DEVEL15-windows-nim-plugin-krb5-referrals-compat-20070209

MIT Kerberos version 5 release 1.6 adds support for referrals in the
client.  As a result krb5_get_host_realm() returns the nul-string for
the realm whenever there is no local domain-realm mapping in the
profile.

aklog must now manually perform the fallback to using the domain of
the vlserver as basis for the realm name if referrals fail.

This will be required for KFW 3.2 support.

(cherry picked from commit 584e1bd98eb4258a2cd1a517f7d49c71407983b5)

diff --git a/src/WINNT/netidmgr_plugin/afsfuncs.c b/src/WINNT/netidmgr_plugin/afsfuncs.c
index 421fc24df9500cc76dc6e446368fc1b432260ff0..7e09b4e27d2ab60ec0f474b639580a704fcbe1f2 100644 (file)
--- a/src/WINNT/netidmgr_plugin/afsfuncs.c
+++ b/src/WINNT/netidmgr_plugin/afsfuncs.c
@@ -727,8 +727,8 @@ afs_klog(khm_handle identity,
     char       RealmName[128];
     char       CellName[128];
     char       ServiceName[128];
-       khm_handle      confighandle;
-       khm_int32       supports_krb4 = 1;
+    khm_handle confighandle;
+    khm_int32  supports_krb4 = 1;
 
     /* signalling */
     BOOL        bGotCreds = FALSE; /* got creds? */
@@ -767,7 +767,7 @@ afs_klog(khm_handle identity,
     }
 
     StringCbCopyA(realm_of_cell, sizeof(realm_of_cell), 
-                  afs_realm_of_cell(&ak_cellconfig));
+                  afs_realm_of_cell(&ak_cellconfig, FALSE));
 
     if (strlen(service) == 0)
         StringCbCopyA(ServiceName, sizeof(ServiceName), "afs");
@@ -844,7 +844,24 @@ afs_klog(khm_handle identity,
         r = pkrb5_cc_set_flags(context, k5cc, flags);
 #endif
         r = pkrb5_get_credentials(context, 0, k5cc, &increds, &k5creds);
-        if (r == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN ||
+       if ((r == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN ||
+             r == KRB5KRB_ERR_GENERIC /* Heimdal */) &&
+            !RealmName[0]) {
+           StringCbCopyA(RealmName, sizeof(RealmName), 
+                         afs_realm_of_cell(&ak_cellconfig, TRUE));
+
+            pkrb5_free_principal(context, increds.server);
+           r = (*pkrb5_build_principal)(context, &increds.server,
+                                        (int) strlen(RealmName),
+                                        RealmName,
+                                        ServiceName,
+                                        CellName,
+                                        0);
+            if (r == 0)
+                r = pkrb5_get_credentials(context, 0, k5cc, 
+                                          &increds, &k5creds);
+       }
+       if (r == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN ||
             r == KRB5KRB_ERR_GENERIC /* Heimdal */) {
             /* Next try Service@REALM */
             pkrb5_free_principal(context, increds.server);
@@ -1168,7 +1185,7 @@ afs_klog(khm_handle identity,
 /* afs_realm_of_cell():               */
 /**************************************/
 static char *
-afs_realm_of_cell(afs_conf_cell *cellconfig)
+afs_realm_of_cell(afs_conf_cell *cellconfig, BOOL referral_fallback)
 {
     char krbhst[MAX_HSTNM]="";
     static char krbrlm[REALM_SZ+1]="";
@@ -1179,36 +1196,45 @@ afs_realm_of_cell(afs_conf_cell *cellconfig)
     if (!cellconfig)
         return 0;
 
-    if ( pkrb5_init_context ) {
-        r = pkrb5_init_context(&ctx); 
-        if ( !r )
-            r = pkrb5_get_host_realm(ctx, cellconfig->hostName[0], &realmlist);
-        if ( !r && realmlist && realmlist[0] ) {
-            StringCbCopyA(krbrlm, sizeof(krbrlm), realmlist[0]);
-            pkrb5_free_host_realm(ctx, realmlist);
-        }
-        if (ctx)
-            pkrb5_free_context(ctx);
-    }
-
-    if ( !krbrlm[0] ) {
-        StringCbCopyA(krbrlm, sizeof(krbrlm), 
-                      (char *)(*pkrb_realmofhost)(cellconfig->hostName[0]));
-        if ((*pkrb_get_krbhst)(krbhst, krbrlm, 1) != KSUCCESS)
-            krbrlm[0] = '\0';
-    }
-
-    if ( !krbrlm[0] ) {
-        char *s = krbrlm;
-        char *t = cellconfig->name;
-        int c;
-
-        while (c = *t++)
-        {
-            if (islower(c)) c=toupper(c);
-            *s++ = c;
-        }
-        *s++ = 0;
+    if (referral_fallback) {
+       char * p;
+       p = strchr(cellconfig->hostName[0], '.');
+       if (p++)
+           StringCbCopyA(krbrlm, sizeof(krbrlm), p);
+       else
+           StringCbCopyA(krbrlm, sizeof(krbrlm), cellconfig->name);
+       strupr(krbrlm);
+    } else {
+       if ( pkrb5_init_context ) {
+           r = pkrb5_init_context(&ctx); 
+           if ( !r )
+               r = pkrb5_get_host_realm(ctx, cellconfig->hostName[0], &realmlist);
+           if ( !r && realmlist && realmlist[0] ) {
+               StringCbCopyA(krbrlm, sizeof(krbrlm), realmlist[0]);
+               pkrb5_free_host_realm(ctx, realmlist);
+           }
+           if (ctx)
+               pkrb5_free_context(ctx);
+       }
+
+       if (r) {
+           if (pkrb_get_krbhst && pkrb_realmofhost) {
+               StringCbCopyA(krbrlm, sizeof(krbrlm), 
+                              (char *)(*pkrb_realmofhost)(cellconfig->hostName[0]));
+               if ((*pkrb_get_krbhst)(krbhst, krbrlm, 1) != KSUCCESS)
+                   krbrlm[0] = '\0';
+           }
+
+           if ( !krbrlm[0] ) {
+               char * p;
+               p = strchr(cellconfig->hostName[0], '.');
+               if (p++)
+                   StringCbCopyA(krbrlm, sizeof(krbrlm), p);
+               else
+                   StringCbCopyA(krbrlm, sizeof(krbrlm), cellconfig->name);
+               strupr(krbrlm);
+           }
+       }
     }
     return(krbrlm);
 }

diff --git a/src/WINNT/netidmgr_plugin/afsfuncs.h b/src/WINNT/netidmgr_plugin/afsfuncs.h
index 5f6ee3fb4b219ee1d4b56f12023f39790312e7ee..b1ba8f19ec9ba65db559be2b04f463cc0d9d1194 100644 (file)
--- a/src/WINNT/netidmgr_plugin/afsfuncs.h
+++ b/src/WINNT/netidmgr_plugin/afsfuncs.h
@@ -73,7 +73,7 @@ ServiceControl(LPSTR lpszMachineName,
 
 void afs_report_error(LONG rc, LPCSTR FailedFunctionName);
 
-static char *afs_realm_of_cell(afs_conf_cell *);
+static char *afs_realm_of_cell(afs_conf_cell *, BOOL);
 static long afs_get_cellconfig_callback(void *, struct sockaddr_in *, char *);
 static int afs_get_cellconfig(char *, afs_conf_cell *, char *);