1*5e01956fSGlenn Barry /*
2*5e01956fSGlenn Barry  * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
3*5e01956fSGlenn Barry  */
47c478bd9Sstevel@tonic-gate /*
57c478bd9Sstevel@tonic-gate  * Copyright 1997 by Massachusetts Institute of Technology
67c478bd9Sstevel@tonic-gate  * All Rights Reserved.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * Export of this software from the United States of America may
97c478bd9Sstevel@tonic-gate  *   require a specific license from the United States Government.
107c478bd9Sstevel@tonic-gate  *   It is the responsibility of any person or organization contemplating
117c478bd9Sstevel@tonic-gate  *   export to obtain such a license before exporting.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
147c478bd9Sstevel@tonic-gate  * distribute this software and its documentation for any purpose and
157c478bd9Sstevel@tonic-gate  * without fee is hereby granted, provided that the above copyright
167c478bd9Sstevel@tonic-gate  * notice appear in all copies and that both that copyright notice and
177c478bd9Sstevel@tonic-gate  * this permission notice appear in supporting documentation, and that
187c478bd9Sstevel@tonic-gate  * the name of M.I.T. not be used in advertising or publicity pertaining
197c478bd9Sstevel@tonic-gate  * to distribution of the software without specific, written prior
207c478bd9Sstevel@tonic-gate  * permission.  Furthermore if you modify this software you must label
217c478bd9Sstevel@tonic-gate  * your software as modified software and not distribute it in such a
227c478bd9Sstevel@tonic-gate  * fashion that it might be confused with the original M.I.T. software.
237c478bd9Sstevel@tonic-gate  * M.I.T. makes no representations about the suitability of
247c478bd9Sstevel@tonic-gate  * this software for any purpose.  It is provided "as is" without express
257c478bd9Sstevel@tonic-gate  * or implied warranty.
267c478bd9Sstevel@tonic-gate  *
277c478bd9Sstevel@tonic-gate  */
287c478bd9Sstevel@tonic-gate 
29ab9b2e15Sgtb #include "gssapiP_krb5.h"
307c478bd9Sstevel@tonic-gate 
317c478bd9Sstevel@tonic-gate /*
327c478bd9Sstevel@tonic-gate  * Check to see whether or not a GSSAPI krb5 credential is valid.  If
337c478bd9Sstevel@tonic-gate  * it is not, return an error.
347c478bd9Sstevel@tonic-gate  */
357c478bd9Sstevel@tonic-gate 
367c478bd9Sstevel@tonic-gate OM_uint32
krb5_gss_validate_cred_1(OM_uint32 * minor_status,gss_cred_id_t cred_handle,krb5_context context)37ab9b2e15Sgtb krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
38ab9b2e15Sgtb 			 krb5_context context)
397c478bd9Sstevel@tonic-gate {
407c478bd9Sstevel@tonic-gate     krb5_gss_cred_id_t cred;
417c478bd9Sstevel@tonic-gate     krb5_error_code code;
427c478bd9Sstevel@tonic-gate     krb5_principal princ;
437c478bd9Sstevel@tonic-gate 
447c478bd9Sstevel@tonic-gate     if (!kg_validate_cred_id(cred_handle)) {
457c478bd9Sstevel@tonic-gate 	*minor_status = (OM_uint32) G_VALIDATE_FAILED;
46ab9b2e15Sgtb 	return(GSS_S_CALL_BAD_STRUCTURE|GSS_S_DEFECTIVE_CREDENTIAL);
477c478bd9Sstevel@tonic-gate     }
487c478bd9Sstevel@tonic-gate 
497c478bd9Sstevel@tonic-gate     cred = (krb5_gss_cred_id_t) cred_handle;
50ab9b2e15Sgtb 
51ab9b2e15Sgtb     code = k5_mutex_lock(&cred->lock);
52ab9b2e15Sgtb     if (code) {
53ab9b2e15Sgtb 	*minor_status = code;
54ab9b2e15Sgtb 	return GSS_S_FAILURE;
55ab9b2e15Sgtb     }
56ab9b2e15Sgtb 
577c478bd9Sstevel@tonic-gate     if (cred->ccache) {
58ab9b2e15Sgtb 	if ((code = krb5_cc_get_principal(context, cred->ccache, &princ))) {
59ab9b2e15Sgtb 	    k5_mutex_unlock(&cred->lock);
607c478bd9Sstevel@tonic-gate 	    *minor_status = code;
61ab9b2e15Sgtb 	    return(GSS_S_DEFECTIVE_CREDENTIAL);
627c478bd9Sstevel@tonic-gate 	}
637c478bd9Sstevel@tonic-gate 	if (!krb5_principal_compare(context, princ, cred->princ)) {
64ab9b2e15Sgtb 	    k5_mutex_unlock(&cred->lock);
657c478bd9Sstevel@tonic-gate 	    *minor_status = KG_CCACHE_NOMATCH;
66ab9b2e15Sgtb 	    return(GSS_S_DEFECTIVE_CREDENTIAL);
677c478bd9Sstevel@tonic-gate 	}
687c478bd9Sstevel@tonic-gate 	(void)krb5_free_principal(context, princ);
697c478bd9Sstevel@tonic-gate     }
707c478bd9Sstevel@tonic-gate     *minor_status = 0;
71ab9b2e15Sgtb     return GSS_S_COMPLETE;
727c478bd9Sstevel@tonic-gate }
73ab9b2e15Sgtb 
74ab9b2e15Sgtb OM_uint32
krb5_gss_validate_cred(minor_status,cred_handle)75ab9b2e15Sgtb krb5_gss_validate_cred(minor_status, cred_handle)
76ab9b2e15Sgtb      OM_uint32 *minor_status;
77ab9b2e15Sgtb      gss_cred_id_t cred_handle;
78ab9b2e15Sgtb {
79ab9b2e15Sgtb     krb5_context context;
80ab9b2e15Sgtb     krb5_error_code code;
81ab9b2e15Sgtb     OM_uint32 maj;
82ab9b2e15Sgtb 
83ab9b2e15Sgtb     code = krb5_gss_init_context(&context);
84ab9b2e15Sgtb     if (code) {
85ab9b2e15Sgtb 	*minor_status = code;
86ab9b2e15Sgtb 	return GSS_S_FAILURE;
87ab9b2e15Sgtb     }
88ab9b2e15Sgtb 
89ab9b2e15Sgtb     maj = krb5_gss_validate_cred_1(minor_status, cred_handle, context);
90ab9b2e15Sgtb     if (maj == 0) {
91ab9b2e15Sgtb 	krb5_gss_cred_id_t cred = (krb5_gss_cred_id_t) cred_handle;
92ab9b2e15Sgtb 	k5_mutex_assert_locked(&cred->lock);
93ab9b2e15Sgtb 	k5_mutex_unlock(&cred->lock);
94*5e01956fSGlenn Barry     } else /* Solaris Kerberos - added this else */
95*5e01956fSGlenn Barry         save_error_info(*minor_status, context);
96ab9b2e15Sgtb     krb5_free_context(context);
97ab9b2e15Sgtb     return maj;
98ab9b2e15Sgtb }
99ab9b2e15Sgtb 
100ab9b2e15Sgtb 
101ab9b2e15Sgtb 
102ab9b2e15Sgtb 
103