[mod_authn_gssapi] option to store delegated creds (fixes #2967)

default enabled for backwards compatibility; disable in future

(thx lameventanas)

x-ref:
  "mod_authn_gssapi requires delegation?"
  https://redmine.lighttpd.net/issues/2967

1 files changed, 11 insertions, 1 deletions

diff --git a/src/mod_authn_gssapi.c b/src/mod_authn_gssapi.c
index 7200408c..b19c6287 100644
--- a/src/mod_authn_gssapi.c
+++ b/src/mod_authn_gssapi.c
@@ -41,6 +41,7 @@
 typedef struct {
     buffer *auth_gssapi_keytab;
     buffer *auth_gssapi_principal;
+    unsigned short int auth_gssapi_store_creds;
 } plugin_config;
 
 typedef struct {
@@ -101,6 +102,7 @@ SETDEFAULTS_FUNC(mod_authn_gssapi_set_defaults) {
     config_values_t cv[] = {
         { "auth.backend.gssapi.keytab",     NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
         { "auth.backend.gssapi.principal",  NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION },
+        { "auth.backend.gssapi.store-creds",NULL, T_CONFIG_BOOLEAN,T_CONFIG_SCOPE_CONNECTION },
         { NULL,                             NULL, T_CONFIG_UNSET,  T_CONFIG_SCOPE_UNSET }
     };
 
@@ -117,6 +119,9 @@ SETDEFAULTS_FUNC(mod_authn_gssapi_set_defaults) {
 
         cv[0].destination = s->auth_gssapi_keytab;
         cv[1].destination = s->auth_gssapi_principal;
+        cv[2].destination = &s->auth_gssapi_store_creds;
+        /* default enabled for backwards compatibility; disable in future */
+        s->auth_gssapi_store_creds = 1;
 
         p->config_storage[i] = s;
 
@@ -137,6 +142,7 @@ static int mod_authn_gssapi_patch_connection(server *srv, connection *con, plugi
 
     PATCH(auth_gssapi_keytab);
     PATCH(auth_gssapi_principal);
+    PATCH(auth_gssapi_store_creds);
 
     /* skip the first, the global context */
     for (i = 1; i < srv->config_context->used; i++) {
@@ -154,6 +160,8 @@ static int mod_authn_gssapi_patch_connection(server *srv, connection *con, plugi
                 PATCH(auth_gssapi_keytab);
             } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.gssapi.principal"))) {
                 PATCH(auth_gssapi_principal);
+            } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.gssapi.store-creds"))) {
+                PATCH(auth_gssapi_store_creds);
             }
         }
     }
@@ -433,7 +441,7 @@ static handler_t mod_authn_gssapi_check_spnego(server *srv, connection *con, plu
         goto end;
     }
 
-    {
+    if (p->conf.auth_gssapi_store_creds) {
         if (!(acc_flags & GSS_C_DELEG_FLAG)) {
             log_error_write(srv, __FILE__, __LINE__, "ss", "Unable to delegate credentials for user:", token_out.value);
             goto end;
@@ -731,6 +739,8 @@ static handler_t mod_authn_gssapi_basic(server *srv, connection *con, void *p_d,
         goto end;
     }
 
+    if (!p->conf.auth_gssapi_store_creds) goto end;
+
     ret = krb5_cc_resolve(kcontext, "MEMORY:", &ret_ccache);
     if (ret) {
         mod_authn_gssapi_log_krb5_error(srv, __FILE__, __LINE__, "krb5_cc_resolve", NULL, kcontext, ret);