principal, char *ktname) {
+void ceo_krb5_auth(char *principal) {
     krb5_error_code retval;
     krb5_creds creds;
     krb5_principal princ;
-    krb5_keytab keytab;
     krb5_ccache cache;
     krb5_get_init_creds_opt options;
 
@@ -60,10 +60,7 @@ void ceo_krb5_auth(char *principal, char *ktname) {
     if ((retval = krb5_cc_default(context, &cache)))
         com_err(prog, retval, "while resolving credentials cache");
 
-    if ((retval = krb5_kt_resolve(context, ktname, &keytab)))
-        com_err(prog, retval, "while resolving keytab %s", admin_bind_keytab);
-
-    if ((retval = krb5_get_init_creds_keytab(context, &creds, princ, keytab, 0, NULL, &options)))
+    if ((retval = krb5_get_init_creds_keytab(context, &creds, princ, NULL, 0, NULL, &options)))
         com_err(prog, retval, "while getting initial credentials");
 
     if ((retval = krb5_cc_initialize(context, cache, princ)))
@@ -73,7 +70,6 @@ void ceo_krb5_auth(char *principal, char *ktname) {
         com_err(prog, retval, "while storing credentials");
 
     krb5_free_cred_contents(context, &creds);
-    krb5_kt_close(context, keytab);
     krb5_free_principal(context, princ);
     krb5_cc_close(context, cache);
 }

diff --git a/src/krb5.h b/src/krb5.h
index 9538b32..5877b79 100644 (file)
--- a/src/krb5.h
+++ b/src/krb5.h
@@ -8,7 +8,7 @@ extern krb5_context context;
 void ceo_krb5_init();
 void ceo_krb5_cleanup();
 
-void ceo_krb5_auth(char *, char *);
+void ceo_krb5_auth(char *);
 void ceo_krb5_deauth();
 
 int ceo_read_password(char *, unsigned int, int);

diff --git a/src/ldap.c b/src/ldap.c
index dd7d34d..c318489 100644 (file)
--- a/src/ldap.c
+++ b/src/ldap.c
@@ -362,7 +362,7 @@ void ceo_ldap_init() {
     int proto = LDAP_DEFAULT_PROTOCOL;
     const char *sasl_mech = "GSSAPI";
 
-    if (!admin_bind_userid || !admin_bind_keytab)
+    if (!admin_bind_userid)
         fatal("not configured");
 
     if (ldap_initialize(&ld, server_url) != LDAP_SUCCESS)
@@ -371,7 +371,7 @@ void ceo_ldap_init() {
     if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &proto) != LDAP_OPT_SUCCESS)
         ldap_fatal("ldap_set_option");
 
-    ceo_krb5_auth(admin_bind_userid, admin_bind_keytab);
+    ceo_krb5_auth(admin_bind_userid);
 
     if (ldap_sasl_interactive_bind_s(ld, NULL, sasl_mech, NULL, NULL,
                 LDAP_SASL_QUIET, &ldap_sasl_interact, NULL) != LDAP_SUCCESS)