pam: apply SIDs from PAC to authentication indicators

This patch reads the PAC of a Kerberos ticket while evaluating the
authentication indicators of the Kerberos ticket during a pam_sss_gss
request. Based on the value of the pam_gssapi_indicators_apply option
the found SIDs might add additional authentication indicators to the
evaluation.

The primary use case is to handle SIDs added by Active Directory's
Authentication Mechanism Assurance (AMA).

:relnote: During the processing of the pam_sss_gss request SSSD will
read the SID from the PAC of the Kerberos ticket and might add
authentication indicators based on the value of the new option
pam_gssapi_indicators_apply. The primary use case is to handle SIDs
added by Active Directory's Authentication Mechanism Assurance (AMA).

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>

Author: sumit-bose

Makefile.am

@@ -1522,13 +1522,15 @@ sssd_pam_SOURCES = \
     src/responder/pam/pam_prompting_config.c \
     src/sss_client/pam_sss_prompt_config.c \
     src/responder/pam/pam_helpers.c \
+    src/providers/ad/ad_pac_common.c \
     $(SSSD_RESPONDER_OBJ)
 if BUILD_PASSKEY
     sssd_pam_SOURCES += src/responder/pam/pamsrv_passkey.c
 endif
 sssd_pam_CFLAGS = \
     $(AM_CFLAGS) \
     $(GSSAPI_KRB5_CFLAGS) \
+    $(NDR_KRB5PAC_CFLAGS) \
     $(NULL)
 sssd_pam_LDADD = \
     $(LIBADD_DL) \
@@ -1540,6 +1542,8 @@ sssd_pam_LDADD = \
     $(SSSD_INTERNAL_LTLIBS) \
     libsss_iface.la \
     libsss_sbus.la \
+    $(NDR_KRB5PAC_LIBS) \
+    libsss_idmap.la \
     $(NULL)
 
 if BUILD_SUDO
@@ -2564,13 +2568,15 @@ pam_srv_tests_SOURCES = \
     src/responder/pam/pamsrv_dp.c \
     src/responder/pam/pam_prompting_config.c \
     src/sss_client/pam_sss_prompt_config.c \
+    src/providers/ad/ad_pac_common.c \
     $(NULL)
 pam_srv_tests_CFLAGS = \
     -U SSSD_LIBEXEC_PATH -DSSSD_LIBEXEC_PATH=\"$(abs_builddir)\" \
     -I$(abs_builddir)/src \
     $(AM_CFLAGS) \
     $(CMOCKA_CFLAGS) \
     $(GSSAPI_KRB5_CFLAGS) \
+    $(NDR_KRB5PAC_CFLAGS) \
     $(NULL)
 pam_srv_tests_LDFLAGS = \
     -Wl,-wrap,sss_packet_get_body \
@@ -2592,6 +2598,7 @@ pam_srv_tests_LDADD = \
     libsss_certmap.la \
     libsss_iface.la \
     libsss_sbus.la \
+    $(NDR_KRB5PAC_LIBS) \
     $(NULL)
 if BUILD_PASSKEY
      pam_srv_tests_SOURCES += src/responder/pam/pamsrv_passkey.c
@@ -2608,13 +2615,15 @@ test_pamsrv_json_SOURCES = \
     src/responder/pam/pam_prompting_config.c \
     src/sss_client/pam_sss_prompt_config.c \
     src/tests/cmocka/test_pamsrv_json.c \
+    src/providers/ad/ad_pac_common.c \
     $(NULL)
 if BUILD_PASSKEY
     test_pamsrv_json_SOURCES += src/responder/pam/pamsrv_passkey.c
 endif # BUILD_PASSKEY
 test_pamsrv_json_CFLAGS = \
     $(AM_CFLAGS) \
     $(CMOCKA_CFLAGS) \
+    $(NDR_KRB5PAC_CFLAGS) \
     $(NULL)
 test_pamsrv_json_LDFLAGS = \
     -Wl,-wrap,json_array_append_new \
@@ -2632,6 +2641,7 @@ test_pamsrv_json_LDADD = \
     libsss_certmap.la \
     libsss_iface.la \
     libsss_sbus.la \
+    $(NDR_KRB5PAC_LIBS) \
     $(NULL)
 
 test_sss_pam_data_SOURCES = \

src/config/SSSDConfig/sssdoptions.py

@@ -111,7 +111,7 @@ def __init__(self):
         'pam_gssapi_indicators_map': _('List of pairs <PAM service>:<authentication indicator> that '
                                        'must be enforced for PAM access with GSSAPI authentication'),
         'pam_gssapi_indicators_apply': _('List of triples <type>:<value>:<authentication indicator> that '
-                                         'assigns additional information from the Kerberos ticket to an'
+                                         'assigns additional information from the Kerberos ticket to an '
                                          'authentication indicator.'),
         'pam_passkey_auth': _('Allow passkey device authentication.'),
         'passkey_child_timeout': _('How many seconds will pam_sss wait for passkey_child to finish'),

src/responder/pam/pamsrv_cmd.c

@@ -20,7 +20,9 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#ifndef _GNU_SOURCE
 #define _GNU_SOURCE
+#endif
 
 #include <time.h>
 #include <string.h>