Re: [jabberd2] GSSAPI Support in gsasl backend

[Jelmer Vernooij]

Am Donnerstag, den 07.08.2008, 16:18 +0200 schrieb Jelmer Vernooij:
> I've been playing with the gsasl backend a bit lately, trying to get the
> Kerberos (GSSAPI) backend to work.
> 
> The attached patch at least gets jabberd to offer GSSAPI authentication
> and makes it successfully complete the first couple of steps in SASL.
> For some reason it doesn't send the last response in the SASL as
> <success/> though but as <challenge/>. I haven't looked into why this is
> yet. 
Attached is an updated version of my patch that causes the login
procedure to complete successfully.

Cheers,

Jelmer
-- 
Jelmer Vernooij <[EMAIL PROTECTED]> - http://samba.org/~jelmer/
Jabber: [EMAIL PROTECTED]

=== modified file 'sx/sasl_gsasl.c'
--- sx/sasl_gsasl.c	2008-07-09 06:55:15 +0000
+++ sx/sasl_gsasl.c	2008-08-07 17:47:40 +0000
@@ -157,6 +157,9 @@
             free(method);
             return;
         }
+	} else if (NULL != gsasl_property_fast(sd, GSASL_GSSAPI_DISPLAY_NAME)) {
+		creds.authzid = strdup(gsasl_property_fast(sd, GSASL_GSSAPI_DISPLAY_NAME));
+		authzid = NULL;
     } else {
         /* override unchecked arbitrary authzid */
         if(creds.realm && creds.realm[0] != '\0') {
@@ -176,7 +179,7 @@
     if(authzid) free(authzid);
 }
 
-/** make the stream suthenticated second time round */
+/** make the stream authenticated second time round */
 static void _sx_sasl_stream(sx_t s, sx_plugin_t p) {
     Gsasl_session *sd = (Gsasl_session *) s->plugin_data[p->index];
 
@@ -620,6 +623,22 @@
             }
             return GSASL_NEEDS_MORE;
 
+        case GSASL_SERVICE:
+            gsasl_property_set(sd, GSASL_SERVICE, "xmpp");
+            return GSASL_OK;
+
+        case GSASL_HOSTNAME:
+            { 
+                char hostname[256];
+                /* get hostname */
+                hostname[0] = '\0';
+                gethostname(hostname, 256);
+                hostname[255] = '\0';
+
+                gsasl_property_set(sd, GSASL_HOSTNAME, hostname);
+           }
+           return GSASL_OK;
+
         case GSASL_VALIDATE_SIMPLE:
             /* GSASL_AUTHID, GSASL_AUTHZID, GSASL_PASSWORD */
             assert((ctx->cb != NULL));
@@ -634,6 +653,15 @@
             else
                 return GSASL_AUTHENTICATION_ERROR;
 
+        case GSASL_VALIDATE_GSSAPI:
+            /* GSASL_AUTHZID, GSASL_GSSAPI_DISPLAY_NAME */
+            creds.authnid = gsasl_property_fast(sd, GSASL_GSSAPI_DISPLAY_NAME);
+            if(!creds.authnid) return GSASL_NO_AUTHID;
+            creds.authzid = gsasl_property_fast(sd, GSASL_AUTHZID);
+            if(!creds.authzid) return GSASL_NO_AUTHZID;
+            gsasl_property_set(sd, GSASL_AUTHID, creds.authnid);
+            return GSASL_OK;
+
         case GSASL_VALIDATE_ANONYMOUS:
             /* GSASL_ANONYMOUS_TOKEN */
             creds.authnid = gsasl_property_fast(sd, GSASL_ANONYMOUS_TOKEN);

signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil