kerberos_authenticator 0.0.4 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4a44179b216387e5f2eb0a20ef4bf9b1cd1aeea1
-  data.tar.gz: 9822897ddb64fdb9f78ef9c490e8228d56f9e6a6
+  metadata.gz: ae668eaa13a5a760620f1c5fbe67ea57c48fb08f
+  data.tar.gz: 60eab79c31c8f11e858c782d3220a5e51db13a37
 SHA512:
-  metadata.gz: 34ca852532daa3c7917ca32424c70ab2ef926656c0ccaee40bfa6cc91eab871c41d411bebc10ee829dfd04bf41208192f73f39f825bc40e432c248bb6bed338f
-  data.tar.gz: c93c71a10984de26d2c2917ae0bbb7351be8532ff6a140921fed507514817f6992d3df838871d7b6ec557cf6b8d8252dcc309861c678584555c5c2d7cdaeb3fe
+  metadata.gz: 89e39afb2afe2ce6d2ffb0e7e39a108aa8f3b3747cc3154985655b1ba71b79773496e0f986a7aa7b7d44d1c1e622a0a357b63c4a12d0424903879afa3aa5f46d
+  data.tar.gz: 35cd393566e7818ea3c71b07b3e5980f9697b025f0ccef61199aa94b73b2d97ebadf9748517c64a1789a0eb85cba919bfa685c68e15221ff66907f7ace2fc191

data/lib/kerberos_authenticator.rb

@@ -35,16 +35,16 @@ module KerberosAuthenticator
   end
 
   # @!attribute [rw] server
-  #   @return [String] the server principal name to use when verifying the identity the KDC
+  #   @return [String] the server principal name to use when verifying the identity of the KDC
 
   # @!attribute [rw] service
   #   @return [String] the service principal name to request a ticket for when obtaining a user's credentials
 
   # @!attribute [rw] keytab_base64
-  #   @return [String] the keytab to use when verifying the identity the KDC represented as a Base64 encoded string (overrides keytab_path)
+  #   @return [String] the keytab to use when verifying the identity of the KDC represented as a Base64 encoded string (overrides keytab_path)
 
   # @!attribute [rw] keytab_path
-  #   @return [String] the path to the keytab to use when verifying the identity the KDC
+  #   @return [String] the path to the keytab to use when verifying the identity of the KDC
 
   @service = nil
 
@@ -92,7 +92,7 @@ module KerberosAuthenticator
   def self.new_kt_tmp_file
     return nil unless keytab_base64
 
-    kt_tmp_file = Tempfile.new('krb5_kt', encoding: 'ascii-8bit')
+    kt_tmp_file = Tempfile.new('krb5_kt', encoding: 'binary')
     kt_tmp_file.write(Base64.decode64(keytab_base64))
     kt_tmp_file.close
 

data/lib/kerberos_authenticator/krb5.rb

@@ -6,12 +6,16 @@ module KerberosAuthenticator
   module Krb5
     extend FFI::Library
 
-    PREFERRED_VERSIONS = ['.3','.26','']
+    # Version suffixes of the library to search for, in order:
+    # - .3: MIT as of Debian 8, RHEL 7
+    # - .26: Heimdal as of Debian 8, RHEL 7 
+    # and then no suffix (which should pickup OS X Kerberos).
+    PREFERRED_VERSIONS = ['.3', '.26', ''].freeze
 
     if ENV['FFI_KRB5_LIBRARY_NAME']
       ffi_lib ENV['FFI_KRB5_LIBRARY_NAME']
     else
-      ffi_lib PREFERRED_VERSIONS.map {|v| FFI.map_library_name('krb5') + v}
+      ffi_lib PREFERRED_VERSIONS.map { |v| FFI.map_library_name('krb5') + v }
     end
 
     # @!attribute [rw] use_secure_context

data/lib/kerberos_authenticator/krb5/creds.rb

@@ -8,13 +8,17 @@ module KerberosAuthenticator
     attach_function :krb5_verify_init_creds_opt_init, [:pointer], :void
     attach_function :krb5_verify_init_creds_opt_set_ap_req_nofail, [:pointer, :bool], :void
 
-    attach_function :krb5_free_creds, [:krb5_context, :krb5_creds], :void
+    attach_function :krb5_free_cred_contents, [:krb5_context, :krb5_creds], :void
     attach_function :krb5_get_init_creds_opt_free, [:krb5_context, :pointer], :void
 
     # Credentials, or tickets, provided by a KDC for a user.
     class Creds
       attr_reader :context, :ptr
 
+      # The size, in bytes, of the krb5_creds structure.
+      # This differs between implementations and architectures.
+      SIZE_OF_KRB5_CREDS = 480
+
       # Requests initial credentials for principal using password from a KDC.
       # @param principal [Principal] the user's Principal
       # @param password [String] the user's password
@@ -25,12 +29,12 @@ module KerberosAuthenticator
       # @see http://web.mit.edu/kerberos/krb5-1.14/doc/appdev/refs/api/krb5_get_init_creds_password.html krb5_get_init_creds_password
       # @see http://web.mit.edu/kerberos/krb5-1.14/doc/appdev/init_creds.html Initial credentials
       def self.initial_creds_for_principal_with_a_password(principal, password, service = nil)
-        raise ArgumentError, 'expected Principal' unless principal.is_a? Principal
+        raise TypeError, 'expected Principal' unless principal.is_a? Principal
 
         context = principal.context
-        ptr = FFI::MemoryPointer.new :char, 120
+        ptr = FFI::MemoryPointer.new :char, SIZE_OF_KRB5_CREDS
 
-        Krb5.get_init_creds_password(context.ptr, ptr, principal.ptr, password, nil, nil, 0, service, nil)
+        Krb5.get_init_creds_password(context.ptr, ptr, principal.ptr, password.to_str, nil, nil, 0, service, nil)
 
         new(context, ptr)
       end
@@ -62,24 +66,20 @@ module KerberosAuthenticator
       # @see http://web.mit.edu/kerberos/krb5-1.14/doc/appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail.html krb5_verify_init_creds_opt_set_ap_req_nofail
       def verify(nofail = false, server_principal = nil, keytab = nil)
         verify_creds_opt = FFI::MemoryPointer.new :int, 2
-
         Krb5.verify_init_creds_opt_init(verify_creds_opt)
+        Krb5.verify_init_creds_opt_set_ap_req_nofail(verify_creds_opt, nofail)
 
-        begin
-          Krb5.verify_init_creds_opt_set_ap_req_nofail(verify_creds_opt, nofail)
-
-          server_princ_ptr = server_principal ? server_principal.ptr : nil
-          keytab_ptr = keytab ? keytab.ptr : nil
+        server_princ_ptr = server_principal ? server_principal.ptr : nil
+        keytab_ptr = keytab ? keytab.ptr : nil
 
-          Krb5.verify_init_creds(context.ptr, ptr, server_princ_ptr, keytab_ptr, nil, verify_creds_opt)
-        end
+        Krb5.verify_init_creds(context.ptr, ptr, server_princ_ptr, keytab_ptr, nil, verify_creds_opt)
 
         true
       end
 
       # @api private
       def self.finalize(context, ptr)
-        proc { Krb5.free_creds(context.ptr, ptr) }
+        proc { Krb5.free_cred_contents(context.ptr, ptr); ptr.free }
       end
     end
   end

data/lib/kerberos_authenticator/krb5/error.rb

@@ -1,7 +1,8 @@
 module KerberosAuthenticator
   module Krb5
     typedef :int, :krb5_error_code
-    attach_function :krb5_get_error_message, [:pointer, :krb5_error_code], :string
+    attach_function :krb5_get_error_message, [:pointer, :krb5_error_code], :strptr
+    attach_function :krb5_free_error_message, [:pointer, :pointer], :void
 
     # A Kerberos library error
     class Error < StandardError
@@ -10,7 +11,13 @@ module KerberosAuthenticator
       # @see http://web.mit.edu/kerberos/krb5-1.14/doc/appdev/refs/api/krb5_get_error_message.html krb5_get_error_message
       def initialize(context_ptr, krb5_error_code)
         @error_code = krb5_error_code
-        super(Krb5.get_error_message(context_ptr, krb5_error_code))
+        error_message, error_ptr = Krb5.get_error_message(context_ptr, krb5_error_code)
+        FFI::AutoPointer.new(error_ptr, self.class.finalize(context_ptr))
+        super(String.new(error_message))
+      end
+
+      def self.finalize(context_ptr)
+        proc { |ptr| Krb5.free_error_message(context_ptr, ptr) }
       end
 
       def self.raise_if_error(context_ptr = nil)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kerberos_authenticator
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.0.5
 platform: ruby
 authors:
 - Adam Watkins
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-04-10 00:00:00.000000000 Z
+date: 2016-04-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi