Re: Trying to use gnus-cloud: what's the pinentry dialog? (and how can I get rid of it?)

["Adam Sjøgren" <asjo@koldfront.dk>]

Robert writes:

> --without-pop --with-kerberos doesnʼt make a great deal of sense,
> since the only C code that depends on kerberos is emacs is in
> src/pop.c

I was hoping to get Kerberos support in url.el at one point and the
optimist in me thought "I probably just have to enable this option".

At a later point I started hacking away at lisp/url/url-auth.el to add
Negotiate auth support, but I couldn't find any way to call the needed
Kerberos functions to generate an initial context token, so I ended up
using a Perl script using GSSAPI as a crutch instead:

= = =
diff --git a/lisp/url/url-auth.el b/lisp/url/url-auth.el
index f291414e81b..b6fd4660291 100644
--- a/lisp/url/url-auth.el
+++ b/lisp/url/url-auth.el
@@ -445,6 +445,44 @@ url-digest-auth
         (if key
             (url-digest-auth-build-response key href realm attrs)))))
 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;; Negotiate authorization code
+;;; ------------------------
+;;; This implements the Negotiate authorization type; only the
+;;; SPNEGO-bases Kerberos part.  See RFC 4559
+;;; https://www.ietf.org/rfc/rfc4559.txt for the complete
+;;; documentation on this type.
+;;;
+;;; This is somewhat secure
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defun url-negotiate-auth-build-response (url attrs)
+  "Compute authorization string for SPNEGO-based Kerberos.
+
+base64 encoding of an InitialContextToken as defined in
+RFC2743, from SPNEGO GSSAPI.
+
+The NTLM part is not implemented"
+  (let ((token (shell-command-to-string (concat "/home/adsj/bin/generate_initialcontexttoken " (url-host url)))))
+      (concat
+       "Negotiate "
+       token)))
+
+(defun url-negotiate-auth (url &optional prompt overwrite realm attrs)
+  "Get the HTTP Negotiate response string for the specified URL.
+
+Optional arguments PROMPT, OVERWRITE, and REALM are not relevant for the
+Negotiate method.
+
+Alist ATTRS contains additional attributes for the authentication
+challenge such as nonce and opaque."
+  (if attrs
+      (let* ((href (if (stringp url) (url-generic-parse-url url) url))
+             (enable-recursive-minibuffers t))
+        (url-negotiate-auth-build-response href attrs))))
+
+;;; End of Negotiate
+
 (defvar url-registered-auth-schemes nil
   "A list of the registered authorization schemes and various and sundry
 information associated with them.")
diff --git a/lisp/url/url.el b/lisp/url/url.el
index a6565e2cdb6..5d5b8b03ea8 100644
--- a/lisp/url/url.el
+++ b/lisp/url/url.el
@@ -64,6 +64,7 @@ url-do-setup
     ;; Register all the authentication schemes we can handle
     (url-register-auth-scheme "basic" nil 4)
     (url-register-auth-scheme "digest" nil 7)
+    (url-register-auth-scheme "negotiate" nil 9)
 
     (setq url-cookie-file
 	  (or url-cookie-file
= = =

The Perl script being:

= = =
#!/usr/bin/perl

use strict;
use warnings;

use MIME::Base64;
use GSSAPI;

my $host=$ARGV[0];
die "Must supply hostname" if (!defined $host);

my $target;
my $status=GSSAPI::Name->import($target, 'HTTP@' . $host, GSSAPI::OID::gss_nt_hostbased_service);
die "Name import failed: $status" if ($status->major != GSS_S_COMPLETE);

my $tname;
$status=$target->display($tname);
die "Status display failed: $status" if ($status->major != GSS_S_COMPLETE);

my $ctx = GSSAPI::Context->new();
my $imech = GSSAPI::OID::gss_mech_krb5;

my $iflags = GSS_C_REPLAY_FLAG;
$iflags = $iflags | GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG; # if ( $ENV{LWP_AUTHEN_NEGOTIATE_DELEGATE} )
my $bindings = GSS_C_NO_CHANNEL_BINDINGS;
my $creds = GSS_C_NO_CREDENTIAL;
my $itime = 0;

my $otoken;
my $itoken=q{}; # prev WWW-Authenticate ...
$status = $ctx->init($creds, $target, $imech, $iflags, $itime, $bindings, $itoken, undef, $otoken, undef, undef);
if ($status->major == GSS_S_COMPLETE or $status->major == GSS_S_CONTINUE_NEEDED) {
    print encode_base64($otoken,"");
}
else {
    die "Fail: $status";
}
= = =

This allows my Gnus to show images from internal servers that use
Kerberos for Single Sign On at work, which is nice.

If only I could figure out how to make the token within url-auth.el,
that would be cool...


  Best regards,

    Adam

-- 
 "Mr. Cotton's... parrot. Same question."                   Adam Sjøgren
                                                       asjo@koldfront.dk