summaryrefslogtreecommitdiffstats
blob: a249ba4d96fa6aeb57e34521477c894e99951a1d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
/*
 * Copyright (c) 2015-2016 Isode Limited.
 * All rights reserved.
 * See the COPYING file for more information.
 */

#pragma once

#include <string>
#include <vector>

#define SECURITY_WIN32
#include <Windows.h>
#include <Sspi.h>

#include <Swiften/Base/API.h>
#include <Swiften/Base/SafeByteArray.h>
#include <Swiften/SASL/ClientAuthenticator.h>

namespace Swift {
	class SWIFTEN_API WindowsGSSAPIClientAuthenticator : public ClientAuthenticator {
		public:
			WindowsGSSAPIClientAuthenticator(const std::string& hostname, const std::string& domainname, int port);

			virtual ~WindowsGSSAPIClientAuthenticator();

			virtual boost::optional<SafeByteArray> getResponse() const;
			virtual bool setChallenge(const boost::optional<std::vector<unsigned char> >&);

			/**
			  * Returns whether the authenticator has the complete
			  * security context. It could be true before any
			  * message exchanges with the server or after some
			  * messages have been exchanged.
			  *
			  * @return True if security context is complete.
			  */
			bool isCompleteContext() {
				return haveCompleteContext_;
			}

			/**
			  * Retrieves the user name associated with the
			  * security context. It will only be set when
			  * isCompleteContext() returns true.
			  *
			  * @return User name in the form "EXAMPLE.COM\user".
			  */
			const std::string& getUserName() {
				return userName_;
			}

			/**
			  * Retrieves the client part of the user name
			  * associated with the security context. It will only
			  * be set when isCompleteContext() returns true.
			  *
			  * @return Client name in the form "user" when the user
			  * name is "EXAMPLE.COM\user".
			  */
			const std::string& getClientName() {
				return clientName_;
			}

			/**
			  * Retrieves the server name associated with the
			  * security context. It will only be set when
			  * isCompleteContext() returns true.
			  *
			  * @return Server name in the form "EXAMPLE.COM".
			  */
			const std::string& getServerName() {
				return serverName_;
			}

			/**
			  * Returns whether an error has occurred at any point,
			  * including in the constructor.
			  *
			  * @return True if an error has occured.
			  */
			bool isError();

			/**
			  * Returns error details if isError() returns true.
			  * May be empty if there are no details to be provided
			  * for the error.
			  *
			  * @return Error details.
			  */
			boost::shared_ptr<boost::system::error_code> getErrorCode() {
				return errorCode_;
			}

		private:
			void buildSecurityContext(const boost::optional<ByteArray>& inputToken);

		private:
			enum Step {
				BuildingSecurityContext,
				SecurityLayerNegotiation,
				ServerAuthenticated
			} step_;
			bool error_;
			boost::shared_ptr<boost::system::error_code> errorCode_;
			std::string servicePrincipalNameString_;
			bool haveCredentialsHandle_;
			bool haveContextHandle_;
			bool haveCompleteContext_;
			CredHandle credentialsHandle_;
			CtxtHandle contextHandle_;
			SecPkgContext_Sizes sizes_;
			SecPkgContext_StreamSizes streamSizes_;
			std::string userName_;
			std::string clientName_;
			std::string serverName_;
			SafeByteArray response_;
	};
}