diff options
author | Steve Holme <steve_holme@hotmail.com> | 2016-08-21 11:56:23 +0100 |
---|---|---|
committer | Steve Holme <steve_holme@hotmail.com> | 2016-08-21 11:56:23 +0100 |
commit | a78c61a4bf5b7eb90b0945d94568b7b3b1f23c6e (patch) | |
tree | 3b487b79f4a429d0ae8ba1ef28f184c4b983d65a /lib/vauth/vauth.c | |
parent | 43dbd766164153d49ab266355d2f35e6bf010b30 (diff) |
sasl: Don't use GSSAPI authentication when domain name not specified
Only choose the GSSAPI authentication mechanism when the user name
contains a Windows domain name or the user is a valid UPN.
Fixes #718
Diffstat (limited to 'lib/vauth/vauth.c')
-rw-r--r-- | lib/vauth/vauth.c | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/lib/vauth/vauth.c b/lib/vauth/vauth.c index 702e2d4bc..b995f34e2 100644 --- a/lib/vauth/vauth.c +++ b/lib/vauth/vauth.c @@ -104,3 +104,44 @@ TCHAR *Curl_auth_build_spn(const char *service, const char *host, } #endif /* USE_WINDOWS_SSPI */ +/* +* Curl_auth_user_contains_domain() +* +* This is used to test if the specified user contains a Windows domain name as +* follows: +* +* User\Domain (Down-level Logon Name) +* User/Domain (curl Down-level format - for compatibility with existing code) +* User@Domain (User Principal Name) +* +* Note: The user name may be empty when using a GSS-API library or Windows SSPI +* as the user and domain are either obtained from the credientals cache when +* using GSS-API or via the currently logged in user's credientals when using +* Windows SSPI. +* +* Parameters: +* +* user [in] - The user name. +* +* Returns TRUE on success; otherwise FALSE. +*/ +bool Curl_auth_user_contains_domain(const char *user) +{ + bool valid = FALSE; + + if(user && *user) { + /* Check we have a domain name or UPN present */ + char *p = strpbrk(user, "\\/@"); + + valid = (p != NULL && p > user && p < user + strlen(user) - 1 ? TRUE : + FALSE); + } +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + else + /* User and domain are obtained from the GSS-API credientials cache or the + currently logged in user from Windows */ + valid = TRUE; +#endif + + return valid; +} |