Re: preauth_always option?

[Michael B Allen <miallen@ioplex.com>]

On Wed, 28 May 2008 16:15:45 -0400
Michael B Allen <miallen@ioplex.com> wrote:

> If not I'll make one and post it but I was hoping someone else had done
> this already.

I'm not in my environment right so I can't supply a real patch yet but
here's the pseudocode that will be the basis for it:

  get_in_cred(padata)
  {
      error = 0;
      state = padata != NULL ? 1 : 2;
  
      do {    
          done = 1;
  
          switch (state) {
              case 1: /* PA supplied as param */
                  break;  
              case 2: /* Try optimistic PA */
                  padata = make_optimistic_padata();
                  if (pdata) {
                      break;  
                  }       
                  /* Cannot determine suitable optimistic
                   * padata, fall through to no PA
                   */      
                  state = 3;
              case 3: /* No PA */
                  break;  
              case 4: /* Extract from ETYPE_INFO */
                  padata = extract_etype_info_padata();
                  break;
          }
  
          sendto_kdc(req, rep);
  
          if (error) {
              if (state == 2) { 
                  if (error == PREAUTH_FAILED) {
                      /* Optimistic PA failed, try no PA to get ETYPE_INFO */
                      state = 3;
                      done = 0;
                  }       
              } else if (state == 3) {
                  if (error == PREAUTH_REQUIRED) {
                      if (is_etype_info_present) {
                          /* Try PA from ETYPE_INFO */
                          state = 4;
                          done = 0;
                      }       
                  }       
              }       
          }       
      } while (!done);
  
      return error;
  }

One could argue that the state machine isn't necessary but, for the long
term, I think it is warranted here.

Mike

-- 
Michael B Allen
PHP Active Directory SPNEGO SSO
http://www.ioplex.com/