static int lc_verify_keytab_ex(const char *principal,
const char *keytab_name,
krb5_context context,
krb5_keytab keytab)
{
bool found;
char *kt_principal;
krb5_error_code krberr;
krb5_kt_cursor cursor;
krb5_keytab_entry entry;
krberr = krb5_kt_start_seq_get(context, keytab, &cursor);
if (krberr) {
DEBUG(SSSDBG_FATAL_FAILURE,
"Cannot read keytab [%s].\n", KEYTAB_CLEAN_NAME);
sss_log(SSS_LOG_ERR, "Error reading keytab file [%s]: [%d][%s]. "
"Unable to create GSSAPI-encrypted LDAP "
"connection.",
KEYTAB_CLEAN_NAME, krberr,
sss_krb5_get_error_message(context, krberr));
return EIO;
}
found = false;
while ((krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0) {
krberr = krb5_unparse_name(context, entry.principal, &kt_principal);
if (krberr) {
DEBUG(SSSDBG_FATAL_FAILURE,
"Could not parse keytab entry\n");
sss_log(SSS_LOG_ERR, "Could not parse keytab entry\n");
return EIO;
}
if (strcmp(principal, kt_principal) == 0) {
found = true;
}
free(kt_principal);
krberr = sss_krb5_free_keytab_entry_contents(context, &entry);
if (krberr) {
/* This should never happen. The API docs for this function
* specify only success for this function
*/
DEBUG(SSSDBG_CRIT_FAILURE,"Could not free keytab entry contents\n");
/* This is non-fatal, so we'll continue here */
}
if (found) {
break;
}
}
krberr = krb5_kt_end_seq_get(context, keytab, &cursor);
if (krberr) {
DEBUG(SSSDBG_FATAL_FAILURE, "Could not close keytab.\n");
sss_log(SSS_LOG_ERR, "Could not close keytab file [%s].",
KEYTAB_CLEAN_NAME);
return EIO;
}
if (!found) {
DEBUG(SSSDBG_FATAL_FAILURE,
"Principal [%s] not found in keytab [%s]\n",
principal,
KEYTAB_CLEAN_NAME);
sss_log(SSS_LOG_ERR, "Error processing keytab file [%s]: "
"Principal [%s] was not found. "
"Unable to create GSSAPI-encrypted LDAP connection.",
KEYTAB_CLEAN_NAME, principal);
return EFAULT;
}
return EOK;
}
krb5_error_code find_principal_in_keytab(krb5_context ctx,
krb5_keytab keytab,
const char *pattern_primary,
const char *pattern_realm,
krb5_principal *princ)
{
krb5_error_code kerr;
krb5_error_code kt_err;
krb5_error_code kerr_d;
krb5_kt_cursor cursor;
krb5_keytab_entry entry;
bool principal_found = false;
memset(&cursor, 0, sizeof(cursor));
kerr = krb5_kt_start_seq_get(ctx, keytab, &cursor);
if (kerr != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "krb5_kt_start_seq_get failed.\n");
return kerr;
}
DEBUG(SSSDBG_TRACE_ALL,
"Trying to find principal %s@%s in keytab.\n", pattern_primary, pattern_realm);
memset(&entry, 0, sizeof(entry));
while ((kt_err = krb5_kt_next_entry(ctx, keytab, &entry, &cursor)) == 0) {
principal_found = match_principal(ctx, entry.principal, pattern_primary, pattern_realm);
if (principal_found) {
break;
}
kerr = sss_krb5_free_keytab_entry_contents(ctx, &entry);
if (kerr != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "Failed to free keytab entry.\n");
}
memset(&entry, 0, sizeof(entry));
}
/* Close the keytab here. Even though we're using cursors, the file
* handle is stored in the krb5_keytab structure, and it gets
* overwritten by other keytab calls, creating a leak. */
kerr = krb5_kt_end_seq_get(ctx, keytab, &cursor);
if (kerr != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "krb5_kt_end_seq_get failed.\n");
goto done;
}
if (!principal_found) {
kerr = KRB5_KT_NOTFOUND;
DEBUG(SSSDBG_TRACE_FUNC,
"No principal matching %s@%s found in keytab.\n",
pattern_primary, pattern_realm);
goto done;
}
/* check if we got any errors from krb5_kt_next_entry */
if (kt_err != 0 && kt_err != KRB5_KT_END) {
DEBUG(SSSDBG_CRIT_FAILURE, "Error while reading keytab.\n");
goto done;
}
kerr = krb5_copy_principal(ctx, entry.principal, princ);
if (kerr != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "krb5_copy_principal failed.\n");
goto done;
}
kerr = 0;
done:
kerr_d = sss_krb5_free_keytab_entry_contents(ctx, &entry);
if (kerr_d != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "Failed to free keytab entry.\n");
}
return kerr;
}
