1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
/* Copyright (c) 2020, 2025, Oracle and/or its affiliates.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License, version 2.0,
as published by the Free Software Foundation.
This program is designed to work with certain software (including
but not limited to OpenSSL) that is licensed under separate terms,
as designated in a particular file or component or in included license
documentation. The authors of MySQL hereby grant you an additional
permission to link the program and your derivative works with the
separately licensed software that they have either included with
the program or referenced in the documentation.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License, version 2.0, for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
#ifndef AUTH_LDAP_KERBEROS_H_
#define AUTH_LDAP_KERBEROS_H_
#include <krb5/krb5.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "log_client.h"
/**
Kerberos class is built around kerberos library.
This class should/can be used for different part of code as standalone
class.
This class performs following operations:
1. Authentication with kerberos server and store the credentials in cache.
2. Get the default configured kerberos user in the OS, from default principal.
Credentials:
A ticket plus the secret session key necessary to use that ticket successfully
in an authentication exchange.
Principal:
A named client or server entity that participates in a network communication,
with one name that is considered canonical
Credential cache:
A credential cache (or ccache) holds Kerberos credentials while they
remain valid and, generally, while the users session lasts, so that
authenticating to a service multiple times (e.g., connecting to a web or mail
server more than once) doesnt require contacting the KDC every time.
*/
namespace auth_ldap_client_kerberos_context {
class Kerberos {
public:
Kerberos(const char *user, const char *password);
~Kerberos();
/**
1. This function authenticates with kerberos server.
2. If TGT destroy is false, this function stores the TGT in Kerberos cache
for subsequent usage.
3. If user credentials already exist in the cache, it doesn't attempt to get
it again.
@retval true Successfully able to obtain and store credentials.
@retval false Failed to obtain and store credentials.
*/
bool obtain_store_credentials();
/**
This function retrieves default principle from kerberos configuration and
parses the user name from it. If user name has not been provided in the
MySQL client, This method can be used to get the user name and use for
authentication.
@retval true Successfully able to get user name.
@retval false Failed to get user name.
*/
bool get_user_name(std::string *name);
void destroy_credentials();
/**
This function gets LDAP host from krb5.conf file.
*/
void get_ldap_host(std::string &host);
private:
/**
This function creates kerberos context, initializes credentials cache and
user principal.
@retval true All the required kerberos objects like context,
credentials cache and user principal are initialized correctly.
@retval false Required kerberos objects failed to initialized.
*/
bool setup();
/**
This function frees kerberos context, credentials, credentials cache and
user principal.
*/
void cleanup();
bool m_initialized;
std::string m_user;
std::string m_password;
std::string m_ldap_server_host;
bool m_destroy_tgt;
krb5_context m_context;
krb5_ccache m_krb_credentials_cache;
krb5_creds m_credentials;
bool m_credentials_created;
void log(int error_code);
krb5_error_code store_credentials();
krb5_error_code obtain_credentials();
bool credential_valid();
bool get_kerberos_config();
};
} // namespace auth_ldap_client_kerberos_context
#endif // AUTH_LDAP_KERBEROS_H_
|
