- (dtucker) [auth-krb5.c platform.{c,h} openbsd-compat/port-aix.{c,h}]

   Bug #1583: Use system's kerberos principal name on AIX if it's available.
   Based on a patch from and tested by Miguel Sanders.

2 files changed, 30 insertions, 1 deletions

diff --git a/openbsd-compat/port-aix.c b/openbsd-compat/port-aix.c
index d9c0876f3..0bdefbf6d 100644
--- a/openbsd-compat/port-aix.c
+++ b/openbsd-compat/port-aix.c
@@ -374,6 +374,31 @@ aix_restoreauthdb(void)
 
 # endif /* WITH_AIXAUTHENTICATE */
 
+# ifdef USE_AIX_KRB_NAME
+/*
+ * aix_krb5_get_principal_name: returns the user's kerberos client principal name if
+ * configured, otherwise NULL.  Caller must free returned string.
+ */
+char *
+aix_krb5_get_principal_name(char *pw_name)
+{
+        char *authname = NULL, *authdomain = NULL, *principal = NULL;
+
+        setuserdb(S_READ);
+        if (getuserattr(pw_name, S_AUTHDOMAIN, &authdomain, SEC_CHAR) != 0)
+                debug("AIX getuserattr S_AUTHDOMAIN: %s", strerror(errno));
+        if (getuserattr(pw_name, S_AUTHNAME, &authname, SEC_CHAR) != 0)
+                debug("AIX getuserattr S_AUTHNAME: %s", strerror(errno));
+
+        if (authdomain != NULL)
+                xasprintf(&principal, "%s@%s", authname ? authname : pw_name, authdomain);
+        else if (authname != NULL)
+                principal = xstrdup(authname);
+        enduserdb();
+        return principal;
+}
+# endif /* USE_AIX_KRB_NAME */
+
 # if defined(AIX_GETNAMEINFO_HACK) && !defined(BROKEN_ADDRINFO)
 # undef getnameinfo
 /*
diff --git a/openbsd-compat/port-aix.h b/openbsd-compat/port-aix.h
index 3ac76ae15..53e4e88a0 100644
--- a/openbsd-compat/port-aix.h
+++ b/openbsd-compat/port-aix.h
@@ -1,4 +1,4 @@
-/* $Id: port-aix.h,v 1.31 2009/08/20 06:20:50 dtucker Exp $ */
+/* $Id: port-aix.h,v 1.32 2009/12/20 23:49:22 dtucker Exp $ */
 
 /*
  *
@@ -95,6 +95,10 @@ int sys_auth_record_login(const char *, const char *, const char *, Buffer *);
 # define CUSTOM_SYS_AUTH_GET_LASTLOGIN_MSG
 char *sys_auth_get_lastlogin_msg(const char *, uid_t);
 # define CUSTOM_FAILED_LOGIN 1
+# if defined(S_AUTHDOMAIN)  && defined (S_AUTHNAME)
+# define USE_AIX_KRB_NAME
+char *aix_krb5_get_principal_name(char *);
+# endif
 #endif
 
 void aix_setauthdb(const char *);