author | Neng Xue <neng.xue@oracle.com> |
Mon, 26 Sep 2016 15:58:55 -0700 | |
changeset 6978 | 14cbeb78966a |
parent 6599 | 1d033832c5e7 |
permissions | -rw-r--r-- |
5490
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
1 |
# |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
2 |
# Temporarily disable anonymity in kadmin (kadmin -n). |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
3 |
# |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
4 |
# This feature currently doesn't work with Solaris rpcsec_gss. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
5 |
# Fails in gss_acquire_cred, because desired_name |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
6 |
# WELLKNOWN/[email protected] != WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
7 |
# |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
8 |
# The patch removes -n option from kadmin and its man pages and |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
9 |
# skips kadmin tests in t_pkinit.py. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
10 |
# |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
11 |
# Support can be added later, if there is demand for it. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
12 |
# This fix would need to either call gss_acquire_cred with empty desired name |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
13 |
# or disregard realm when matching desired name. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
14 |
# Either way, rpcsec.so code would need to be adjusted too to accommodate this |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
15 |
# change. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
16 |
# |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
17 |
# This patch is Solaris specific and not intented for upstream contribution. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
18 |
# Patch source: in-house |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
19 |
# |
6599
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
20 |
--- a/src/kadmin/cli/kadmin.c |
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
21 |
+++ b/src/kadmin/cli/kadmin.c |
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
22 |
@@ -268,7 +268,7 @@ kadmin_startup(int argc, char *argv[], char **request_out, char ***args_out) |
5490
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
23 |
} |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
24 |
|
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
25 |
while ((optchar = getopt(argc, argv, |
6085
eb3c11e27709
PSARC/2016/244 Sync MIT Kerberos to 1.14.2
Shawn Emery <shawn.emery@oracle.com>
parents:
5986
diff
changeset
|
26 |
- "+x:r:p:knq:w:d:s:mc:t:e:ON")) != EOF) { |
eb3c11e27709
PSARC/2016/244 Sync MIT Kerberos to 1.14.2
Shawn Emery <shawn.emery@oracle.com>
parents:
5986
diff
changeset
|
27 |
+ "+x:r:p:kq:w:d:s:mc:t:e:ON")) != EOF) { |
5490
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
28 |
switch (optchar) { |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
29 |
case 'x': |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
30 |
db_args_size++; |
6599
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
31 |
--- a/src/man/kadmin.man |
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
32 |
+++ b/src/man/kadmin.man |
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
33 |
@@ -37,7 +37,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] |
5490
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
34 |
[\fB\-r\fP \fIrealm\fP] |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
35 |
[\fB\-p\fP \fIprincipal\fP] |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
36 |
[\fB\-q\fP \fIquery\fP] |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
37 |
-[[\fB\-c\fP \fIcache_name\fP]|[\fB\-k\fP [\fB\-t\fP \fIkeytab\fP]]|\fB\-n\fP] |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
38 |
+[[\fB\-c\fP \fIcache_name\fP]|[\fB\-k\fP [\fB\-t\fP \fIkeytab\fP]]] |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
39 |
[\fB\-w\fP \fIpassword\fP] |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
40 |
[\fB\-s\fP \fIadmin_server\fP[:\fIport\fP]] |
6599
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
41 |
[command args...] |
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
42 |
@@ -99,21 +99,6 @@ a password. In this case, the default principal will be |
5490
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
43 |
Use \fIkeytab\fP to decrypt the KDC response. This can only be used |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
44 |
with the \fB\-k\fP option. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
45 |
.TP |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
46 |
-.B \fB\-n\fP |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
47 |
-Requests anonymous processing. Two types of anonymous principals |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
48 |
-are supported. For fully anonymous Kerberos, configure PKINIT on |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
49 |
-the KDC and configure \fBpkinit_anchors\fP in the client\(aqs |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
50 |
-\fIkrb5.conf(5)\fP\&. Then use the \fB\-n\fP option with a principal |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
51 |
-of the form \fB@REALM\fP (an empty principal name followed by the |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
52 |
-at\-sign and a realm name). If permitted by the KDC, an anonymous |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
53 |
-ticket will be returned. A second form of anonymous tickets is |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
54 |
-supported; these realm\-exposed tickets hide the identity of the |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
55 |
-client but not the client\(aqs realm. For this mode, use \fBkinit |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
56 |
-\-n\fP with a normal principal name. If supported by the KDC, the |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
57 |
-principal (but not realm) will be replaced by the anonymous |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
58 |
-principal. As of release 1.8, the MIT Kerberos KDC only supports |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
59 |
-fully anonymous operation. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
60 |
-.TP |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
61 |
.B \fB\-c\fP \fIcredentials_cache\fP |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
62 |
Use \fIcredentials_cache\fP as the credentials cache. The |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
63 |
cache should contain a service ticket for the \fBkadmin/ADMINHOST\fP |
6599
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
64 |
--- a/src/tests/t_pkinit.py |
1d033832c5e7
24377741 Update Userland krb5 to MIT 1.14.3
Shawn Emery <shawn.emery@oracle.com>
parents:
6085
diff
changeset
|
65 |
+++ b/src/tests/t_pkinit.py |
6085
eb3c11e27709
PSARC/2016/244 Sync MIT Kerberos to 1.14.2
Shawn Emery <shawn.emery@oracle.com>
parents:
5986
diff
changeset
|
66 |
@@ -73,15 +73,16 @@ if '97:' in out: |
eb3c11e27709
PSARC/2016/244 Sync MIT Kerberos to 1.14.2
Shawn Emery <shawn.emery@oracle.com>
parents:
5986
diff
changeset
|
67 |
fail('auth indicators seen in anonymous PKINIT ticket') |
5490
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
68 |
|
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
69 |
# Test anonymous kadmin. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
70 |
-f = open(os.path.join(realm.testdir, 'acl'), 'a') |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
71 |
-f.write('WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS a *') |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
72 |
-f.close() |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
73 |
-realm.start_kadmind() |
6085
eb3c11e27709
PSARC/2016/244 Sync MIT Kerberos to 1.14.2
Shawn Emery <shawn.emery@oracle.com>
parents:
5986
diff
changeset
|
74 |
-realm.run([kadmin, '-n', 'addprinc', '-pw', 'test', 'testadd']) |
eb3c11e27709
PSARC/2016/244 Sync MIT Kerberos to 1.14.2
Shawn Emery <shawn.emery@oracle.com>
parents:
5986
diff
changeset
|
75 |
-out = realm.run([kadmin, '-n', 'getprinc', 'testadd'], expected_code=1) |
5490
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
76 |
-if "Operation requires ``get'' privilege" not in out: |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
77 |
- fail('Anonymous kadmin has too much privilege') |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
78 |
-realm.stop_kadmind() |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
79 |
+#f = open(os.path.join(realm.testdir, 'acl'), 'a') |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
80 |
+#f.write('WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS a *') |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
81 |
+#f.close() |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
82 |
+#realm.start_kadmind() |
6085
eb3c11e27709
PSARC/2016/244 Sync MIT Kerberos to 1.14.2
Shawn Emery <shawn.emery@oracle.com>
parents:
5986
diff
changeset
|
83 |
+#realm.run([kadmin, '-n', 'addprinc', '-pw', 'test', 'testadd']) |
eb3c11e27709
PSARC/2016/244 Sync MIT Kerberos to 1.14.2
Shawn Emery <shawn.emery@oracle.com>
parents:
5986
diff
changeset
|
84 |
+#out = realm.run([kadmin, '-n', 'getprinc', 'testadd'], expected_code=1) |
5490
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
85 |
+#if "Operation requires ``get'' privilege" not in out: |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
86 |
+# fail('Anonymous kadmin has too much privilege') |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
87 |
+#realm.stop_kadmind() |
6085
eb3c11e27709
PSARC/2016/244 Sync MIT Kerberos to 1.14.2
Shawn Emery <shawn.emery@oracle.com>
parents:
5986
diff
changeset
|
88 |
+sys.stderr.write("Anonymous pkinit support in kadmin disabled, skipping...\n"); |
5490
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
89 |
|
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
90 |
# Test with anonymous restricted; FAST should work but kvno should fail. |
9bf0bc57423a
PSARC/2015/144 Kerberos 1.13 Delivery to Userland
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
91 |
r_env = realm.special_env('restrict', True, kdc_conf=restrictive_kdc_conf) |