Add configure variable for default PKCS#11 module

[ghudson@mit.edu: added documentation of configure variable and doc
substitution; shortened commit message]

ticket: 9058 (new)

diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
index d5d6e06ebb797f01d9b21185fc032b5bcfb2b32c..f22d5db11b4b4f670e54083d8605ed19f5eac5af 100644 (file)
--- a/doc/admin/conf_files/krb5_conf.rst
+++ b/doc/admin/conf_files/krb5_conf.rst
@@ -1011,7 +1011,7 @@ information for PKINIT is as follows:
     All keyword/values are optional.  *modname* specifies the location
     of a library implementing PKCS #11.  If a value is encountered
     with no keyword, it is assumed to be the *modname*.  If no
-    module-name is specified, the default is ``opensc-pkcs11.so``.
+    module-name is specified, the default is |pkcs11_modname|.
     ``slotid=`` and/or ``token=`` may be specified to force the use of
     a particular smard card reader or token if there is more than one
     available.  ``certid=`` and/or ``certlabel=`` may be specified to

diff --git a/doc/build/options2configure.rst b/doc/build/options2configure.rst
index 9e355dc2c5a725ba3417e727792a320ebed0a6ec..e879b18bd2efdfa329e99758a84d20ab01173349 100644 (file)
--- a/doc/build/options2configure.rst
+++ b/doc/build/options2configure.rst
@@ -137,6 +137,9 @@ Environment variables
     This option allows one to specify libraries to be passed to the
     linker (e.g., ``-l<library>``)
 
+**PKCS11_MODNAME=**\ *library*
+    Override the built-in default PKCS11 library name.
+
 **SS_LIB=**\ *libs*...
     If ``-lss`` is not the correct way to link in your installed ss
     library, for example if additional support libraries are needed,

diff --git a/doc/conf.py b/doc/conf.py
index fa0eb80f1f1ad419e94349fcc0dc567f36e8a25f..9d7f81ab09530a708c5855be42d3ebfcbd77bcf0 100644 (file)
--- a/doc/conf.py
+++ b/doc/conf.py
@@ -242,6 +242,7 @@ if 'mansubs' in tags:
     ccache = '``@CCNAME@``'
     keytab = '``@KTNAME@``'
     ckeytab = '``@CKTNAME@``'
+    pkcs11_modname = '``@PKCS11MOD@``'
 elif 'pathsubs' in tags:
     # Read configured paths from a file produced by the build system.
     exec(open("paths.py").read())
@@ -255,6 +256,7 @@ else:
     ccache = ':ref:`DEFCCNAME <paths>`'
     keytab = ':ref:`DEFKTNAME <paths>`'
     ckeytab = ':ref:`DEFCKTNAME <paths>`'
+    pkcs11_modname = ':ref:`PKCS11_MODNAME <paths>`'
 
 rst_epilog = '\n'
 
@@ -275,6 +277,7 @@ else:
     rst_epilog += '.. |ccache| replace:: %s\n' % ccache
     rst_epilog += '.. |keytab| replace:: %s\n' % keytab
     rst_epilog += '.. |ckeytab| replace:: %s\n' % ckeytab
+    rst_epilog += '.. |pkcs11_modname| replace:: %s\n' % pkcs11_modname
     rst_epilog += '''
 .. |krb5conf| replace:: ``/etc/krb5.conf``
 .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal``

diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst
index 74e69f4ad0172e2acd5b7a60ca4d6ad1b32c3db6..aea7af3dbb2dfea53677a796407bc5c7ab77541e 100644 (file)
--- a/doc/mitK5defaults.rst
+++ b/doc/mitK5defaults.rst
@@ -59,18 +59,19 @@ subdirectories of ``/usr/local``.  When MIT krb5 is integrated into an
 operating system, the paths are generally chosen to match the
 operating system's filesystem layout.
 
-==========================  =============  ===========================  ===========================
-Description                 Symbolic name  Custom build path            Typical OS path
-==========================  =============  ===========================  ===========================
-User programs               BINDIR         ``/usr/local/bin``           ``/usr/bin``
-Libraries and plugins       LIBDIR         ``/usr/local/lib``           ``/usr/lib``
-Parent of KDC state dir     LOCALSTATEDIR  ``/usr/local/var``           ``/var``
-Parent of KDC runtime dir   RUNSTATEDIR    ``/usr/local/var/run``       ``/run``
-Administrative programs     SBINDIR        ``/usr/local/sbin``          ``/usr/sbin``
-Alternate krb5.conf dir     SYSCONFDIR     ``/usr/local/etc``           ``/etc``
-Default ccache name         DEFCCNAME      ``FILE:/tmp/krb5cc_%{uid}``  ``FILE:/tmp/krb5cc_%{uid}``
-Default keytab name         DEFKTNAME      ``FILE:/etc/krb5.keytab``    ``FILE:/etc/krb5.keytab``
-==========================  =============  ===========================  ===========================
+==========================  ==============  ===========================  ===========================
+Description                 Symbolic name   Custom build path            Typical OS path
+==========================  ==============  ===========================  ===========================
+User programs               BINDIR          ``/usr/local/bin``           ``/usr/bin``
+Libraries and plugins       LIBDIR          ``/usr/local/lib``           ``/usr/lib``
+Parent of KDC state dir     LOCALSTATEDIR   ``/usr/local/var``           ``/var``
+Parent of KDC runtime dir   RUNSTATEDIR     ``/usr/local/var/run``       ``/run``
+Administrative programs     SBINDIR         ``/usr/local/sbin``          ``/usr/sbin``
+Alternate krb5.conf dir     SYSCONFDIR      ``/usr/local/etc``           ``/etc``
+Default ccache name         DEFCCNAME       ``FILE:/tmp/krb5cc_%{uid}``  ``FILE:/tmp/krb5cc_%{uid}``
+Default keytab name         DEFKTNAME       ``FILE:/etc/krb5.keytab``    ``FILE:/etc/krb5.keytab``
+Default PKCS11 module       PKCS11_MODNAME  ``opensc-pkcs11.so``         ``opensc-pkcs11.so``
+==========================  ==============  ===========================  ===========================
 
 The default client keytab name (DEFCKTNAME) typically defaults to
 ``FILE:/usr/local/var/krb5/user/%{euid}/client.keytab`` for a custom

diff --git a/src/configure.ac b/src/configure.ac
index f03028b5fd283989accbca2cad1a0a4beab9c3d8..cd16b656ea46ac5eb3f8c9e4b4d9c50a78699277 100644 (file)
--- a/src/configure.ac
+++ b/src/configure.ac
@@ -1467,6 +1467,14 @@ AC_DEFINE_UNQUOTED(DEFKTNAME, ["$DEFKTNAME"], [Define to default keytab name])
 AC_DEFINE_UNQUOTED(DEFCKTNAME, ["$DEFCKTNAME"],
                    [Define to default client keytab name])
 
+AC_ARG_VAR(PKCS11_MODNAME, [Default PKCS11 module name])
+if test "${PKCS11_MODNAME+set}" != set; then
+       PKCS11_MODNAME=opensc-pkcs11.so
+fi
+AC_MSG_NOTICE([Default PKCS11 module name: $PKCS11_MODNAME])
+AC_DEFINE_UNQUOTED(PKCS11_MODNAME, ["$PKCS11_MODNAME"],
+                   [Default PKCS11 module name])
+
 AC_CONFIG_FILES([build-tools/krb5-config], [chmod +x build-tools/krb5-config])
 AC_CONFIG_FILES([build-tools/kadm-server.pc
        build-tools/kadm-client.pc

diff --git a/src/doc/Makefile.in b/src/doc/Makefile.in
index 379bc36511a835dc5aaf76dbf770a03de69725eb..a1b0cff0a45308fc0ecb1e716b2098f580b1a99b 100644 (file)
--- a/src/doc/Makefile.in
+++ b/src/doc/Makefile.in
@@ -10,6 +10,7 @@ sysconfdir=@sysconfdir@
 DEFCCNAME=@DEFCCNAME@
 DEFKTNAME=@DEFKTNAME@
 DEFCKTNAME=@DEFCKTNAME@
+PKCS11_MODNAME=@PKCS11_MODNAME@
 
 RST_SOURCES= _static \
        _templates \
@@ -118,6 +119,7 @@ paths.py:
        echo 'ccache = "``$(DEFCCNAME)``"' >> $@
        echo 'keytab = "``$(DEFKTNAME)``"' >> $@
        echo 'ckeytab = "``$(DEFCKTNAME)``"' >> $@
+       echo 'pkcs11_modname = "``$(PKCS11_MODNAME)``"' >> $@
 
 # Dummy rule that man/Makefile can invoke
 version.py: $(docsrc)/version.py

diff --git a/src/man/Makefile.in b/src/man/Makefile.in
index 00b1b2de06a144feb86b2837faaab7c9cdcf749c..85cae0914ebad83daec4dcd0e14d17f76748a102 100644 (file)
--- a/src/man/Makefile.in
+++ b/src/man/Makefile.in
@@ -8,6 +8,7 @@ sysconfdir=@sysconfdir@
 DEFCCNAME=@DEFCCNAME@
 DEFKTNAME=@DEFKTNAME@
 DEFCKTNAME=@DEFCKTNAME@
+PKCS11_MODNAME=@PKCS11_MODNAME@
 
 MANSUBS=k5identity.sub k5login.sub k5srvutil.sub kadm5.acl.sub kadmin.sub \
        kadmind.sub kdb5_ldap_util.sub kdb5_util.sub kdc.conf.sub \
@@ -47,7 +48,8 @@ $(docsrc)/version.py: $(top_srcdir)/patchlevel.h
            -e 's|@SYSCONFDIR@|$(sysconfdir)|g' \
            -e 's|@CCNAME@|$(DEFCCNAME)|g' \
            -e 's|@KTNAME@|$(DEFKTNAME)|g' \
-           -e 's|@CKTNAME@|$(DEFCKTNAME)|g' $? > $@
+           -e 's|@CKTNAME@|$(DEFCKTNAME)|g' \
+           -e 's|@PKCS11MOD@|$(PKCS11_MODNAME)|g' $? > $@
 
 all: $(MANSUBS)
 

diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
index fa44183188153b9c4316352b7069ec81b1b75c69..912ae4989cf27f002230148814e6d235bf60e40d 100644 (file)
--- a/src/man/krb5.conf.man
+++ b/src/man/krb5.conf.man
@@ -1148,7 +1148,7 @@ user\(aqs certificate and private key.
 All keyword/values are optional.  \fImodname\fP specifies the location
 of a library implementing PKCS #11.  If a value is encountered
 with no keyword, it is assumed to be the \fImodname\fP\&.  If no
-module\-name is specified, the default is \fBopensc\-pkcs11.so\fP\&.
+module\-name is specified, the default is \fB@PKCS11MOD@\fP\&.
 \fBslotid=\fP and/or \fBtoken=\fP may be specified to force the use of
 a particular smard card reader or token if there is more than one
 available.  \fBcertid=\fP and/or \fBcertlabel=\fP may be specified to

diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
index 8135535e2cce61582072bb3eb8a0edf0003748e2..66f92d8f03f5eabd467c3ff80d6e90ac6bb8a0a4 100644 (file)
--- a/src/plugins/preauth/pkinit/pkinit.h
+++ b/src/plugins/preauth/pkinit/pkinit.h
@@ -42,7 +42,6 @@
 #ifndef WITHOUT_PKCS11
 #include "pkcs11.h"
 
-#define PKCS11_MODNAME "opensc-pkcs11.so"
 #define PK_SIGLEN_GUESS 1000
 #define PK_NOSLOT 999999
 #endif