1450 lines
33 KiB
C
1450 lines
33 KiB
C
/*
|
|
* Copyright (c) 2004 Kungliga Tekniska Högskolan
|
|
* (Royal Institute of Technology, Stockholm, Sweden).
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
*
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* 3. Neither the name of the Institute nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
|
|
#define HAVE_TSASL 1
|
|
|
|
#include "kadm5_locl.h"
|
|
#if 1
|
|
#undef OPENLDAP
|
|
#undef HAVE_TSASL
|
|
#endif
|
|
#ifdef OPENLDAP
|
|
#include <ldap.h>
|
|
#ifdef HAVE_TSASL
|
|
#include <tsasl.h>
|
|
#endif
|
|
#include <resolve.h>
|
|
#include <base64.h>
|
|
#endif
|
|
|
|
RCSID("$Id: ad.c 17445 2006-05-05 10:37:46Z lha $");
|
|
|
|
#ifdef OPENLDAP
|
|
|
|
#define CTX2LP(context) ((LDAP *)((context)->ldap_conn))
|
|
#define CTX2BASE(context) ((context)->base_dn)
|
|
|
|
/*
|
|
* userAccountControl
|
|
*/
|
|
|
|
#define UF_SCRIPT 0x00000001
|
|
#define UF_ACCOUNTDISABLE 0x00000002
|
|
#define UF_UNUSED_0 0x00000004
|
|
#define UF_HOMEDIR_REQUIRED 0x00000008
|
|
#define UF_LOCKOUT 0x00000010
|
|
#define UF_PASSWD_NOTREQD 0x00000020
|
|
#define UF_PASSWD_CANT_CHANGE 0x00000040
|
|
#define UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED 0x00000080
|
|
#define UF_TEMP_DUPLICATE_ACCOUNT 0x00000100
|
|
#define UF_NORMAL_ACCOUNT 0x00000200
|
|
#define UF_UNUSED_1 0x00000400
|
|
#define UF_INTERDOMAIN_TRUST_ACCOUNT 0x00000800
|
|
#define UF_WORKSTATION_TRUST_ACCOUNT 0x00001000
|
|
#define UF_SERVER_TRUST_ACCOUNT 0x00002000
|
|
#define UF_UNUSED_2 0x00004000
|
|
#define UF_UNUSED_3 0x00008000
|
|
#define UF_PASSWD_NOT_EXPIRE 0x00010000
|
|
#define UF_MNS_LOGON_ACCOUNT 0x00020000
|
|
#define UF_SMARTCARD_REQUIRED 0x00040000
|
|
#define UF_TRUSTED_FOR_DELEGATION 0x00080000
|
|
#define UF_NOT_DELEGATED 0x00100000
|
|
#define UF_USE_DES_KEY_ONLY 0x00200000
|
|
#define UF_DONT_REQUIRE_PREAUTH 0x00400000
|
|
#define UF_UNUSED_4 0x00800000
|
|
#define UF_UNUSED_5 0x01000000
|
|
#define UF_UNUSED_6 0x02000000
|
|
#define UF_UNUSED_7 0x04000000
|
|
#define UF_UNUSED_8 0x08000000
|
|
#define UF_UNUSED_9 0x10000000
|
|
#define UF_UNUSED_10 0x20000000
|
|
#define UF_UNUSED_11 0x40000000
|
|
#define UF_UNUSED_12 0x80000000
|
|
|
|
/*
|
|
*
|
|
*/
|
|
|
|
#ifndef HAVE_TSASL
|
|
static int
|
|
sasl_interact(LDAP *ld, unsigned flags, void *defaults, void *interact)
|
|
{
|
|
return LDAP_SUCCESS;
|
|
}
|
|
#endif
|
|
|
|
#if 0
|
|
static Sockbuf_IO ldap_tsasl_io = {
|
|
NULL, /* sbi_setup */
|
|
NULL, /* sbi_remove */
|
|
NULL, /* sbi_ctrl */
|
|
NULL, /* sbi_read */
|
|
NULL, /* sbi_write */
|
|
NULL /* sbi_close */
|
|
};
|
|
#endif
|
|
|
|
#ifdef HAVE_TSASL
|
|
static int
|
|
ldap_tsasl_bind_s(LDAP *ld,
|
|
LDAP_CONST char *dn,
|
|
LDAPControl **serverControls,
|
|
LDAPControl **clientControls,
|
|
const char *host)
|
|
{
|
|
char *attrs[] = { "supportedSASLMechanisms", NULL };
|
|
struct tsasl_peer *peer = NULL;
|
|
struct tsasl_buffer in, out;
|
|
struct berval ccred, *scred;
|
|
LDAPMessage *m, *m0;
|
|
const char *mech;
|
|
char **vals;
|
|
int ret, rc;
|
|
|
|
ret = tsasl_peer_init(TSASL_FLAGS_INITIATOR | TSASL_FLAGS_CLEAR,
|
|
"ldap", host, &peer);
|
|
if (ret != TSASL_DONE) {
|
|
rc = LDAP_LOCAL_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
rc = ldap_search_s(ld, "", LDAP_SCOPE_BASE, NULL, attrs, 0, &m0);
|
|
if (rc != LDAP_SUCCESS)
|
|
goto out;
|
|
|
|
m = ldap_first_entry(ld, m0);
|
|
if (m == NULL) {
|
|
ldap_msgfree(m0);
|
|
goto out;
|
|
}
|
|
|
|
vals = ldap_get_values(ld, m, "supportedSASLMechanisms");
|
|
if (vals == NULL) {
|
|
ldap_msgfree(m0);
|
|
goto out;
|
|
}
|
|
|
|
ret = tsasl_find_best_mech(peer, vals, &mech);
|
|
if (ret) {
|
|
ldap_msgfree(m0);
|
|
goto out;
|
|
}
|
|
|
|
ldap_msgfree(m0);
|
|
|
|
ret = tsasl_select_mech(peer, mech);
|
|
if (ret != TSASL_DONE) {
|
|
rc = LDAP_LOCAL_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
in.tb_data = NULL;
|
|
in.tb_size = 0;
|
|
|
|
do {
|
|
ret = tsasl_request(peer, &in, &out);
|
|
if (in.tb_size != 0) {
|
|
free(in.tb_data);
|
|
in.tb_data = NULL;
|
|
in.tb_size = 0;
|
|
}
|
|
if (ret != TSASL_DONE && ret != TSASL_CONTINUE) {
|
|
rc = LDAP_AUTH_UNKNOWN;
|
|
goto out;
|
|
}
|
|
|
|
ccred.bv_val = out.tb_data;
|
|
ccred.bv_len = out.tb_size;
|
|
|
|
rc = ldap_sasl_bind_s(ld, dn, mech, &ccred,
|
|
serverControls, clientControls, &scred);
|
|
tsasl_buffer_free(&out);
|
|
|
|
if (rc != LDAP_SUCCESS && rc != LDAP_SASL_BIND_IN_PROGRESS) {
|
|
if(scred && scred->bv_len)
|
|
ber_bvfree(scred);
|
|
goto out;
|
|
}
|
|
|
|
in.tb_data = malloc(scred->bv_len);
|
|
if (in.tb_data == NULL) {
|
|
rc = LDAP_LOCAL_ERROR;
|
|
goto out;
|
|
}
|
|
memcpy(in.tb_data, scred->bv_val, scred->bv_len);
|
|
in.tb_size = scred->bv_len;
|
|
ber_bvfree(scred);
|
|
|
|
} while (rc == LDAP_SASL_BIND_IN_PROGRESS);
|
|
|
|
out:
|
|
if (rc == LDAP_SUCCESS) {
|
|
#if 0
|
|
ber_sockbuf_add_io(ld->ld_conns->lconn_sb, &ldap_tsasl_io,
|
|
LBER_SBIOD_LEVEL_APPLICATION, peer);
|
|
|
|
#endif
|
|
} else if (peer != NULL)
|
|
tsasl_peer_free(peer);
|
|
|
|
return rc;
|
|
}
|
|
#endif /* HAVE_TSASL */
|
|
|
|
|
|
static int
|
|
check_ldap(kadm5_ad_context *context, int ret)
|
|
{
|
|
switch (ret) {
|
|
case LDAP_SUCCESS:
|
|
return 0;
|
|
case LDAP_SERVER_DOWN: {
|
|
LDAP *lp = CTX2LP(context);
|
|
ldap_unbind(lp);
|
|
context->ldap_conn = NULL;
|
|
free(context->base_dn);
|
|
context->base_dn = NULL;
|
|
return 1;
|
|
}
|
|
default:
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
/*
|
|
*
|
|
*/
|
|
|
|
static void
|
|
laddattr(char ***al, int *attrlen, char *attr)
|
|
{
|
|
char **a;
|
|
a = realloc(*al, (*attrlen + 2) * sizeof(**al));
|
|
if (a == NULL)
|
|
return;
|
|
a[*attrlen] = attr;
|
|
a[*attrlen + 1] = NULL;
|
|
(*attrlen)++;
|
|
*al = a;
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
_kadm5_ad_connect(void *server_handle)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
struct {
|
|
char *server;
|
|
int port;
|
|
} *s, *servers = NULL;
|
|
int i, num_servers = 0;
|
|
|
|
if (context->ldap_conn)
|
|
return 0;
|
|
|
|
{
|
|
struct dns_reply *r;
|
|
struct resource_record *rr;
|
|
char *domain;
|
|
|
|
asprintf(&domain, "_ldap._tcp.%s", context->realm);
|
|
if (domain == NULL) {
|
|
krb5_set_error_string(context->context, "malloc");
|
|
return KADM5_NO_SRV;
|
|
}
|
|
|
|
r = dns_lookup(domain, "SRV");
|
|
free(domain);
|
|
if (r == NULL) {
|
|
krb5_set_error_string(context->context, "Didn't find ldap dns");
|
|
return KADM5_NO_SRV;
|
|
}
|
|
|
|
for (rr = r->head ; rr != NULL; rr = rr->next) {
|
|
if (rr->type != T_SRV)
|
|
continue;
|
|
s = realloc(servers, sizeof(*servers) * (num_servers + 1));
|
|
if (s == NULL) {
|
|
krb5_set_error_string(context->context, "malloc");
|
|
dns_free_data(r);
|
|
goto fail;
|
|
}
|
|
servers = s;
|
|
num_servers++;
|
|
servers[num_servers - 1].port = rr->u.srv->port;
|
|
servers[num_servers - 1].server = strdup(rr->u.srv->target);
|
|
}
|
|
dns_free_data(r);
|
|
}
|
|
|
|
if (num_servers == 0) {
|
|
krb5_set_error_string(context->context, "No AD server found in DNS");
|
|
return KADM5_NO_SRV;
|
|
}
|
|
|
|
for (i = 0; i < num_servers; i++) {
|
|
int lret, version = LDAP_VERSION3;
|
|
LDAP *lp;
|
|
|
|
lp = ldap_init(servers[i].server, servers[i].port);
|
|
if (lp == NULL)
|
|
continue;
|
|
|
|
if (ldap_set_option(lp, LDAP_OPT_PROTOCOL_VERSION, &version)) {
|
|
ldap_unbind(lp);
|
|
continue;
|
|
}
|
|
|
|
if (ldap_set_option(lp, LDAP_OPT_REFERRALS, LDAP_OPT_OFF)) {
|
|
ldap_unbind(lp);
|
|
continue;
|
|
}
|
|
|
|
#ifdef HAVE_TSASL
|
|
lret = ldap_tsasl_bind_s(lp, NULL, NULL, NULL, servers[i].server);
|
|
|
|
#else
|
|
lret = ldap_sasl_interactive_bind_s(lp, NULL, NULL, NULL, NULL,
|
|
LDAP_SASL_QUIET,
|
|
sasl_interact, NULL);
|
|
#endif
|
|
if (lret != LDAP_SUCCESS) {
|
|
krb5_set_error_string(context->context,
|
|
"Couldn't contact any AD servers: %s",
|
|
ldap_err2string(lret));
|
|
ldap_unbind(lp);
|
|
continue;
|
|
}
|
|
|
|
context->ldap_conn = lp;
|
|
break;
|
|
}
|
|
if (i >= num_servers) {
|
|
goto fail;
|
|
}
|
|
|
|
{
|
|
LDAPMessage *m, *m0;
|
|
char **attr = NULL;
|
|
int attrlen = 0;
|
|
char **vals;
|
|
int ret;
|
|
|
|
laddattr(&attr, &attrlen, "defaultNamingContext");
|
|
|
|
ret = ldap_search_s(CTX2LP(context), "", LDAP_SCOPE_BASE,
|
|
"objectclass=*", attr, 0, &m);
|
|
free(attr);
|
|
if (check_ldap(context, ret))
|
|
goto fail;
|
|
|
|
if (ldap_count_entries(CTX2LP(context), m) > 0) {
|
|
m0 = ldap_first_entry(CTX2LP(context), m);
|
|
if (m0 == NULL) {
|
|
krb5_set_error_string(context->context,
|
|
"Error in AD ldap responce");
|
|
ldap_msgfree(m);
|
|
goto fail;
|
|
}
|
|
vals = ldap_get_values(CTX2LP(context),
|
|
m0, "defaultNamingContext");
|
|
if (vals == NULL) {
|
|
krb5_set_error_string(context->context,
|
|
"No naming context found");
|
|
goto fail;
|
|
}
|
|
context->base_dn = strdup(vals[0]);
|
|
} else
|
|
goto fail;
|
|
ldap_msgfree(m);
|
|
}
|
|
|
|
for (i = 0; i < num_servers; i++)
|
|
free(servers[i].server);
|
|
free(servers);
|
|
|
|
return 0;
|
|
|
|
fail:
|
|
for (i = 0; i < num_servers; i++)
|
|
free(servers[i].server);
|
|
free(servers);
|
|
|
|
if (context->ldap_conn) {
|
|
ldap_unbind(CTX2LP(context));
|
|
context->ldap_conn = NULL;
|
|
}
|
|
return KADM5_RPC_ERROR;
|
|
}
|
|
|
|
#define NTTIME_EPOCH 0x019DB1DED53E8000LL
|
|
|
|
static time_t
|
|
nt2unixtime(const char *str)
|
|
{
|
|
unsigned long long t;
|
|
t = strtoll(str, NULL, 10);
|
|
t = ((t - NTTIME_EPOCH) / (long long)10000000);
|
|
if (t > (((time_t)(~(long long)0)) >> 1))
|
|
return 0;
|
|
return (time_t)t;
|
|
}
|
|
|
|
static long long
|
|
unix2nttime(time_t unix_time)
|
|
{
|
|
long long wt;
|
|
wt = unix_time * (long long)10000000 + (long long)NTTIME_EPOCH;
|
|
return wt;
|
|
}
|
|
|
|
/* XXX create filter in a better way */
|
|
|
|
static int
|
|
ad_find_entry(kadm5_ad_context *context,
|
|
const char *fqdn,
|
|
const char *pn,
|
|
char **name)
|
|
{
|
|
LDAPMessage *m, *m0;
|
|
char *attr[] = { "distinguishedName", NULL };
|
|
char *filter;
|
|
int ret;
|
|
|
|
if (name)
|
|
*name = NULL;
|
|
|
|
if (fqdn)
|
|
asprintf(&filter,
|
|
"(&(objectClass=computer)(|(dNSHostName=%s)(servicePrincipalName=%s)))",
|
|
fqdn, pn);
|
|
else if(pn)
|
|
asprintf(&filter, "(&(objectClass=account)(userPrincipalName=%s))", pn);
|
|
else
|
|
return KADM5_RPC_ERROR;
|
|
|
|
ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
|
|
LDAP_SCOPE_SUBTREE,
|
|
filter, attr, 0, &m);
|
|
free(filter);
|
|
if (check_ldap(context, ret))
|
|
return KADM5_RPC_ERROR;
|
|
|
|
if (ldap_count_entries(CTX2LP(context), m) > 0) {
|
|
char **vals;
|
|
m0 = ldap_first_entry(CTX2LP(context), m);
|
|
vals = ldap_get_values(CTX2LP(context), m0, "distinguishedName");
|
|
if (vals == NULL || vals[0] == NULL) {
|
|
ldap_msgfree(m);
|
|
return KADM5_RPC_ERROR;
|
|
}
|
|
if (name)
|
|
*name = strdup(vals[0]);
|
|
ldap_msgfree(m);
|
|
} else
|
|
return KADM5_UNK_PRINC;
|
|
|
|
return 0;
|
|
}
|
|
|
|
#endif /* OPENLDAP */
|
|
|
|
static kadm5_ret_t
|
|
ad_get_cred(kadm5_ad_context *context, const char *password)
|
|
{
|
|
kadm5_ret_t ret;
|
|
krb5_ccache cc;
|
|
char *service;
|
|
|
|
if (context->ccache)
|
|
return 0;
|
|
|
|
asprintf(&service, "%s/%s@%s", KRB5_TGS_NAME,
|
|
context->realm, context->realm);
|
|
if (service == NULL)
|
|
return ENOMEM;
|
|
|
|
ret = _kadm5_c_get_cred_cache(context->context,
|
|
context->client_name,
|
|
service,
|
|
password, krb5_prompter_posix,
|
|
NULL, NULL, &cc);
|
|
free(service);
|
|
if(ret)
|
|
return ret; /* XXX */
|
|
context->ccache = cc;
|
|
return 0;
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_chpass_principal(void *server_handle,
|
|
krb5_principal principal,
|
|
const char *password)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
krb5_data result_code_string, result_string;
|
|
int result_code;
|
|
kadm5_ret_t ret;
|
|
|
|
ret = ad_get_cred(context, NULL);
|
|
if (ret)
|
|
return ret;
|
|
|
|
krb5_data_zero (&result_code_string);
|
|
krb5_data_zero (&result_string);
|
|
|
|
ret = krb5_set_password_using_ccache (context->context,
|
|
context->ccache,
|
|
password,
|
|
principal,
|
|
&result_code,
|
|
&result_code_string,
|
|
&result_string);
|
|
|
|
krb5_data_free (&result_code_string);
|
|
krb5_data_free (&result_string);
|
|
|
|
/* XXX do mapping here on error codes */
|
|
|
|
return ret;
|
|
}
|
|
|
|
#ifdef OPENLDAP
|
|
static const char *
|
|
get_fqdn(krb5_context context, const krb5_principal p)
|
|
{
|
|
const char *s, *hosttypes[] = { "host", "ldap", "gc", "cifs", "dns" };
|
|
int i;
|
|
|
|
s = krb5_principal_get_comp_string(context, p, 0);
|
|
if (p == NULL)
|
|
return NULL;
|
|
|
|
for (i = 0; i < sizeof(hosttypes)/sizeof(hosttypes[0]); i++) {
|
|
if (strcasecmp(s, hosttypes[i]) == 0)
|
|
return krb5_principal_get_comp_string(context, p, 1);
|
|
}
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_create_principal(void *server_handle,
|
|
kadm5_principal_ent_t entry,
|
|
uint32_t mask,
|
|
const char *password)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
|
|
/*
|
|
* KADM5_PRINC_EXPIRE_TIME
|
|
*
|
|
* return 0 || KADM5_DUP;
|
|
*/
|
|
|
|
#ifdef OPENLDAP
|
|
LDAPMod *attrs[8], rattrs[7], *a;
|
|
char *useraccvals[2] = { NULL, NULL },
|
|
*samvals[2], *dnsvals[2], *spnvals[5], *upnvals[2], *tv[2];
|
|
char *ocvals_spn[] = { "top", "person", "organizationalPerson",
|
|
"user", "computer", NULL};
|
|
char *p, *realmless_p, *p_msrealm = NULL, *dn = NULL;
|
|
const char *fqdn;
|
|
char *s, *samname = NULL, *short_spn = NULL;
|
|
int ret, i;
|
|
int32_t uf_flags = 0;
|
|
|
|
if ((mask & KADM5_PRINCIPAL) == 0)
|
|
return KADM5_BAD_MASK;
|
|
|
|
for (i = 0; i < sizeof(rattrs)/sizeof(rattrs[0]); i++)
|
|
attrs[i] = &rattrs[i];
|
|
attrs[i] = NULL;
|
|
|
|
ret = ad_get_cred(context, NULL);
|
|
if (ret)
|
|
return ret;
|
|
|
|
ret = _kadm5_ad_connect(server_handle);
|
|
if (ret)
|
|
return ret;
|
|
|
|
fqdn = get_fqdn(context->context, entry->principal);
|
|
|
|
ret = krb5_unparse_name(context->context, entry->principal, &p);
|
|
if (ret)
|
|
return ret;
|
|
|
|
if (ad_find_entry(context, fqdn, p, NULL) == 0) {
|
|
free(p);
|
|
return KADM5_DUP;
|
|
}
|
|
|
|
if (mask & KADM5_ATTRIBUTES) {
|
|
if (entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)
|
|
uf_flags |= UF_ACCOUNTDISABLE|UF_LOCKOUT;
|
|
if ((entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH) == 0)
|
|
uf_flags |= UF_DONT_REQUIRE_PREAUTH;
|
|
if (entry->attributes & KRB5_KDB_REQUIRES_HW_AUTH)
|
|
uf_flags |= UF_SMARTCARD_REQUIRED;
|
|
}
|
|
|
|
realmless_p = strdup(p);
|
|
if (realmless_p == NULL) {
|
|
ret = ENOMEM;
|
|
goto out;
|
|
}
|
|
s = strrchr(realmless_p, '@');
|
|
if (s)
|
|
*s = '\0';
|
|
|
|
if (fqdn) {
|
|
/* create computer account */
|
|
asprintf(&samname, "%s$", fqdn);
|
|
if (samname == NULL) {
|
|
ret = ENOMEM;
|
|
goto out;
|
|
}
|
|
s = strchr(samname, '.');
|
|
if (s) {
|
|
s[0] = '$';
|
|
s[1] = '\0';
|
|
}
|
|
|
|
short_spn = strdup(p);
|
|
if (short_spn == NULL) {
|
|
errno = ENOMEM;
|
|
goto out;
|
|
}
|
|
s = strchr(short_spn, '.');
|
|
if (s) {
|
|
*s = '\0';
|
|
} else {
|
|
free(short_spn);
|
|
short_spn = NULL;
|
|
}
|
|
|
|
p_msrealm = strdup(p);
|
|
if (p_msrealm == NULL) {
|
|
errno = ENOMEM;
|
|
goto out;
|
|
}
|
|
s = strrchr(p_msrealm, '@');
|
|
if (s) {
|
|
*s = '/';
|
|
} else {
|
|
free(p_msrealm);
|
|
p_msrealm = NULL;
|
|
}
|
|
|
|
asprintf(&dn, "cn=%s, cn=Computers, %s", fqdn, CTX2BASE(context));
|
|
if (dn == NULL) {
|
|
ret = ENOMEM;
|
|
goto out;
|
|
}
|
|
|
|
a = &rattrs[0];
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "objectClass";
|
|
a->mod_values = ocvals_spn;
|
|
a++;
|
|
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "userAccountControl";
|
|
a->mod_values = useraccvals;
|
|
asprintf(&useraccvals[0], "%d",
|
|
uf_flags |
|
|
UF_PASSWD_NOT_EXPIRE |
|
|
UF_WORKSTATION_TRUST_ACCOUNT);
|
|
useraccvals[1] = NULL;
|
|
a++;
|
|
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "sAMAccountName";
|
|
a->mod_values = samvals;
|
|
samvals[0] = samname;
|
|
samvals[1] = NULL;
|
|
a++;
|
|
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "dNSHostName";
|
|
a->mod_values = dnsvals;
|
|
dnsvals[0] = (char *)fqdn;
|
|
dnsvals[1] = NULL;
|
|
a++;
|
|
|
|
/* XXX add even more spn's */
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "servicePrincipalName";
|
|
a->mod_values = spnvals;
|
|
i = 0;
|
|
spnvals[i++] = p;
|
|
spnvals[i++] = realmless_p;
|
|
if (short_spn)
|
|
spnvals[i++] = short_spn;
|
|
if (p_msrealm)
|
|
spnvals[i++] = p_msrealm;
|
|
spnvals[i++] = NULL;
|
|
a++;
|
|
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "userPrincipalName";
|
|
a->mod_values = upnvals;
|
|
upnvals[0] = p;
|
|
upnvals[1] = NULL;
|
|
a++;
|
|
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "accountExpires";
|
|
a->mod_values = tv;
|
|
tv[0] = "9223372036854775807"; /* "never" */
|
|
tv[1] = NULL;
|
|
a++;
|
|
|
|
} else {
|
|
/* create user account */
|
|
|
|
a = &rattrs[0];
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "userAccountControl";
|
|
a->mod_values = useraccvals;
|
|
asprintf(&useraccvals[0], "%d",
|
|
uf_flags |
|
|
UF_PASSWD_NOT_EXPIRE);
|
|
useraccvals[1] = NULL;
|
|
a++;
|
|
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "sAMAccountName";
|
|
a->mod_values = samvals;
|
|
samvals[0] = realmless_p;
|
|
samvals[1] = NULL;
|
|
a++;
|
|
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "userPrincipalName";
|
|
a->mod_values = upnvals;
|
|
upnvals[0] = p;
|
|
upnvals[1] = NULL;
|
|
a++;
|
|
|
|
a->mod_op = LDAP_MOD_ADD;
|
|
a->mod_type = "accountExpires";
|
|
a->mod_values = tv;
|
|
tv[0] = "9223372036854775807"; /* "never" */
|
|
tv[1] = NULL;
|
|
a++;
|
|
}
|
|
|
|
attrs[a - &rattrs[0]] = NULL;
|
|
|
|
ret = ldap_add_s(CTX2LP(context), dn, attrs);
|
|
|
|
out:
|
|
if (useraccvals[0])
|
|
free(useraccvals[0]);
|
|
if (realmless_p)
|
|
free(realmless_p);
|
|
if (samname)
|
|
free(samname);
|
|
if (short_spn)
|
|
free(short_spn);
|
|
if (p_msrealm)
|
|
free(p_msrealm);
|
|
free(p);
|
|
|
|
if (check_ldap(context, ret))
|
|
return KADM5_RPC_ERROR;
|
|
|
|
return 0;
|
|
#else
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
#endif
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_delete_principal(void *server_handle, krb5_principal principal)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
#ifdef OPENLDAP
|
|
char *p, *dn = NULL;
|
|
const char *fqdn;
|
|
int ret;
|
|
|
|
ret = ad_get_cred(context, NULL);
|
|
if (ret)
|
|
return ret;
|
|
|
|
ret = _kadm5_ad_connect(server_handle);
|
|
if (ret)
|
|
return ret;
|
|
|
|
fqdn = get_fqdn(context->context, principal);
|
|
|
|
ret = krb5_unparse_name(context->context, principal, &p);
|
|
if (ret)
|
|
return ret;
|
|
|
|
if (ad_find_entry(context, fqdn, p, &dn) != 0) {
|
|
free(p);
|
|
return KADM5_UNK_PRINC;
|
|
}
|
|
|
|
ret = ldap_delete_s(CTX2LP(context), dn);
|
|
|
|
free(dn);
|
|
free(p);
|
|
|
|
if (check_ldap(context, ret))
|
|
return KADM5_RPC_ERROR;
|
|
return 0;
|
|
#else
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
#endif
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_destroy(void *server_handle)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
|
|
if (context->ccache)
|
|
krb5_cc_destroy(context->context, context->ccache);
|
|
|
|
#ifdef OPENLDAP
|
|
{
|
|
LDAP *lp = CTX2LP(context);
|
|
if (lp)
|
|
ldap_unbind(lp);
|
|
if (context->base_dn)
|
|
free(context->base_dn);
|
|
}
|
|
#endif
|
|
free(context->realm);
|
|
free(context->client_name);
|
|
krb5_free_principal(context->context, context->caller);
|
|
if(context->my_context)
|
|
krb5_free_context(context->context);
|
|
return 0;
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_flush(void *server_handle)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
#ifdef OPENLDAP
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
#else
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
#endif
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_get_principal(void *server_handle,
|
|
krb5_principal principal,
|
|
kadm5_principal_ent_t entry,
|
|
uint32_t mask)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
#ifdef OPENLDAP
|
|
LDAPMessage *m, *m0;
|
|
char **attr = NULL;
|
|
int attrlen = 0;
|
|
char *filter, *p, *q, *u;
|
|
int ret;
|
|
|
|
/*
|
|
* principal
|
|
* KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES
|
|
*/
|
|
|
|
/*
|
|
* return 0 || KADM5_DUP;
|
|
*/
|
|
|
|
memset(entry, 0, sizeof(*entry));
|
|
|
|
if (mask & KADM5_KVNO)
|
|
laddattr(&attr, &attrlen, "msDS-KeyVersionNumber");
|
|
|
|
if (mask & KADM5_PRINCIPAL) {
|
|
laddattr(&attr, &attrlen, "userPrincipalName");
|
|
laddattr(&attr, &attrlen, "servicePrincipalName");
|
|
}
|
|
laddattr(&attr, &attrlen, "objectClass");
|
|
laddattr(&attr, &attrlen, "lastLogon");
|
|
laddattr(&attr, &attrlen, "badPwdCount");
|
|
laddattr(&attr, &attrlen, "badPasswordTime");
|
|
laddattr(&attr, &attrlen, "pwdLastSet");
|
|
laddattr(&attr, &attrlen, "accountExpires");
|
|
laddattr(&attr, &attrlen, "userAccountControl");
|
|
|
|
krb5_unparse_name_short(context->context, principal, &p);
|
|
krb5_unparse_name(context->context, principal, &u);
|
|
|
|
/* replace @ in domain part with a / */
|
|
q = strrchr(p, '@');
|
|
if (q && (p != q && *(q - 1) != '\\'))
|
|
*q = '/';
|
|
|
|
asprintf(&filter,
|
|
"(|(userPrincipalName=%s)(servicePrincipalName=%s)(servicePrincipalName=%s))",
|
|
u, p, u);
|
|
free(p);
|
|
free(u);
|
|
|
|
ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
|
|
LDAP_SCOPE_SUBTREE,
|
|
filter, attr, 0, &m);
|
|
free(attr);
|
|
if (check_ldap(context, ret))
|
|
return KADM5_RPC_ERROR;
|
|
|
|
if (ldap_count_entries(CTX2LP(context), m) > 0) {
|
|
char **vals;
|
|
m0 = ldap_first_entry(CTX2LP(context), m);
|
|
if (m0 == NULL) {
|
|
ldap_msgfree(m);
|
|
goto fail;
|
|
}
|
|
#if 0
|
|
vals = ldap_get_values(CTX2LP(context), m0, "servicePrincipalName");
|
|
if (vals)
|
|
printf("servicePrincipalName %s\n", vals[0]);
|
|
vals = ldap_get_values(CTX2LP(context), m0, "userPrincipalName");
|
|
if (vals)
|
|
printf("userPrincipalName %s\n", vals[0]);
|
|
vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
|
|
if (vals)
|
|
printf("userAccountControl %s\n", vals[0]);
|
|
#endif
|
|
entry->princ_expire_time = 0;
|
|
if (mask & KADM5_PRINC_EXPIRE_TIME) {
|
|
vals = ldap_get_values(CTX2LP(context), m0, "accountExpires");
|
|
if (vals)
|
|
entry->princ_expire_time = nt2unixtime(vals[0]);
|
|
}
|
|
entry->last_success = 0;
|
|
if (mask & KADM5_LAST_SUCCESS) {
|
|
vals = ldap_get_values(CTX2LP(context), m0, "lastLogon");
|
|
if (vals)
|
|
entry->last_success = nt2unixtime(vals[0]);
|
|
}
|
|
if (mask & KADM5_LAST_FAILED) {
|
|
vals = ldap_get_values(CTX2LP(context), m0, "badPasswordTime");
|
|
if (vals)
|
|
entry->last_failed = nt2unixtime(vals[0]);
|
|
}
|
|
if (mask & KADM5_LAST_PWD_CHANGE) {
|
|
vals = ldap_get_values(CTX2LP(context), m0, "pwdLastSet");
|
|
if (vals)
|
|
entry->last_pwd_change = nt2unixtime(vals[0]);
|
|
}
|
|
if (mask & KADM5_FAIL_AUTH_COUNT) {
|
|
vals = ldap_get_values(CTX2LP(context), m0, "badPwdCount");
|
|
if (vals)
|
|
entry->fail_auth_count = atoi(vals[0]);
|
|
}
|
|
if (mask & KADM5_ATTRIBUTES) {
|
|
vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
|
|
if (vals) {
|
|
uint32_t i;
|
|
i = atoi(vals[0]);
|
|
if (i & (UF_ACCOUNTDISABLE|UF_LOCKOUT))
|
|
entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
|
|
if ((i & UF_DONT_REQUIRE_PREAUTH) == 0)
|
|
entry->attributes |= KRB5_KDB_REQUIRES_PRE_AUTH;
|
|
if (i & UF_SMARTCARD_REQUIRED)
|
|
entry->attributes |= KRB5_KDB_REQUIRES_HW_AUTH;
|
|
if ((i & UF_WORKSTATION_TRUST_ACCOUNT) == 0)
|
|
entry->attributes |= KRB5_KDB_DISALLOW_SVR;
|
|
}
|
|
}
|
|
if (mask & KADM5_KVNO) {
|
|
vals = ldap_get_values(CTX2LP(context), m0,
|
|
"msDS-KeyVersionNumber");
|
|
if (vals)
|
|
entry->kvno = atoi(vals[0]);
|
|
else
|
|
entry->kvno = 0;
|
|
}
|
|
ldap_msgfree(m);
|
|
} else {
|
|
return KADM5_UNK_PRINC;
|
|
}
|
|
|
|
if (mask & KADM5_PRINCIPAL)
|
|
krb5_copy_principal(context->context, principal, &entry->principal);
|
|
|
|
return 0;
|
|
fail:
|
|
return KADM5_RPC_ERROR;
|
|
#else
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
#endif
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_get_principals(void *server_handle,
|
|
const char *expression,
|
|
char ***principals,
|
|
int *count)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
|
|
/*
|
|
* KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES
|
|
*/
|
|
|
|
#ifdef OPENLDAP
|
|
kadm5_ret_t ret;
|
|
|
|
ret = ad_get_cred(context, NULL);
|
|
if (ret)
|
|
return ret;
|
|
|
|
ret = _kadm5_ad_connect(server_handle);
|
|
if (ret)
|
|
return ret;
|
|
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
#else
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
#endif
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_get_privs(void *server_handle, uint32_t*privs)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_modify_principal(void *server_handle,
|
|
kadm5_principal_ent_t entry,
|
|
uint32_t mask)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
|
|
/*
|
|
* KADM5_ATTRIBUTES
|
|
* KRB5_KDB_DISALLOW_ALL_TIX (| KADM5_KVNO)
|
|
*/
|
|
|
|
#ifdef OPENLDAP
|
|
LDAPMessage *m = NULL, *m0;
|
|
kadm5_ret_t ret;
|
|
char **attr = NULL;
|
|
int attrlen = 0;
|
|
char *p = NULL, *s = NULL, *q;
|
|
char **vals;
|
|
LDAPMod *attrs[4], rattrs[3], *a;
|
|
char *uaf[2] = { NULL, NULL };
|
|
char *kvno[2] = { NULL, NULL };
|
|
char *tv[2] = { NULL, NULL };
|
|
char *filter, *dn;
|
|
int i;
|
|
|
|
for (i = 0; i < sizeof(rattrs)/sizeof(rattrs[0]); i++)
|
|
attrs[i] = &rattrs[i];
|
|
attrs[i] = NULL;
|
|
a = &rattrs[0];
|
|
|
|
ret = _kadm5_ad_connect(server_handle);
|
|
if (ret)
|
|
return ret;
|
|
|
|
if (mask & KADM5_KVNO)
|
|
laddattr(&attr, &attrlen, "msDS-KeyVersionNumber");
|
|
if (mask & KADM5_PRINC_EXPIRE_TIME)
|
|
laddattr(&attr, &attrlen, "accountExpires");
|
|
if (mask & KADM5_ATTRIBUTES)
|
|
laddattr(&attr, &attrlen, "userAccountControl");
|
|
laddattr(&attr, &attrlen, "distinguishedName");
|
|
|
|
krb5_unparse_name(context->context, entry->principal, &p);
|
|
|
|
s = strdup(p);
|
|
|
|
q = strrchr(s, '@');
|
|
if (q && (p != q && *(q - 1) != '\\'))
|
|
*q = '\0';
|
|
|
|
asprintf(&filter,
|
|
"(|(userPrincipalName=%s)(servicePrincipalName=%s))",
|
|
s, s);
|
|
free(p);
|
|
free(s);
|
|
|
|
ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
|
|
LDAP_SCOPE_SUBTREE,
|
|
filter, attr, 0, &m);
|
|
free(attr);
|
|
free(filter);
|
|
if (check_ldap(context, ret))
|
|
return KADM5_RPC_ERROR;
|
|
|
|
if (ldap_count_entries(CTX2LP(context), m) <= 0) {
|
|
ret = KADM5_RPC_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
m0 = ldap_first_entry(CTX2LP(context), m);
|
|
|
|
if (mask & KADM5_ATTRIBUTES) {
|
|
int32_t i;
|
|
|
|
vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
|
|
if (vals == NULL) {
|
|
ret = KADM5_RPC_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
i = atoi(vals[0]);
|
|
if (i == 0)
|
|
return KADM5_RPC_ERROR;
|
|
|
|
if (entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)
|
|
i |= (UF_ACCOUNTDISABLE|UF_LOCKOUT);
|
|
else
|
|
i &= ~(UF_ACCOUNTDISABLE|UF_LOCKOUT);
|
|
if (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)
|
|
i &= ~UF_DONT_REQUIRE_PREAUTH;
|
|
else
|
|
i |= UF_DONT_REQUIRE_PREAUTH;
|
|
if (entry->attributes & KRB5_KDB_REQUIRES_HW_AUTH)
|
|
i |= UF_SMARTCARD_REQUIRED;
|
|
else
|
|
i &= UF_SMARTCARD_REQUIRED;
|
|
if (entry->attributes & KRB5_KDB_DISALLOW_SVR)
|
|
i &= ~UF_WORKSTATION_TRUST_ACCOUNT;
|
|
else
|
|
i |= UF_WORKSTATION_TRUST_ACCOUNT;
|
|
|
|
asprintf(&uaf[0], "%d", i);
|
|
|
|
a->mod_op = LDAP_MOD_REPLACE;
|
|
a->mod_type = "userAccountControl";
|
|
a->mod_values = uaf;
|
|
a++;
|
|
}
|
|
|
|
if (mask & KADM5_KVNO) {
|
|
vals = ldap_get_values(CTX2LP(context), m0, "msDS-KeyVersionNumber");
|
|
if (vals == NULL) {
|
|
entry->kvno = 0;
|
|
} else {
|
|
asprintf(&kvno[0], "%d", entry->kvno);
|
|
|
|
a->mod_op = LDAP_MOD_REPLACE;
|
|
a->mod_type = "msDS-KeyVersionNumber";
|
|
a->mod_values = kvno;
|
|
a++;
|
|
}
|
|
}
|
|
|
|
if (mask & KADM5_PRINC_EXPIRE_TIME) {
|
|
long long wt;
|
|
vals = ldap_get_values(CTX2LP(context), m0, "accountExpires");
|
|
if (vals == NULL) {
|
|
ret = KADM5_RPC_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
wt = unix2nttime(entry->princ_expire_time);
|
|
|
|
asprintf(&tv[0], "%llu", wt);
|
|
|
|
a->mod_op = LDAP_MOD_REPLACE;
|
|
a->mod_type = "accountExpires";
|
|
a->mod_values = tv;
|
|
a++;
|
|
}
|
|
|
|
vals = ldap_get_values(CTX2LP(context), m0, "distinguishedName");
|
|
if (vals == NULL) {
|
|
ret = KADM5_RPC_ERROR;
|
|
goto out;
|
|
}
|
|
dn = vals[0];
|
|
|
|
attrs[a - &rattrs[0]] = NULL;
|
|
|
|
ret = ldap_modify_s(CTX2LP(context), dn, attrs);
|
|
if (check_ldap(context, ret))
|
|
return KADM5_RPC_ERROR;
|
|
|
|
out:
|
|
if (m)
|
|
ldap_msgfree(m);
|
|
if (uaf[0])
|
|
free(uaf[0]);
|
|
if (kvno[0])
|
|
free(kvno[0]);
|
|
if (tv[0])
|
|
free(tv[0]);
|
|
return ret;
|
|
#else
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
#endif
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_randkey_principal(void *server_handle,
|
|
krb5_principal principal,
|
|
krb5_keyblock **keys,
|
|
int *n_keys)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
|
|
/*
|
|
* random key
|
|
*/
|
|
|
|
#ifdef OPENLDAP
|
|
krb5_data result_code_string, result_string;
|
|
int result_code, plen;
|
|
kadm5_ret_t ret;
|
|
char *password;
|
|
|
|
*keys = NULL;
|
|
*n_keys = 0;
|
|
|
|
{
|
|
char p[64];
|
|
krb5_generate_random_block(p, sizeof(p));
|
|
plen = base64_encode(p, sizeof(p), &password);
|
|
if (plen < 0)
|
|
return ENOMEM;
|
|
}
|
|
|
|
ret = ad_get_cred(context, NULL);
|
|
if (ret) {
|
|
free(password);
|
|
return ret;
|
|
}
|
|
|
|
krb5_data_zero (&result_code_string);
|
|
krb5_data_zero (&result_string);
|
|
|
|
ret = krb5_set_password_using_ccache (context->context,
|
|
context->ccache,
|
|
password,
|
|
principal,
|
|
&result_code,
|
|
&result_code_string,
|
|
&result_string);
|
|
|
|
krb5_data_free (&result_code_string);
|
|
krb5_data_free (&result_string);
|
|
|
|
if (ret == 0) {
|
|
|
|
*keys = malloc(sizeof(**keys) * 1);
|
|
if (*keys == NULL) {
|
|
ret = ENOMEM;
|
|
goto out;
|
|
}
|
|
*n_keys = 1;
|
|
|
|
ret = krb5_string_to_key(context->context,
|
|
ENCTYPE_ARCFOUR_HMAC_MD5,
|
|
password,
|
|
principal,
|
|
&(*keys)[0]);
|
|
memset(password, 0, sizeof(password));
|
|
if (ret) {
|
|
free(*keys);
|
|
*keys = NULL;
|
|
*n_keys = 0;
|
|
goto out;
|
|
}
|
|
}
|
|
memset(password, 0, plen);
|
|
free(password);
|
|
out:
|
|
return ret;
|
|
#else
|
|
*keys = NULL;
|
|
*n_keys = 0;
|
|
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
#endif
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_rename_principal(void *server_handle,
|
|
krb5_principal from,
|
|
krb5_principal to)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
}
|
|
|
|
static kadm5_ret_t
|
|
kadm5_ad_chpass_principal_with_key(void *server_handle,
|
|
krb5_principal princ,
|
|
int n_key_data,
|
|
krb5_key_data *key_data)
|
|
{
|
|
kadm5_ad_context *context = server_handle;
|
|
krb5_set_error_string(context->context, "Function not implemented");
|
|
return KADM5_RPC_ERROR;
|
|
}
|
|
|
|
static void
|
|
set_funcs(kadm5_ad_context *c)
|
|
{
|
|
#define SET(C, F) (C)->funcs.F = kadm5_ad_ ## F
|
|
SET(c, chpass_principal);
|
|
SET(c, chpass_principal_with_key);
|
|
SET(c, create_principal);
|
|
SET(c, delete_principal);
|
|
SET(c, destroy);
|
|
SET(c, flush);
|
|
SET(c, get_principal);
|
|
SET(c, get_principals);
|
|
SET(c, get_privs);
|
|
SET(c, modify_principal);
|
|
SET(c, randkey_principal);
|
|
SET(c, rename_principal);
|
|
}
|
|
|
|
kadm5_ret_t
|
|
kadm5_ad_init_with_password_ctx(krb5_context context,
|
|
const char *client_name,
|
|
const char *password,
|
|
const char *service_name,
|
|
kadm5_config_params *realm_params,
|
|
unsigned long struct_version,
|
|
unsigned long api_version,
|
|
void **server_handle)
|
|
{
|
|
kadm5_ret_t ret;
|
|
kadm5_ad_context *ctx;
|
|
|
|
ctx = malloc(sizeof(*ctx));
|
|
if(ctx == NULL)
|
|
return ENOMEM;
|
|
memset(ctx, 0, sizeof(*ctx));
|
|
set_funcs(ctx);
|
|
|
|
ctx->context = context;
|
|
krb5_add_et_list (context, initialize_kadm5_error_table_r);
|
|
|
|
ret = krb5_parse_name(ctx->context, client_name, &ctx->caller);
|
|
if(ret) {
|
|
free(ctx);
|
|
return ret;
|
|
}
|
|
|
|
if(realm_params->mask & KADM5_CONFIG_REALM) {
|
|
ret = 0;
|
|
ctx->realm = strdup(realm_params->realm);
|
|
if (ctx->realm == NULL)
|
|
ret = ENOMEM;
|
|
} else
|
|
ret = krb5_get_default_realm(ctx->context, &ctx->realm);
|
|
if (ret) {
|
|
free(ctx);
|
|
return ret;
|
|
}
|
|
|
|
ctx->client_name = strdup(client_name);
|
|
|
|
if(password != NULL && *password != '\0')
|
|
ret = ad_get_cred(ctx, password);
|
|
else
|
|
ret = ad_get_cred(ctx, NULL);
|
|
if(ret) {
|
|
kadm5_ad_destroy(ctx);
|
|
return ret;
|
|
}
|
|
|
|
#ifdef OPENLDAP
|
|
ret = _kadm5_ad_connect(ctx);
|
|
if (ret) {
|
|
kadm5_ad_destroy(ctx);
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
*server_handle = ctx;
|
|
return 0;
|
|
}
|
|
|
|
kadm5_ret_t
|
|
kadm5_ad_init_with_password(const char *client_name,
|
|
const char *password,
|
|
const char *service_name,
|
|
kadm5_config_params *realm_params,
|
|
unsigned long struct_version,
|
|
unsigned long api_version,
|
|
void **server_handle)
|
|
{
|
|
krb5_context context;
|
|
kadm5_ret_t ret;
|
|
kadm5_ad_context *ctx;
|
|
|
|
ret = krb5_init_context(&context);
|
|
if (ret)
|
|
return ret;
|
|
ret = kadm5_ad_init_with_password_ctx(context,
|
|
client_name,
|
|
password,
|
|
service_name,
|
|
realm_params,
|
|
struct_version,
|
|
api_version,
|
|
server_handle);
|
|
if(ret) {
|
|
krb5_free_context(context);
|
|
return ret;
|
|
}
|
|
ctx = *server_handle;
|
|
ctx->my_context = 1;
|
|
return 0;
|
|
}
|