1 dnl Checks for Kerberos
2 dnl NOTE: while we intend to do generic gss-api, currently we
3 dnl have a requirement to get an initial Kerberos machine
4 dnl credential. Thus, the requirement for Kerberos.
5 dnl The Kerberos gssapi library will be dynamically loaded?
6 AC_DEFUN([AC_KERBEROS_V5],[
7 AC_MSG_CHECKING(for Kerberos v5)
9 [AS_HELP_STRING([--with-krb5=DIR], [use Kerberos v5 installation in DIR])],
20 for dir in $krb5_with /usr /usr/kerberos /usr/local /usr/local/krb5 \
21 /usr/krb5 /usr/heimdal /usr/local/heimdal /usr/athena ; do
22 dnl This ugly hack brought on by the split installation of
23 dnl MIT Kerberos on Fedora Core 1
25 if test -f $dir/bin/krb5-config; then
26 K5CONFIG=$dir/bin/krb5-config
27 elif test -f "/usr/kerberos/bin/krb5-config"; then
28 K5CONFIG="/usr/kerberos/bin/krb5-config"
29 elif test -f "/usr/lib/mit/bin/krb5-config"; then
30 K5CONFIG="/usr/lib/mit/bin/krb5-config"
32 if test "$K5CONFIG" != ""; then
33 KRBCFLAGS=`$K5CONFIG --cflags`
34 KRBLIBS=`$K5CONFIG --libs gssapi`
35 K5VERS=`$K5CONFIG --version | head -n 1 | awk '{split($(4),v,"."); if (v@<:@"3"@:>@ == "") v@<:@"3"@:>@ = "0"; print v@<:@"1"@:>@v@<:@"2"@:>@v@<:@"3"@:>@ }'`
36 AC_DEFINE_UNQUOTED(KRB5_VERSION, $K5VERS, [Define this as the Kerberos version number])
37 sub_dir=`pkg-config --variable=libdir krb5 | sed "s#^$dir/##"`
38 if test -f $dir/include/gssapi/gssapi_krb5.h -a \
39 \( -f $dir/$sub_dir/libgssapi_krb5.a -o \
40 -f $dir/$sub_dir/libgssapi_krb5.so \) ; then
42 dnl If we are using MIT K5 1.3.1 and before, we *MUST* use the
43 dnl private function (gss_krb5_ccache_name) to get correct
44 dnl behavior of changing the ccache used by gssapi.
45 dnl Starting in 1.3.2, we *DO NOT* want to use
46 dnl gss_krb5_ccache_name, instead we want to set KRB5CCNAME
47 dnl to get gssapi to use a different ccache
48 if test $K5VERS -le 131; then
49 AC_DEFINE(USE_GSS_KRB5_CCACHE_NAME, 1, [Define this if the private function, gss_krb5_cache_name, must be used to tell the Kerberos library which credentials cache to use. Otherwise, this is done by setting the KRB5CCNAME environment variable])
51 gssapi_lib=gssapi_krb5
53 dnl The following ugly hack brought on by the split installation
54 dnl of Heimdal Kerberos on SuSe
55 elif test \( -f $dir/include/heim_err.h -o\
56 -f $dir/include/heimdal/heim_err.h \) -a \
57 -f $dir/lib/libroken.a; then
58 AC_DEFINE(HAVE_HEIMDAL, 1, [Define this if you have Heimdal Kerberos libraries])
65 dnl We didn't find a usable Kerberos environment
66 if test "x$require_krb5" = "xyes" -a "x$KRBDIR" = "x"; then
67 if test "x$krb5_with" = "x"; then
70 Kerberos v5 with GSS support not found: consider --disable-gss or --with-krb5=
75 Kerberos v5 with GSS support not found at $krb5_with
80 if test "x$KRBDIR" != "x"; then
82 AC_MSG_RESULT($KRBDIR)
84 dnl Check if -rpath=$(KRBDIR)/lib is needed
85 echo "The current KRBDIR is $KRBDIR"
86 if test "$KRBDIR/lib" = "/lib" -o "$KRBDIR/lib" = "/usr/lib" \
87 -o "$KRBDIR/lib" = "//lib" -o "$KRBDIR/lib" = "/usr//lib" ; then
89 elif /sbin/ldconfig -p | grep > /dev/null "=> $KRBDIR/lib/"; then
92 KRBLDFLAGS="-Wl,-rpath=$KRBDIR/lib"
95 dnl Now check for functions within gssapi library
96 AC_CHECK_LIB($gssapi_lib, gss_krb5_set_allowable_enctypes,
97 AC_DEFINE(HAVE_SET_ALLOWABLE_ENCTYPES, 1, [Define this if the Kerberos GSS library supports gss_krb5_set_allowable_enctypes]), ,$KRBLIBS)
98 AC_CHECK_LIB($gssapi_lib, gss_krb5_ccache_name,
99 AC_DEFINE(HAVE_GSS_KRB5_CCACHE_NAME, 1, [Define this if the Kerberos GSS library supports gss_krb5_ccache_name]), ,$KRBLIBS)
101 dnl Check for newer error message facility
102 AC_CHECK_LIB($gssapi_lib, krb5_get_error_message,
103 AC_DEFINE(HAVE_KRB5_GET_ERROR_MESSAGE, 1, [Define this if the function krb5_get_error_message is available]), ,$KRBLIBS)
105 dnl Check for function to specify addressless tickets
106 AC_CHECK_LIB($gssapi_lib, krb5_get_init_creds_opt_set_addressless,
107 AC_DEFINE(HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS, 1, [Define this if the function krb5_get_init_creds_opt_set_addressless is available]), ,$KRBLIBS)
109 dnl Check for krb5int_derive_key
110 AC_CHECK_LIB($gssapi_lib, krb5int_derive_key,
111 [HAVE_KRB5INT_DERIVE_KEY=1; AC_DEFINE(HAVE_KRB5INT_DERIVE_KEY, 1, [Define this if the function krb5int_derive_key is available])], ,$KRBLIBS)
113 dnl Version 1.15 introduced aes-sha2 support, which changes the
114 dnl number of paramters of function krb5int_derive_key.
115 if test $K5VERS -ge 1150; then
116 AC_DEFINE(HAVE_AES_SHA2_SUPPORT, 1,
117 [aes-sha2 is supported by krb5])
120 dnl Check for krb5_derive_key
121 AC_CHECK_LIB($gssapi_lib, krb5_derive_key,
122 [HAVE_KRB5_DERIVE_KEY=1; AC_DEFINE(HAVE_KRB5_DERIVE_KEY, 1, [Define this if the function krb5_derive_key is available])], ,$KRBLIBS)
124 AS_IF([test "x$HAVE_KRB5INT_DERIVE_KEY" = "x1" -o "x$HAVE_KRB5_DERIVE_KEY" = "x1"],
125 [AC_DEFINE(HAVE_KRB5, 1, [Define this if you have MIT Kerberos libraries])],
126 [KRBDIR=""; AC_MSG_WARN([
128 Disable gss/krb5 due to missing both
129 krb5int_derive_key and krb5_derive_key functions!
133 dnl Version 1.18 removed support for all DES3 enctypes (des3-cbc-raw,
134 dnl des3-hmac-sha1, des3-cbc-sha1-kd).
135 AC_MSG_CHECKING([for DES3 enctype support by krb5])
136 if test $K5VERS -lt 1180; then
137 AC_DEFINE(HAVE_DES3_SUPPORT, 1,
138 [DES3 enctype is supported by krb5])
144 dnl If they specified a directory and it didn't work, give them a warning
145 if test "x$krb5_with" != "x" -a "$krb5_with" != "$KRBDIR"; then
148 Using $KRBDIR instead of requested value of $krb5_with for Kerberos!
154 AC_SUBST([KRBCFLAGS])
155 AC_SUBST([KRBLDFLAGS])
159 AC_MSG_RESULT([not found!])
160 fi # "x$KRBDIR" != "x"