public
/
pyceo-broken
12
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Remove keytab configuration 

Instead we'll always use the default keytab, which is /etc/krb5.keytab
or the KRB5_KTNAME environment variable.
This commit is contained in:
Michael Spang 2009-07-25 04:19:29 -04:00
parent d6e6b2bc63
commit 60e272e8c6
5 changed files with 7 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/config-vars.h
View File

@ -25,9 +25,6 @@ CONFIG_STR(notify_hook)
CONFIG_STR(realm)
CONFIG_STR(admin_principal)
CONFIG_STR(admin_keytab)
CONFIG_STR(admin_bind_userid)
CONFIG_STR(admin_bind_keytab)
CONFIG_STR(privileged_group)

2
src/kadm.c
View File

@ -14,7 +14,7 @@ void ceo_kadm_init() {
kadm5_config_params params;
memset((void *) &params, 0, sizeof(params));
retval = kadm5_init_with_skey(admin_principal, admin_keytab,
retval = kadm5_init_with_skey(admin_principal, NULL /*admin_keytab */,
KADM5_ADMIN_SERVICE, &params, KADM5_STRUCT_VERSION,
KADM5_API_VERSION_2, &handle);
if (retval) {

10
src/krb5.c
View File

@ -1,4 +1,5 @@
#include <stdio.h>
#include <krb5.h>
#include <syslog.h>
@ -43,11 +44,10 @@ void ceo_krb5_init() {
com_err(prog, retval, "while setting default realm");
}
void ceo_krb5_auth(char *principal, char *ktname) {
void ceo_krb5_auth(char *principal) {
krb5_error_code retval;
krb5_creds creds;
krb5_principal princ;
krb5_keytab keytab;
krb5_ccache cache;
krb5_get_init_creds_opt options;
@ -60,10 +60,7 @@ void ceo_krb5_auth(char *principal, char *ktname) {
if ((retval = krb5_cc_default(context, &cache)))
com_err(prog, retval, "while resolving credentials cache");
if ((retval = krb5_kt_resolve(context, ktname, &keytab)))
com_err(prog, retval, "while resolving keytab %s", admin_bind_keytab);
if ((retval = krb5_get_init_creds_keytab(context, &creds, princ, keytab, 0, NULL, &options)))
if ((retval = krb5_get_init_creds_keytab(context, &creds, princ, NULL, 0, NULL, &options)))
com_err(prog, retval, "while getting initial credentials");
if ((retval = krb5_cc_initialize(context, cache, princ)))
@ -73,7 +70,6 @@ void ceo_krb5_auth(char *principal, char *ktname) {
com_err(prog, retval, "while storing credentials");
krb5_free_cred_contents(context, &creds);
krb5_kt_close(context, keytab);
krb5_free_principal(context, princ);
krb5_cc_close(context, cache);
}

2
src/krb5.h
View File

@ -8,7 +8,7 @@ extern krb5_context context;
void ceo_krb5_init();
void ceo_krb5_cleanup();
void ceo_krb5_auth(char *, char *);
void ceo_krb5_auth(char *);
void ceo_krb5_deauth();
int ceo_read_password(char *, unsigned int, int);

4
src/ldap.c
View File

@ -362,7 +362,7 @@ void ceo_ldap_init() {
int proto = LDAP_DEFAULT_PROTOCOL;
const char *sasl_mech = "GSSAPI";
if (!admin_bind_userid || !admin_bind_keytab)
if (!admin_bind_userid)
fatal("not configured");
if (ldap_initialize(&ld, server_url) != LDAP_SUCCESS)
@ -371,7 +371,7 @@ void ceo_ldap_init() {
if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &proto) != LDAP_OPT_SUCCESS)
ldap_fatal("ldap_set_option");
ceo_krb5_auth(admin_bind_userid, admin_bind_keytab);
ceo_krb5_auth(admin_bind_userid);
if (ldap_sasl_interactive_bind_s(ld, NULL, sasl_mech, NULL, NULL,
LDAP_SASL_QUIET, &ldap_sasl_interact, NULL) != LDAP_SUCCESS)