sasl with heimdal kerberos

sasl with heimdal kerberos

[Martin von Gagern]

[-- Attachment #1.1.1: Type: text/plain, Size: 1177 bytes --]

Hi!

I'm using Gentoo Linux with autofs-5.0.3, cyrus-sasl-2.1.22 and heimdal
0.7.2. I got compile time error messages when trying to compile autofs
with sasl support. I reported them as https://bugs.gentoo.org/210762

Today I was made aware that the same issues were already mentioned on
this mailing list here, in a thread titled "sasl compilation error"
http://www.mail-archive.com/autofs@linux.kernel.org/msg06165.html

I just had a closer look at this, and found two useful macros defined in
the heimdal headers, called krb5_realm_length and krb5_realm_data. MIT
kerberos doesn't seem to define them, but a simple preprocessor siwtch
is enough to introduce them in a MIT-compatible fashion.

With this I created a patch that causes autofs to compile on my system,
and which I would expect to compile for all sane Heimdal and MIT setups,
and to work correctly as well. Be warned, though, that I haven't got any
real Kerberos set up here, so I didn't actually test that things work.

Greetings,
   Martin von Gagern

P.S.: This is a repost of my original message from 2008-04-28.
       Looks like that got lost as I wasn't subscribed at the time.


[-- Attachment #1.1.2: autofs-heimdal-support.patch --]
[-- Type: text/plain, Size: 1415 bytes --]

--- autofs-5.0.3.orig/modules/cyrus-sasl.c	2008-04-28 16:17:03.000000000 +0200
+++ autofs-5.0.3/modules/cyrus-sasl.c	2008-04-28 16:41:58.000000000 +0200
@@ -66,6 +66,15 @@
 #endif
 #endif
 
+/**
+ * The type of a principal is different for MIT Krb5 and Heimdal.
+ * These macros are provided by Heimdal, and introduced here for MIT.
+ */
+#ifndef krb5_realm_length
+#define krb5_realm_length(r) ((r).length)
+#define krb5_realm_data(r) ((r).data)
+#endif
+
 /*
  *  Once a krb5 credentials cache is setup, we need to set the KRB5CCNAME
  *  environment variable so that the library knows where to find it.
@@ -452,11 +461,11 @@
 
 	/* setup a principal for the ticket granting service */
 	ret = krb5_build_principal_ext(ctxt->krb5ctxt, &tgs_princ,
-		krb5_princ_realm(ctxt->krb5ctxt, krb5_client_princ)->length,
-		krb5_princ_realm(ctxt->krb5ctxt, krb5_client_princ)->data,
+		krb5_realm_length(*krb5_princ_realm(ctxt->krb5ctxt, krb5_client_princ)),
+		krb5_realm_data(*krb5_princ_realm(ctxt->krb5ctxt, krb5_client_princ)),
 		strlen(KRB5_TGS_NAME), KRB5_TGS_NAME,
-		krb5_princ_realm(ctxt->krb5ctxt, krb5_client_princ)->length,
-		krb5_princ_realm(ctxt->krb5ctxt, krb5_client_princ)->data,
+		krb5_realm_length(*krb5_princ_realm(ctxt->krb5ctxt, krb5_client_princ)),
+		krb5_realm_data(*krb5_princ_realm(ctxt->krb5ctxt, krb5_client_princ)),
 		0);
 	if (ret) {
 		error(logopt,


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]

[-- Attachment #2: Type: text/plain, Size: 140 bytes --]

_______________________________________________
autofs mailing list
autofs@linux.kernel.org
http://linux.kernel.org/mailman/listinfo/autofs

Re: sasl with heimdal kerberos

[Ian Kent]

On Thu, 2008-05-15 at 16:02 +0200, Martin von Gagern wrote:
> Hi!
> 
> I'm using Gentoo Linux with autofs-5.0.3, cyrus-sasl-2.1.22 and heimdal
> 0.7.2. I got compile time error messages when trying to compile autofs
> with sasl support. I reported them as https://bugs.gentoo.org/210762
> 
> Today I was made aware that the same issues were already mentioned on
> this mailing list here, in a thread titled "sasl compilation error"
> http://www.mail-archive.com/autofs@linux.kernel.org/msg06165.html
> 
> I just had a closer look at this, and found two useful macros defined in
> the heimdal headers, called krb5_realm_length and krb5_realm_data. MIT
> kerberos doesn't seem to define them, but a simple preprocessor siwtch
> is enough to introduce them in a MIT-compatible fashion.

Interesting.

> 
> With this I created a patch that causes autofs to compile on my system,
> and which I would expect to compile for all sane Heimdal and MIT setups,
> and to work correctly as well. Be warned, though, that I haven't got any
> real Kerberos set up here, so I didn't actually test that things work.

It would be good if someone could check this out.

Ian