/* Define if you want GSI/Globus authentication support */

#undef GSI

# Check whether the user wants GSI (Globus) support

GSI_MSG="no"

AC_ARG_WITH(gsi,

	[  --with-gsi              Enable Globus GSI authentication support],

	[  

		if test "x$withval" != "xno" ; then

			AC_MSG_CHECKING(for Globus GSI)

			AC_DEFINE(GSI)

			AC_DEFINE(GSSAPI)

			GSI_MSG="yes"

			# $GLOBUS_LOCATION is root of GSI installation

			if test -z "$GLOBUS_LOCATION" ; then

				AC_MSG_ERROR(GLOBUS_LOCATION environment variable must be set .)

			fi

			if test ! -d "$GLOBUS_LOCATION" ; then

				AC_MSG_ERROR(GLOBUS_LOCATION environment variable must be set to Globus install directory path.)

			fi

			# Get Globus library "flavor"

			AC_ARG_WITH(globus-flavor,

				[  --with-globus-flavor=TYPE  Specify Globus flavor type (ex: gcc32dbg)],

				[

					globus_flavor="$withval"

					if test "x$globus_flavor" = "xyes" ; then

						AC_MSG_ERROR(--with-globus-flavor=TYPE must specify a flavor type)

					fi

				],

				[

					AC_MSG_ERROR(--with-globus-flavor=TYPE must be specified)

				]

			)

			# Add directory for GSI headers

			GLOBUS_INCLUDE="${GLOBUS_LOCATION}/include/${globus_flavor}"

			if test ! -d "$GLOBUS_INCLUDE" ; then

				AC_MSG_ERROR(Cannot find Globus flavor-specific include directory: ${GLOBUS_INCLUDE})

			fi

			GSI_CPPFLAGS="-I${GLOBUS_INCLUDE}"

			# Use globus-makefile-header tool to add needed libs

			if test ! -x "${GLOBUS_LOCATION}/bin/globus-makefile-header" ; then

				AC_MSG_ERROR(${GLOBUS_LOCATION}/bin/globus-makefile-header does not exist)

			fi

			GSI_LIBS=`${GLOBUS_LOCATION}/bin/globus-makefile-header --flavor=${globus_flavor} globus_gss_assist | perl -n -e 'if (/GLOBUS_PKG_LIBS = (.*)/){print $1;}'`

			if test -z "$GSI_LIBS" ; then

				AC_MSG_ERROR(globus-makefile-header failed)

			fi

			if test -n "${need_dash_r}"; then

				GSI_LDFLAGS="-L${GLOBUS_LOCATION}/lib -R{GLOBUS_LOCATION}/lib"

			else

				GSI_LDFLAGS="-L${GLOBUS_LOCATION}/lib"

			fi

			AC_DEFINE(HAVE_GSSAPI_H)

			LIBS="$LIBS $GSI_LIBS"

			LDFLAGS="$LDFLAGS $GSI_LDFLAGS"

			CPPFLAGS="$CPPFLAGS $GSI_CPPFLAGS"

			# test that we got the libraries OK

			AC_TRY_LINK(

				[],

				[],

				[

					AC_MSG_RESULT(yes)

				],

				[

					AC_MSG_ERROR(link with GSI libraries failed)

				]

			)

		fi

	]

)

echo "                       GSI support: $GSI_MSG"

/*

 * Copyright (c) 2001-2004 Simon Wilkinson. All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

#include "includes.h"

#ifdef GSSAPI

#ifdef GSI

#include "auth.h"

#include "xmalloc.h"

#include "log.h"

#include "servconf.h"

#include "ssh-gss.h"

#include <globus_gss_assist.h>

extern ServerOptions options;

static int ssh_gssapi_gsi_userok(ssh_gssapi_client *client, char *name);

static void ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client);

ssh_gssapi_mech gssapi_gsi_mech = {

	"dZuIebMjgUqaxvbF7hDbAw==",

	"GSI",

	{9, "\x2B\x06\x01\x04\x01\x9B\x50\x01\x01"},

	NULL,

	&ssh_gssapi_gsi_userok,

	NULL,

	&ssh_gssapi_gsi_storecreds

};

/* Initialize the GSI library */

static int

ssh_gssapi_gsi_init(void)

{

	if (globus_module_activate(GLOBUS_GSI_GSS_ASSIST_MODULE) != 0) {

		return 0;

	}

	return 1;

}

/*

 * Check if this user is OK to login under GSI. User has been authenticated

 * as identity in global 'client_name.value' and is trying to log in as passed

 * username in 'name'.

 * Returns true if the user is OK to log in, otherwise returns 0.

 */

static int

ssh_gssapi_gsi_userok(ssh_gssapi_client *client, char *name)

{

	int retval;

	if (ssh_gssapi_gsi_init() == 0)

		return 0;

	/* globus_gss_assist_userok() returns 0 on success */

	if (globus_gss_assist_userok(client->displayname.value,

				     name)) {

		retval = 0;

	} else {

		retval = 1;

		logit("GSI user %s is authorized as target user %s",

		      (char *) client->displayname.value, name);

	}

	return retval;

}

/* This writes out any forwarded credentials from the structure populated

 * during userauth. Called after we have setuid to the user */

static void

ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client)

{

	OM_uint32	major_status;

	OM_uint32	minor_status;

	gss_buffer_desc	export_cred = GSS_C_EMPTY_BUFFER;

	char *		p;

	if (client->creds == NULL) {

		debug("No credentials stored");

		return;

	}

	if (ssh_gssapi_gsi_init() == 0)

		return;

	major_status = gss_export_cred(&minor_status,

				       client->creds,

				       GSS_C_NO_OID,

				       1,

				       &export_cred);

	if (GSS_ERROR(major_status)) {

		Gssctxt *ctx;

		ssh_gssapi_build_ctx(&ctx);

		ctx->major = major_status;

		ctx->minor = minor_status;

		ssh_gssapi_set_oid(ctx, &gssapi_gsi_mech.oid);

		ssh_gssapi_error(ctx);

		ssh_gssapi_delete_ctx(&ctx);

		return;

	}

	p = strchr((char *) export_cred.value, '=');

	if (p == NULL) {

		logit("Failed to parse exported credentials string '%.100s'",

		      (char *)export_cred.value);

		gss_release_buffer(&minor_status, &export_cred);

		return;

	}

	*p++ = '\0';

	if (strcmp((char *)export_cred.value,"X509_USER_DELEG_PROXY") == 0) {

		client->store.envvar = strdup("X509_USER_PROXY");

	} else {

		client->store.envvar = strdup((char *)export_cred.value);

	}

	client->store.envval = strdup(p);

#ifdef USE_PAM

	if (options.use_pam)

		do_pam_putenv(client->store.envvar, client->store.envval);

#endif

	if (access(p, R_OK) == 0) {

		client->store.filename = strdup(p);

	}

	gss_release_buffer(&minor_status, &export_cred);

	return;

}

#endif /* GSI */

#endif /* GSSAPI */

#ifdef GSI

extern ssh_gssapi_mech gssapi_gsi_mech;

#endif

#endif

#ifdef GSI

	&gssapi_gsi_mech,