linux - 如何使用已建立的 GSS API 上下文获取客户端用户名

Question

我正在使用 Kerberos 实现 Windows -> Linux 透明身份验证。在 Windows 端，我使用 SSPI。我成功地在 Windows 客户端和 Windows 服务器之间建立了上下文，像这样检索客户端的用户名:

SecPkgContext_Names extraData;
res = QueryContextAttributes(&context, SECPKG_ATTR_NAMES, &extraData);

现在是时候做同样的事情了，不过是在 Linux 机器上。我使用 gss_accept_sec_context，它返回 GSS_S_COMPLETE，并填充类型为 gss_ctx_id_t 的变量。但我很难获得客户名称。我异常(exception)，它可以使用 gss_inquire_sec_context_by_oid 来完成，但是，我找不到要传递的内容

const gss_OID /*desired_object*/

谁能给我指路？

Answer 1

好的，我终于找到了解决方案。它总是在表面上 - 愚蠢的我。

static gss_OID_desc mechDescKERBEROS = { 9, (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
static gss_OID      mechKERBEROS = &mechDescKERBEROS;

gss_ctx_id_t        serverContext = GSS_C_NO_CONTEXT;

// Establish context....

// Now we have established context. All lines below are for getting source user name in form of username@DOMAIN.COM (I got it capitalized, yes)
gss_name_t  srcName = NULL;
gss_name_t  targetName = NULL;
OM_uint32   lifetime;
OM_uint32   ctxFlags = 0;
int         locallyInitiated = 0;
int         open = 0;
maj_stat = gss_inquire_context(&min_stat, serverContext, &srcName, &targetName, &lifetime, &mechKERBEROS, &ctxFlags, &locallyInitiated, &open);
if (maj_stat == GSS_S_COMPLETE)
{
    gss_buffer_desc buff = GSS_C_EMPTY_BUFFER;
    maj_stat = gss_display_name(&min_stat, srcName, &buff, &GSS_C_NT_USER_NAME);
    if (maj_stat == GSS_S_COMPLETE)
    {
        std::string tmp((char*)buff.value);
        // tmp now contains our name
        // Release buffer
        maj_stat = gss_release_buffer(&min_stat, &buff);
    }

    // Release names
    if (srcName != NULL)
        maj_stat = gss_release_name(&min_stat, &srcName);
    if (targetName != NULL)
        maj_stat = gss_release_name(&min_stat, &targetName);
}