Attachment 305508 Details for Bug 446670 – Kerberos Strip Realm patch for mod_auth_kerb

[patch] Kerberos Strip Realm patch for mod_auth_kerb

mod_auth_kerb-strip_realm.patch (text/plain), 2.12 KB, created by Tomas Edwardsson on 2008-05-15 16:28:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Edwardsson

Created: 2008-05-15 16:28:39 UTC

Size: 2.12 KB

patch

obsolete

>diff -ur mod_auth_kerb-5.1.orig/README mod_auth_kerb-5.1/README
>--- mod_auth_kerb-5.1.orig/README	2005-08-05 15:16:29.000000000 +0000
>+++ mod_auth_kerb-5.1/README	2008-05-15 16:23:14.000000000 +0000
>@@ -91,6 +91,9 @@
>    authentication scheme in Apache (Apache 2.1 seems to provide better support
>    for multiple various authentication mechanisms).
> 
>+KrbStripRealm on | off		(set to off by default)
>+   If set to 'on' the realm is stripped from the username sent to scripts (REMOTE_USER).
>+
> Note on server principals
> -------------------------
> Now you have to create an service key for the module, which is needed to
>diff -ur mod_auth_kerb-5.1.orig/src/mod_auth_kerb.c mod_auth_kerb-5.1/src/mod_auth_kerb.c
>--- mod_auth_kerb-5.1.orig/src/mod_auth_kerb.c	2008-05-15 15:43:44.000000000 +0000
>+++ mod_auth_kerb-5.1/src/mod_auth_kerb.c	2008-05-15 16:09:16.000000000 +0000
>@@ -153,6 +153,7 @@
> 	const char *krb_service_name;
> 	int krb_authoritative;
> 	int krb_delegate_basic;
>+	int krb_strip_realm;
> #if 0
> 	int krb_ssl_preauthentication;
> #endif
>@@ -207,6 +208,9 @@
> 
>    command("KrbDelegateBasic", ap_set_flag_slot, krb_delegate_basic,
>      FLAG, "Always offer Basic authentication regardless of KrbMethodK5Pass and pass on authentication to lower modules if Basic headers arrive."),
>+   command("KrbStripRealm", ap_set_file_slot, krb_strip_realm,
>+     TAKE1, "Strip REALM from logged in user."),
>+
> 
> #if 0
>    command("KrbEnableSSLPreauthentication", ap_set_flag_slot, krb_ssl_preauthentication,
>@@ -284,6 +288,7 @@
> 	((kerb_auth_config *)rec)->krb_service_name = NULL;
> 	((kerb_auth_config *)rec)->krb_authoritative = 1;
> 	((kerb_auth_config *)rec)->krb_delegate_basic = 0;
>+	((kerb_auth_config *)rec)->krb_strip_realm = 0;
> #if 0
> 	((kerb_auth_config *)rec)->krb_ssl_preauthentication = 0;
> #endif
>@@ -1513,6 +1518,15 @@
>       set_kerb_auth_headers(r, conf, use_krb4, use_krb5, negotiate_ret_value);
> 
>    /* XXX log_debug: if ret==OK, log(user XY authenticated) */
>+   if (conf->krb_strip_realm) {
>+      if (ret == OK) {
>+         char *p;
>+         p = strchr(MK_USER, '@');
>+         if (p)
>+            *p = '\0';
>+      }
>+   }
>+
> 
>    return ret;
> }

Actions: View | Diff

Attachments on bug 446670: 305508