robin/smb
1
0
Fork 0
mirror of https://codeberg.org/icewind/SMB.git synced 2026-06-03 17:24:07 +02:00
Code Issues Projects Releases Packages Wiki Activity

re-add option for passing ticket by memory and copying the ticket to a new temp location

Browse source
This commit is contained in:
Robin Appelman 2022-01-20 14:36:37 +01:00
commit 3a87f21b83
1 changed files with 46 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

51
src/KerberosApacheAuth.php
View file

@ -34,6 +34,46 @@ class KerberosApacheAuth extends KerberosAuth implements IAuth {
/** @var bool */ /** @var bool */
private $init = false; private $init = false;
/** @var string|false */
private $ticketName;
public function __construct() {
$this->ticketName = getenv("KRB5CCNAME");
}
/**
* Copy the ticket to a temporary location and use that ticket for authentication
*
* @return void
*/
public function copyTicket(): void {
if (!$this->checkTicket()) {
return;
}
$krb5 = new \KRB5CCache();
$krb5->open($this->ticketName);
$tmpFilename = tempnam("/tmp", "krb5cc_php_");
$tmpCacheFile = "FILE:" . $tmpFilename;
$krb5->save($tmpCacheFile);
$this->ticketPath = $tmpFilename;
$this->ticketName = $tmpCacheFile;
}
/**
* Pass the ticket to smbclient by memory instead of path
*
* @return void
*/
public function passTicketFromMemory(): void {
if (!$this->checkTicket()) {
return;
}
$krb5 = new \KRB5CCache();
$krb5->open($this->ticketName);
$this->ticketName = (string)$krb5->getName();
}
/** /**
* Check if a valid kerberos ticket is present * Check if a valid kerberos ticket is present
* *
@ -41,13 +81,12 @@ class KerberosApacheAuth extends KerberosAuth implements IAuth {
*/ */
public function checkTicket(): bool { public function checkTicket(): bool {
//read apache kerberos ticket cache //read apache kerberos ticket cache
$cacheFile = getenv("KRB5CCNAME"); if (!$this->ticketName) {
if (!$cacheFile) {
return false; return false;
} }
$krb5 = new \KRB5CCache(); $krb5 = new \KRB5CCache();
$krb5->open($cacheFile); $krb5->open($this->ticketName);
return count($krb5->getEntries()) > 0; return count($krb5->getEntries()) > 0;
} }
@ -64,11 +103,13 @@ class KerberosApacheAuth extends KerberosAuth implements IAuth {
} }
//read apache kerberos ticket cache //read apache kerberos ticket cache
$cacheFile = getenv("KRB5CCNAME");
if (!$this->checkTicket()) { if (!$this->checkTicket()) {
throw new Exception('No kerberos ticket cache environment variable (KRB5CCNAME) found.'); throw new Exception('No kerberos ticket cache environment variable (KRB5CCNAME) found.');
} }
putenv("KRB5CCNAME=" . $cacheFile);
// note that even if the ticketname is the value we got from `getenv("KRB5CCNAME")` we still need to set the env variable ourselves
// this is because `getenv` also reads the variables passed from the SAPI (apache-php) and we need to set the variable in the OS's env
putenv("KRB5CCNAME=" . $this->ticketName);
} }
public function getExtraCommandLineArguments(): string { public function getExtraCommandLineArguments(): string {