80 |
return rc; |
return rc; |
81 |
} |
} |
82 |
|
|
83 |
int |
static int |
84 |
auth_gssapi (struct imap4d_command *command, char **username) |
auth_gssapi (struct imap4d_command *command, |
85 |
|
char *auth_type_unused, char *arg_unused, char **username) |
86 |
{ |
{ |
87 |
gss_buffer_desc tokbuf, outbuf; |
gss_buffer_desc tokbuf, outbuf; |
88 |
OM_uint32 maj_stat, min_stat, min_stat2; |
OM_uint32 maj_stat, min_stat, min_stat2; |
116 |
if (maj_stat != GSS_S_COMPLETE) |
if (maj_stat != GSS_S_COMPLETE) |
117 |
{ |
{ |
118 |
display_status ("import name", maj_stat, min_stat); |
display_status ("import name", maj_stat, min_stat); |
119 |
util_finish (command, RESP_NO, "GSSAPI authentication not available"); |
return RESP_NO; |
|
return 1; |
|
120 |
} |
} |
121 |
|
|
122 |
maj_stat = gss_acquire_cred (&min_stat, server_name, 0, |
maj_stat = gss_acquire_cred (&min_stat, server_name, 0, |
127 |
if (maj_stat != GSS_S_COMPLETE) |
if (maj_stat != GSS_S_COMPLETE) |
128 |
{ |
{ |
129 |
display_status ("acquire credentials", maj_stat, min_stat); |
display_status ("acquire credentials", maj_stat, min_stat); |
130 |
util_finish (command, RESP_NO, "GSSAPI authentication not available"); |
return RESP_NO; |
|
return 1; |
|
131 |
} |
} |
132 |
|
|
133 |
/* Start the dialogue */ |
/* Start the dialogue */ |
134 |
|
|
135 |
util_send ("+ GO AHEAD\r\n"); |
util_send ("+ GO AHEAD\r\n"); |
136 |
|
util_flush_output (); |
137 |
|
|
138 |
context = GSS_C_NO_CONTEXT; |
context = GSS_C_NO_CONTEXT; |
139 |
|
|
140 |
for (;;) |
for (;;) |
173 |
display_status ("accept context", maj_stat, min_stat); |
display_status ("accept context", maj_stat, min_stat); |
174 |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
175 |
gss_release_buffer (&min_stat, &outbuf); |
gss_release_buffer (&min_stat, &outbuf); |
176 |
util_finish (command, RESP_NO, "GSSAPI authentication failed"); |
return RESP_NO; |
|
return 1; |
|
177 |
} |
} |
178 |
|
|
179 |
if (outbuf.length) |
if (outbuf.length) |
216 |
gss_release_buffer (&min_stat, &outbuf); |
gss_release_buffer (&min_stat, &outbuf); |
217 |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
218 |
gss_release_buffer (&min_stat, &outbuf); |
gss_release_buffer (&min_stat, &outbuf); |
219 |
util_finish (command, RESP_NO, |
return RESP_NO; |
|
"GSSAPI authentication failed: unsupported protection mechanism"); |
|
|
return 1; |
|
220 |
} |
} |
221 |
protection_mech = mech; |
protection_mech = mech; |
222 |
client_buffer_size = sec_level & 0x00ffffffff; |
client_buffer_size = sec_level & 0x00ffffffff; |
231 |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
232 |
gss_release_buffer (&min_stat, &outbuf); |
gss_release_buffer (&min_stat, &outbuf); |
233 |
free (*username); |
free (*username); |
234 |
util_finish (command, RESP_NO, "GSSAPI authentication failed"); |
return RESP_NO; |
|
return 1; |
|
235 |
} |
} |
236 |
|
|
237 |
if (imap4d_gss_userok (&client_name, *username)) |
if (imap4d_gss_userok (&client_name, *username)) |
238 |
{ |
{ |
239 |
syslog (LOG_NOTICE, _("GSSAPI user %s is NOT authorized as %s"), |
syslog (LOG_NOTICE, _("GSSAPI user %s is NOT authorized as %s"), |
240 |
(char *) client_name.value, *username); |
(char *) client_name.value, *username); |
|
util_finish (command, RESP_NO, |
|
|
"GSSAPI user %s is NOT authorized as %s", |
|
|
client_name.value, *username); |
|
241 |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
242 |
gss_release_buffer (&min_stat, &outbuf); |
gss_release_buffer (&min_stat, &outbuf); |
243 |
gss_release_buffer (&min_stat, &client_name); |
gss_release_buffer (&min_stat, &client_name); |
244 |
free (*username); |
free (*username); |
245 |
return 1; |
return RESP_NO; |
246 |
} |
} |
247 |
else |
else |
248 |
{ |
{ |
253 |
gss_release_buffer (&min_stat, &client_name); |
gss_release_buffer (&min_stat, &client_name); |
254 |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
maj_stat = gss_delete_sec_context (&min_stat, &context, &outbuf); |
255 |
gss_release_buffer (&min_stat, &outbuf); |
gss_release_buffer (&min_stat, &outbuf); |
256 |
util_finish (command, RESP_OK, "GSSAPI authentication successful"); |
return RESP_OK; |
257 |
return 0; |
} |
258 |
|
|
259 |
|
void |
260 |
|
auth_gssapi_init () |
261 |
|
{ |
262 |
|
auth_add ("GSSAPI", auth_gssapi); |
263 |
} |
} |
264 |
|
|
265 |
|
|