1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Kerberos v5 authentication and ticket-passing routines.
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
5*0Sstevel@tonic-gate */
6*0Sstevel@tonic-gate /*
7*0Sstevel@tonic-gate * Copyright (c) 2002 Daniel Kouril. All rights reserved.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
10*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions
11*0Sstevel@tonic-gate * are met:
12*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
13*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
14*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
15*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the
16*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution.
17*0Sstevel@tonic-gate *
18*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19*0Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20*0Sstevel@tonic-gate * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21*0Sstevel@tonic-gate * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22*0Sstevel@tonic-gate * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24*0Sstevel@tonic-gate * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25*0Sstevel@tonic-gate * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26*0Sstevel@tonic-gate * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27*0Sstevel@tonic-gate * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28*0Sstevel@tonic-gate */
29*0Sstevel@tonic-gate
30*0Sstevel@tonic-gate #include "includes.h"
31*0Sstevel@tonic-gate RCSID("$OpenBSD: auth-krb5.c,v 1.9 2002/09/09 06:48:06 itojun Exp $");
32*0Sstevel@tonic-gate
33*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
34*0Sstevel@tonic-gate
35*0Sstevel@tonic-gate #include "ssh.h"
36*0Sstevel@tonic-gate #include "ssh1.h"
37*0Sstevel@tonic-gate #include "packet.h"
38*0Sstevel@tonic-gate #include "xmalloc.h"
39*0Sstevel@tonic-gate #include "log.h"
40*0Sstevel@tonic-gate #include "servconf.h"
41*0Sstevel@tonic-gate #include "uidswap.h"
42*0Sstevel@tonic-gate #include "auth.h"
43*0Sstevel@tonic-gate
44*0Sstevel@tonic-gate #ifdef KRB5
45*0Sstevel@tonic-gate #include <krb5.h>
46*0Sstevel@tonic-gate #ifndef HEIMDAL
47*0Sstevel@tonic-gate #define krb5_get_err_text(context,code) error_message(code)
48*0Sstevel@tonic-gate #endif /* !HEIMDAL */
49*0Sstevel@tonic-gate
50*0Sstevel@tonic-gate extern ServerOptions options;
51*0Sstevel@tonic-gate
52*0Sstevel@tonic-gate static int
krb5_init(void * context)53*0Sstevel@tonic-gate krb5_init(void *context)
54*0Sstevel@tonic-gate {
55*0Sstevel@tonic-gate Authctxt *authctxt = (Authctxt *)context;
56*0Sstevel@tonic-gate krb5_error_code problem;
57*0Sstevel@tonic-gate static int cleanup_registered = 0;
58*0Sstevel@tonic-gate
59*0Sstevel@tonic-gate if (authctxt->krb5_ctx == NULL) {
60*0Sstevel@tonic-gate problem = krb5_init_context(&authctxt->krb5_ctx);
61*0Sstevel@tonic-gate if (problem)
62*0Sstevel@tonic-gate return (problem);
63*0Sstevel@tonic-gate krb5_init_ets(authctxt->krb5_ctx);
64*0Sstevel@tonic-gate }
65*0Sstevel@tonic-gate if (!cleanup_registered) {
66*0Sstevel@tonic-gate fatal_add_cleanup(krb5_cleanup_proc, authctxt);
67*0Sstevel@tonic-gate cleanup_registered = 1;
68*0Sstevel@tonic-gate }
69*0Sstevel@tonic-gate return (0);
70*0Sstevel@tonic-gate }
71*0Sstevel@tonic-gate
72*0Sstevel@tonic-gate /*
73*0Sstevel@tonic-gate * Try krb5 authentication. server_user is passed for logging purposes
74*0Sstevel@tonic-gate * only, in auth is received ticket, in client is returned principal
75*0Sstevel@tonic-gate * from the ticket
76*0Sstevel@tonic-gate */
77*0Sstevel@tonic-gate int
auth_krb5(Authctxt * authctxt,krb5_data * auth,char ** client,krb5_data * reply)78*0Sstevel@tonic-gate auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *reply)
79*0Sstevel@tonic-gate {
80*0Sstevel@tonic-gate krb5_error_code problem;
81*0Sstevel@tonic-gate krb5_principal server;
82*0Sstevel@tonic-gate krb5_ticket *ticket;
83*0Sstevel@tonic-gate int fd, ret;
84*0Sstevel@tonic-gate
85*0Sstevel@tonic-gate ret = 0;
86*0Sstevel@tonic-gate server = NULL;
87*0Sstevel@tonic-gate ticket = NULL;
88*0Sstevel@tonic-gate reply->length = 0;
89*0Sstevel@tonic-gate
90*0Sstevel@tonic-gate problem = krb5_init(authctxt);
91*0Sstevel@tonic-gate if (problem)
92*0Sstevel@tonic-gate goto err;
93*0Sstevel@tonic-gate
94*0Sstevel@tonic-gate problem = krb5_auth_con_init(authctxt->krb5_ctx,
95*0Sstevel@tonic-gate &authctxt->krb5_auth_ctx);
96*0Sstevel@tonic-gate if (problem)
97*0Sstevel@tonic-gate goto err;
98*0Sstevel@tonic-gate
99*0Sstevel@tonic-gate fd = packet_get_connection_in();
100*0Sstevel@tonic-gate #ifdef HEIMDAL
101*0Sstevel@tonic-gate problem = krb5_auth_con_setaddrs_from_fd(authctxt->krb5_ctx,
102*0Sstevel@tonic-gate authctxt->krb5_auth_ctx, &fd);
103*0Sstevel@tonic-gate #else
104*0Sstevel@tonic-gate problem = krb5_auth_con_genaddrs(authctxt->krb5_ctx,
105*0Sstevel@tonic-gate authctxt->krb5_auth_ctx,fd,
106*0Sstevel@tonic-gate KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR |
107*0Sstevel@tonic-gate KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
108*0Sstevel@tonic-gate #endif
109*0Sstevel@tonic-gate if (problem)
110*0Sstevel@tonic-gate goto err;
111*0Sstevel@tonic-gate
112*0Sstevel@tonic-gate problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL ,
113*0Sstevel@tonic-gate KRB5_NT_SRV_HST, &server);
114*0Sstevel@tonic-gate if (problem)
115*0Sstevel@tonic-gate goto err;
116*0Sstevel@tonic-gate
117*0Sstevel@tonic-gate problem = krb5_rd_req(authctxt->krb5_ctx, &authctxt->krb5_auth_ctx,
118*0Sstevel@tonic-gate auth, server, NULL, NULL, &ticket);
119*0Sstevel@tonic-gate if (problem)
120*0Sstevel@tonic-gate goto err;
121*0Sstevel@tonic-gate
122*0Sstevel@tonic-gate #ifdef HEIMDAL
123*0Sstevel@tonic-gate problem = krb5_copy_principal(authctxt->krb5_ctx, ticket->client,
124*0Sstevel@tonic-gate &authctxt->krb5_user);
125*0Sstevel@tonic-gate #else
126*0Sstevel@tonic-gate problem = krb5_copy_principal(authctxt->krb5_ctx,
127*0Sstevel@tonic-gate ticket->enc_part2->client,
128*0Sstevel@tonic-gate &authctxt->krb5_user);
129*0Sstevel@tonic-gate #endif
130*0Sstevel@tonic-gate if (problem)
131*0Sstevel@tonic-gate goto err;
132*0Sstevel@tonic-gate
133*0Sstevel@tonic-gate /* if client wants mutual auth */
134*0Sstevel@tonic-gate problem = krb5_mk_rep(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
135*0Sstevel@tonic-gate reply);
136*0Sstevel@tonic-gate if (problem)
137*0Sstevel@tonic-gate goto err;
138*0Sstevel@tonic-gate
139*0Sstevel@tonic-gate /* Check .k5login authorization now. */
140*0Sstevel@tonic-gate if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
141*0Sstevel@tonic-gate authctxt->pw->pw_name))
142*0Sstevel@tonic-gate goto err;
143*0Sstevel@tonic-gate
144*0Sstevel@tonic-gate if (client)
145*0Sstevel@tonic-gate krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
146*0Sstevel@tonic-gate client);
147*0Sstevel@tonic-gate
148*0Sstevel@tonic-gate ret = 1;
149*0Sstevel@tonic-gate err:
150*0Sstevel@tonic-gate if (server)
151*0Sstevel@tonic-gate krb5_free_principal(authctxt->krb5_ctx, server);
152*0Sstevel@tonic-gate if (ticket)
153*0Sstevel@tonic-gate krb5_free_ticket(authctxt->krb5_ctx, ticket);
154*0Sstevel@tonic-gate if (!ret && reply->length) {
155*0Sstevel@tonic-gate xfree(reply->data);
156*0Sstevel@tonic-gate memset(reply, 0, sizeof(*reply));
157*0Sstevel@tonic-gate }
158*0Sstevel@tonic-gate
159*0Sstevel@tonic-gate if (problem) {
160*0Sstevel@tonic-gate if (authctxt->krb5_ctx != NULL)
161*0Sstevel@tonic-gate debug("Kerberos v5 authentication failed: %s",
162*0Sstevel@tonic-gate krb5_get_err_text(authctxt->krb5_ctx, problem));
163*0Sstevel@tonic-gate else
164*0Sstevel@tonic-gate debug("Kerberos v5 authentication failed: %d",
165*0Sstevel@tonic-gate problem);
166*0Sstevel@tonic-gate }
167*0Sstevel@tonic-gate
168*0Sstevel@tonic-gate return (ret);
169*0Sstevel@tonic-gate }
170*0Sstevel@tonic-gate
171*0Sstevel@tonic-gate int
auth_krb5_tgt(Authctxt * authctxt,krb5_data * tgt)172*0Sstevel@tonic-gate auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt)
173*0Sstevel@tonic-gate {
174*0Sstevel@tonic-gate krb5_error_code problem;
175*0Sstevel@tonic-gate krb5_ccache ccache = NULL;
176*0Sstevel@tonic-gate char *pname;
177*0Sstevel@tonic-gate krb5_creds **creds;
178*0Sstevel@tonic-gate
179*0Sstevel@tonic-gate if (authctxt->pw == NULL || authctxt->krb5_user == NULL)
180*0Sstevel@tonic-gate return (0);
181*0Sstevel@tonic-gate
182*0Sstevel@tonic-gate temporarily_use_uid(authctxt->pw);
183*0Sstevel@tonic-gate
184*0Sstevel@tonic-gate #ifdef HEIMDAL
185*0Sstevel@tonic-gate problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, &ccache);
186*0Sstevel@tonic-gate #else
187*0Sstevel@tonic-gate {
188*0Sstevel@tonic-gate char ccname[40];
189*0Sstevel@tonic-gate int tmpfd;
190*0Sstevel@tonic-gate
191*0Sstevel@tonic-gate snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
192*0Sstevel@tonic-gate
193*0Sstevel@tonic-gate if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
194*0Sstevel@tonic-gate log("mkstemp(): %.100s", strerror(errno));
195*0Sstevel@tonic-gate problem = errno;
196*0Sstevel@tonic-gate goto fail;
197*0Sstevel@tonic-gate }
198*0Sstevel@tonic-gate if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
199*0Sstevel@tonic-gate log("fchmod(): %.100s", strerror(errno));
200*0Sstevel@tonic-gate close(tmpfd);
201*0Sstevel@tonic-gate problem = errno;
202*0Sstevel@tonic-gate goto fail;
203*0Sstevel@tonic-gate }
204*0Sstevel@tonic-gate close(tmpfd);
205*0Sstevel@tonic-gate problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &ccache);
206*0Sstevel@tonic-gate }
207*0Sstevel@tonic-gate #endif
208*0Sstevel@tonic-gate if (problem)
209*0Sstevel@tonic-gate goto fail;
210*0Sstevel@tonic-gate
211*0Sstevel@tonic-gate problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
212*0Sstevel@tonic-gate authctxt->krb5_user);
213*0Sstevel@tonic-gate if (problem)
214*0Sstevel@tonic-gate goto fail;
215*0Sstevel@tonic-gate
216*0Sstevel@tonic-gate #ifdef HEIMDAL
217*0Sstevel@tonic-gate problem = krb5_rd_cred2(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
218*0Sstevel@tonic-gate ccache, tgt);
219*0Sstevel@tonic-gate if (problem)
220*0Sstevel@tonic-gate goto fail;
221*0Sstevel@tonic-gate #else
222*0Sstevel@tonic-gate problem = krb5_rd_cred(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
223*0Sstevel@tonic-gate tgt, &creds, NULL);
224*0Sstevel@tonic-gate if (problem)
225*0Sstevel@tonic-gate goto fail;
226*0Sstevel@tonic-gate problem = krb5_cc_store_cred(authctxt->krb5_ctx, ccache, *creds);
227*0Sstevel@tonic-gate if (problem)
228*0Sstevel@tonic-gate goto fail;
229*0Sstevel@tonic-gate #endif
230*0Sstevel@tonic-gate
231*0Sstevel@tonic-gate authctxt->krb5_fwd_ccache = ccache;
232*0Sstevel@tonic-gate ccache = NULL;
233*0Sstevel@tonic-gate
234*0Sstevel@tonic-gate authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
235*0Sstevel@tonic-gate
236*0Sstevel@tonic-gate problem = krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
237*0Sstevel@tonic-gate &pname);
238*0Sstevel@tonic-gate if (problem)
239*0Sstevel@tonic-gate goto fail;
240*0Sstevel@tonic-gate
241*0Sstevel@tonic-gate debug("Kerberos v5 TGT accepted (%s)", pname);
242*0Sstevel@tonic-gate
243*0Sstevel@tonic-gate restore_uid();
244*0Sstevel@tonic-gate
245*0Sstevel@tonic-gate return (1);
246*0Sstevel@tonic-gate
247*0Sstevel@tonic-gate fail:
248*0Sstevel@tonic-gate if (problem)
249*0Sstevel@tonic-gate debug("Kerberos v5 TGT passing failed: %s",
250*0Sstevel@tonic-gate krb5_get_err_text(authctxt->krb5_ctx, problem));
251*0Sstevel@tonic-gate if (ccache)
252*0Sstevel@tonic-gate krb5_cc_destroy(authctxt->krb5_ctx, ccache);
253*0Sstevel@tonic-gate
254*0Sstevel@tonic-gate restore_uid();
255*0Sstevel@tonic-gate
256*0Sstevel@tonic-gate return (0);
257*0Sstevel@tonic-gate }
258*0Sstevel@tonic-gate
259*0Sstevel@tonic-gate int
auth_krb5_password(Authctxt * authctxt,const char * password)260*0Sstevel@tonic-gate auth_krb5_password(Authctxt *authctxt, const char *password)
261*0Sstevel@tonic-gate {
262*0Sstevel@tonic-gate #ifndef HEIMDAL
263*0Sstevel@tonic-gate krb5_creds creds;
264*0Sstevel@tonic-gate krb5_principal server;
265*0Sstevel@tonic-gate char ccname[40];
266*0Sstevel@tonic-gate int tmpfd;
267*0Sstevel@tonic-gate #endif
268*0Sstevel@tonic-gate krb5_error_code problem;
269*0Sstevel@tonic-gate
270*0Sstevel@tonic-gate if (authctxt->pw == NULL)
271*0Sstevel@tonic-gate return (0);
272*0Sstevel@tonic-gate
273*0Sstevel@tonic-gate temporarily_use_uid(authctxt->pw);
274*0Sstevel@tonic-gate
275*0Sstevel@tonic-gate problem = krb5_init(authctxt);
276*0Sstevel@tonic-gate if (problem)
277*0Sstevel@tonic-gate goto out;
278*0Sstevel@tonic-gate
279*0Sstevel@tonic-gate problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
280*0Sstevel@tonic-gate &authctxt->krb5_user);
281*0Sstevel@tonic-gate if (problem)
282*0Sstevel@tonic-gate goto out;
283*0Sstevel@tonic-gate
284*0Sstevel@tonic-gate #ifdef HEIMDAL
285*0Sstevel@tonic-gate problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops,
286*0Sstevel@tonic-gate &authctxt->krb5_fwd_ccache);
287*0Sstevel@tonic-gate if (problem)
288*0Sstevel@tonic-gate goto out;
289*0Sstevel@tonic-gate
290*0Sstevel@tonic-gate problem = krb5_cc_initialize(authctxt->krb5_ctx,
291*0Sstevel@tonic-gate authctxt->krb5_fwd_ccache, authctxt->krb5_user);
292*0Sstevel@tonic-gate if (problem)
293*0Sstevel@tonic-gate goto out;
294*0Sstevel@tonic-gate
295*0Sstevel@tonic-gate restore_uid();
296*0Sstevel@tonic-gate problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
297*0Sstevel@tonic-gate authctxt->krb5_fwd_ccache, password, 1, NULL);
298*0Sstevel@tonic-gate temporarily_use_uid(authctxt->pw);
299*0Sstevel@tonic-gate
300*0Sstevel@tonic-gate if (problem)
301*0Sstevel@tonic-gate goto out;
302*0Sstevel@tonic-gate
303*0Sstevel@tonic-gate #else
304*0Sstevel@tonic-gate problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
305*0Sstevel@tonic-gate authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
306*0Sstevel@tonic-gate if (problem)
307*0Sstevel@tonic-gate goto out;
308*0Sstevel@tonic-gate
309*0Sstevel@tonic-gate problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
310*0Sstevel@tonic-gate KRB5_NT_SRV_HST, &server);
311*0Sstevel@tonic-gate if (problem)
312*0Sstevel@tonic-gate goto out;
313*0Sstevel@tonic-gate
314*0Sstevel@tonic-gate restore_uid();
315*0Sstevel@tonic-gate problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
316*0Sstevel@tonic-gate NULL, NULL, NULL);
317*0Sstevel@tonic-gate krb5_free_principal(authctxt->krb5_ctx, server);
318*0Sstevel@tonic-gate temporarily_use_uid(authctxt->pw);
319*0Sstevel@tonic-gate if (problem)
320*0Sstevel@tonic-gate goto out;
321*0Sstevel@tonic-gate
322*0Sstevel@tonic-gate if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
323*0Sstevel@tonic-gate authctxt->pw->pw_name)) {
324*0Sstevel@tonic-gate problem = -1;
325*0Sstevel@tonic-gate goto out;
326*0Sstevel@tonic-gate }
327*0Sstevel@tonic-gate
328*0Sstevel@tonic-gate snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
329*0Sstevel@tonic-gate
330*0Sstevel@tonic-gate if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
331*0Sstevel@tonic-gate log("mkstemp(): %.100s", strerror(errno));
332*0Sstevel@tonic-gate problem = errno;
333*0Sstevel@tonic-gate goto out;
334*0Sstevel@tonic-gate }
335*0Sstevel@tonic-gate
336*0Sstevel@tonic-gate if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
337*0Sstevel@tonic-gate log("fchmod(): %.100s", strerror(errno));
338*0Sstevel@tonic-gate close(tmpfd);
339*0Sstevel@tonic-gate problem = errno;
340*0Sstevel@tonic-gate goto out;
341*0Sstevel@tonic-gate }
342*0Sstevel@tonic-gate close(tmpfd);
343*0Sstevel@tonic-gate
344*0Sstevel@tonic-gate problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
345*0Sstevel@tonic-gate if (problem)
346*0Sstevel@tonic-gate goto out;
347*0Sstevel@tonic-gate
348*0Sstevel@tonic-gate problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
349*0Sstevel@tonic-gate authctxt->krb5_user);
350*0Sstevel@tonic-gate if (problem)
351*0Sstevel@tonic-gate goto out;
352*0Sstevel@tonic-gate
353*0Sstevel@tonic-gate problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
354*0Sstevel@tonic-gate &creds);
355*0Sstevel@tonic-gate if (problem)
356*0Sstevel@tonic-gate goto out;
357*0Sstevel@tonic-gate #endif
358*0Sstevel@tonic-gate
359*0Sstevel@tonic-gate authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
360*0Sstevel@tonic-gate
361*0Sstevel@tonic-gate out:
362*0Sstevel@tonic-gate restore_uid();
363*0Sstevel@tonic-gate
364*0Sstevel@tonic-gate if (problem) {
365*0Sstevel@tonic-gate if (authctxt->krb5_ctx != NULL && problem!=-1)
366*0Sstevel@tonic-gate debug("Kerberos password authentication failed: %s",
367*0Sstevel@tonic-gate krb5_get_err_text(authctxt->krb5_ctx, problem));
368*0Sstevel@tonic-gate else
369*0Sstevel@tonic-gate debug("Kerberos password authentication failed: %d",
370*0Sstevel@tonic-gate problem);
371*0Sstevel@tonic-gate
372*0Sstevel@tonic-gate krb5_cleanup_proc(authctxt);
373*0Sstevel@tonic-gate
374*0Sstevel@tonic-gate if (options.kerberos_or_local_passwd)
375*0Sstevel@tonic-gate return (-1);
376*0Sstevel@tonic-gate else
377*0Sstevel@tonic-gate return (0);
378*0Sstevel@tonic-gate }
379*0Sstevel@tonic-gate return (1);
380*0Sstevel@tonic-gate }
381*0Sstevel@tonic-gate
382*0Sstevel@tonic-gate void
krb5_cleanup_proc(void * context)383*0Sstevel@tonic-gate krb5_cleanup_proc(void *context)
384*0Sstevel@tonic-gate {
385*0Sstevel@tonic-gate Authctxt *authctxt = (Authctxt *)context;
386*0Sstevel@tonic-gate
387*0Sstevel@tonic-gate debug("krb5_cleanup_proc called");
388*0Sstevel@tonic-gate if (authctxt->krb5_fwd_ccache) {
389*0Sstevel@tonic-gate krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
390*0Sstevel@tonic-gate authctxt->krb5_fwd_ccache = NULL;
391*0Sstevel@tonic-gate }
392*0Sstevel@tonic-gate if (authctxt->krb5_user) {
393*0Sstevel@tonic-gate krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
394*0Sstevel@tonic-gate authctxt->krb5_user = NULL;
395*0Sstevel@tonic-gate }
396*0Sstevel@tonic-gate if (authctxt->krb5_auth_ctx) {
397*0Sstevel@tonic-gate krb5_auth_con_free(authctxt->krb5_ctx,
398*0Sstevel@tonic-gate authctxt->krb5_auth_ctx);
399*0Sstevel@tonic-gate authctxt->krb5_auth_ctx = NULL;
400*0Sstevel@tonic-gate }
401*0Sstevel@tonic-gate if (authctxt->krb5_ctx) {
402*0Sstevel@tonic-gate krb5_free_context(authctxt->krb5_ctx);
403*0Sstevel@tonic-gate authctxt->krb5_ctx = NULL;
404*0Sstevel@tonic-gate }
405*0Sstevel@tonic-gate }
406*0Sstevel@tonic-gate
407*0Sstevel@tonic-gate #endif /* KRB5 */
408