17c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 27c478bd9Sstevel@tonic-gate 37c478bd9Sstevel@tonic-gate /* 47c478bd9Sstevel@tonic-gate * Copyright 1997 by Massachusetts Institute of Technology 57c478bd9Sstevel@tonic-gate * All Rights Reserved. 67c478bd9Sstevel@tonic-gate * 77c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may 87c478bd9Sstevel@tonic-gate * require a specific license from the United States Government. 97c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 107c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting. 117c478bd9Sstevel@tonic-gate * 127c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 137c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 147c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 157c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 167c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 177c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 187c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 197c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 207c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a 217c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 227c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 237c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 247c478bd9Sstevel@tonic-gate * or implied warranty. 257c478bd9Sstevel@tonic-gate * 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 28*ab9b2e15Sgtb #include "gssapiP_krb5.h" 297c478bd9Sstevel@tonic-gate 307c478bd9Sstevel@tonic-gate /* 317c478bd9Sstevel@tonic-gate * Check to see whether or not a GSSAPI krb5 credential is valid. If 327c478bd9Sstevel@tonic-gate * it is not, return an error. 337c478bd9Sstevel@tonic-gate */ 347c478bd9Sstevel@tonic-gate 357c478bd9Sstevel@tonic-gate OM_uint32 36*ab9b2e15Sgtb krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle, 37*ab9b2e15Sgtb krb5_context context) 387c478bd9Sstevel@tonic-gate { 397c478bd9Sstevel@tonic-gate krb5_gss_cred_id_t cred; 407c478bd9Sstevel@tonic-gate krb5_error_code code; 417c478bd9Sstevel@tonic-gate krb5_principal princ; 427c478bd9Sstevel@tonic-gate 437c478bd9Sstevel@tonic-gate if (!kg_validate_cred_id(cred_handle)) { 447c478bd9Sstevel@tonic-gate *minor_status = (OM_uint32) G_VALIDATE_FAILED; 45*ab9b2e15Sgtb return(GSS_S_CALL_BAD_STRUCTURE|GSS_S_DEFECTIVE_CREDENTIAL); 467c478bd9Sstevel@tonic-gate } 477c478bd9Sstevel@tonic-gate 487c478bd9Sstevel@tonic-gate cred = (krb5_gss_cred_id_t) cred_handle; 497c478bd9Sstevel@tonic-gate 50*ab9b2e15Sgtb code = k5_mutex_lock(&cred->lock); 517c478bd9Sstevel@tonic-gate if (code) { 527c478bd9Sstevel@tonic-gate *minor_status = code; 53*ab9b2e15Sgtb return GSS_S_FAILURE; 54*ab9b2e15Sgtb } 55*ab9b2e15Sgtb 56*ab9b2e15Sgtb if (cred->ccache) { 57*ab9b2e15Sgtb if ((code = krb5_cc_get_principal(context, cred->ccache, &princ))) { 58*ab9b2e15Sgtb k5_mutex_unlock(&cred->lock); 59*ab9b2e15Sgtb *minor_status = code; 60*ab9b2e15Sgtb return(GSS_S_DEFECTIVE_CREDENTIAL); 617c478bd9Sstevel@tonic-gate } 627c478bd9Sstevel@tonic-gate if (!krb5_principal_compare(context, princ, cred->princ)) { 63*ab9b2e15Sgtb k5_mutex_unlock(&cred->lock); 647c478bd9Sstevel@tonic-gate *minor_status = KG_CCACHE_NOMATCH; 65*ab9b2e15Sgtb return(GSS_S_DEFECTIVE_CREDENTIAL); 667c478bd9Sstevel@tonic-gate } 677c478bd9Sstevel@tonic-gate (void)krb5_free_principal(context, princ); 687c478bd9Sstevel@tonic-gate } 697c478bd9Sstevel@tonic-gate *minor_status = 0; 70*ab9b2e15Sgtb return GSS_S_COMPLETE; 717c478bd9Sstevel@tonic-gate } 72*ab9b2e15Sgtb 73*ab9b2e15Sgtb OM_uint32 74*ab9b2e15Sgtb krb5_gss_validate_cred(minor_status, cred_handle) 75*ab9b2e15Sgtb OM_uint32 *minor_status; 76*ab9b2e15Sgtb gss_cred_id_t cred_handle; 77*ab9b2e15Sgtb { 78*ab9b2e15Sgtb krb5_context context; 79*ab9b2e15Sgtb krb5_error_code code; 80*ab9b2e15Sgtb OM_uint32 maj; 81*ab9b2e15Sgtb 82*ab9b2e15Sgtb code = krb5_gss_init_context(&context); 83*ab9b2e15Sgtb if (code) { 84*ab9b2e15Sgtb *minor_status = code; 85*ab9b2e15Sgtb return GSS_S_FAILURE; 86*ab9b2e15Sgtb } 87*ab9b2e15Sgtb 88*ab9b2e15Sgtb maj = krb5_gss_validate_cred_1(minor_status, cred_handle, context); 89*ab9b2e15Sgtb if (maj == 0) { 90*ab9b2e15Sgtb krb5_gss_cred_id_t cred = (krb5_gss_cred_id_t) cred_handle; 91*ab9b2e15Sgtb k5_mutex_assert_locked(&cred->lock); 92*ab9b2e15Sgtb k5_mutex_unlock(&cred->lock); 93*ab9b2e15Sgtb } 94*ab9b2e15Sgtb krb5_free_context(context); 95*ab9b2e15Sgtb return maj; 96*ab9b2e15Sgtb } 97*ab9b2e15Sgtb 98*ab9b2e15Sgtb 99*ab9b2e15Sgtb 100*ab9b2e15Sgtb 101