2 * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadm5_locl.h"
35 #include <sys/types.h>
36 #include <sys/socket.h>
37 #include <netinet/in.h>
40 RCSID("$Id: init_c.c 21972 2007-10-18 19:11:15Z lha $");
43 set_funcs(kadm5_client_context *c)
45 #define SET(C, F) (C)->funcs.F = kadm5 ## _c_ ## F
46 SET(c, chpass_principal);
47 SET(c, chpass_principal_with_key);
48 SET(c, create_principal);
49 SET(c, delete_principal);
52 SET(c, get_principal);
53 SET(c, get_principals);
55 SET(c, modify_principal);
56 SET(c, randkey_principal);
57 SET(c, rename_principal);
61 _kadm5_c_init_context(kadm5_client_context **ctx,
62 kadm5_config_params *params,
68 *ctx = malloc(sizeof(**ctx));
71 memset(*ctx, 0, sizeof(**ctx));
72 krb5_add_et_list (context, initialize_kadm5_error_table_r);
74 (*ctx)->context = context;
75 if(params->mask & KADM5_CONFIG_REALM) {
77 (*ctx)->realm = strdup(params->realm);
78 if ((*ctx)->realm == NULL)
81 ret = krb5_get_default_realm((*ctx)->context, &(*ctx)->realm);
86 if(params->mask & KADM5_CONFIG_ADMIN_SERVER)
87 (*ctx)->admin_server = strdup(params->admin_server);
91 ret = krb5_get_krb_admin_hst (context, &(*ctx)->realm, &hostlist);
97 (*ctx)->admin_server = strdup(*hostlist);
98 krb5_free_krbhst (context, hostlist);
101 if ((*ctx)->admin_server == NULL) {
106 colon = strchr ((*ctx)->admin_server, ':');
110 (*ctx)->kadmind_port = 0;
112 if(params->mask & KADM5_CONFIG_KADMIND_PORT)
113 (*ctx)->kadmind_port = params->kadmind_port;
114 else if (colon != NULL) {
117 (*ctx)->kadmind_port = htons(strtol (colon, &end, 0));
119 if ((*ctx)->kadmind_port == 0)
120 (*ctx)->kadmind_port = krb5_getportbyname (context, "kerberos-adm",
125 static krb5_error_code
126 get_kadm_ticket(krb5_context context,
128 krb5_principal client,
129 const char *server_name)
134 memset(&in, 0, sizeof(in));
136 ret = krb5_parse_name(context, server_name, &in.server);
139 ret = krb5_get_credentials(context, 0, id, &in, &out);
141 krb5_free_creds(context, out);
142 krb5_free_principal(context, in.server);
146 static krb5_error_code
147 get_new_cache(krb5_context context,
148 krb5_principal client,
149 const char *password,
150 krb5_prompter_fct prompter,
152 const char *server_name,
153 krb5_ccache *ret_cache)
157 krb5_get_init_creds_opt *opt;
160 ret = krb5_get_init_creds_opt_alloc (context, &opt);
164 krb5_get_init_creds_opt_set_default_flags(context, "kadmin",
165 krb5_principal_get_realm(context,
170 krb5_get_init_creds_opt_set_forwardable (opt, FALSE);
171 krb5_get_init_creds_opt_set_proxiable (opt, FALSE);
173 if(password == NULL && prompter == NULL) {
176 ret = krb5_kt_default(context, &kt);
178 ret = krb5_kt_resolve(context, keytab, &kt);
180 krb5_get_init_creds_opt_free(context, opt);
183 ret = krb5_get_init_creds_keytab (context,
190 krb5_kt_close(context, kt);
192 ret = krb5_get_init_creds_password (context,
202 krb5_get_init_creds_opt_free(context, opt);
206 case KRB5_LIBOS_PWDINTR: /* don't print anything if it was just C-c:ed */
207 case KRB5KRB_AP_ERR_BAD_INTEGRITY:
208 case KRB5KRB_AP_ERR_MODIFIED:
209 return KADM5_BAD_PASSWORD;
213 ret = krb5_cc_gen_new(context, &krb5_mcc_ops, &id);
216 ret = krb5_cc_initialize (context, id, cred.client);
219 ret = krb5_cc_store_cred (context, id, &cred);
222 krb5_free_cred_contents (context, &cred);
228 * Check the credential cache `id´ to figure out what principal to use
229 * when talking to the kadmind. If there is a initial kadmin/admin@
230 * credential in the cache, use that client principal. Otherwise, use
231 * the client principals first component and add /admin to the
235 static krb5_error_code
236 get_cache_principal(krb5_context context,
238 krb5_principal *client)
241 const char *name, *inst;
242 krb5_principal p1, p2;
244 ret = krb5_cc_default(context, id);
250 ret = krb5_cc_get_principal(context, *id, &p1);
252 krb5_cc_close(context, *id);
257 ret = krb5_make_principal(context, &p2, NULL,
258 "kadmin", "admin", NULL);
260 krb5_cc_close(context, *id);
262 krb5_free_principal(context, p1);
268 krb5_kdc_flags flags;
271 memset(&in, 0, sizeof(in));
276 /* check for initial ticket kadmin/admin */
277 ret = krb5_get_credentials_with_flags(context, KRB5_GC_CACHED, flags,
279 krb5_free_principal(context, p2);
281 if (out->flags.b.initial) {
283 krb5_free_creds(context, out);
286 krb5_free_creds(context, out);
289 krb5_cc_close(context, *id);
292 name = krb5_principal_get_comp_string(context, p1, 0);
293 inst = krb5_principal_get_comp_string(context, p1, 1);
294 if(inst == NULL || strcmp(inst, "admin") != 0) {
295 ret = krb5_make_principal(context, &p2, NULL, name, "admin", NULL);
296 krb5_free_principal(context, p1);
310 _kadm5_c_get_cred_cache(krb5_context context,
311 const char *client_name,
312 const char *server_name,
313 const char *password,
314 krb5_prompter_fct prompter,
317 krb5_ccache *ret_cache)
320 krb5_ccache id = NULL;
321 krb5_principal default_client = NULL, client = NULL;
323 /* treat empty password as NULL */
324 if(password && *password == '\0')
326 if(server_name == NULL)
327 server_name = KADM5_ADMIN_SERVICE;
329 if(client_name != NULL) {
330 ret = krb5_parse_name(context, client_name, &client);
337 ret = krb5_cc_get_principal(context, id, &client);
341 /* get principal from default cache, ok if this doesn't work */
343 ret = get_cache_principal(context, &id, &default_client);
346 * No client was specified by the caller and we cannot
347 * determine the client from a credentials cache.
351 user = get_default_username ();
354 krb5_set_error_string(context, "Unable to find local user name");
355 return KADM5_FAILURE;
357 ret = krb5_make_principal(context, &default_client,
358 NULL, user, "admin", NULL);
366 * No client was specified by the caller, but we have a client
367 * from the default credentials cache.
369 if (client == NULL && default_client != NULL)
370 client = default_client;
373 if(id && (default_client == NULL ||
374 krb5_principal_compare(context, client, default_client))) {
375 ret = get_kadm_ticket(context, id, client, server_name);
378 krb5_free_principal(context, default_client);
379 if (default_client != client)
380 krb5_free_principal(context, client);
384 /* couldn't get ticket from cache */
387 /* get creds via AS request */
388 if(id && (id != ccache))
389 krb5_cc_close(context, id);
390 if (client != default_client)
391 krb5_free_principal(context, default_client);
393 ret = get_new_cache(context, client, password, prompter, keytab,
394 server_name, ret_cache);
395 krb5_free_principal(context, client);
400 kadm_connect(kadm5_client_context *ctx)
403 krb5_principal server;
406 struct addrinfo *ai, *a;
407 struct addrinfo hints;
409 char portstr[NI_MAXSERV];
410 char *hostname, *slash;
412 krb5_context context = ctx->context;
414 memset (&hints, 0, sizeof(hints));
415 hints.ai_socktype = SOCK_STREAM;
416 hints.ai_protocol = IPPROTO_TCP;
418 snprintf (portstr, sizeof(portstr), "%u", ntohs(ctx->kadmind_port));
420 hostname = ctx->admin_server;
421 slash = strchr (hostname, '/');
423 hostname = slash + 1;
425 error = getaddrinfo (hostname, portstr, &hints, &ai);
427 krb5_clear_error_string(context);
428 return KADM5_BAD_SERVER_NAME;
431 for (a = ai; a != NULL; a = a->ai_next) {
432 s = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
435 if (connect (s, a->ai_addr, a->ai_addrlen) < 0) {
436 krb5_clear_error_string(context);
437 krb5_warn (context, errno, "connect(%s)", hostname);
445 krb5_clear_error_string(context);
446 krb5_warnx (context, "failed to contact %s", hostname);
447 return KADM5_FAILURE;
449 ret = _kadm5_c_get_cred_cache(context,
452 NULL, ctx->prompter, ctx->keytab,
462 asprintf(&service_name, "%s@%s", KADM5_ADMIN_SERVICE, ctx->realm);
464 asprintf(&service_name, "%s", KADM5_ADMIN_SERVICE);
466 if (service_name == NULL) {
469 krb5_clear_error_string(context);
473 ret = krb5_parse_name(context, service_name, &server);
477 if(ctx->ccache == NULL)
478 krb5_cc_close(context, cc);
484 ret = krb5_sendauth(context, &ctx->ac, &s,
485 KADMIN_APPL_VERSION, NULL,
486 server, AP_OPTS_MUTUAL_REQUIRED,
487 NULL, NULL, cc, NULL, NULL, NULL);
490 kadm5_config_params p;
491 memset(&p, 0, sizeof(p));
493 p.mask |= KADM5_CONFIG_REALM;
494 p.realm = ctx->realm;
496 ret = _kadm5_marshal_params(context, &p, ¶ms);
498 ret = krb5_write_priv_message(context, ctx->ac, &s, ¶ms);
499 krb5_data_free(¶ms);
503 if(ctx->ccache == NULL)
504 krb5_cc_close(context, cc);
507 } else if(ret == KRB5_SENDAUTH_BADAPPLVERS) {
510 s = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
513 krb5_clear_error_string(context);
516 if (connect (s, a->ai_addr, a->ai_addrlen) < 0) {
519 krb5_clear_error_string(context);
522 ret = krb5_sendauth(context, &ctx->ac, &s,
523 KADMIN_OLD_APPL_VERSION, NULL,
524 server, AP_OPTS_MUTUAL_REQUIRED,
525 NULL, NULL, cc, NULL, NULL, NULL);
533 krb5_free_principal(context, server);
534 if(ctx->ccache == NULL)
535 krb5_cc_close(context, cc);
542 _kadm5_connect(void *handle)
544 kadm5_client_context *ctx = handle;
546 return kadm_connect(ctx);
551 kadm5_c_init_with_context(krb5_context context,
552 const char *client_name,
553 const char *password,
554 krb5_prompter_fct prompter,
557 const char *service_name,
558 kadm5_config_params *realm_params,
559 unsigned long struct_version,
560 unsigned long api_version,
561 void **server_handle)
564 kadm5_client_context *ctx;
567 ret = _kadm5_c_init_context(&ctx, realm_params, context);
571 if(password != NULL && *password != '\0') {
572 ret = _kadm5_c_get_cred_cache(context,
575 password, prompter, keytab, ccache, &cc);
577 return ret; /* XXX */
582 if (client_name != NULL)
583 ctx->client_name = strdup(client_name);
585 ctx->client_name = NULL;
586 if (service_name != NULL)
587 ctx->service_name = strdup(service_name);
589 ctx->service_name = NULL;
590 ctx->prompter = prompter;
591 ctx->keytab = keytab;
592 ctx->ccache = ccache;
593 /* maybe we should copy the params here */
596 *server_handle = ctx;
601 init_context(const char *client_name,
602 const char *password,
603 krb5_prompter_fct prompter,
606 const char *service_name,
607 kadm5_config_params *realm_params,
608 unsigned long struct_version,
609 unsigned long api_version,
610 void **server_handle)
612 krb5_context context;
614 kadm5_server_context *ctx;
616 ret = krb5_init_context(&context);
619 ret = kadm5_c_init_with_context(context,
631 krb5_free_context(context);
634 ctx = *server_handle;
640 kadm5_c_init_with_password_ctx(krb5_context context,
641 const char *client_name,
642 const char *password,
643 const char *service_name,
644 kadm5_config_params *realm_params,
645 unsigned long struct_version,
646 unsigned long api_version,
647 void **server_handle)
649 return kadm5_c_init_with_context(context,
663 kadm5_c_init_with_password(const char *client_name,
664 const char *password,
665 const char *service_name,
666 kadm5_config_params *realm_params,
667 unsigned long struct_version,
668 unsigned long api_version,
669 void **server_handle)
671 return init_context(client_name,
684 kadm5_c_init_with_skey_ctx(krb5_context context,
685 const char *client_name,
687 const char *service_name,
688 kadm5_config_params *realm_params,
689 unsigned long struct_version,
690 unsigned long api_version,
691 void **server_handle)
693 return kadm5_c_init_with_context(context,
708 kadm5_c_init_with_skey(const char *client_name,
710 const char *service_name,
711 kadm5_config_params *realm_params,
712 unsigned long struct_version,
713 unsigned long api_version,
714 void **server_handle)
716 return init_context(client_name,
729 kadm5_c_init_with_creds_ctx(krb5_context context,
730 const char *client_name,
732 const char *service_name,
733 kadm5_config_params *realm_params,
734 unsigned long struct_version,
735 unsigned long api_version,
736 void **server_handle)
738 return kadm5_c_init_with_context(context,
752 kadm5_c_init_with_creds(const char *client_name,
754 const char *service_name,
755 kadm5_config_params *realm_params,
756 unsigned long struct_version,
757 unsigned long api_version,
758 void **server_handle)
760 return init_context(client_name,
774 kadm5_init(char *client_name, char *pass,
776 kadm5_config_params *realm_params,
777 unsigned long struct_version,
778 unsigned long api_version,
779 void **server_handle)