Add identity and port configuration parameters

Provide parameters to configure the port and server identity of
the WebAuth user information service, primarily for testing
purposes.

diff --git a/TODO b/TODO
index 467fb5bed642edc961c02ea58a28dd8ae5055fe5..cc179b0505950fd273d24c431687f5aff57846dc 100644 (file)
--- a/TODO
+++ b/TODO
@@ -7,12 +7,6 @@ Protocol:
 
 Configuration:
 
- * Allow configuration of the principal of the WebAuth user information
-   service (used for remctl authentication).
-
- * Allow configuration of the port of the WebAuth user information
-   service.
-
  * Consider changing the configuration to take the user information
    service location as a URL instead of the separate server and command
    parameters, matching the way that mod_webkdc is configured.

diff --git a/internal.h b/internal.h
index 1b4f16c0d1bd7f9a8cb2b3cfbe40176f795a3c4d..ac74780d3ee2ecff3399cae113d8c3ab1d904369 100644 (file)
--- a/internal.h
+++ b/internal.h
@@ -27,6 +27,8 @@ struct pam_args;
  */
 struct pam_config {
     char *host;                 /* Host for user information queries. */
+    long port;                  /* Port for user information queries. */
+    char *identity;             /* Identity for user information queries. */
     char *command;              /* Base command for queries. */
     char *keytab;               /* Keytab for authentication. */
     long timeout;               /* Timeout for authentication call. */

diff --git a/options.c b/options.c
index cfe609e2ca2b545221cd4b1380a1e44b2afbe369..dfe68c29e2b7810f2cc19a6ad144b96b8faefbc9 100644 (file)
--- a/options.c
+++ b/options.c
@@ -24,10 +24,12 @@
 /* Our option definition. */
 #define K(name) (#name), offsetof(struct pam_config, name)
 static const struct option options[] = {
-    { K(command), true, STRING (NULL)               },
-    { K(host),    true, STRING (NULL)               },
-    { K(keytab),  true, STRING ("/etc/krb5.keytab") },
-    { K(timeout), true, NUMBER (30)                 },
+    { K(command),   true, STRING (NULL)               },
+    { K(host),      true, STRING (NULL)               },
+    { K(identity),  true, STRING (NULL)               },
+    { K(keytab),    true, STRING ("/etc/krb5.keytab") },
+    { K(port),      true, NUMBER (0)                  },
+    { K(timeout),   true, NUMBER (30)                 },
 };
 static const size_t optlen = sizeof(options) / sizeof(options[0]);
 

diff --git a/pam_webauth_otp.pod b/pam_webauth_otp.pod
index 86113cbdbbb3a842a461db93a7906b894ccbedcf..747c058477c40f776c223128459924fb8792cea0 100644 (file)
--- a/pam_webauth_otp.pod
+++ b/pam_webauth_otp.pod
@@ -81,9 +81,16 @@ command portion of the remctl call.  This option must be set.
 The hostname of the WebAuth information service against which to validate
 the OTP code.  This host, at least currently, must provide the WebAuth
 user information service (at least the C<webkdc-validate> command) via
-remctl.  The principal used for authentication will be the default host
-principal for that host, as determined by remctl's normal principal
-derivation algorithm.  This option must be set.
+remctl.  The principal used for authentication will default host principal
+for that host, as determined by remctl's normal principal derivation
+algorithm, but see I<principal>.  This option must be set.
+
+=item identity=I<principal>
+
+Sets the identity of the WebAuth user information service.  This is the
+principal to which the module will authenticate when validating OTP codes.
+The default is the normal host principal for the host on which the WebAuth
+user information service is running.
 
 =item keytab=I<path>
 
@@ -92,6 +99,12 @@ service.  The first principal found in the keytab will be used as the
 client identity.  The default, if not set, is F</etc/krb5.keytab>, which
 will generally use the local system host credentials.
 
+=item port=I<port>
+
+The port of the WebAuth user information service.  The default, if not
+set, is to follow the normal remctl behavior of trying the registered
+(4373) and legacy (4444) ports.
+
 =item timeout=I<timeout>
 
 How long to wait, in seconds, for a reply from the WebAuth user

diff --git a/public.c b/public.c
index 40ae376803b7e15f12f615a6737c6cec9741ecd9..d25ca5644b133d0f1c4e3c1f0c6c3a4e16edcdb7 100644 (file)
--- a/public.c
+++ b/public.c
@@ -123,6 +123,8 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
     memset(&config, 0, sizeof(config));
     config.protocol = WA_PROTOCOL_REMCTL;
     config.host     = args->config->host;
+    config.port     = args->config->port;
+    config.identity = args->config->identity;
     config.command  = args->config->command;
     config.keytab   = args->config->keytab;
     config.timeout  = args->config->timeout;