2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Executor/PAMAuth.h.orig pegasus/src/Executor/PAMAuth.h
|
|
|
|
--- pegasus/src/Executor/PAMAuth.h.orig 2011-02-14 13:16:01.619503260 +0100
|
|
|
|
+++ pegasus/src/Executor/PAMAuth.h 2011-02-14 13:31:30.694134170 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -49,6 +49,9 @@
|
2008-11-11 13:39:19 +00:00
|
|
|
#include <Executor/Defines.h>
|
|
|
|
#include <Executor/Socket.h>
|
|
|
|
|
|
|
|
+#include <syslog.h>
|
|
|
|
+typedef bool Boolean;
|
|
|
|
+
|
2011-02-16 10:39:40 +00:00
|
|
|
#ifdef PEGASUS_FLAVOR
|
|
|
|
# define PAM_CONFIG_FILE "wbem" PEGASUS_FLAVOR
|
|
|
|
#else
|
|
|
|
@@ -398,29 +401,60 @@ static int PAMValidateUserCallback(
|
2008-11-11 13:39:19 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
static int PAMAuthenticateInProcess(
|
|
|
|
- const char* username, const char* password)
|
|
|
|
+ const char* username, const char* password, const Boolean isRemoteUser)
|
|
|
|
{
|
|
|
|
PAMData data;
|
|
|
|
struct pam_conv pconv;
|
|
|
|
pam_handle_t* handle;
|
|
|
|
+ int retcode;
|
|
|
|
|
|
|
|
data.password = password;
|
|
|
|
pconv.conv = PAMAuthenticateCallback;
|
|
|
|
pconv.appdata_ptr = &data;
|
|
|
|
|
|
|
|
+ // NOTE: if any pam call should log anything, our syslog socket will be redirected
|
|
|
|
+ // to the AUTH facility, so we need to redirect it back after each pam call.
|
|
|
|
+
|
2011-02-16 10:39:40 +00:00
|
|
|
+ if ((retcode = pam_start(PAM_CONFIG_FILE, username, &pconv, &handle)) != PAM_SUCCESS)
|
2008-11-11 13:39:19 +00:00
|
|
|
+ {
|
|
|
|
+ closelog();
|
|
|
|
+ openlog("cimserver", LOG_PID, LOG_DAEMON);
|
2011-02-16 10:39:40 +00:00
|
|
|
+ syslog(LOG_ERR, "pam_start failed: %s", pam_strerror(handle, retcode));
|
2008-11-11 13:39:19 +00:00
|
|
|
+ syslog(LOG_ERR, "PAM authentication failed for %s user: %s",
|
|
|
|
+ isRemoteUser ? "remote" : "local", username);
|
|
|
|
+ return -1;
|
|
|
|
+ }
|
|
|
|
|
2011-02-16 10:39:40 +00:00
|
|
|
- if (pam_start(PAM_CONFIG_FILE, username, &pconv, &handle) != PAM_SUCCESS)
|
2008-11-11 13:39:19 +00:00
|
|
|
+ if ((retcode = pam_set_item(handle, PAM_TTY, isRemoteUser ? "wbemNetwork" : "wbemLocal")) != PAM_SUCCESS)
|
|
|
|
+ {
|
|
|
|
+ pam_end(handle, 0);
|
|
|
|
+ closelog();
|
|
|
|
+ openlog("cimserver", LOG_PID, LOG_DAEMON);
|
2011-02-16 10:39:40 +00:00
|
|
|
+ syslog(LOG_ERR, "pam_set_item(PAM_TTY=wbem) failed: %s", pam_strerror(handle, retcode));
|
2008-11-11 13:39:19 +00:00
|
|
|
+ syslog(LOG_ERR, "PAM authentication failed for %s user: %s",
|
|
|
|
+ isRemoteUser ? "remote" : "local", username);
|
|
|
|
return -1;
|
|
|
|
+ }
|
|
|
|
|
|
|
|
- if (pam_authenticate(handle, 0) != PAM_SUCCESS)
|
|
|
|
+ if ((retcode = pam_authenticate(handle, 0)) != PAM_SUCCESS)
|
|
|
|
{
|
|
|
|
pam_end(handle, 0);
|
|
|
|
+ closelog();
|
|
|
|
+ openlog("cimserver", LOG_PID, LOG_DAEMON);
|
|
|
|
+ syslog(LOG_ERR, "pam_authenticate failed: %s",pam_strerror(handle, retcode));
|
|
|
|
+ syslog(LOG_ERR, "PAM authentication failed for %s user: %s",
|
|
|
|
+ isRemoteUser ? "remote" : "local", username);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
- if (pam_acct_mgmt(handle, 0) != PAM_SUCCESS)
|
|
|
|
+ if ((retcode = pam_acct_mgmt(handle, 0)) != PAM_SUCCESS)
|
|
|
|
{
|
|
|
|
pam_end(handle, 0);
|
|
|
|
+ closelog();
|
|
|
|
+ openlog("cimserver", LOG_PID, LOG_DAEMON);
|
|
|
|
+ syslog(LOG_ERR, "pam_acct_mgmt failed: %s",pam_strerror(handle, retcode));
|
|
|
|
+ syslog(LOG_ERR, "PAM authentication failed for %s user: %s",
|
|
|
|
+ isRemoteUser ? "remote" : "local", username);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2011-02-16 10:39:40 +00:00
|
|
|
@@ -444,16 +478,34 @@ static int PAMValidateUserInProcess(cons
|
2008-11-11 13:39:19 +00:00
|
|
|
PAMData data;
|
|
|
|
struct pam_conv pconv;
|
|
|
|
pam_handle_t* phandle;
|
|
|
|
+ int retcode;
|
|
|
|
|
|
|
|
pconv.conv = PAMValidateUserCallback;
|
|
|
|
pconv.appdata_ptr = &data;
|
|
|
|
|
2011-02-16 10:39:40 +00:00
|
|
|
- if (pam_start(PAM_CONFIG_FILE, username, &pconv, &phandle) != PAM_SUCCESS)
|
|
|
|
+ if ((retcode = pam_start(PAM_CONFIG_FILE, username, &pconv, &phandle)) != PAM_SUCCESS)
|
2008-11-11 13:39:19 +00:00
|
|
|
+ {
|
|
|
|
+ closelog();
|
|
|
|
+ openlog("cimserver", LOG_PID, LOG_DAEMON);
|
2011-02-16 10:39:40 +00:00
|
|
|
+ syslog(LOG_ERR, "pam_start() failed: %s", pam_strerror(phandle, retcode));
|
2008-11-11 13:39:19 +00:00
|
|
|
return -1;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ if ((retcode = pam_set_item(phandle, PAM_TTY, "wbemLocal")) != PAM_SUCCESS)
|
|
|
|
+ {
|
|
|
|
+ pam_end(phandle, 0);
|
|
|
|
+ closelog();
|
|
|
|
+ openlog("cimserver", LOG_PID, LOG_DAEMON);
|
2011-02-16 10:39:40 +00:00
|
|
|
+ syslog(LOG_ERR, "pam_set_item(PAM_TTY=wbemLocal) failed: %s", pam_strerror(phandle, retcode));
|
2008-11-11 13:39:19 +00:00
|
|
|
+ return -1;
|
|
|
|
+ }
|
|
|
|
|
|
|
|
- if (pam_acct_mgmt(phandle, 0) != PAM_SUCCESS)
|
|
|
|
+ if ((retcode = pam_acct_mgmt(phandle, 0)) != PAM_SUCCESS)
|
|
|
|
{
|
|
|
|
pam_end(phandle, 0);
|
|
|
|
+ closelog();
|
|
|
|
+ openlog("cimserver", LOG_PID, LOG_DAEMON);
|
2011-02-16 10:39:40 +00:00
|
|
|
+ syslog(LOG_ERR, "pam_acct_mgmt() failed: %s", pam_strerror(phandle, retcode));
|
2008-11-11 13:39:19 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2011-02-16 10:39:40 +00:00
|
|
|
@@ -472,12 +524,12 @@ static int PAMValidateUserInProcess(cons
|
2008-11-11 13:39:19 +00:00
|
|
|
**==============================================================================
|
|
|
|
*/
|
|
|
|
|
|
|
|
-static int PAMAuthenticate(const char* username, const char* password)
|
|
|
|
+static int PAMAuthenticate(const char* username, const char* password, const Boolean isRemoteUser)
|
|
|
|
{
|
|
|
|
#ifdef PEGASUS_USE_PAM_STANDALONE_PROC
|
|
|
|
return CimserveraProcessOperation("authenticate", username, password);
|
|
|
|
#else
|
|
|
|
- return PAMAuthenticateInProcess(username, password);
|
|
|
|
+ return PAMAuthenticateInProcess(username, password, isRemoteUser);
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Common/AuthenticationInfo.h.orig pegasus/src/Pegasus/Common/AuthenticationInfo.h
|
|
|
|
--- pegasus/src/Pegasus/Common/AuthenticationInfo.h.orig 2011-02-14 14:50:41.087630325 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Common/AuthenticationInfo.h 2011-02-14 14:52:30.082207742 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -354,6 +354,22 @@ public:
|
2008-11-11 13:39:19 +00:00
|
|
|
return _rep->getRemotePrivilegedUserAccessChecked();
|
|
|
|
}
|
|
|
|
|
2009-06-16 12:09:03 +00:00
|
|
|
+ /** Indicate whether the user is Remote
|
|
|
|
+ */
|
|
|
|
+ Boolean isRemoteUser() const
|
|
|
|
+ {
|
|
|
|
+ CheckRep(_rep);
|
|
|
|
+ return _rep->isRemoteUser();
|
|
|
|
+ }
|
2008-11-11 13:39:19 +00:00
|
|
|
+
|
2009-06-16 12:09:03 +00:00
|
|
|
+ /** Set the Remote User flag
|
|
|
|
+ */
|
|
|
|
+ void setRemoteUser(Boolean isRemoteUser)
|
|
|
|
+ {
|
|
|
|
+ CheckRep(_rep);
|
|
|
|
+ _rep->setRemoteUser(isRemoteUser);
|
|
|
|
+ }
|
2008-11-11 13:39:19 +00:00
|
|
|
+
|
|
|
|
private:
|
|
|
|
|
|
|
|
AuthenticationInfo(AuthenticationInfoRep* rep) : _rep(rep)
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Common/AuthenticationInfoRep.cpp.orig pegasus/src/Pegasus/Common/AuthenticationInfoRep.cpp
|
|
|
|
--- pegasus/src/Pegasus/Common/AuthenticationInfoRep.cpp.orig 2011-02-14 14:52:52.401989289 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Common/AuthenticationInfoRep.cpp 2011-02-14 14:55:40.179890990 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -44,7 +44,8 @@ const String AuthenticationInfoRep::AUTH
|
2008-11-11 13:39:19 +00:00
|
|
|
|
|
|
|
AuthenticationInfoRep::AuthenticationInfoRep(Boolean flag)
|
|
|
|
: _connectionAuthenticated(false),
|
|
|
|
- _wasRemotePrivilegedUserAccessChecked(false)
|
|
|
|
+ _wasRemotePrivilegedUserAccessChecked(false),
|
2011-02-16 10:39:40 +00:00
|
|
|
+ _isRemoteUser(true)
|
2008-11-11 13:39:19 +00:00
|
|
|
{
|
|
|
|
PEG_METHOD_ENTER(
|
|
|
|
TRC_AUTHENTICATION, "AuthenticationInfoRep::AuthenticationInfoRep");
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -60,6 +61,16 @@ AuthenticationInfoRep::~AuthenticationIn
|
2008-11-11 13:39:19 +00:00
|
|
|
PEG_METHOD_EXIT();
|
|
|
|
}
|
|
|
|
|
2009-06-16 12:09:03 +00:00
|
|
|
+void AuthenticationInfoRep::setRemoteUser(Boolean isRemoteUser)
|
2008-11-11 13:39:19 +00:00
|
|
|
+{
|
|
|
|
+ PEG_METHOD_ENTER(TRC_AUTHENTICATION,
|
|
|
|
+ "AuthenticationInfoRep::setRemoteUser");
|
|
|
|
+
|
|
|
|
+ _isRemoteUser = isRemoteUser;
|
|
|
|
+
|
|
|
|
+ PEG_METHOD_EXIT();
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
void AuthenticationInfoRep::setConnectionAuthenticated(
|
|
|
|
Boolean connectionAuthenticated)
|
|
|
|
{
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Common/AuthenticationInfoRep.h.orig pegasus/src/Pegasus/Common/AuthenticationInfoRep.h
|
|
|
|
--- pegasus/src/Pegasus/Common/AuthenticationInfoRep.h.orig 2011-02-14 14:55:54.525678940 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Common/AuthenticationInfoRep.h 2011-02-14 15:02:45.815917313 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -147,6 +147,13 @@ public:
|
2008-11-11 13:39:19 +00:00
|
|
|
void setSecurityAssociation();
|
|
|
|
#endif
|
|
|
|
|
|
|
|
+ Boolean isRemoteUser() const
|
|
|
|
+ {
|
|
|
|
+ return _isRemoteUser;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ void setRemoteUser(Boolean isRemoteUser);
|
|
|
|
+
|
|
|
|
Array<SSLCertificateInfo*> getClientCertificateChain()
|
|
|
|
{
|
|
|
|
return _clientCertificate;
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -190,6 +197,7 @@ private:
|
2008-11-11 13:39:19 +00:00
|
|
|
Boolean _wasRemotePrivilegedUserAccessChecked;
|
|
|
|
|
|
|
|
Array<SSLCertificateInfo*> _clientCertificate;
|
|
|
|
+ Boolean _isRemoteUser;
|
|
|
|
};
|
|
|
|
|
|
|
|
PEGASUS_NAMESPACE_END
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Common/Executor.cpp.orig pegasus/src/Pegasus/Common/Executor.cpp
|
|
|
|
--- pegasus/src/Pegasus/Common/Executor.cpp.orig 2011-02-14 15:03:08.021683671 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Common/Executor.cpp 2011-02-14 15:07:44.839168734 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -125,7 +125,8 @@ public:
|
2008-11-11 13:39:19 +00:00
|
|
|
|
|
|
|
virtual int authenticatePassword(
|
|
|
|
const char* username,
|
|
|
|
- const char* password) = 0;
|
|
|
|
+ const char* password,
|
|
|
|
+ Boolean isRemoteUser) = 0;
|
|
|
|
|
|
|
|
virtual int validateUser(
|
|
|
|
const char* username) = 0;
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -555,10 +556,11 @@ public:
|
2008-11-11 13:39:19 +00:00
|
|
|
|
|
|
|
virtual int authenticatePassword(
|
|
|
|
const char* username,
|
|
|
|
- const char* password)
|
|
|
|
+ const char* password,
|
|
|
|
+ Boolean isRemoteUser)
|
|
|
|
{
|
|
|
|
#if defined(PEGASUS_PAM_AUTHENTICATION)
|
|
|
|
- return PAMAuthenticate(username, password);
|
|
|
|
+ return PAMAuthenticate(username, password, isRemoteUser);
|
|
|
|
#else
|
|
|
|
// ATTN: not handled so don't call in this case.
|
|
|
|
return -1;
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -897,7 +899,8 @@ public:
|
2008-11-11 13:39:19 +00:00
|
|
|
|
|
|
|
virtual int authenticatePassword(
|
|
|
|
const char* username,
|
|
|
|
- const char* password)
|
|
|
|
+ const char* password,
|
|
|
|
+ Boolean isRemoteUser)
|
|
|
|
{
|
|
|
|
AutoMutex autoMutex(_mutex);
|
|
|
|
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -1165,10 +1168,11 @@ int Executor::reapProviderAgent(
|
2008-11-11 13:39:19 +00:00
|
|
|
|
|
|
|
int Executor::authenticatePassword(
|
|
|
|
const char* username,
|
|
|
|
- const char* password)
|
|
|
|
+ const char* password,
|
|
|
|
+ Boolean isRemoteUser)
|
|
|
|
{
|
|
|
|
once(&_executorImplOnce, _initExecutorImpl);
|
|
|
|
- return _executorImpl->authenticatePassword(username, password);
|
|
|
|
+ return _executorImpl->authenticatePassword(username, password, isRemoteUser);
|
|
|
|
}
|
|
|
|
|
|
|
|
int Executor::validateUser(
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Common/Executor.h.orig pegasus/src/Pegasus/Common/Executor.h
|
|
|
|
--- pegasus/src/Pegasus/Common/Executor.h.orig 2011-02-14 15:07:53.267218973 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Common/Executor.h 2011-02-14 15:08:44.392587890 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -183,7 +183,8 @@ public:
|
2008-11-11 13:39:19 +00:00
|
|
|
*/
|
|
|
|
static int authenticatePassword(
|
|
|
|
const char* username,
|
|
|
|
- const char* password);
|
|
|
|
+ const char* password,
|
|
|
|
+ Boolean isRemoteUser);
|
|
|
|
|
|
|
|
/** Check whether the given user is valid for the underlying authentcation
|
|
|
|
mechanism.
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Common/HTTPConnection.cpp.orig pegasus/src/Pegasus/Common/HTTPConnection.cpp
|
|
|
|
--- pegasus/src/Pegasus/Common/HTTPConnection.cpp.orig 2011-02-14 15:09:01.546724864 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Common/HTTPConnection.cpp 2011-02-14 15:10:25.210147273 +0100
|
|
|
|
@@ -2220,6 +2220,30 @@ void HTTPConnection::_handleReadEvent()
|
2008-11-11 13:39:19 +00:00
|
|
|
message->contentLanguages = contentLanguages;
|
|
|
|
message->dest = _outputMessageQueue->getQueueId();
|
|
|
|
|
|
|
|
+ // Allow authenticators to differentiate Remote and Local users:
|
|
|
|
+ struct sockaddr_in sin_peer, sin_svr; // don't need to worry about IPv6 yet ...
|
|
|
|
+ socklen_t slen1=sizeof(struct sockaddr_in), slen2=sizeof(struct sockaddr_in);
|
|
|
|
+ uint32_t sock = _socket.get()->getSocket() ;
|
|
|
|
+ memset(&sin_peer,'\0',slen1);
|
|
|
|
+ memset(&sin_svr, '\0',slen2);
|
|
|
|
+ if ( ( ::getpeername( sock, (struct sockaddr*)&sin_peer, &slen1) == 0 )
|
|
|
|
+ ||( ::getsockname( sock, (struct sockaddr*)&sin_svr, &slen2) == 0 )
|
|
|
|
+ )
|
|
|
|
+ {
|
|
|
|
+ if( sin_peer.sin_family == AF_INET )
|
|
|
|
+ {
|
|
|
|
+ if( ((ntohl( sin_peer.sin_addr.s_addr ) >> 24) & 0xff) == 127 )
|
|
|
|
+ // message was sent FROM localhost interface
|
|
|
|
+ message->isFromRemoteHost = false;
|
|
|
|
+ }
|
|
|
|
+ if( sin_svr.sin_family == AF_INET )
|
|
|
|
+ {
|
|
|
|
+ if( ((ntohl( sin_svr.sin_addr.s_addr ) >> 24) & 0xff) == 127 )
|
|
|
|
+ // message was sent TO localhost interface
|
|
|
|
+ message->isFromRemoteHost = false;
|
|
|
|
+ }
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
//
|
|
|
|
// The _closeConnection method sets the _connectionClosePending flag.
|
|
|
|
// If we are executing on the client side and the
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Common/HTTPMessage.cpp.orig pegasus/src/Pegasus/Common/HTTPMessage.cpp
|
|
|
|
--- pegasus/src/Pegasus/Common/HTTPMessage.cpp.orig 2011-02-14 15:10:33.796216618 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Common/HTTPMessage.cpp 2011-02-14 15:11:13.417152699 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -133,7 +133,8 @@ HTTPMessage::HTTPMessage(
|
2008-11-11 13:39:19 +00:00
|
|
|
queueId(queueId_),
|
|
|
|
authInfo(0),
|
|
|
|
acceptLanguagesDecoded(false),
|
|
|
|
- contentLanguagesDecoded(false)
|
|
|
|
+ contentLanguagesDecoded(false),
|
|
|
|
+ isFromRemoteHost(true)
|
|
|
|
{
|
|
|
|
if (cimException_)
|
|
|
|
cimException = *cimException_;
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Common/HTTPMessage.h.orig pegasus/src/Pegasus/Common/HTTPMessage.h
|
|
|
|
--- pegasus/src/Pegasus/Common/HTTPMessage.h.orig 2011-02-14 15:11:20.936089412 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Common/HTTPMessage.h 2011-02-14 15:11:49.449641100 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -73,6 +73,7 @@ public:
|
2008-11-11 13:39:19 +00:00
|
|
|
ContentLanguageList contentLanguages;
|
|
|
|
Boolean acceptLanguagesDecoded;
|
|
|
|
Boolean contentLanguagesDecoded;
|
|
|
|
+ Boolean isFromRemoteHost;
|
|
|
|
CIMException cimException;
|
|
|
|
|
|
|
|
void parse(
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Common/tests/Executor/TestExecutor.cpp.orig pegasus/src/Pegasus/Common/tests/Executor/TestExecutor.cpp
|
|
|
|
--- pegasus/src/Pegasus/Common/tests/Executor/TestExecutor.cpp.orig 2011-02-14 15:12:06.539770136 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Common/tests/Executor/TestExecutor.cpp 2011-02-14 15:13:14.537240826 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -76,7 +76,7 @@ void testExecutorLoopbackImpl()
|
2008-11-11 13:39:19 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
PEGASUS_TEST_ASSERT(Executor::authenticatePassword(
|
|
|
|
- "xnonexistentuserx", "wrongpassword") == -1);
|
|
|
|
+ "xnonexistentuserx", "wrongpassword", true) == -1);
|
|
|
|
PEGASUS_TEST_ASSERT(Executor::validateUser("xnonexistentuserx") == -1);
|
|
|
|
|
|
|
|
char challengeFilePath[EXECUTOR_BUFFER_SIZE];
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -115,7 +115,7 @@ void testExecutorSocketImpl()
|
2008-11-11 13:39:19 +00:00
|
|
|
PEGASUS_TEST_ASSERT(Executor::reapProviderAgent(123) == 0);
|
|
|
|
|
|
|
|
PEGASUS_TEST_ASSERT(Executor::authenticatePassword(
|
|
|
|
- "xnonexistentuserx", "wrongpassword") == -1);
|
|
|
|
+ "xnonexistentuserx", "wrongpassword", true) == -1);
|
|
|
|
PEGASUS_TEST_ASSERT(Executor::validateUser("xnonexistentuserx") == -1);
|
|
|
|
|
|
|
|
char challengeFilePath[EXECUTOR_BUFFER_SIZE];
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.cpp.orig pegasus/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.cpp
|
|
|
|
--- pegasus/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.cpp.orig 2011-02-14 15:13:40.405462470 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.cpp 2011-02-14 15:14:31.834866750 +0100
|
|
|
|
@@ -153,7 +153,7 @@ Boolean BasicAuthenticationHandler::auth
|
2008-11-11 13:39:19 +00:00
|
|
|
}
|
|
|
|
authInfo->setRemotePrivilegedUserAccessChecked();
|
|
|
|
|
|
|
|
- authenticated = _basicAuthenticator->authenticate(userName, password);
|
|
|
|
+ authenticated = _basicAuthenticator->authenticate(userName, password, authInfo->isRemoteUser());
|
|
|
|
|
|
|
|
// Log audit message.
|
|
|
|
PEG_AUDIT_LOG(logBasicAuthentication(
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Security/Authentication/BasicAuthenticator.h.orig pegasus/src/Pegasus/Security/Authentication/BasicAuthenticator.h
|
|
|
|
--- pegasus/src/Pegasus/Security/Authentication/BasicAuthenticator.h.orig 2011-02-14 15:14:38.744727386 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Security/Authentication/BasicAuthenticator.h 2011-02-14 15:15:14.442171950 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -65,7 +65,8 @@ public:
|
2008-11-11 13:39:19 +00:00
|
|
|
*/
|
|
|
|
virtual Boolean authenticate(
|
2009-06-16 12:09:03 +00:00
|
|
|
const String& userName,
|
2008-11-11 13:39:19 +00:00
|
|
|
- const String& password) = 0;
|
|
|
|
+ const String& password,
|
|
|
|
+ Boolean isRemoteUser) = 0;
|
|
|
|
|
|
|
|
/** Construct and return the HTTP Basic authentication challenge header
|
|
|
|
@return A string containing the authentication challenge header.
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticator.h.orig pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticator.h
|
|
|
|
--- pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticator.h.orig 2011-02-14 15:15:34.154626760 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticator.h 2011-02-14 15:16:12.858446134 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -53,7 +53,8 @@ public:
|
2008-11-11 13:39:19 +00:00
|
|
|
|
|
|
|
Boolean authenticate(
|
2009-06-16 12:09:03 +00:00
|
|
|
const String& userName,
|
2008-11-11 13:39:19 +00:00
|
|
|
- const String& password);
|
|
|
|
+ const String& password,
|
|
|
|
+ Boolean isRemoteUser);
|
|
|
|
|
|
|
|
Boolean validateUser(const String& userName);
|
|
|
|
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorStub.cpp.orig pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorStub.cpp
|
|
|
|
--- pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorStub.cpp.orig 2011-02-14 15:16:22.357629018 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorStub.cpp 2011-02-14 15:16:58.699154516 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -73,7 +73,8 @@ PAMBasicAuthenticator::~PAMBasicAuthenti
|
2008-11-11 13:39:19 +00:00
|
|
|
|
|
|
|
Boolean PAMBasicAuthenticator::authenticate(
|
2009-06-16 12:09:03 +00:00
|
|
|
const String& userName,
|
2008-11-11 13:39:19 +00:00
|
|
|
- const String& password)
|
|
|
|
+ const String& password,
|
|
|
|
+ Boolean isRemoteUser)
|
|
|
|
{
|
|
|
|
PEG_METHOD_ENTER(TRC_AUTHENTICATION,
|
|
|
|
"PAMBasicAuthenticator::authenticate()");
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorUnix.cpp.orig pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorUnix.cpp
|
|
|
|
--- pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorUnix.cpp.orig 2011-02-14 15:17:06.878172796 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorUnix.cpp 2011-02-14 15:18:17.547972458 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -64,13 +64,14 @@ PAMBasicAuthenticator::~PAMBasicAuthenti
|
2008-11-11 13:39:19 +00:00
|
|
|
|
|
|
|
Boolean PAMBasicAuthenticator::authenticate(
|
2009-06-16 12:09:03 +00:00
|
|
|
const String& userName,
|
2008-11-11 13:39:19 +00:00
|
|
|
- const String& password)
|
|
|
|
+ const String& password,
|
|
|
|
+ Boolean isRemoteUser)
|
|
|
|
{
|
|
|
|
PEG_METHOD_ENTER(TRC_AUTHENTICATION,
|
|
|
|
"PAMBasicAuthenticator::authenticate()");
|
|
|
|
|
|
|
|
if (Executor::authenticatePassword(
|
|
|
|
- userName.getCString(), password.getCString()) != 0)
|
|
|
|
+ userName.getCString(), password.getCString(), isRemoteUser) != 0)
|
|
|
|
{
|
|
|
|
return false;
|
|
|
|
}
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Security/Authentication/SecureBasicAuthenticator.cpp.orig pegasus/src/Pegasus/Security/Authentication/SecureBasicAuthenticator.cpp
|
|
|
|
--- pegasus/src/Pegasus/Security/Authentication/SecureBasicAuthenticator.cpp.orig 2011-02-14 15:18:30.200547751 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Security/Authentication/SecureBasicAuthenticator.cpp 2011-02-14 15:19:03.483692138 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -236,7 +236,7 @@ Boolean SecureBasicAuthenticator::authen
|
2008-11-11 13:39:19 +00:00
|
|
|
if (Executor::detectExecutor() == 0)
|
|
|
|
{
|
|
|
|
if (Executor::authenticatePassword(
|
|
|
|
- userName.getCString(), password.getCString()) == 0)
|
|
|
|
+ userName.getCString(), password.getCString(), true) == 0)
|
|
|
|
{
|
|
|
|
authenticated = true;
|
|
|
|
}
|
2011-02-16 10:39:40 +00:00
|
|
|
diff -up pegasus/src/Pegasus/Server/HTTPAuthenticatorDelegator.cpp.orig pegasus/src/Pegasus/Server/HTTPAuthenticatorDelegator.cpp
|
|
|
|
--- pegasus/src/Pegasus/Server/HTTPAuthenticatorDelegator.cpp.orig 2011-02-14 15:19:27.483680767 +0100
|
|
|
|
+++ pegasus/src/Pegasus/Server/HTTPAuthenticatorDelegator.cpp 2011-02-14 15:21:04.092710797 +0100
|
2009-06-16 12:09:03 +00:00
|
|
|
@@ -421,6 +421,9 @@ void HTTPAuthenticatorDelegator::handleH
|
|
|
|
Tracer::LEVEL3,
|
|
|
|
"HTTPAuthenticatorDelegator - Authentication processing start");
|
2008-11-11 13:39:19 +00:00
|
|
|
|
|
|
|
+ // Let Authenticators know whether this user is Local or Remote:
|
|
|
|
+ httpMessage->authInfo->setRemoteUser( httpMessage->isFromRemoteHost );
|
|
|
|
+
|
|
|
|
//
|
|
|
|
// Handle authentication:
|
|
|
|
//
|