2 * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadm5_locl.h"
35 #include <sys/types.h>
36 #include <sys/socket.h>
37 #include <netinet/in.h>
40 RCSID("$Id: init_c.c,v 1.35 2000/01/28 03:20:18 assar Exp $");
43 set_funcs(kadm5_client_context *c)
45 #define SET(C, F) (C)->funcs.F = kadm5 ## _c_ ## F
46 SET(c, chpass_principal);
47 SET(c, chpass_principal);
48 SET(c, create_principal);
49 SET(c, delete_principal);
52 SET(c, get_principal);
53 SET(c, get_principals);
55 SET(c, modify_principal);
56 SET(c, randkey_principal);
57 SET(c, rename_principal);
61 _kadm5_c_init_context(kadm5_client_context **ctx,
62 kadm5_config_params *params,
68 *ctx = malloc(sizeof(**ctx));
71 memset(*ctx, 0, sizeof(**ctx));
72 krb5_add_et_list (context, initialize_kadm5_error_table_r);
74 (*ctx)->context = context;
75 if(params->mask & KADM5_CONFIG_REALM)
76 (*ctx)->realm = strdup(params->realm);
78 krb5_get_default_realm((*ctx)->context, &(*ctx)->realm);
79 if(params->mask & KADM5_CONFIG_ADMIN_SERVER)
80 (*ctx)->admin_server = strdup(params->admin_server);
84 ret = krb5_get_krb_admin_hst (context, &(*ctx)->realm, &hostlist);
87 (*ctx)->admin_server = strdup(*hostlist);
88 krb5_free_krbhst (context, hostlist);
91 if ((*ctx)->admin_server == NULL)
93 colon = strchr ((*ctx)->admin_server, ':');
97 (*ctx)->kadmind_port = 0;
99 if(params->mask & KADM5_CONFIG_KADMIND_PORT)
100 (*ctx)->kadmind_port = params->kadmind_port;
101 else if (colon != NULL) {
104 (*ctx)->kadmind_port = htons(strtol (colon, &end, 0));
106 if ((*ctx)->kadmind_port == 0)
107 (*ctx)->kadmind_port = krb5_getportbyname (context, "kerberos-adm",
112 static krb5_error_code
113 get_kadm_ticket(krb5_context context,
115 krb5_principal client,
116 const char *server_name)
121 memset(&in, 0, sizeof(in));
123 ret = krb5_parse_name(context, server_name, &in.server);
126 ret = krb5_get_credentials(context, 0, id, &in, &out);
128 krb5_free_creds(context, out);
129 krb5_free_principal(context, in.server);
133 static krb5_error_code
134 get_new_cache(krb5_context context,
135 krb5_principal client,
136 const char *password,
137 krb5_prompter_fct prompter,
139 const char *server_name,
140 krb5_ccache *ret_cache)
144 krb5_get_init_creds_opt opt;
147 krb5_get_init_creds_opt_init (&opt);
148 krb5_get_init_creds_opt_set_forwardable (&opt, FALSE);
149 krb5_get_init_creds_opt_set_proxiable (&opt, FALSE);
151 if(password == NULL && prompter == NULL) {
154 ret = krb5_kt_default(context, &kt);
156 ret = krb5_kt_resolve(context, keytab, &kt);
159 ret = krb5_get_init_creds_keytab (context,
166 krb5_kt_close(context, kt);
168 ret = krb5_get_init_creds_password (context,
181 case KRB5_LIBOS_PWDINTR: /* don't print anything if it was just C-c:ed */
182 case KRB5KRB_AP_ERR_BAD_INTEGRITY:
183 case KRB5KRB_AP_ERR_MODIFIED:
184 return KADM5_BAD_PASSWORD;
188 ret = krb5_cc_gen_new(context, &krb5_mcc_ops, &id);
191 ret = krb5_cc_initialize (context, id, cred.client);
194 ret = krb5_cc_store_cred (context, id, &cred);
197 krb5_free_creds_contents (context, &cred);
202 static krb5_error_code
203 get_cred_cache(krb5_context context,
204 const char *client_name,
205 const char *server_name,
206 const char *password,
207 krb5_prompter_fct prompter,
210 krb5_ccache *ret_cache)
213 krb5_ccache id = NULL;
214 krb5_principal default_client = NULL, client = NULL;
216 /* treat empty password as NULL */
217 if(password && *password == '\0')
219 if(server_name == NULL)
220 server_name = KADM5_ADMIN_SERVICE;
222 if(client_name != NULL) {
223 ret = krb5_parse_name(context, client_name, &client);
228 if(password != NULL || prompter != NULL) {
229 /* get principal from default cache, ok if this doesn't work */
230 ret = krb5_cc_default(context, &id);
232 ret = krb5_cc_get_principal(context, id, &default_client);
234 krb5_cc_close(context, id);
240 client = default_client;
244 user = get_default_username ();
247 return KADM5_FAILURE;
248 ret = krb5_make_principal(context, &client,
249 NULL, user, "admin", NULL);
253 if(client != default_client) {
254 krb5_free_principal(context, default_client);
255 default_client = NULL;
257 krb5_cc_close(context, id);
261 } else if(ccache != NULL)
265 if(id && (default_client == NULL ||
266 krb5_principal_compare(context, client, default_client))) {
267 ret = get_kadm_ticket(context, id, client, server_name);
270 krb5_free_principal(context, default_client);
271 if (default_client != client)
272 krb5_free_principal(context, client);
276 /* couldn't get ticket from cache */
279 /* get creds via AS request */
281 krb5_cc_close(context, id);
282 if (client != default_client)
283 krb5_free_principal(context, default_client);
285 ret = get_new_cache(context, client, password, prompter, keytab,
286 server_name, ret_cache);
287 krb5_free_principal(context, client);
292 kadm5_c_init_with_context(krb5_context context,
293 const char *client_name,
294 const char *password,
295 krb5_prompter_fct prompter,
298 const char *service_name,
299 kadm5_config_params *realm_params,
300 unsigned long struct_version,
301 unsigned long api_version,
302 void **server_handle)
305 kadm5_client_context *ctx;
306 krb5_principal server;
309 struct addrinfo *ai, *a;
310 struct addrinfo hints;
312 char portstr[NI_MAXSERV];
313 char *hostname, *slash;
315 memset (&hints, 0, sizeof(hints));
316 hints.ai_socktype = SOCK_STREAM;
317 hints.ai_protocol = IPPROTO_TCP;
319 ret = _kadm5_c_init_context(&ctx, realm_params, context);
323 snprintf (portstr, sizeof(portstr), "%u", ntohs(ctx->kadmind_port));
325 hostname = ctx->admin_server;
326 slash = strchr (hostname, '/');
328 hostname = slash + 1;
330 error = getaddrinfo (hostname, portstr, &hints, &ai);
332 return KADM5_BAD_SERVER_NAME;
334 for (a = ai; a != NULL; a = a->ai_next) {
335 s = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
338 if (connect (s, a->ai_addr, a->ai_addrlen) < 0) {
339 krb5_warn (context, errno, "connect(%s)", hostname);
347 krb5_warnx (context, "failed to contact %s", hostname);
348 return KADM5_FAILURE;
350 ret = get_cred_cache(context, client_name, service_name,
351 password, prompter, keytab, ccache, &cc);
358 ret = krb5_parse_name(context, KADM5_ADMIN_SERVICE, &server);
362 krb5_cc_close(context, cc);
368 ret = krb5_sendauth(context, &ctx->ac, &s,
369 KADMIN_APPL_VERSION, NULL,
370 server, AP_OPTS_MUTUAL_REQUIRED,
371 NULL, NULL, cc, NULL, NULL, NULL);
373 krb5_data params, enc_data;
374 ret = _kadm5_marshal_params(context, realm_params, ¶ms);
376 ret = krb5_mk_priv(context,
382 ret = krb5_write_message(context, &s, &enc_data);
384 krb5_data_free(¶ms);
385 krb5_data_free(&enc_data);
386 } else if(ret == KRB5_SENDAUTH_BADAPPLVERS) {
389 s = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
394 if (connect (s, a->ai_addr, a->ai_addrlen) < 0) {
401 ret = krb5_sendauth(context, &ctx->ac, &s,
402 KADMIN_OLD_APPL_VERSION, NULL,
403 server, AP_OPTS_MUTUAL_REQUIRED,
404 NULL, NULL, cc, NULL, NULL, NULL);
412 krb5_free_principal(context, server);
414 krb5_cc_close(context, cc);
420 *server_handle = ctx;
425 init_context(const char *client_name,
426 const char *password,
427 krb5_prompter_fct prompter,
430 const char *service_name,
431 kadm5_config_params *realm_params,
432 unsigned long struct_version,
433 unsigned long api_version,
434 void **server_handle)
436 krb5_context context;
438 kadm5_server_context *ctx;
440 krb5_init_context(&context);
441 ret = kadm5_c_init_with_context(context,
453 krb5_free_context(context);
456 ctx = *server_handle;
462 kadm5_c_init_with_password_ctx(krb5_context context,
463 const char *client_name,
464 const char *password,
465 const char *service_name,
466 kadm5_config_params *realm_params,
467 unsigned long struct_version,
468 unsigned long api_version,
469 void **server_handle)
471 return kadm5_c_init_with_context(context,
485 kadm5_c_init_with_password(const char *client_name,
486 const char *password,
487 const char *service_name,
488 kadm5_config_params *realm_params,
489 unsigned long struct_version,
490 unsigned long api_version,
491 void **server_handle)
493 return init_context(client_name,
506 kadm5_c_init_with_skey_ctx(krb5_context context,
507 const char *client_name,
509 const char *service_name,
510 kadm5_config_params *realm_params,
511 unsigned long struct_version,
512 unsigned long api_version,
513 void **server_handle)
515 return kadm5_c_init_with_context(context,
530 kadm5_c_init_with_skey(const char *client_name,
532 const char *service_name,
533 kadm5_config_params *realm_params,
534 unsigned long struct_version,
535 unsigned long api_version,
536 void **server_handle)
538 return init_context(client_name,
551 kadm5_c_init_with_creds_ctx(krb5_context context,
552 const char *client_name,
554 const char *service_name,
555 kadm5_config_params *realm_params,
556 unsigned long struct_version,
557 unsigned long api_version,
558 void **server_handle)
560 return kadm5_c_init_with_context(context,
574 kadm5_c_init_with_creds(const char *client_name,
576 const char *service_name,
577 kadm5_config_params *realm_params,
578 unsigned long struct_version,
579 unsigned long api_version,
580 void **server_handle)
582 return init_context(client_name,
596 kadm5_init(char *client_name, char *pass,
598 kadm5_config_params *realm_params,
599 unsigned long struct_version,
600 unsigned long api_version,
601 void **server_handle)