2 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #include "krb5_locl.h"
39 * @page krb5_ccache_intro The credential cache functions
40 * @section section_krb5_ccache Kerberos credential caches
42 * krb5_ccache structure holds a Kerberos credential cache.
44 * Heimdal support the follow types of credential caches:
47 * Store the credential in a database
49 * Store the credential in memory
51 * Store the credential in memory
53 * A credential cache server based solution for Mac OS X
55 * A credential cache server based solution for all platforms
59 * This is a minimalistic version of klist:
64 main (int argc, char **argv)
67 krb5_cc_cursor cursor;
72 if (krb5_init_context (&context) != 0)
73 errx(1, "krb5_context");
75 ret = krb5_cc_default (context, &id);
77 krb5_err(context, 1, ret, "krb5_cc_default");
79 ret = krb5_cc_start_seq_get(context, id, &cursor);
81 krb5_err(context, 1, ret, "krb5_cc_start_seq_get");
83 while((ret = krb5_cc_next_cred(context, id, &cursor, &creds)) == 0){
86 krb5_unparse_name(context, creds.server, &principal);
87 printf("principal: %s\\n", principal);
89 krb5_free_cred_contents (context, &creds);
91 ret = krb5_cc_end_seq_get(context, id, &cursor);
93 krb5_err(context, 1, ret, "krb5_cc_end_seq_get");
95 krb5_cc_close(context, id);
97 krb5_free_context(context);
104 * Add a new ccache type with operations `ops', overwriting any
105 * existing one if `override'.
107 * @param context a Keberos context
108 * @param ops type of plugin symbol
109 * @param override flag to select if the registration is to overide
110 * an existing ops with the same name.
112 * @return Return an error code or 0, see krb5_get_error_message().
114 * @ingroup krb5_ccache
117 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
118 krb5_cc_register(krb5_context context,
119 const krb5_cc_ops *ops,
120 krb5_boolean override)
124 for(i = 0; i < context->num_cc_ops && context->cc_ops[i]->prefix; i++) {
125 if(strcmp(context->cc_ops[i]->prefix, ops->prefix) == 0) {
127 krb5_set_error_message(context,
129 N_("cache type %s already exists", "type"),
131 return KRB5_CC_TYPE_EXISTS;
136 if(i == context->num_cc_ops) {
137 const krb5_cc_ops **o = realloc(rk_UNCONST(context->cc_ops),
138 (context->num_cc_ops + 1) *
139 sizeof(context->cc_ops[0]));
141 krb5_set_error_message(context, KRB5_CC_NOMEM,
142 N_("malloc: out of memory", ""));
143 return KRB5_CC_NOMEM;
146 context->cc_ops[context->num_cc_ops] = NULL;
147 context->num_cc_ops++;
149 context->cc_ops[i] = ops;
154 * Allocate the memory for a `id' and the that function table to
155 * `ops'. Returns 0 or and error code.
159 _krb5_cc_allocate(krb5_context context,
160 const krb5_cc_ops *ops,
165 p = malloc (sizeof(*p));
167 krb5_set_error_message(context, KRB5_CC_NOMEM,
168 N_("malloc: out of memory", ""));
169 return KRB5_CC_NOMEM;
178 * Allocate memory for a new ccache in `id' with operations `ops'
179 * and name `residual'. Return 0 or an error code.
182 static krb5_error_code
183 allocate_ccache (krb5_context context,
184 const krb5_cc_ops *ops,
185 const char *residual,
189 #ifdef KRB5_USE_PATH_TOKENS
190 char * exp_residual = NULL;
192 ret = _krb5_expand_path_tokens(context, residual, &exp_residual);
196 residual = exp_residual;
199 ret = _krb5_cc_allocate(context, ops, id);
201 #ifdef KRB5_USE_PATH_TOKENS
208 ret = (*id)->ops->resolve(context, id, residual);
214 #ifdef KRB5_USE_PATH_TOKENS
223 is_possible_path_name(const char * name)
227 if ((colon = strchr(name, ':')) == NULL)
231 /* <drive letter>:\path\to\cache ? */
233 if (colon == name + 1 &&
234 strchr(colon + 1, ':') == NULL)
242 * Find and allocate a ccache in `id' from the specification in `residual'.
243 * If the ccache name doesn't contain any colon, interpret it as a file name.
245 * @param context a Keberos context.
246 * @param name string name of a credential cache.
247 * @param id return pointer to a found credential cache.
249 * @return Return 0 or an error code. In case of an error, id is set
250 * to NULL, see krb5_get_error_message().
252 * @ingroup krb5_ccache
256 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
257 krb5_cc_resolve(krb5_context context,
265 for(i = 0; i < context->num_cc_ops && context->cc_ops[i]->prefix; i++) {
266 size_t prefix_len = strlen(context->cc_ops[i]->prefix);
268 if(strncmp(context->cc_ops[i]->prefix, name, prefix_len) == 0
269 && name[prefix_len] == ':') {
270 return allocate_ccache (context, context->cc_ops[i],
271 name + prefix_len + 1,
275 if (is_possible_path_name(name))
276 return allocate_ccache (context, &krb5_fcc_ops, name, id);
278 krb5_set_error_message(context, KRB5_CC_UNKNOWN_TYPE,
279 N_("unknown ccache type %s", "name"), name);
280 return KRB5_CC_UNKNOWN_TYPE;
285 * Generates a new unique ccache of `type` in `id'. If `type' is NULL,
286 * the library chooses the default credential cache type. The supplied
287 * `hint' (that can be NULL) is a string that the credential cache
288 * type can use to base the name of the credential on, this is to make
289 * it easier for the user to differentiate the credentials.
291 * @return Return an error code or 0, see krb5_get_error_message().
293 * @ingroup krb5_ccache
296 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
297 krb5_cc_new_unique(krb5_context context, const char *type,
298 const char *hint, krb5_ccache *id)
300 const krb5_cc_ops *ops;
303 ops = krb5_cc_get_prefix_ops(context, type);
305 krb5_set_error_message(context, KRB5_CC_UNKNOWN_TYPE,
306 "Credential cache type %s is unknown", type);
307 return KRB5_CC_UNKNOWN_TYPE;
310 ret = _krb5_cc_allocate(context, ops, id);
313 ret = (*id)->ops->gen_new(context, id);
322 * Return the name of the ccache `id'
324 * @ingroup krb5_ccache
328 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
329 krb5_cc_get_name(krb5_context context,
332 return id->ops->get_name(context, id);
336 * Return the type of the ccache `id'.
338 * @ingroup krb5_ccache
342 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
343 krb5_cc_get_type(krb5_context context,
346 return id->ops->prefix;
350 * Return the complete resolvable name the cache
352 * @param context a Keberos context
353 * @param id return pointer to a found credential cache
354 * @param str the returned name of a credential cache, free with krb5_xfree()
356 * @return Returns 0 or an error (and then *str is set to NULL).
358 * @ingroup krb5_ccache
362 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
363 krb5_cc_get_full_name(krb5_context context,
367 const char *type, *name;
371 type = krb5_cc_get_type(context, id);
373 krb5_set_error_message(context, KRB5_CC_UNKNOWN_TYPE,
374 "cache have no name of type");
375 return KRB5_CC_UNKNOWN_TYPE;
378 name = krb5_cc_get_name(context, id);
380 krb5_set_error_message(context, KRB5_CC_BADNAME,
381 "cache of type %s have no name", type);
382 return KRB5_CC_BADNAME;
385 if (asprintf(str, "%s:%s", type, name) == -1) {
386 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
394 * Return krb5_cc_ops of a the ccache `id'.
396 * @ingroup krb5_ccache
400 KRB5_LIB_FUNCTION const krb5_cc_ops * KRB5_LIB_CALL
401 krb5_cc_get_ops(krb5_context context, krb5_ccache id)
407 * Expand variables in `str' into `res'
411 _krb5_expand_default_cc_name(krb5_context context, const char *str, char **res)
413 return _krb5_expand_path_tokens(context, str, res);
417 * Return non-zero if envirnoment that will determine default krb5cc
422 environment_changed(krb5_context context)
426 /* if the cc name was set, don't change it */
427 if (context->default_cc_name_set)
430 /* XXX performance: always ask KCM/API if default name has changed */
431 if (context->default_cc_name &&
432 (strncmp(context->default_cc_name, "KCM:", 4) == 0 ||
433 strncmp(context->default_cc_name, "API:", 4) == 0))
439 e = getenv("KRB5CCNAME");
441 if (context->default_cc_name_env) {
442 free(context->default_cc_name_env);
443 context->default_cc_name_env = NULL;
447 if (context->default_cc_name_env == NULL)
449 if (strcmp(e, context->default_cc_name_env) != 0)
456 * Switch the default default credential cache for a specific
457 * credcache type (and name for some implementations).
459 * @return Return an error code or 0, see krb5_get_error_message().
461 * @ingroup krb5_ccache
464 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
465 krb5_cc_switch(krb5_context context, krb5_ccache id)
468 _krb5_set_default_cc_name_to_registry(context, id);
471 if (id->ops->set_default == NULL)
474 return (*id->ops->set_default)(context, id);
478 * Return true if the default credential cache support switch
480 * @ingroup krb5_ccache
483 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
484 krb5_cc_support_switch(krb5_context context, const char *type)
486 const krb5_cc_ops *ops;
488 ops = krb5_cc_get_prefix_ops(context, type);
489 if (ops && ops->set_default)
495 * Set the default cc name for `context' to `name'.
497 * @ingroup krb5_ccache
500 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
501 krb5_cc_set_default_name(krb5_context context, const char *name)
503 krb5_error_code ret = 0;
504 char *p = NULL, *exp_p = NULL;
507 const char *e = NULL;
510 e = getenv("KRB5CCNAME");
513 if (context->default_cc_name_env)
514 free(context->default_cc_name_env);
515 context->default_cc_name_env = strdup(e);
521 e = p = _krb5_get_default_cc_name_from_registry(context);
525 e = krb5_config_get_string(context, NULL, "libdefaults",
526 "default_cc_name", NULL);
528 ret = _krb5_expand_default_cc_name(context, e, &p);
533 const krb5_cc_ops *ops = KRB5_DEFAULT_CCTYPE;
534 e = krb5_config_get_string(context, NULL, "libdefaults",
535 "default_cc_type", NULL);
537 ops = krb5_cc_get_prefix_ops(context, e);
539 krb5_set_error_message(context,
540 KRB5_CC_UNKNOWN_TYPE,
541 "Credential cache type %s "
543 return KRB5_CC_UNKNOWN_TYPE;
546 ret = (*ops->get_default_name)(context, &p);
551 context->default_cc_name_set = 0;
554 context->default_cc_name_set = 1;
558 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
562 ret = _krb5_expand_path_tokens(context, p, &exp_p);
567 if (context->default_cc_name)
568 free(context->default_cc_name);
570 context->default_cc_name = exp_p;
576 * Return a pointer to a context static string containing the default
579 * @return String to the default credential cache name.
581 * @ingroup krb5_ccache
585 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
586 krb5_cc_default_name(krb5_context context)
588 if (context->default_cc_name == NULL || environment_changed(context))
589 krb5_cc_set_default_name(context, NULL);
591 return context->default_cc_name;
595 * Open the default ccache in `id'.
597 * @return Return an error code or 0, see krb5_get_error_message().
599 * @ingroup krb5_ccache
603 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
604 krb5_cc_default(krb5_context context,
607 const char *p = krb5_cc_default_name(context);
610 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
613 return krb5_cc_resolve(context, p, id);
617 * Create a new ccache in `id' for `primary_principal'.
619 * @return Return an error code or 0, see krb5_get_error_message().
621 * @ingroup krb5_ccache
625 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
626 krb5_cc_initialize(krb5_context context,
628 krb5_principal primary_principal)
630 return (*id->ops->init)(context, id, primary_principal);
635 * Remove the ccache `id'.
637 * @return Return an error code or 0, see krb5_get_error_message().
639 * @ingroup krb5_ccache
643 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
644 krb5_cc_destroy(krb5_context context,
649 ret = (*id->ops->destroy)(context, id);
650 krb5_cc_close (context, id);
655 * Stop using the ccache `id' and free the related resources.
657 * @return Return an error code or 0, see krb5_get_error_message().
659 * @ingroup krb5_ccache
663 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
664 krb5_cc_close(krb5_context context,
668 ret = (*id->ops->close)(context, id);
674 * Store `creds' in the ccache `id'.
676 * @return Return an error code or 0, see krb5_get_error_message().
678 * @ingroup krb5_ccache
682 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
683 krb5_cc_store_cred(krb5_context context,
687 return (*id->ops->store)(context, id, creds);
691 * Retrieve the credential identified by `mcreds' (and `whichfields')
692 * from `id' in `creds'. 'creds' must be free by the caller using
693 * krb5_free_cred_contents.
695 * @param context A Kerberos 5 context
696 * @param id a Kerberos 5 credential cache
697 * @param whichfields what fields to use for matching credentials, same
698 * flags as whichfields in krb5_compare_creds()
699 * @param mcreds template credential to use for comparing
700 * @param creds returned credential, free with krb5_free_cred_contents()
702 * @return Return an error code or 0, see krb5_get_error_message().
704 * @ingroup krb5_ccache
708 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
709 krb5_cc_retrieve_cred(krb5_context context,
711 krb5_flags whichfields,
712 const krb5_creds *mcreds,
716 krb5_cc_cursor cursor;
718 if (id->ops->retrieve != NULL) {
719 return (*id->ops->retrieve)(context, id, whichfields,
723 ret = krb5_cc_start_seq_get(context, id, &cursor);
726 while((ret = krb5_cc_next_cred(context, id, &cursor, creds)) == 0){
727 if(krb5_compare_creds(context, whichfields, mcreds, creds)){
731 krb5_free_cred_contents (context, creds);
733 krb5_cc_end_seq_get(context, id, &cursor);
738 * Return the principal of `id' in `principal'.
740 * @return Return an error code or 0, see krb5_get_error_message().
742 * @ingroup krb5_ccache
746 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
747 krb5_cc_get_principal(krb5_context context,
749 krb5_principal *principal)
751 return (*id->ops->get_princ)(context, id, principal);
755 * Start iterating over `id', `cursor' is initialized to the
756 * beginning. Caller must free the cursor with krb5_cc_end_seq_get().
758 * @return Return an error code or 0, see krb5_get_error_message().
760 * @ingroup krb5_ccache
764 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
765 krb5_cc_start_seq_get (krb5_context context,
766 const krb5_ccache id,
767 krb5_cc_cursor *cursor)
769 return (*id->ops->get_first)(context, id, cursor);
773 * Retrieve the next cred pointed to by (`id', `cursor') in `creds'
774 * and advance `cursor'.
776 * @return Return an error code or 0, see krb5_get_error_message().
778 * @ingroup krb5_ccache
782 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
783 krb5_cc_next_cred (krb5_context context,
784 const krb5_ccache id,
785 krb5_cc_cursor *cursor,
788 return (*id->ops->get_next)(context, id, cursor, creds);
792 * Destroy the cursor `cursor'.
794 * @ingroup krb5_ccache
798 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
799 krb5_cc_end_seq_get (krb5_context context,
800 const krb5_ccache id,
801 krb5_cc_cursor *cursor)
803 return (*id->ops->end_get)(context, id, cursor);
807 * Remove the credential identified by `cred', `which' from `id'.
809 * @ingroup krb5_ccache
813 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
814 krb5_cc_remove_cred(krb5_context context,
819 if(id->ops->remove_cred == NULL) {
820 krb5_set_error_message(context,
822 "ccache %s does not support remove_cred",
824 return EACCES; /* XXX */
826 return (*id->ops->remove_cred)(context, id, which, cred);
830 * Set the flags of `id' to `flags'.
832 * @ingroup krb5_ccache
836 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
837 krb5_cc_set_flags(krb5_context context,
841 return (*id->ops->set_flags)(context, id, flags);
845 * Get the flags of `id', store them in `flags'.
847 * @ingroup krb5_ccache
850 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
851 krb5_cc_get_flags(krb5_context context,
860 * Copy the contents of `from' to `to' if the given match function
863 * @param context A Kerberos 5 context.
864 * @param from the cache to copy data from.
865 * @param to the cache to copy data to.
866 * @param match a match function that should return TRUE if cred argument should be copied, if NULL, all credentials are copied.
867 * @param matchctx context passed to match function.
868 * @param matched set to true if there was a credential that matched, may be NULL.
870 * @return Return an error code or 0, see krb5_get_error_message().
872 * @ingroup krb5_ccache
875 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
876 krb5_cc_copy_match_f(krb5_context context,
877 const krb5_ccache from,
879 krb5_boolean (*match)(krb5_context, void *, const krb5_creds *),
881 unsigned int *matched)
884 krb5_cc_cursor cursor;
886 krb5_principal princ;
891 ret = krb5_cc_get_principal(context, from, &princ);
894 ret = krb5_cc_initialize(context, to, princ);
896 krb5_free_principal(context, princ);
899 ret = krb5_cc_start_seq_get(context, from, &cursor);
901 krb5_free_principal(context, princ);
905 while ((ret = krb5_cc_next_cred(context, from, &cursor, &cred)) == 0) {
906 if (match == NULL || (*match)(context, matchctx, &cred) == 0) {
909 ret = krb5_cc_store_cred(context, to, &cred);
913 krb5_free_cred_contents(context, &cred);
915 krb5_cc_end_seq_get(context, from, &cursor);
916 krb5_free_principal(context, princ);
917 if (ret == KRB5_CC_END)
923 * Just like krb5_cc_copy_match_f(), but copy everything.
925 * @ingroup @krb5_ccache
928 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
929 krb5_cc_copy_cache(krb5_context context,
930 const krb5_ccache from,
933 return krb5_cc_copy_match_f(context, from, to, NULL, NULL, NULL);
937 * Return the version of `id'.
939 * @ingroup krb5_ccache
943 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
944 krb5_cc_get_version(krb5_context context,
945 const krb5_ccache id)
947 if(id->ops->get_version)
948 return (*id->ops->get_version)(context, id);
954 * Clear `mcreds' so it can be used with krb5_cc_retrieve_cred
956 * @ingroup krb5_ccache
960 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
961 krb5_cc_clear_mcred(krb5_creds *mcred)
963 memset(mcred, 0, sizeof(*mcred));
967 * Get the cc ops that is registered in `context' to handle the
968 * prefix. prefix can be a complete credential cache name or a
969 * prefix, the function will only use part up to the first colon (:)
970 * if there is one. If prefix the argument is NULL, the default ccache
971 * implemtation is returned.
973 * @return Returns NULL if ops not found.
975 * @ingroup krb5_ccache
979 KRB5_LIB_FUNCTION const krb5_cc_ops * KRB5_LIB_CALL
980 krb5_cc_get_prefix_ops(krb5_context context, const char *prefix)
986 return KRB5_DEFAULT_CCTYPE;
987 if (prefix[0] == '/')
988 return &krb5_fcc_ops;
992 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
999 for(i = 0; i < context->num_cc_ops && context->cc_ops[i]->prefix; i++) {
1000 if(strcmp(context->cc_ops[i]->prefix, p) == 0) {
1002 return context->cc_ops[i];
1009 struct krb5_cc_cache_cursor_data {
1010 const krb5_cc_ops *ops;
1011 krb5_cc_cursor cursor;
1015 * Start iterating over all caches of specified type. See also
1016 * krb5_cccol_cursor_new().
1018 * @param context A Kerberos 5 context
1019 * @param type optional type to iterate over, if NULL, the default cache is used.
1020 * @param cursor cursor should be freed with krb5_cc_cache_end_seq_get().
1022 * @return Return an error code or 0, see krb5_get_error_message().
1024 * @ingroup krb5_ccache
1028 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1029 krb5_cc_cache_get_first (krb5_context context,
1031 krb5_cc_cache_cursor *cursor)
1033 const krb5_cc_ops *ops;
1034 krb5_error_code ret;
1037 type = krb5_cc_default_name(context);
1039 ops = krb5_cc_get_prefix_ops(context, type);
1041 krb5_set_error_message(context, KRB5_CC_UNKNOWN_TYPE,
1042 "Unknown type \"%s\" when iterating "
1043 "trying to iterate the credential caches", type);
1044 return KRB5_CC_UNKNOWN_TYPE;
1047 if (ops->get_cache_first == NULL) {
1048 krb5_set_error_message(context, KRB5_CC_NOSUPP,
1049 N_("Credential cache type %s doesn't support "
1050 "iterations over caches", "type"),
1052 return KRB5_CC_NOSUPP;
1055 *cursor = calloc(1, sizeof(**cursor));
1056 if (*cursor == NULL) {
1057 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1061 (*cursor)->ops = ops;
1063 ret = ops->get_cache_first(context, &(*cursor)->cursor);
1072 * Retrieve the next cache pointed to by (`cursor') in `id'
1073 * and advance `cursor'.
1075 * @param context A Kerberos 5 context
1076 * @param cursor the iterator cursor, returned by krb5_cc_cache_get_first()
1077 * @param id next ccache
1079 * @return Return 0 or an error code. Returns KRB5_CC_END when the end
1080 * of caches is reached, see krb5_get_error_message().
1082 * @ingroup krb5_ccache
1086 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1087 krb5_cc_cache_next (krb5_context context,
1088 krb5_cc_cache_cursor cursor,
1091 return cursor->ops->get_cache_next(context, cursor->cursor, id);
1095 * Destroy the cursor `cursor'.
1097 * @return Return an error code or 0, see krb5_get_error_message().
1099 * @ingroup krb5_ccache
1103 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1104 krb5_cc_cache_end_seq_get (krb5_context context,
1105 krb5_cc_cache_cursor cursor)
1107 krb5_error_code ret;
1108 ret = cursor->ops->end_cache_get(context, cursor->cursor);
1115 * Search for a matching credential cache that have the
1116 * `principal' as the default principal. On success, `id' needs to be
1117 * freed with krb5_cc_close() or krb5_cc_destroy().
1119 * @param context A Kerberos 5 context
1120 * @param client The principal to search for
1121 * @param id the returned credential cache
1123 * @return On failure, error code is returned and `id' is set to NULL.
1125 * @ingroup krb5_ccache
1129 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1130 krb5_cc_cache_match (krb5_context context,
1131 krb5_principal client,
1134 krb5_cccol_cursor cursor;
1135 krb5_error_code ret;
1136 krb5_ccache cache = NULL;
1140 ret = krb5_cccol_cursor_new (context, &cursor);
1144 while (krb5_cccol_cursor_next (context, cursor, &cache) == 0 && cache != NULL) {
1145 krb5_principal principal;
1147 ret = krb5_cc_get_principal(context, cache, &principal);
1151 match = krb5_principal_compare(context, principal, client);
1152 krb5_free_principal(context, principal);
1157 krb5_cc_close(context, cache);
1161 krb5_cccol_cursor_free(context, &cursor);
1163 if (cache == NULL) {
1166 krb5_unparse_name(context, client, &str);
1168 krb5_set_error_message(context, KRB5_CC_NOTFOUND,
1169 N_("Principal %s not found in any "
1170 "credential cache", ""),
1171 str ? str : "<out of memory>");
1174 return KRB5_CC_NOTFOUND;
1182 * Move the content from one credential cache to another. The
1183 * operation is an atomic switch.
1185 * @param context a Keberos context
1186 * @param from the credential cache to move the content from
1187 * @param to the credential cache to move the content to
1189 * @return On sucess, from is freed. On failure, error code is
1190 * returned and from and to are both still allocated, see krb5_get_error_message().
1192 * @ingroup krb5_ccache
1195 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1196 krb5_cc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
1198 krb5_error_code ret;
1200 if (strcmp(from->ops->prefix, to->ops->prefix) != 0) {
1201 krb5_set_error_message(context, KRB5_CC_NOSUPP,
1202 N_("Moving credentials between diffrent "
1203 "types not yet supported", ""));
1204 return KRB5_CC_NOSUPP;
1207 ret = (*to->ops->move)(context, from, to);
1209 memset(from, 0, sizeof(*from));
1215 #define KRB5_CONF_NAME "krb5_ccache_conf_data"
1216 #define KRB5_REALM_NAME "X-CACHECONF:"
1218 static krb5_error_code
1219 build_conf_principals(krb5_context context, krb5_ccache id,
1220 krb5_const_principal principal,
1221 const char *name, krb5_creds *cred)
1223 krb5_principal client;
1224 krb5_error_code ret;
1227 memset(cred, 0, sizeof(*cred));
1229 ret = krb5_cc_get_principal(context, id, &client);
1234 ret = krb5_unparse_name(context, principal, &pname);
1239 ret = krb5_make_principal(context, &cred->server,
1241 KRB5_CONF_NAME, name, pname, NULL);
1244 krb5_free_principal(context, client);
1247 ret = krb5_copy_principal(context, client, &cred->client);
1248 krb5_free_principal(context, client);
1253 * Return TRUE (non zero) if the principal is a configuration
1254 * principal (generated part of krb5_cc_set_config()). Returns FALSE
1255 * (zero) if not a configuration principal.
1257 * @param context a Keberos context
1258 * @param principal principal to check if it a configuration principal
1260 * @ingroup krb5_ccache
1263 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
1264 krb5_is_config_principal(krb5_context context,
1265 krb5_const_principal principal)
1267 if (strcmp(principal->realm, KRB5_REALM_NAME) != 0)
1270 if (principal->name.name_string.len == 0 ||
1271 strcmp(principal->name.name_string.val[0], KRB5_CONF_NAME) != 0)
1278 * Store some configuration for the credential cache in the cache.
1279 * Existing configuration under the same name is over-written.
1281 * @param context a Keberos context
1282 * @param id the credential cache to store the data for
1283 * @param principal configuration for a specific principal, if
1284 * NULL, global for the whole cache.
1285 * @param name name under which the configuraion is stored.
1286 * @param data data to store, if NULL, configure is removed.
1288 * @ingroup krb5_ccache
1291 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1292 krb5_cc_set_config(krb5_context context, krb5_ccache id,
1293 krb5_const_principal principal,
1294 const char *name, krb5_data *data)
1296 krb5_error_code ret;
1299 ret = build_conf_principals(context, id, principal, name, &cred);
1303 /* Remove old configuration */
1304 ret = krb5_cc_remove_cred(context, id, 0, &cred);
1305 if (ret && ret != KRB5_CC_NOTFOUND)
1309 /* not that anyone care when this expire */
1310 cred.times.authtime = time(NULL);
1311 cred.times.endtime = cred.times.authtime + 3600 * 24 * 30;
1313 ret = krb5_data_copy(&cred.ticket, data->data, data->length);
1317 ret = krb5_cc_store_cred(context, id, &cred);
1321 krb5_free_cred_contents (context, &cred);
1326 * Get some configuration for the credential cache in the cache.
1328 * @param context a Keberos context
1329 * @param id the credential cache to store the data for
1330 * @param principal configuration for a specific principal, if
1331 * NULL, global for the whole cache.
1332 * @param name name under which the configuraion is stored.
1333 * @param data data to fetched, free with krb5_data_free()
1335 * @ingroup krb5_ccache
1339 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1340 krb5_cc_get_config(krb5_context context, krb5_ccache id,
1341 krb5_const_principal principal,
1342 const char *name, krb5_data *data)
1344 krb5_creds mcred, cred;
1345 krb5_error_code ret;
1347 memset(&cred, 0, sizeof(cred));
1348 krb5_data_zero(data);
1350 ret = build_conf_principals(context, id, principal, name, &mcred);
1354 ret = krb5_cc_retrieve_cred(context, id, 0, &mcred, &cred);
1358 ret = krb5_data_copy(data, cred.ticket.data, cred.ticket.length);
1361 krb5_free_cred_contents (context, &cred);
1362 krb5_free_cred_contents (context, &mcred);
1370 struct krb5_cccol_cursor_data {
1372 krb5_cc_cache_cursor cursor;
1376 * Get a new cache interation cursor that will interate over all
1377 * credentials caches independent of type.
1379 * @param context a Keberos context
1380 * @param cursor passed into krb5_cccol_cursor_next() and free with krb5_cccol_cursor_free().
1382 * @return Returns 0 or and error code, see krb5_get_error_message().
1384 * @ingroup krb5_ccache
1387 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1388 krb5_cccol_cursor_new(krb5_context context, krb5_cccol_cursor *cursor)
1390 *cursor = calloc(1, sizeof(**cursor));
1391 if (*cursor == NULL) {
1392 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1396 (*cursor)->cursor = NULL;
1402 * Get next credential cache from the iteration.
1404 * @param context A Kerberos 5 context
1405 * @param cursor the iteration cursor
1406 * @param cache the returned cursor, pointer is set to NULL on failure
1407 * and a cache on success. The returned cache needs to be freed
1408 * with krb5_cc_close() or destroyed with krb5_cc_destroy().
1409 * MIT Kerberos behavies slightly diffrent and sets cache to NULL
1410 * when all caches are iterated over and return 0.
1412 * @return Return 0 or and error, KRB5_CC_END is returned at the end
1413 * of iteration. See krb5_get_error_message().
1415 * @ingroup krb5_ccache
1419 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1420 krb5_cccol_cursor_next(krb5_context context, krb5_cccol_cursor cursor,
1423 krb5_error_code ret;
1427 while (cursor->idx < context->num_cc_ops) {
1429 if (cursor->cursor == NULL) {
1430 ret = krb5_cc_cache_get_first (context,
1431 context->cc_ops[cursor->idx]->prefix,
1438 ret = krb5_cc_cache_next(context, cursor->cursor, cache);
1442 krb5_cc_cache_end_seq_get(context, cursor->cursor);
1443 cursor->cursor = NULL;
1444 if (ret != KRB5_CC_END)
1449 if (cursor->idx >= context->num_cc_ops) {
1450 krb5_set_error_message(context, KRB5_CC_END,
1451 N_("Reached end of credential caches", ""));
1459 * End an iteration and free all resources, can be done before end is reached.
1461 * @param context A Kerberos 5 context
1462 * @param cursor the iteration cursor to be freed.
1464 * @return Return 0 or and error, KRB5_CC_END is returned at the end
1465 * of iteration. See krb5_get_error_message().
1467 * @ingroup krb5_ccache
1470 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1471 krb5_cccol_cursor_free(krb5_context context, krb5_cccol_cursor *cursor)
1473 krb5_cccol_cursor c = *cursor;
1478 krb5_cc_cache_end_seq_get(context, c->cursor);
1485 * Return the last time the credential cache was modified.
1487 * @param context A Kerberos 5 context
1488 * @param id The credential cache to probe
1489 * @param mtime the last modification time, set to 0 on error.
1491 * @return Return 0 or and error. See krb5_get_error_message().
1493 * @ingroup krb5_ccache
1497 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1498 krb5_cc_last_change_time(krb5_context context,
1500 krb5_timestamp *mtime)
1503 return (*id->ops->lastchange)(context, id, mtime);
1507 * Return the last modfication time for a cache collection. The query
1508 * can be limited to a specific cache type. If the function return 0
1509 * and mtime is 0, there was no credentials in the caches.
1511 * @param context A Kerberos 5 context
1512 * @param type The credential cache to probe, if NULL, all type are traversed.
1513 * @param mtime the last modification time, set to 0 on error.
1515 * @return Return 0 or and error. See krb5_get_error_message().
1517 * @ingroup krb5_ccache
1520 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1521 krb5_cccol_last_change_time(krb5_context context,
1523 krb5_timestamp *mtime)
1525 krb5_cccol_cursor cursor;
1526 krb5_error_code ret;
1528 krb5_timestamp t = 0;
1532 ret = krb5_cccol_cursor_new (context, &cursor);
1536 while (krb5_cccol_cursor_next(context, cursor, &id) == 0 && id != NULL) {
1538 if (type && strcmp(krb5_cc_get_type(context, id), type) != 0)
1541 ret = krb5_cc_last_change_time(context, id, &t);
1542 krb5_cc_close(context, id);
1549 krb5_cccol_cursor_free(context, &cursor);
1554 * Return a friendly name on credential cache. Free the result with krb5_xfree().
1556 * @return Return an error code or 0, see krb5_get_error_message().
1558 * @ingroup krb5_ccache
1561 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1562 krb5_cc_get_friendly_name(krb5_context context,
1566 krb5_error_code ret;
1569 ret = krb5_cc_get_config(context, id, NULL, "FriendlyName", &data);
1571 krb5_principal principal;
1572 ret = krb5_cc_get_principal(context, id, &principal);
1575 ret = krb5_unparse_name(context, principal, name);
1576 krb5_free_principal(context, principal);
1578 ret = asprintf(name, "%.*s", (int)data.length, (char *)data.data);
1579 krb5_data_free(&data);
1582 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
1591 * Set the friendly name on credential cache.
1593 * @return Return an error code or 0, see krb5_get_error_message().
1595 * @ingroup krb5_ccache
1598 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1599 krb5_cc_set_friendly_name(krb5_context context,
1605 data.data = rk_UNCONST(name);
1606 data.length = strlen(name);
1608 return krb5_cc_set_config(context, id, NULL, "FriendlyName", &data);
1612 * Get the lifetime of the initial ticket in the cache
1614 * Get the lifetime of the initial ticket in the cache, if the initial
1615 * ticket was not found, the error code KRB5_CC_END is returned.
1617 * @param context A Kerberos 5 context.
1618 * @param id a credential cache
1619 * @param t the relative lifetime of the initial ticket
1621 * @return Return an error code or 0, see krb5_get_error_message().
1623 * @ingroup krb5_ccache
1626 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1627 krb5_cc_get_lifetime(krb5_context context, krb5_ccache id, time_t *t)
1629 krb5_cc_cursor cursor;
1630 krb5_error_code ret;
1637 ret = krb5_cc_start_seq_get(context, id, &cursor);
1641 while ((ret = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) {
1642 if (cred.flags.b.initial) {
1643 if (now < cred.times.endtime)
1644 *t = cred.times.endtime - now;
1645 krb5_free_cred_contents(context, &cred);
1648 krb5_free_cred_contents(context, &cred);
1651 krb5_cc_end_seq_get(context, id, &cursor);
1657 * Set the time offset betwen the client and the KDC
1659 * If the backend doesn't support KDC offset, use the context global setting.
1661 * @param context A Kerberos 5 context.
1662 * @param id a credential cache
1663 * @param offset the offset in seconds
1665 * @return Return an error code or 0, see krb5_get_error_message().
1667 * @ingroup krb5_ccache
1670 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1671 krb5_cc_set_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat offset)
1673 if (id->ops->set_kdc_offset == NULL) {
1674 context->kdc_sec_offset = offset;
1675 context->kdc_usec_offset = 0;
1678 return (*id->ops->set_kdc_offset)(context, id, offset);
1682 * Get the time offset betwen the client and the KDC
1684 * If the backend doesn't support KDC offset, use the context global setting.
1686 * @param context A Kerberos 5 context.
1687 * @param id a credential cache
1688 * @param offset the offset in seconds
1690 * @return Return an error code or 0, see krb5_get_error_message().
1692 * @ingroup krb5_ccache
1695 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1696 krb5_cc_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *offset)
1698 if (id->ops->get_kdc_offset == NULL) {
1699 *offset = context->kdc_sec_offset;
1702 return (*id->ops->get_kdc_offset)(context, id, offset);
1708 #define REGPATH_MIT_KRB5 "SOFTWARE\\MIT\\Kerberos5"
1710 _krb5_get_default_cc_name_from_registry(krb5_context context)
1714 char * ccname = NULL;
1716 code = RegOpenKeyEx(HKEY_CURRENT_USER,
1718 0, KEY_READ, &hk_k5);
1720 if (code != ERROR_SUCCESS)
1723 ccname = _krb5_parse_reg_value_as_string(context, hk_k5, "ccname",
1732 _krb5_set_default_cc_name_to_registry(krb5_context context, krb5_ccache id)
1737 char * ccname = NULL;
1739 code = RegOpenKeyEx(HKEY_CURRENT_USER,
1741 0, KEY_READ|KEY_WRITE, &hk_k5);
1743 if (code != ERROR_SUCCESS)
1746 ret = asprintf(&ccname, "%s:%s", krb5_cc_get_type(context, id), krb5_cc_get_name(context, id));
1750 ret = _krb5_store_string_to_reg_value(context, hk_k5, "ccname",
1751 REG_SZ, ccname, -1, 0);