1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /* lib/krb5/os/localauth_names.c - names localauth module */
3 /*
4 * Copyright (C) 2013 by the Massachusetts Institute of Technology.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * * Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 *
14 * * Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
24 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
26 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
28 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
30 * OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 #include "k5-int.h"
34 #include "os-proto.h"
35 #include <krb5/localauth_plugin.h>
36
37 static krb5_error_code
an2ln_names(krb5_context context,krb5_localauth_moddata data,const char * type,const char * residual,krb5_const_principal aname,char ** lname_out)38 an2ln_names(krb5_context context, krb5_localauth_moddata data,
39 const char *type, const char *residual, krb5_const_principal aname,
40 char **lname_out)
41 {
42 krb5_error_code ret;
43 char *realm = NULL, *pname = NULL, **mapping_values = NULL;
44 const char *hierarchy[5];
45 size_t count;
46
47 *lname_out = NULL;
48
49 /*
50 * Fetch the profile values for realms-><defaultrealm>->
51 * auth_to_local_names-><princname>. Use the principal name without realm;
52 * this is problematic in many multiple-realm environments, but is how
53 * we've historically done it.
54 */
55 ret = krb5_get_default_realm(context, &realm);
56 if (ret)
57 return KRB5_LNAME_NOTRANS;
58 ret = krb5_unparse_name_flags(context, aname,
59 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &pname);
60 if (ret)
61 goto cleanup;
62 hierarchy[0] = KRB5_CONF_REALMS;
63 hierarchy[1] = realm;
64 hierarchy[2] = KRB5_CONF_AUTH_TO_LOCAL_NAMES;
65 hierarchy[3] = pname;
66 hierarchy[4] = NULL;
67 ret = profile_get_values(context->profile, hierarchy, &mapping_values);
68 if (ret) {
69 ret = KRB5_LNAME_NOTRANS;
70 goto cleanup;
71 }
72
73 /* We found one or more explicit mappings. Use the last one. */
74 for (count = 0; mapping_values[count] != NULL; count++);
75 *lname_out = strdup(mapping_values[count - 1]);
76 if (*lname_out == NULL)
77 ret = ENOMEM;
78
79 cleanup:
80 free(realm);
81 free(pname);
82 profile_free_list(mapping_values);
83 return ret;
84 }
85
86 static void
freestr(krb5_context context,krb5_localauth_moddata data,char * str)87 freestr(krb5_context context, krb5_localauth_moddata data, char *str)
88 {
89 free(str);
90 }
91
92 krb5_error_code
localauth_names_initvt(krb5_context context,int maj_ver,int min_ver,krb5_plugin_vtable vtable)93 localauth_names_initvt(krb5_context context, int maj_ver, int min_ver,
94 krb5_plugin_vtable vtable)
95 {
96 krb5_localauth_vtable vt = (krb5_localauth_vtable)vtable;
97
98 vt->name = "names";
99 vt->an2ln = an2ln_names;
100 vt->free_string = freestr;
101 return 0;
102 }
103