Ticket History #5610: NIM password prompt does not identify itself

This patch solves the titlebar problem by putting the explanatory
prompt in the dialog. It uses two registry settings:

PluginManager/NameSpaceName: The word 'Kerberos' which is prepended
to the Username input label.

PluginManager/NewCredPromptText: 'Enter your Kerberos password.'

Either registry entry can be omitted.

This patch embeds knowledge of the New Cedentials dialog in the krb5
plugin, which is not a valid long term solution. Why? The patch or
something like it needs to be included in KfW 3.2.2 before midweek.


C:\KfW\pismere\athena\auth\krb5\src\windows\identity>svn diff
plugins\krb5\krb5identpro.c
Index: plugins/krb5/krb5identpro.c
===================================================================
--- plugins/krb5/krb5identpro.c (revision 19911)
+++ plugins/krb5/krb5identpro.c (working copy)
@@ -31,7 +31,11 @@
#include<strsafe.h>
#include<krb5.h>
#include<assert.h>
+#include <string.h>

+#include <memory.h>
+#include <wchar.h>
+
#define K5_NCID_UN_LABEL (KHUI_CW_ID_MIN + 0)
#define K5_NCID_UN (KHUI_CW_ID_MIN + 1)
#define K5_NCID_REALM_LABEL (KHUI_CW_ID_MIN + 2)
@@ -49,6 +53,8 @@
HWND hw_realm;
} k5_new_cred_data;

+#define IDC_ENTUNAME 1145 /* Hack! */
+
static
void
trim_str(wchar_t * s, khm_size cch) {
@@ -397,6 +403,7 @@
return FALSE;
}

+
/* UI Callback

runs in UI thread */
@@ -427,6 +434,12 @@
khm_int32 rv;
khm_handle hident;

+ khm_handle csp_pm = NULL;
+ wchar_t namespace[KCONF_MAXCCH_NAME];
+ khm_size cbsize;
+ wchar_t promptText[KCONF_MAXCCH_NAME];
+ HWND hw_prompt;
+
hw_parent = (HWND) lParam;
defident[0] = L'\0';

@@ -435,6 +448,16 @@
assert(hw_parent != NULL);
#endif

+ if (!KHM_FAILED(khc_open_space(NULL, L"PluginManager",
KHM_PERM_READ, &csp_pm))) {
+ ZeroMemory(namespace, sizeof(namespace) * sizeof
(wchar_t));
+ ZeroMemory(promptText, sizeof(promptText) * sizeof
(wchar_t));
+ cbsize = sizeof(namespace);
+ khc_read_string(csp_pm, L"NameSpaceName", namespace,
&cbsize);
+ cbsize = sizeof(promptText);
+ khc_read_string(csp_pm, L"NewCredPromptText",
promptText, &cbsize);
+ khc_close_space(csp_pm);
+ }
+
d = PMALLOC(sizeof(*d));
assert(d);
ZeroMemory(d, sizeof(*d));
@@ -446,10 +469,17 @@
LoadString(hResModule, IDS_NC_USERNAME,
wbuf, ARRAYLENGTH(wbuf));

+ /* Find and set IDC_ENTUNAME: */
+ hw_prompt = GetDlgItem(hw_parent, IDC_ENTUNAME);
+ if (hw_prompt) SendMessage(hw_prompt, WM_SETTEXT, 0,
(LPARAM)promptText);
+
+ /* Build up username prompt from NameSpaceName and
Username: */
+ wcsncat(namespace, wbuf, KCONF_MAXCCH_NAME);
+
d->hw_username_label = CreateWindow
(L"STATIC",
- wbuf,
- SS_SIMPLE | WS_CHILD | WS_VISIBLE,
+ namespace,
+ WS_CHILD | WS_VISIBLE,
0, 0, 100, 100, /* bogus values */
hw_parent,
(HMENU) K5_NCID_UN_LABEL,
@@ -713,6 +743,7 @@
WM_SETTEXT,
0,
(LPARAM) defident);
+
}

set_identity_from_ui(nc, d);


C:\KfW\pismere\athena\auth\krb5\src\windows\identity>svn diff
ui/resource.h
Index: ui/resource.h
===================================================================
--- ui/resource.h (revision 19911)
+++ ui/resource.h (working copy)
@@ -1,6 +1,6 @@
//{{NO_DEPENDENCIES}}
// Microsoft Visual C++ generated include file.
-// Used by C:\work\pismere\athena\auth\krb5
\src\windows\identity\ui\lang\en_us\khapp.rc
+// Used by C:\KfW\pismere\athena\auth\krb5
\src\windows\identity\ui\lang\en_us\khapp.rc
//
#define IDI_MAIN_APP 104
#define IDD_PP_CRED 106
@@ -397,6 +397,7 @@
#define IDC_CFG_NOTACT_STATIC 1142
#define IDC_NC_BASIC 1143
#define IDC_CONTENT 1144
+#define IDC_ENTUNAME 1145
#define IDA_ACTIVATE_MENU 40003
#define IDA_UP 40004
#define IDA_DOWN 40005
@@ -411,7 +412,7 @@
#ifndef APSTUDIO_READONLY_SYMBOLS
#define _APS_NEXT_RESOURCE_VALUE 214
#define _APS_NEXT_COMMAND_VALUE 40010
-#define _APS_NEXT_CONTROL_VALUE 1145
+#define _APS_NEXT_CONTROL_VALUE 1146
#define _APS_NEXT_SYMED_VALUE 101
#endif
#endif

khapp.rc was editted with Visual Studio so the line wraps are
different. A prompt line was added to the new credentials dialog and
the BBAR OK button was made the same height as the other buttons. svn
diff crashes.

Since these settings are specific to the Kerberos 5 plug-in, they should
go under PluginManager/Plugins/Krb5Cred/Parameters . Note that both
Krb5Ident and Krb5Cred plug-ins share the same configuration space since
they use the same configuration settings.

...
...

The labels used for password prompting are provided by the Kerberos 5
plug-in. If you want to change the text of these labels, you should do
so at k5_kinit_prompter() and k5_cached_kinit_prompter() in
krb5newcreds.c before the label text is provided to NIM.

Doing it this way can cause problems for a few reasons. The control IDs
for controls in the new credentials dialog can change. Also, the
plug-in doesn't always know that what it's prompting for is a password,
which is why we use the prompt string provided by the KDC.

If the registry settings are optional, you should check for their
existence before using their values. The code seems to assume they
always exist.


I sometimes use Visual Studio for editing the .rc files as well. You'll
have to use something else to fix line endings after saving the files
with VS.

- Asanka Herath
Secure-Endpoints Inc.

[asanka - Mon Sep 24 17:10:18 2007]:


Also please remember, whenever you add new registry values, they must be
added to the schema.

Thanks for the reminder about the csv file.

C:\KfW\pismere\athena\auth\krb5\src\windows\identity>svn diff -x --
ignore-eol-style plugins\krb5\krbconfig.csv
Index: plugins/krb5/krbconfig.csv
===================================================================
--- plugins/krb5/krbconfig.csv (revision 19911)
+++ plugins/krb5/krbconfig.csv (working copy)
@@ -25,6 +25,8 @@
LRURealms,KC_STRING,,
LRUPrincipals,KC_STRING,,
LastDefaultIdent,KC_STRING,,Last known default identity
+ NameSpaceName,KC_STRING,,The name of the service NIM presents to
the user. Typically 'Kerberos ' if given at all. Prepended
to 'Username' in the NewCreds
Username input label
+ NewCredPromptText,KC_STRING,,The prompt sentence at the top of
the New Creds dialog
PromptCacheLifetime,KC_INT32,172800,Lifetime of the prompt cache
in seconds
DefaultCCName,KC_STRING,,Default CC name (only per identity)
DefaultToFileCache,KC_INT32,0,"If no DefaultCCName is specified
for an identity, use a generated FILE: cache instead of an API: cache"


C:\KfW\pismere\athena\auth\krb5\src\windows\identity>svn diff -x --
ignore-eol-style plugins\krb5\krb5identpro.c
Index: plugins/krb5/krb5identpro.c
===================================================================
--- plugins/krb5/krb5identpro.c (revision 19911)
+++ plugins/krb5/krb5identpro.c (working copy)
@@ -31,6 +31,7 @@
#include<strsafe.h>
#include<krb5.h>
#include<assert.h>
+#include <string.h>

#define K5_NCID_UN_LABEL (KHUI_CW_ID_MIN + 0)
#define K5_NCID_UN (KHUI_CW_ID_MIN + 1)
@@ -49,6 +50,8 @@
HWND hw_realm;
} k5_new_cred_data;

+#define IDC_ENTUNAME 1145 /* Hack! */
+
static
void
trim_str(wchar_t * s, khm_size cch) {
@@ -397,6 +400,7 @@
return FALSE;
}

+
/* UI Callback

runs in UI thread */
@@ -427,6 +431,12 @@
khm_int32 rv;
khm_handle hident;

+ khm_handle csp_pm = NULL;
+ wchar_t namespace[KCONF_MAXCCH_NAME];
+ khm_size cbsize;
+ wchar_t promptText[KCONF_MAXCCH_NAME];
+ HWND hw_prompt;
+
hw_parent = (HWND) lParam;
defident[0] = L'\0';

@@ -435,6 +445,19 @@
assert(hw_parent != NULL);
#endif

+ ZeroMemory(namespace, sizeof(namespace) * sizeof
(wchar_t));
+ ZeroMemory(promptText, sizeof(promptText) * sizeof
(wchar_t));
+ if (!KHM_FAILED(khc_open_space(NULL,
L"PluginManager\\Plugins\\Krb5Cred\\Parameters",
+ KHM_PERM_READ, &csp_pm))) {
+ cbsize = sizeof(namespace);
+ khc_read_string(csp_pm, L"NameSpaceName", namespace,
&cbsize);
+
+ cbsize = sizeof(promptText);
+ khc_read_string(csp_pm, L"NewCredPromptText",
promptText, &cbsize);
+
+ khc_close_space(csp_pm);
+ }
+
d = PMALLOC(sizeof(*d));
assert(d);
ZeroMemory(d, sizeof(*d));
@@ -446,10 +469,17 @@
LoadString(hResModule, IDS_NC_USERNAME,
wbuf, ARRAYLENGTH(wbuf));

+ /* Find and set IDC_ENTUNAME: */
+ hw_prompt = GetDlgItem(hw_parent, IDC_ENTUNAME);
+ if (hw_prompt) SendMessage(hw_prompt, WM_SETTEXT, 0,
(LPARAM)promptText);
+
+ /* Build up username prompt from NameSpaceName and
Username: */
+ wcsncat(namespace, wbuf, KCONF_MAXCCH_NAME);
+
d->hw_username_label = CreateWindow
(L"STATIC",
- wbuf,
- SS_SIMPLE | WS_CHILD | WS_VISIBLE,
+ namespace,
+ WS_CHILD | WS_VISIBLE,
0, 0, 100, 100, /* bogus values */
hw_parent,
(HMENU) K5_NCID_UN_LABEL,
@@ -713,6 +743,7 @@
WM_SETTEXT,
0,
(LPARAM) defident);
+
}

set_identity_from_ui(nc, d);