4  * pam-krb5 supports a feature where the principal for authentication can be
9  * This file collects all the pieces related to that support.
14  * Copyright 2008-2012
15  *     The Board of Trustees of the Leland Stanford Junior University
17  * SPDX-License-Identifier: BSD-3-clause or GPL-1+
28 #include <pam-util/args.h>
29 #include <pam-util/logging.h>
50     if (args->config->alt_auth_map == NULL)  in pamk5_map_principal()
71     for (p = args->config->alt_auth_map; *p != '\0'; p++) {  in pamk5_map_principal()
79     if (realm != NULL && strchr(args->config->alt_auth_map, '@') == NULL)  in pamk5_map_principal()
86     for (p = args->config->alt_auth_map; *p != '\0'; p++) {  in pamk5_map_principal()
96     if (realm != NULL && strchr(args->config->alt_auth_map, '@') == NULL) {  in pamk5_map_principal()
129     struct context *ctx = args->config->ctx;  in pamk5_alt_auth()
134     retval = pamk5_map_principal(args, ctx->name, &kuser);  in pamk5_alt_auth()
137     retval = krb5_parse_name(ctx->context, kuser, &princ);  in pamk5_alt_auth()
145     if (args->debug) {  in pamk5_alt_auth()
148         retval = krb5_unparse_name(ctx->context, princ, &principal);  in pamk5_alt_auth()
152             putil_debug(args, "mapping %s to %s", ctx->name, principal);  in pamk5_alt_auth()
153             krb5_free_unparsed_name(ctx->context, principal);  in pamk5_alt_auth()
161     retval = krb5_get_init_creds_password(ctx->context, creds, princ,  in pamk5_alt_auth()
166         krb5_free_principal(ctx->context, princ);  in pamk5_alt_auth()
170         if (ctx->princ != NULL)  in pamk5_alt_auth()
171             krb5_free_principal(ctx->context, ctx->princ);  in pamk5_alt_auth()
172         ctx->princ = princ;  in pamk5_alt_auth()
182  * the context matches the alt_auth_map-derived identity of the user we're
197     if (args == NULL || args->config == NULL || args->config->ctx == NULL)  in pamk5_alt_auth_verify()
199     ctx = args->config->ctx;  in pamk5_alt_auth_verify()
200     if (ctx->context == NULL || ctx->name == NULL)  in pamk5_alt_auth_verify()
202     if (pamk5_map_principal(args, ctx->name, &name) != 0) {  in pamk5_alt_auth_verify()
206     retval = krb5_parse_name(ctx->context, name, &princ);  in pamk5_alt_auth_verify()
212     retval = krb5_unparse_name(ctx->context, princ, &mapped);  in pamk5_alt_auth_verify()
218     retval = krb5_unparse_name(ctx->context, ctx->princ, &authed);  in pamk5_alt_auth_verify()
234         krb5_free_unparsed_name(ctx->context, authed);  in pamk5_alt_auth_verify()
236         krb5_free_unparsed_name(ctx->context, mapped);  in pamk5_alt_auth_verify()
238         krb5_free_principal(ctx->context, princ);  in pamk5_alt_auth_verify()