Multiple Kerberos fixes to get the new "copy credentials from UID" to work,

and to report the correct auth requirements from the backend.

Also, we now use the "host" service name for all IPP requests, since that will
always exist on client machines.

git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@8659 7a7537e8-13f0-0310-91df-b6672ffda945

diff --git a/backend/ipp.c b/backend/ipp.c
index dfd7f69439d04882758ca74af03a56a4b650603b..9f7266ae5b467eab673c3135f641cfb833e47ef9 100644 (file)
--- a/backend/ipp.c
+++ b/backend/ipp.c
@@ -1056,8 +1056,26 @@ main(int  argc,                          /* I - Number of command-line args */
        httpReconnect(http);
       }
       else
+      {
+       /*
+       * Update auth-info-required as needed...
+       */
+
         _cupsLangPrintf(stderr, _("ERROR: Print file was not accepted (%s)!\n"),
                        cupsLastErrorString());
+
+       if (ipp_status == IPP_NOT_AUTHORIZED)
+       {
+         fprintf(stderr, "DEBUG: WWW-Authenticate=\"%s\"\n",
+                 httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE));
+
+         if (!strncmp(httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE),
+                      "Negotiate", 9))
+           fputs("ATTR: auth-info-required=negotiate\n", stderr);
+         else
+           fputs("ATTR: auth-info-required=username,password\n", stderr);
+       }
+      }
     }
     else if ((job_id_attr = ippFindAttribute(response, "job-id",
                                              IPP_TAG_INTEGER)) == NULL)
@@ -1277,19 +1295,6 @@ main(int  argc,                          /* I - Number of command-line args */
       page_count > start_count)
     fprintf(stderr, "PAGE: total %d\n", page_count - start_count);
 
- /*
-  * Update auth-info-required as needed...
-  */
-
-  if (ipp_status == IPP_NOT_AUTHORIZED)
-  {
-    if (!strncmp(httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE),
-                 "Negotiate", 9))
-      fputs("ATTR: auth-info-required=negotiate\n", stderr);
-    else
-      fputs("ATTR: auth-info-required=username,password\n", stderr);
-  }
-
  /*
   * Free memory...
   */

diff --git a/config-scripts/cups-gssapi.m4 b/config-scripts/cups-gssapi.m4
index daa8db66858873d6aa6361d05f5cdb42e6d52d91..7c61735b809477afab5f580ae35c7433a5b2e29c 100644 (file)
--- a/config-scripts/cups-gssapi.m4
+++ b/config-scripts/cups-gssapi.m4
@@ -109,7 +109,7 @@ AC_ARG_WITH(gssservicename, [  --with-gssservicename   set default gss service n
 
 if test x$default_gssservicename != xno; then
        if test "x$default_gssservicename" = "xdefault"; then
-               CUPS_DEFAULT_GSSSERVICENAME="ipp"
+               CUPS_DEFAULT_GSSSERVICENAME="host"
        else
                CUPS_DEFAULT_GSSSERVICENAME="$default_gssservicename"
        fi

diff --git a/cups/auth.c b/cups/auth.c
index a166f5b61fb4a5a96a6c6a1c608ff5e5f2de2442..ed27e69198a9203056be133661d4e4d43ca65284 100644 (file)
--- a/cups/auth.c
+++ b/cups/auth.c
@@ -487,7 +487,7 @@ cups_gss_printf(OM_uint32  major_status,/* I - Major status code */
     gss_display_status(&err_minor_status, minor_status, GSS_C_MECH_CODE,
                       GSS_C_NULL_OID, &msg_ctx, &minor_status_string);
 
-  DEBUG_printf(("8%s: %s, %s", message, (char *)major_status_string.value,
+  DEBUG_printf(("1%s: %s, %s", message, (char *)major_status_string.value,
                (char *)minor_status_string.value));
 
   gss_release_buffer(&err_minor_status, &major_status_string);
@@ -622,7 +622,12 @@ cups_local_auth(http_t *http)              /* I - HTTP connection to server */
   * information...
   */
 
-  if (http->hostaddr->addr.sa_family == AF_LOCAL &&
+#    ifdef HAVE_GSSAPI
+  if (strncmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9) &&
+#    else
+  if (
+#    endif /* HAVE_GSSAPI */
+      http->hostaddr->addr.sa_family == AF_LOCAL &&
       !getenv("GATEWAY_INTERFACE"))    /* Not via CGI programs... */
   {
    /*

diff --git a/scheduler/auth.c b/scheduler/auth.c
index a7c251ffc8fd62cbac35ac1164ea449ef7e7ece3..e8692d8d828cd5a194afe40b965cd17d64fd244d 100644 (file)
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -1052,7 +1052,7 @@ cupsdAuthorize(cupsd_client_t *con)       /* I - Client connection */
 
     if (!con->gss_creds)
       cupsdLogMessage(CUPSD_LOG_DEBUG,
-                      "cupsdAuthorize: No credentials!");
+                      "cupsdAuthorize: No delegated credentials!");
 
     if (major_status == GSS_S_CONTINUE_NEEDED)
       cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
@@ -1584,7 +1584,11 @@ cupsdCopyKrb5Creds(cupsd_client_t *con)  /* I - Client connection */
 
     peersize = sizeof(peercred);
 
+#      ifdef __APPLE__
+    if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
+#      else
     if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
+#      endif /* __APPLE__ */
     {
       cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
                       strerror(errno));
@@ -1592,6 +1596,10 @@ cupsdCopyKrb5Creds(cupsd_client_t *con)  /* I - Client connection */
       return (NULL);
     }
 
+    cupsdLogMessage(CUPSD_LOG_DEBUG,
+                    "cupsdCopyKrb5Creds: Copying credentials for UID %d...",
+                   CUPSD_UCRED_UID(peercred));
+
     krb5_ipc_client_set_target_uid(CUPSD_UCRED_UID(peercred));
 
     if ((error = krb5_cc_default(KerberosContext, &peerccache)) != 0)

diff --git a/scheduler/client.c b/scheduler/client.c
index e265b86c2d0df54aa4c346c8a048b4b4bf632a5e..52991ad6ce38c1b23a416c9afef5609cde539315 100644 (file)
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -2578,7 +2578,8 @@ cupsdSendHeader(
 
     if (auth_str[0])
     {
-      cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdSendHeader: WWW-Authenticate: %s",
+      cupsdLogMessage(CUPSD_LOG_DEBUG,
+                      "cupsdSendHeader: %d WWW-Authenticate: %s", con->http.fd,
                       auth_str);
 
       if (httpPrintf(HTTP(con), "WWW-Authenticate: %s\r\n", auth_str) < 0)

diff --git a/scheduler/ipp.c b/scheduler/ipp.c
index 4b53c8674d4a62df76ed21b89b3b4553998a92de..7820ae731f3a0d1ca9cd8175719fe2840f75401f 100644 (file)
--- a/scheduler/ipp.c
+++ b/scheduler/ipp.c
@@ -9610,7 +9610,11 @@ save_auth_info(
   cupsFileClose(fp);
 
 #if defined(HAVE_GSSAPI) && defined(HAVE_KRB5_H)
+#  ifdef HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID
+  if (con->http.hostaddr->addr.sa_family == AF_LOCAL || con->gss_creds)
+#  else
   if (con->gss_creds)
+#  endif /* HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID */
     save_krb5_creds(con, job);
   else if (job->ccname)
     cupsdClearString(&(job->ccname));