pam-krb5: Import/add pam-krb5 from eyeire.orgvendor/pam-krb5/4.11vendor/pam-krb5

From https://www.eyrie.org/~eagle/software/pam-krb5/:

pam-krb5 provides a Kerberos PAM module that supports authentication,
user ticket cache handling, simple authorization (via .k5login or
checking Kerberos principals against local usernames), and password
changing. It can be configured through either options in the PAM
configuration itself or through entries in the system krb5.conf file,
and it tries to work around PAM implementation flaws in commonly-used
PAM-enabled applications such as OpenSSH and xdm. It supports both
PKINIT and FAST to the extent that the underlying Kerberos libraries
support these features.

The reason for this import is to provide an MIT KRB5 compatible
pam_krb5 PAM module. The existing pam_krb5 in FreeBS only works
with Heimdal.

Sponsored by:	The FreeBSD Foundation

7 files changed, 124 insertions, 0 deletions

diff --git a/tests/data/scripts/realm/fail-bad-user-realm b/tests/data/scripts/realm/fail-bad-user-realm
new file mode 100644
index 000000000000..d30bec6f1f33
--- /dev/null
+++ b/tests/data/scripts/realm/fail-bad-user-realm
@@ -0,0 +1,17 @@
+# Test authentication failure with different user_realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache user_realm=%0
+
+[run]
+    authenticate = PAM_AUTHINFO_UNAVAIL
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/realm/fail-no-realm b/tests/data/scripts/realm/fail-no-realm
new file mode 100644
index 000000000000..87b59aab49f2
--- /dev/null
+++ b/tests/data/scripts/realm/fail-no-realm
@@ -0,0 +1,17 @@
+# Test authentication failure due to wrong realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache
+
+[run]
+    authenticate = PAM_AUTHINFO_UNAVAIL
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/realm/fail-no-realm-debug b/tests/data/scripts/realm/fail-no-realm-debug
new file mode 100644
index 000000000000..5ef2ce588177
--- /dev/null
+++ b/tests/data/scripts/realm/fail-no-realm-debug
@@ -0,0 +1,21 @@
+# Test authentication failure due to wrong realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache debug
+
+[run]
+    authenticate = PAM_AUTHINFO_UNAVAIL
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %u@%0
+    DEBUG /^\(user %u\) krb5_get_init_creds_password: /
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
+    DEBUG pam_sm_authenticate: exit (failure)
diff --git a/tests/data/scripts/realm/fail-realm b/tests/data/scripts/realm/fail-realm
new file mode 100644
index 000000000000..6dfe6a044354
--- /dev/null
+++ b/tests/data/scripts/realm/fail-realm
@@ -0,0 +1,17 @@
+# Test authentication failure with different realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache realm=%0
+
+[run]
+    authenticate = PAM_AUTHINFO_UNAVAIL
+
+[output]
+    NOTICE authentication failure; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/realm/fail-user-realm b/tests/data/scripts/realm/fail-user-realm
new file mode 100644
index 000000000000..c97324c2d028
--- /dev/null
+++ b/tests/data/scripts/realm/fail-user-realm
@@ -0,0 +1,18 @@
+# Test authentication failure with different user_realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache user_realm=%0
+
+[run]
+    authenticate = PAM_AUTH_ERR
+
+[output]
+    ERR /^\(user %u\) cannot convert principal to user: /
+    NOTICE failed authorization check; logname=%u uid=%i euid=%i tty= ruser= rhost=
diff --git a/tests/data/scripts/realm/pass-realm b/tests/data/scripts/realm/pass-realm
new file mode 100644
index 000000000000..91136c9bfc1c
--- /dev/null
+++ b/tests/data/scripts/realm/pass-realm
@@ -0,0 +1,17 @@
+# Test authentication success with different realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache realm=%0
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u@%0
diff --git a/tests/data/scripts/realm/pass-user-realm b/tests/data/scripts/realm/pass-user-realm
new file mode 100644
index 000000000000..86007c2d4d26
--- /dev/null
+++ b/tests/data/scripts/realm/pass-user-realm
@@ -0,0 +1,17 @@
+# Test authentication success with different user_realm.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2020 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010-2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# SPDX-License-Identifier: BSD-3-clause or GPL-1+
+
+[options]
+    auth = force_first_pass no_ccache user_realm=%0
+
+[run]
+    authenticate = PAM_SUCCESS
+
+[output]
+    INFO user %u authenticated as %u@%0