Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

krb5_child: ignore Smartcard identifiers with a ':' #7748

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

krb5_child: ignore Smartcard identifiers with a ':' #7748

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 31 additions & 9 deletions src/providers/krb5/krb5_child.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1839,6 +1839,18 @@ static errno_t get_pkinit_identity(TALLOC_CTX *mem_ctx,
module_name = "p11-kit-proxy.so";
}

/* The ':' character is used as a seperator and libkrb5 currently does not
* allow to escape it in names. So we have to error out if any of the
* names contains a ':' */
if (strchr(token_name, ':') != NULL || strchr(module_name, ':') != NULL
|| strchr(key_id, ':') != NULL || strchr(label, ':') != NULL) {
DEBUG(SSSDBG_OP_FAILURE,
"Some of the certificate identification data ([%s][%s][%s][%s]) "
"contain a ':' character\n",
token_name, module_name, key_id, label);
return ERR_INVALID_CONFIG;
}

identity = talloc_asprintf(mem_ctx, "PKCS11:module_name=%s", module_name);
if (identity == NULL) {
DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
Expand Down Expand Up @@ -2316,17 +2328,27 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr,

ret = get_pkinit_identity(kr, kr->pd->authtok, &identity);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE, "get_pkinit_identity failed.\n");
return ret;
/* Skip Smartcard credentials during SSSD pre-auth if they contain
* invalid characters and figure out if other authentication
* methods are available. */
if (ret == ERR_INVALID_CONFIG && kr->pd->cmd == SSS_PAM_PREAUTH) {
DEBUG(SSSDBG_OP_FAILURE,
"Smartcard credentials are ignored.\n");
} else {
DEBUG(SSSDBG_OP_FAILURE, "get_pkinit_identity failed.\n");
return ret;
}
}

kerr = krb5_get_init_creds_opt_set_pa(kr->ctx, kr->options,
"X509_user_identity", identity);
talloc_free(identity);
if (kerr != 0) {
DEBUG(SSSDBG_CRIT_FAILURE,
"krb5_get_init_creds_opt_set_pa failed.\n");
return kerr;
if (ret == EOK) {
kerr = krb5_get_init_creds_opt_set_pa(kr->ctx, kr->options,
"X509_user_identity", identity);
talloc_free(identity);
if (kerr != 0) {
DEBUG(SSSDBG_CRIT_FAILURE,
"krb5_get_init_creds_opt_set_pa failed.\n");
return kerr;
}
}

/* TODO: Maybe X509_anchors should be added here as well */
Expand Down
Loading