[27] Saved ticket support for kerberos

.github/workflows/smb-kerberos.yml

@@ -18,8 +18,6 @@ jobs:
 
     if: ${{ github.repository_owner != 'nextcloud-gmbh' }}
 
-    name: smb-kerberos-sso
-
     steps:
       - name: Checkout server
         uses: actions/checkout@v3
@@ -30,7 +28,7 @@ jobs:
         with:
           repository: nextcloud/user_saml
           path: apps/user_saml
-          ref: stable27
+          ref: stable-5.2
       - name: Pull images
         run: |
           docker pull ghcr.io/icewind1991/samba-krb-test-dc
@@ -56,3 +54,89 @@ jobs:
           FILEPATH=$(docker exec --user 33 apache ./occ log:file | grep "Log file:" | cut -d' ' -f3)
           echo "$FILEPATH:"
           docker exec --user 33 apache cat $FILEPATH
+
+  smb-kerberos-session-tests:
+    runs-on: ubuntu-latest
+
+    if: ${{ github.repository_owner != 'nextcloud-gmbh' }}
+
+    steps:
+      - name: Checkout server
+        uses: actions/checkout@v3
+        with:
+          submodules: true
+      - name: Checkout user_saml
+        uses: actions/checkout@v3
+        with:
+          repository: nextcloud/user_saml
+          path: apps/user_saml
+          ref: stable-5.2
+      - name: Pull images
+        run: |
+          docker pull ghcr.io/icewind1991/samba-krb-test-dc
+          docker pull ghcr.io/icewind1991/samba-krb-test-apache
+          docker pull ghcr.io/icewind1991/samba-krb-test-client
+          docker tag ghcr.io/icewind1991/samba-krb-test-dc icewind1991/samba-krb-test-dc
+          docker tag ghcr.io/icewind1991/samba-krb-test-apache icewind1991/samba-krb-test-apache
+          docker tag ghcr.io/icewind1991/samba-krb-test-client icewind1991/samba-krb-test-client
+      - name: Setup AD-DC
+        run: |
+          DC_IP=$(apps/files_external/tests/sso-setup/start-dc.sh)
+          sleep 1
+          apps/files_external/tests/sso-setup/start-apache.sh $DC_IP $PWD -v $PWD/apps/files_external/tests/sso-setup/apache-session.conf:/etc/apache2/sites-enabled/000-default.conf
+          echo "DC_IP=$DC_IP" >> $GITHUB_ENV
+      - name: Set up Nextcloud
+        run: |
+          apps/files_external/tests/sso-setup/setup-sso-nc.sh smb::kerberos_sso_session
+      - name: Test SSO
+        run: |
+          apps/files_external/tests/sso-setup/test-sso-smb-session.sh ${{ env.DC_IP }}
+      - name: Show logs
+        if: failure()
+        run: |
+          FILEPATH=$(docker exec --user 33 apache ./occ log:file | grep "Log file:" | cut -d' ' -f3)
+          echo "$FILEPATH:"
+          docker exec --user 33 apache cat $FILEPATH
+
+  smb-kerberos-database-tests:
+    runs-on: ubuntu-latest
+
+    if: ${{ github.repository_owner != 'nextcloud-gmbh' }}
+
+    steps:
+      - name: Checkout server
+        uses: actions/checkout@v3
+        with:
+          submodules: true
+      - name: Checkout user_saml
+        uses: actions/checkout@v3
+        with:
+          repository: nextcloud/user_saml
+          path: apps/user_saml
+          ref: stable-5.2
+      - name: Pull images
+        run: |
+          docker pull ghcr.io/icewind1991/samba-krb-test-dc
+          docker pull ghcr.io/icewind1991/samba-krb-test-apache
+          docker pull ghcr.io/icewind1991/samba-krb-test-client
+          docker tag ghcr.io/icewind1991/samba-krb-test-dc icewind1991/samba-krb-test-dc
+          docker tag ghcr.io/icewind1991/samba-krb-test-apache icewind1991/samba-krb-test-apache
+          docker tag ghcr.io/icewind1991/samba-krb-test-client icewind1991/samba-krb-test-client
+      - name: Setup AD-DC
+        run: |
+          DC_IP=$(apps/files_external/tests/sso-setup/start-dc.sh)
+          sleep 1
+          apps/files_external/tests/sso-setup/start-apache.sh $DC_IP $PWD -v $PWD/apps/files_external/tests/sso-setup/apache-session.conf:/etc/apache2/sites-enabled/000-default.conf
+          echo "DC_IP=$DC_IP" >> $GITHUB_ENV
+      - name: Set up Nextcloud
+        run: |
+          apps/files_external/tests/sso-setup/setup-sso-nc.sh smb::kerberos_sso_database
+      - name: Test SSO
+        run: |
+          apps/files_external/tests/sso-setup/test-sso-smb-session.sh ${{ env.DC_IP }}
+      - name: Show logs
+        if: failure()
+        run: |
+          FILEPATH=$(docker exec --user 33 apache ./occ log:file | grep "Log file:" | cut -d' ' -f3)
+          echo "$FILEPATH:"
+          docker exec --user 33 apache cat $FILEPATH

apps/files_external/3rdparty/composer.json

@@ -8,7 +8,7 @@
 		"classmap-authoritative": true
 	},
 	"require": {
-		"icewind/smb": "3.5.4",
+		"icewind/smb": "3.6.0",
 		"icewind/streams": "0.7.7"
 	}
 }

apps/files_external/3rdparty/composer/autoload_classmap.php

@@ -32,6 +32,7 @@
     'Icewind\\SMB\\Exception\\InvalidPathException' => $vendorDir . '/icewind/smb/src/Exception/InvalidPathException.php',
     'Icewind\\SMB\\Exception\\InvalidRequestException' => $vendorDir . '/icewind/smb/src/Exception/InvalidRequestException.php',
     'Icewind\\SMB\\Exception\\InvalidResourceException' => $vendorDir . '/icewind/smb/src/Exception/InvalidResourceException.php',
+    'Icewind\\SMB\\Exception\\InvalidTicket' => $vendorDir . '/icewind/smb/src/Exception/InvalidTicket.php',
     'Icewind\\SMB\\Exception\\InvalidTypeException' => $vendorDir . '/icewind/smb/src/Exception/InvalidTypeException.php',
     'Icewind\\SMB\\Exception\\NoLoginServerException' => $vendorDir . '/icewind/smb/src/Exception/NoLoginServerException.php',
     'Icewind\\SMB\\Exception\\NoRouteToHostException' => $vendorDir . '/icewind/smb/src/Exception/NoRouteToHostException.php',
@@ -50,6 +51,7 @@
     'Icewind\\SMB\\ITimeZoneProvider' => $vendorDir . '/icewind/smb/src/ITimeZoneProvider.php',
     'Icewind\\SMB\\KerberosApacheAuth' => $vendorDir . '/icewind/smb/src/KerberosApacheAuth.php',
     'Icewind\\SMB\\KerberosAuth' => $vendorDir . '/icewind/smb/src/KerberosAuth.php',
+    'Icewind\\SMB\\KerberosTicket' => $vendorDir . '/icewind/smb/src/KerberosTicket.php',
     'Icewind\\SMB\\Native\\NativeFileInfo' => $vendorDir . '/icewind/smb/src/Native/NativeFileInfo.php',
     'Icewind\\SMB\\Native\\NativeReadStream' => $vendorDir . '/icewind/smb/src/Native/NativeReadStream.php',
     'Icewind\\SMB\\Native\\NativeServer' => $vendorDir . '/icewind/smb/src/Native/NativeServer.php',

apps/files_external/3rdparty/composer/autoload_static.php

@@ -52,6 +52,7 @@ class ComposerStaticInit98fe9b281934250b3a93f69a5ce843b3
         'Icewind\\SMB\\Exception\\InvalidPathException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidPathException.php',
         'Icewind\\SMB\\Exception\\InvalidRequestException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidRequestException.php',
         'Icewind\\SMB\\Exception\\InvalidResourceException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidResourceException.php',
+        'Icewind\\SMB\\Exception\\InvalidTicket' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidTicket.php',
         'Icewind\\SMB\\Exception\\InvalidTypeException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/InvalidTypeException.php',
         'Icewind\\SMB\\Exception\\NoLoginServerException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/NoLoginServerException.php',
         'Icewind\\SMB\\Exception\\NoRouteToHostException' => __DIR__ . '/..' . '/icewind/smb/src/Exception/NoRouteToHostException.php',
@@ -70,6 +71,7 @@ class ComposerStaticInit98fe9b281934250b3a93f69a5ce843b3
         'Icewind\\SMB\\ITimeZoneProvider' => __DIR__ . '/..' . '/icewind/smb/src/ITimeZoneProvider.php',
         'Icewind\\SMB\\KerberosApacheAuth' => __DIR__ . '/..' . '/icewind/smb/src/KerberosApacheAuth.php',
         'Icewind\\SMB\\KerberosAuth' => __DIR__ . '/..' . '/icewind/smb/src/KerberosAuth.php',
+        'Icewind\\SMB\\KerberosTicket' => __DIR__ . '/..' . '/icewind/smb/src/KerberosTicket.php',
         'Icewind\\SMB\\Native\\NativeFileInfo' => __DIR__ . '/..' . '/icewind/smb/src/Native/NativeFileInfo.php',
         'Icewind\\SMB\\Native\\NativeReadStream' => __DIR__ . '/..' . '/icewind/smb/src/Native/NativeReadStream.php',
         'Icewind\\SMB\\Native\\NativeServer' => __DIR__ . '/..' . '/icewind/smb/src/Native/NativeServer.php',

apps/files_external/3rdparty/composer/installed.json

@@ -2,17 +2,17 @@
     "packages": [
         {
             "name": "icewind/smb",
-            "version": "v3.5.4",
-            "version_normalized": "3.5.4.0",
+            "version": "v3.6.0",
+            "version_normalized": "3.6.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/icewind1991/SMB.git",
-                "reference": "76995aa11c14e39bccd0f2370ed63b2f8f623a6d"
+                "reference": "e0e86b16640f5892dd00408ed50ad18357dac6c1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/icewind1991/SMB/zipball/76995aa11c14e39bccd0f2370ed63b2f8f623a6d",
-                "reference": "76995aa11c14e39bccd0f2370ed63b2f8f623a6d",
+                "url": "https://api.github.com/repos/icewind1991/SMB/zipball/e0e86b16640f5892dd00408ed50ad18357dac6c1",
+                "reference": "e0e86b16640f5892dd00408ed50ad18357dac6c1",
                 "shasum": ""
             },
             "require": {
@@ -25,7 +25,7 @@
                 "phpunit/phpunit": "^8.5|^9.3.8",
                 "psalm/phar": "^4.3"
             },
-            "time": "2022-05-30T15:18:19+00:00",
+            "time": "2023-08-10T13:17:39+00:00",
             "type": "library",
             "installation-source": "dist",
             "autoload": {
@@ -46,7 +46,7 @@
             "description": "php wrapper for smbclient and libsmbclient-php",
             "support": {
                 "issues": "https://github.com/icewind1991/SMB/issues",
-                "source": "https://github.com/icewind1991/SMB/tree/v3.5.4"
+                "source": "https://github.com/icewind1991/SMB/tree/v3.6.0"
             },
             "install-path": "../icewind/smb"
         },

apps/files_external/3rdparty/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => 'files_external/3rdparty',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '979f4033ca1cd0be7f255f028d4cc637a216440d',
+        'reference' => '733d6b54097417b3f49673ac0491aebdb46648fd',
         'type' => 'library',
         'install_path' => __DIR__ . '/../',
         'aliases' => array(),
@@ -13,16 +13,16 @@
         'files_external/3rdparty' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '979f4033ca1cd0be7f255f028d4cc637a216440d',
+            'reference' => '733d6b54097417b3f49673ac0491aebdb46648fd',
             'type' => 'library',
             'install_path' => __DIR__ . '/../',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'icewind/smb' => array(
-            'pretty_version' => 'v3.5.4',
-            'version' => '3.5.4.0',
-            'reference' => '76995aa11c14e39bccd0f2370ed63b2f8f623a6d',
+            'pretty_version' => 'v3.6.0',
+            'version' => '3.6.0.0',
+            'reference' => 'e0e86b16640f5892dd00408ed50ad18357dac6c1',
             'type' => 'library',
             'install_path' => __DIR__ . '/../icewind/smb',
             'aliases' => array(),

apps/files_external/3rdparty/icewind/smb/README.md

@@ -65,19 +65,20 @@ $server = $serverFactory->createServer('localhost', $auth);
 
 By re-using a client ticket you can create a single sign-on setup where the user authenticates against
 the web service using kerberos. And the web server can forward that ticket to the smb server, allowing it
-to act on the behalf of the user without requiring the user to enter his passord.
+to act on the behalf of the user without requiring the user to enter his password.
 
 The setup for such a system is fairly involved and requires roughly the following this
 
 - The web server is authenticated against kerberos with a machine account
 - Delegation is enabled for the web server's machine account
-- Apache is setup to perform kerberos authentication and save the ticket in it's environment
+- The web server is setup to perform kerberos authentication and save the ticket in it's environment
 - Php has the krb5 extension installed
 - The client authenticates using a ticket with forwarding enabled
 
 ```php
 $serverFactory = new ServerFactory();
-$auth = new KerberosApacheAuth();
+$auth = new KerberosAuth();
+$auth->setTicket(KerberosTicket::fromEnv());
 $server = $serverFactory->createServer('localhost', $auth);
 ```
 

apps/files_external/3rdparty/icewind/smb/example-sso-kerberos.php

@@ -0,0 +1,26 @@
+<?php
+
+use Icewind\SMB\KerberosTicket;
+
+require('vendor/autoload.php');
+
+if (php_sapi_name() == "cli") {
+	echo "Note: this example shouldn't be called from cli as it expects apache to setup the keberos ticket\n";
+}
+
+// dfs paths not working
+$host = 'krb.domain.test';
+$share = 'netlogon';
+
+$auth = new \Icewind\SMB\KerberosAuth();
+$auth->setTicket(KerberosTicket::fromEnv());
+$serverFactory = new \Icewind\SMB\ServerFactory();
+
+$server = $serverFactory->createServer($host, $auth);
+
+$share = $server->getShare($share);
+
+$files = $share->dir('/');
+foreach ($files as $file) {
+	echo $file->getName() . "\n";
+}

apps/files_external/3rdparty/icewind/smb/src/Exception/InvalidTicket.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * @copyright Copyright (c) 2022 Robin Appelman <robin@icewind.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace Icewind\SMB\Exception;
+
+class InvalidTicket extends Exception {
+
+}