2 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "krb5_locl.h"
37 * @page krb5_ccache_intro The credential cache functions
38 * @section section_krb5_ccache Kerberos credential caches
40 * krb5_ccache structure holds a Kerberos credential cache.
42 * Heimdal support the follow types of credential caches:
45 * Store the credential in a database
47 * Store the credential in memory
49 * Store the credential in memory
51 * A credential cache server based solution for Mac OS X
53 * A credential cache server based solution for all platforms
57 * This is a minimalistic version of klist:
62 main (int argc, char **argv)
65 krb5_cc_cursor cursor;
70 if (krb5_init_context (&context) != 0)
71 errx(1, "krb5_context");
73 ret = krb5_cc_default (context, &id);
75 krb5_err(context, 1, ret, "krb5_cc_default");
77 ret = krb5_cc_start_seq_get(context, id, &cursor);
79 krb5_err(context, 1, ret, "krb5_cc_start_seq_get");
81 while((ret = krb5_cc_next_cred(context, id, &cursor, &creds)) == 0){
84 krb5_unparse_name_short(context, creds.server, &principal);
85 printf("principal: %s\\n", principal);
87 krb5_free_cred_contents (context, &creds);
89 ret = krb5_cc_end_seq_get(context, id, &cursor);
91 krb5_err(context, 1, ret, "krb5_cc_end_seq_get");
93 krb5_cc_close(context, id);
95 krb5_free_context(context);
102 * Add a new ccache type with operations `ops', overwriting any
103 * existing one if `override'.
105 * @param context a Keberos context
106 * @param ops type of plugin symbol
107 * @param override flag to select if the registration is to overide
108 * an existing ops with the same name.
110 * @return Return an error code or 0, see krb5_get_error_message().
112 * @ingroup krb5_ccache
115 krb5_error_code KRB5_LIB_FUNCTION
116 krb5_cc_register(krb5_context context
,
117 const krb5_cc_ops
*ops
,
118 krb5_boolean override
)
122 for(i
= 0; i
< context
->num_cc_ops
&& context
->cc_ops
[i
]->prefix
; i
++) {
123 if(strcmp(context
->cc_ops
[i
]->prefix
, ops
->prefix
) == 0) {
125 krb5_set_error_message(context
,
127 N_("cache type %s already exists", "type"),
129 return KRB5_CC_TYPE_EXISTS
;
134 if(i
== context
->num_cc_ops
) {
135 const krb5_cc_ops
**o
= realloc(context
->cc_ops
,
136 (context
->num_cc_ops
+ 1) *
137 sizeof(context
->cc_ops
[0]));
139 krb5_set_error_message(context
, KRB5_CC_NOMEM
,
140 N_("malloc: out of memory", ""));
141 return KRB5_CC_NOMEM
;
144 context
->cc_ops
[context
->num_cc_ops
] = NULL
;
145 context
->num_cc_ops
++;
147 context
->cc_ops
[i
] = ops
;
152 * Allocate the memory for a `id' and the that function table to
153 * `ops'. Returns 0 or and error code.
157 _krb5_cc_allocate(krb5_context context
,
158 const krb5_cc_ops
*ops
,
163 p
= malloc (sizeof(*p
));
165 krb5_set_error_message(context
, KRB5_CC_NOMEM
,
166 N_("malloc: out of memory", ""));
167 return KRB5_CC_NOMEM
;
176 * Allocate memory for a new ccache in `id' with operations `ops'
177 * and name `residual'. Return 0 or an error code.
180 static krb5_error_code
181 allocate_ccache (krb5_context context
,
182 const krb5_cc_ops
*ops
,
183 const char *residual
,
188 ret
= _krb5_cc_allocate(context
, ops
, id
);
191 ret
= (*id
)->ops
->resolve(context
, id
, residual
);
198 * Find and allocate a ccache in `id' from the specification in `residual'.
199 * If the ccache name doesn't contain any colon, interpret it as a file name.
201 * @param context a Keberos context.
202 * @param name string name of a credential cache.
203 * @param id return pointer to a found credential cache.
205 * @return Return 0 or an error code. In case of an error, id is set
206 * to NULL, see krb5_get_error_message().
208 * @ingroup krb5_ccache
212 krb5_error_code KRB5_LIB_FUNCTION
213 krb5_cc_resolve(krb5_context context
,
221 for(i
= 0; i
< context
->num_cc_ops
&& context
->cc_ops
[i
]->prefix
; i
++) {
222 size_t prefix_len
= strlen(context
->cc_ops
[i
]->prefix
);
224 if(strncmp(context
->cc_ops
[i
]->prefix
, name
, prefix_len
) == 0
225 && name
[prefix_len
] == ':') {
226 return allocate_ccache (context
, context
->cc_ops
[i
],
227 name
+ prefix_len
+ 1,
231 if (strchr (name
, ':') == NULL
)
232 return allocate_ccache (context
, &krb5_fcc_ops
, name
, id
);
234 krb5_set_error_message(context
, KRB5_CC_UNKNOWN_TYPE
,
235 N_("unknown ccache type %s", "name"), name
);
236 return KRB5_CC_UNKNOWN_TYPE
;
241 * Generates a new unique ccache of `type` in `id'. If `type' is NULL,
242 * the library chooses the default credential cache type. The supplied
243 * `hint' (that can be NULL) is a string that the credential cache
244 * type can use to base the name of the credential on, this is to make
245 * it easier for the user to differentiate the credentials.
247 * @return Return an error code or 0, see krb5_get_error_message().
249 * @ingroup krb5_ccache
252 krb5_error_code KRB5_LIB_FUNCTION
253 krb5_cc_new_unique(krb5_context context
, const char *type
,
254 const char *hint
, krb5_ccache
*id
)
256 const krb5_cc_ops
*ops
;
259 ops
= krb5_cc_get_prefix_ops(context
, type
);
261 krb5_set_error_message(context
, KRB5_CC_UNKNOWN_TYPE
,
262 "Credential cache type %s is unknown", type
);
263 return KRB5_CC_UNKNOWN_TYPE
;
266 ret
= _krb5_cc_allocate(context
, ops
, id
);
269 ret
= (*id
)->ops
->gen_new(context
, id
);
278 * Return the name of the ccache `id'
280 * @ingroup krb5_ccache
284 const char* KRB5_LIB_FUNCTION
285 krb5_cc_get_name(krb5_context context
,
288 return id
->ops
->get_name(context
, id
);
292 * Return the type of the ccache `id'.
294 * @ingroup krb5_ccache
298 const char* KRB5_LIB_FUNCTION
299 krb5_cc_get_type(krb5_context context
,
302 return id
->ops
->prefix
;
306 * Return the complete resolvable name the ccache `id' in `str´.
307 * `str` should be freed with free(3).
308 * Returns 0 or an error (and then *str is set to NULL).
310 * @ingroup krb5_ccache
314 krb5_error_code KRB5_LIB_FUNCTION
315 krb5_cc_get_full_name(krb5_context context
,
319 const char *type
, *name
;
323 type
= krb5_cc_get_type(context
, id
);
325 krb5_set_error_message(context
, KRB5_CC_UNKNOWN_TYPE
,
326 "cache have no name of type");
327 return KRB5_CC_UNKNOWN_TYPE
;
330 name
= krb5_cc_get_name(context
, id
);
332 krb5_set_error_message(context
, KRB5_CC_BADNAME
,
333 "cache of type %s have no name", type
);
334 return KRB5_CC_BADNAME
;
337 if (asprintf(str
, "%s:%s", type
, name
) == -1) {
338 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
346 * Return krb5_cc_ops of a the ccache `id'.
348 * @ingroup krb5_ccache
353 krb5_cc_get_ops(krb5_context context
, krb5_ccache id
)
359 * Expand variables in `str' into `res'
363 _krb5_expand_default_cc_name(krb5_context context
, const char *str
, char **res
)
365 size_t tlen
, len
= 0;
366 char *tmp
, *tmp2
, *append
;
370 while (str
&& *str
) {
371 tmp
= strstr(str
, "%{");
372 if (tmp
&& tmp
!= str
) {
373 append
= malloc((tmp
- str
) + 1);
375 memcpy(append
, str
, tmp
- str
);
376 append
[tmp
- str
] = '\0';
380 tmp2
= strchr(tmp
, '}');
384 krb5_set_error_message(context
, KRB5_CONFIG_BADFORMAT
,
385 "variable missing }");
386 return KRB5_CONFIG_BADFORMAT
;
388 if (strncasecmp(tmp
, "%{uid}", 6) == 0)
389 asprintf(&append
, "%u", (unsigned)getuid());
390 else if (strncasecmp(tmp
, "%{null}", 7) == 0)
395 krb5_set_error_message(context
,
396 KRB5_CONFIG_BADFORMAT
,
397 "expand default cache unknown "
399 (int)(tmp2
- tmp
) - 2, tmp
+ 2);
400 return KRB5_CONFIG_BADFORMAT
;
404 append
= strdup(str
);
407 if (append
== NULL
) {
410 krb5_set_error_message(context
, ENOMEM
,
411 N_("malloc: out of memory", ""));
415 tlen
= strlen(append
);
416 tmp
= realloc(*res
, len
+ tlen
+ 1);
421 krb5_set_error_message(context
, ENOMEM
,
422 N_("malloc: out of memory", ""));
426 memcpy(*res
+ len
, append
, tlen
+ 1);
434 * Return non-zero if envirnoment that will determine default krb5cc
439 environment_changed(krb5_context context
)
443 /* if the cc name was set, don't change it */
444 if (context
->default_cc_name_set
)
450 e
= getenv("KRB5CCNAME");
452 if (context
->default_cc_name_env
) {
453 free(context
->default_cc_name_env
);
454 context
->default_cc_name_env
= NULL
;
458 if (context
->default_cc_name_env
== NULL
)
460 if (strcmp(e
, context
->default_cc_name_env
) != 0)
467 * Switch the default default credential cache for a specific
468 * credcache type (and name for some implementations).
470 * @return Return an error code or 0, see krb5_get_error_message().
472 * @ingroup krb5_ccache
476 krb5_cc_switch(krb5_context context
, krb5_ccache id
)
479 if (id
->ops
->set_default
== NULL
)
482 return (*id
->ops
->set_default
)(context
, id
);
486 * Set the default cc name for `context' to `name'.
488 * @ingroup krb5_ccache
491 krb5_error_code KRB5_LIB_FUNCTION
492 krb5_cc_set_default_name(krb5_context context
, const char *name
)
494 krb5_error_code ret
= 0;
498 const char *e
= NULL
;
501 e
= getenv("KRB5CCNAME");
504 if (context
->default_cc_name_env
)
505 free(context
->default_cc_name_env
);
506 context
->default_cc_name_env
= strdup(e
);
510 e
= krb5_config_get_string(context
, NULL
, "libdefaults",
511 "default_cc_name", NULL
);
513 ret
= _krb5_expand_default_cc_name(context
, e
, &p
);
518 const krb5_cc_ops
*ops
= KRB5_DEFAULT_CCTYPE
;
519 e
= krb5_config_get_string(context
, NULL
, "libdefaults",
520 "default_cc_type", NULL
);
522 ops
= krb5_cc_get_prefix_ops(context
, e
);
524 krb5_set_error_message(context
,
525 KRB5_CC_UNKNOWN_TYPE
,
526 "Credential cache type %s "
528 return KRB5_CC_UNKNOWN_TYPE
;
531 ret
= (*ops
->get_default_name
)(context
, &p
);
536 context
->default_cc_name_set
= 0;
539 context
->default_cc_name_set
= 1;
543 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
547 if (context
->default_cc_name
)
548 free(context
->default_cc_name
);
550 context
->default_cc_name
= p
;
556 * Return a pointer to a context static string containing the default
559 * @return String to the default credential cache name.
561 * @ingroup krb5_ccache
565 const char* KRB5_LIB_FUNCTION
566 krb5_cc_default_name(krb5_context context
)
568 if (context
->default_cc_name
== NULL
|| environment_changed(context
))
569 krb5_cc_set_default_name(context
, NULL
);
571 return context
->default_cc_name
;
575 * Open the default ccache in `id'.
577 * @return Return an error code or 0, see krb5_get_error_message().
579 * @ingroup krb5_ccache
583 krb5_error_code KRB5_LIB_FUNCTION
584 krb5_cc_default(krb5_context context
,
587 const char *p
= krb5_cc_default_name(context
);
590 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
593 return krb5_cc_resolve(context
, p
, id
);
597 * Create a new ccache in `id' for `primary_principal'.
599 * @return Return an error code or 0, see krb5_get_error_message().
601 * @ingroup krb5_ccache
605 krb5_error_code KRB5_LIB_FUNCTION
606 krb5_cc_initialize(krb5_context context
,
608 krb5_principal primary_principal
)
610 return (*id
->ops
->init
)(context
, id
, primary_principal
);
615 * Remove the ccache `id'.
617 * @return Return an error code or 0, see krb5_get_error_message().
619 * @ingroup krb5_ccache
623 krb5_error_code KRB5_LIB_FUNCTION
624 krb5_cc_destroy(krb5_context context
,
629 ret
= (*id
->ops
->destroy
)(context
, id
);
630 krb5_cc_close (context
, id
);
635 * Stop using the ccache `id' and free the related resources.
637 * @return Return an error code or 0, see krb5_get_error_message().
639 * @ingroup krb5_ccache
643 krb5_error_code KRB5_LIB_FUNCTION
644 krb5_cc_close(krb5_context context
,
648 ret
= (*id
->ops
->close
)(context
, id
);
654 * Store `creds' in the ccache `id'.
656 * @return Return an error code or 0, see krb5_get_error_message().
658 * @ingroup krb5_ccache
662 krb5_error_code KRB5_LIB_FUNCTION
663 krb5_cc_store_cred(krb5_context context
,
667 return (*id
->ops
->store
)(context
, id
, creds
);
671 * Retrieve the credential identified by `mcreds' (and `whichfields')
672 * from `id' in `creds'. 'creds' must be free by the caller using
673 * krb5_free_cred_contents.
675 * @param context A Kerberos 5 context
676 * @param id a Kerberos 5 credential cache
677 * @param whichfields what fields to use for matching credentials, same
678 * flags as whichfields in krb5_compare_creds()
679 * @param mcreds template credential to use for comparing
680 * @param creds returned credential, free with krb5_free_cred_contents()
682 * @return Return an error code or 0, see krb5_get_error_message().
684 * @ingroup krb5_ccache
688 krb5_error_code KRB5_LIB_FUNCTION
689 krb5_cc_retrieve_cred(krb5_context context
,
691 krb5_flags whichfields
,
692 const krb5_creds
*mcreds
,
696 krb5_cc_cursor cursor
;
698 if (id
->ops
->retrieve
!= NULL
) {
699 return (*id
->ops
->retrieve
)(context
, id
, whichfields
,
703 ret
= krb5_cc_start_seq_get(context
, id
, &cursor
);
706 while((ret
= krb5_cc_next_cred(context
, id
, &cursor
, creds
)) == 0){
707 if(krb5_compare_creds(context
, whichfields
, mcreds
, creds
)){
711 krb5_free_cred_contents (context
, creds
);
713 krb5_cc_end_seq_get(context
, id
, &cursor
);
718 * Return the principal of `id' in `principal'.
720 * @return Return an error code or 0, see krb5_get_error_message().
722 * @ingroup krb5_ccache
726 krb5_error_code KRB5_LIB_FUNCTION
727 krb5_cc_get_principal(krb5_context context
,
729 krb5_principal
*principal
)
731 return (*id
->ops
->get_princ
)(context
, id
, principal
);
735 * Start iterating over `id', `cursor' is initialized to the
736 * beginning. Caller must free the cursor with krb5_cc_end_seq_get().
738 * @return Return an error code or 0, see krb5_get_error_message().
740 * @ingroup krb5_ccache
744 krb5_error_code KRB5_LIB_FUNCTION
745 krb5_cc_start_seq_get (krb5_context context
,
746 const krb5_ccache id
,
747 krb5_cc_cursor
*cursor
)
749 return (*id
->ops
->get_first
)(context
, id
, cursor
);
753 * Retrieve the next cred pointed to by (`id', `cursor') in `creds'
754 * and advance `cursor'.
756 * @return Return an error code or 0, see krb5_get_error_message().
758 * @ingroup krb5_ccache
762 krb5_error_code KRB5_LIB_FUNCTION
763 krb5_cc_next_cred (krb5_context context
,
764 const krb5_ccache id
,
765 krb5_cc_cursor
*cursor
,
768 return (*id
->ops
->get_next
)(context
, id
, cursor
, creds
);
772 * Destroy the cursor `cursor'.
774 * @ingroup krb5_ccache
778 krb5_error_code KRB5_LIB_FUNCTION
779 krb5_cc_end_seq_get (krb5_context context
,
780 const krb5_ccache id
,
781 krb5_cc_cursor
*cursor
)
783 return (*id
->ops
->end_get
)(context
, id
, cursor
);
787 * Remove the credential identified by `cred', `which' from `id'.
789 * @ingroup krb5_ccache
793 krb5_error_code KRB5_LIB_FUNCTION
794 krb5_cc_remove_cred(krb5_context context
,
799 if(id
->ops
->remove_cred
== NULL
) {
800 krb5_set_error_message(context
,
802 "ccache %s does not support remove_cred",
804 return EACCES
; /* XXX */
806 return (*id
->ops
->remove_cred
)(context
, id
, which
, cred
);
810 * Set the flags of `id' to `flags'.
812 * @ingroup krb5_ccache
816 krb5_error_code KRB5_LIB_FUNCTION
817 krb5_cc_set_flags(krb5_context context
,
821 return (*id
->ops
->set_flags
)(context
, id
, flags
);
825 * Get the flags of `id', store them in `flags'.
827 * @ingroup krb5_ccache
830 krb5_error_code KRB5_LIB_FUNCTION
831 krb5_cc_get_flags(krb5_context context
,
840 * Copy the contents of `from' to `to' if the given match function
843 * @param context A Kerberos 5 context.
844 * @param from the cache to copy data from.
845 * @param to the cache to copy data to.
846 * @param match a match function that should return TRUE if cred argument should be copied, if NULL, all credentials are copied.
847 * @param matchctx context passed to match function.
848 * @param matched set to true if there was a credential that matched, may be NULL.
850 * @return Return an error code or 0, see krb5_get_error_message().
852 * @ingroup krb5_ccache
855 krb5_error_code KRB5_LIB_FUNCTION
856 krb5_cc_copy_match_f(krb5_context context
,
857 const krb5_ccache from
,
859 krb5_boolean (*match
)(krb5_context
, void *, const krb5_creds
*),
861 unsigned int *matched
)
864 krb5_cc_cursor cursor
;
866 krb5_principal princ
;
871 ret
= krb5_cc_get_principal(context
, from
, &princ
);
874 ret
= krb5_cc_initialize(context
, to
, princ
);
876 krb5_free_principal(context
, princ
);
879 ret
= krb5_cc_start_seq_get(context
, from
, &cursor
);
881 krb5_free_principal(context
, princ
);
885 while ((ret
= krb5_cc_next_cred(context
, from
, &cursor
, &cred
)) == 0) {
886 if (match
== NULL
|| (*match
)(context
, matchctx
, &cred
) == 0) {
889 ret
= krb5_cc_store_cred(context
, to
, &cred
);
893 krb5_free_cred_contents(context
, &cred
);
895 krb5_cc_end_seq_get(context
, from
, &cursor
);
896 krb5_free_principal(context
, princ
);
897 if (ret
== KRB5_CC_END
)
903 * Just like krb5_cc_copy_match_f(), but copy everything.
905 * @ingroup @krb5_ccache
908 krb5_error_code KRB5_LIB_FUNCTION
909 krb5_cc_copy_cache(krb5_context context
,
910 const krb5_ccache from
,
913 return krb5_cc_copy_match_f(context
, from
, to
, NULL
, NULL
, NULL
);
917 * Return the version of `id'.
919 * @ingroup krb5_ccache
923 krb5_error_code KRB5_LIB_FUNCTION
924 krb5_cc_get_version(krb5_context context
,
925 const krb5_ccache id
)
927 if(id
->ops
->get_version
)
928 return (*id
->ops
->get_version
)(context
, id
);
934 * Clear `mcreds' so it can be used with krb5_cc_retrieve_cred
936 * @ingroup krb5_ccache
940 void KRB5_LIB_FUNCTION
941 krb5_cc_clear_mcred(krb5_creds
*mcred
)
943 memset(mcred
, 0, sizeof(*mcred
));
947 * Get the cc ops that is registered in `context' to handle the
948 * prefix. prefix can be a complete credential cache name or a
949 * prefix, the function will only use part up to the first colon (:)
950 * if there is one. If prefix the argument is NULL, the default ccache
951 * implemtation is returned.
953 * @return Returns NULL if ops not found.
955 * @ingroup krb5_ccache
960 krb5_cc_get_prefix_ops(krb5_context context
, const char *prefix
)
966 return KRB5_DEFAULT_CCTYPE
;
967 if (prefix
[0] == '/')
968 return &krb5_fcc_ops
;
972 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
979 for(i
= 0; i
< context
->num_cc_ops
&& context
->cc_ops
[i
]->prefix
; i
++) {
980 if(strcmp(context
->cc_ops
[i
]->prefix
, p
) == 0) {
982 return context
->cc_ops
[i
];
989 struct krb5_cc_cache_cursor_data
{
990 const krb5_cc_ops
*ops
;
991 krb5_cc_cursor cursor
;
995 * Start iterating over all caches of specified type. See also
996 * krb5_cccol_cursor_new().
998 * @param context A Kerberos 5 context
999 * @param type optional type to iterate over, if NULL, the default cache is used.
1000 * @param cursor cursor should be freed with krb5_cc_cache_end_seq_get().
1002 * @return Return an error code or 0, see krb5_get_error_message().
1004 * @ingroup krb5_ccache
1008 krb5_error_code KRB5_LIB_FUNCTION
1009 krb5_cc_cache_get_first (krb5_context context
,
1011 krb5_cc_cache_cursor
*cursor
)
1013 const krb5_cc_ops
*ops
;
1014 krb5_error_code ret
;
1017 type
= krb5_cc_default_name(context
);
1019 ops
= krb5_cc_get_prefix_ops(context
, type
);
1021 krb5_set_error_message(context
, KRB5_CC_UNKNOWN_TYPE
,
1022 "Unknown type \"%s\" when iterating "
1023 "trying to iterate the credential caches", type
);
1024 return KRB5_CC_UNKNOWN_TYPE
;
1027 if (ops
->get_cache_first
== NULL
) {
1028 krb5_set_error_message(context
, KRB5_CC_NOSUPP
,
1029 N_("Credential cache type %s doesn't support "
1030 "iterations over caches", "type"),
1032 return KRB5_CC_NOSUPP
;
1035 *cursor
= calloc(1, sizeof(**cursor
));
1036 if (*cursor
== NULL
) {
1037 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
1041 (*cursor
)->ops
= ops
;
1043 ret
= ops
->get_cache_first(context
, &(*cursor
)->cursor
);
1052 * Retrieve the next cache pointed to by (`cursor') in `id'
1053 * and advance `cursor'.
1055 * @param context A Kerberos 5 context
1056 * @param cursor the iterator cursor, returned by krb5_cc_cache_get_first()
1057 * @param id next ccache
1059 * @return Return 0 or an error code. Returns KRB5_CC_END when the end
1060 * of caches is reached, see krb5_get_error_message().
1062 * @ingroup krb5_ccache
1066 krb5_error_code KRB5_LIB_FUNCTION
1067 krb5_cc_cache_next (krb5_context context
,
1068 krb5_cc_cache_cursor cursor
,
1071 return cursor
->ops
->get_cache_next(context
, cursor
->cursor
, id
);
1075 * Destroy the cursor `cursor'.
1077 * @return Return an error code or 0, see krb5_get_error_message().
1079 * @ingroup krb5_ccache
1083 krb5_error_code KRB5_LIB_FUNCTION
1084 krb5_cc_cache_end_seq_get (krb5_context context
,
1085 krb5_cc_cache_cursor cursor
)
1087 krb5_error_code ret
;
1088 ret
= cursor
->ops
->end_cache_get(context
, cursor
->cursor
);
1095 * Search for a matching credential cache that have the
1096 * `principal' as the default principal. On success, `id' needs to be
1097 * freed with krb5_cc_close() or krb5_cc_destroy().
1099 * @param context A Kerberos 5 context
1100 * @param client The principal to search for
1101 * @param id the returned credential cache
1103 * @return On failure, error code is returned and `id' is set to NULL.
1105 * @ingroup krb5_ccache
1109 krb5_error_code KRB5_LIB_FUNCTION
1110 krb5_cc_cache_match (krb5_context context
,
1111 krb5_principal client
,
1114 krb5_cccol_cursor cursor
;
1115 krb5_error_code ret
;
1116 krb5_ccache cache
= NULL
;
1120 ret
= krb5_cccol_cursor_new (context
, &cursor
);
1124 while (krb5_cccol_cursor_next (context
, cursor
, &cache
) == 0 && cache
!= NULL
) {
1125 krb5_principal principal
;
1127 ret
= krb5_cc_get_principal(context
, cache
, &principal
);
1131 match
= krb5_principal_compare(context
, principal
, client
);
1132 krb5_free_principal(context
, principal
);
1137 krb5_cc_close(context
, cache
);
1141 krb5_cccol_cursor_free(context
, &cursor
);
1143 if (cache
== NULL
) {
1146 krb5_unparse_name(context
, client
, &str
);
1148 krb5_set_error_message(context
, KRB5_CC_NOTFOUND
,
1149 N_("Principal %s not found in any "
1150 "credential cache", ""),
1151 str
? str
: "<out of memory>");
1154 return KRB5_CC_NOTFOUND
;
1162 * Move the content from one credential cache to another. The
1163 * operation is an atomic switch.
1165 * @param context a Keberos context
1166 * @param from the credential cache to move the content from
1167 * @param to the credential cache to move the content to
1169 * @return On sucess, from is freed. On failure, error code is
1170 * returned and from and to are both still allocated, see krb5_get_error_message().
1172 * @ingroup krb5_ccache
1176 krb5_cc_move(krb5_context context
, krb5_ccache from
, krb5_ccache to
)
1178 krb5_error_code ret
;
1180 if (strcmp(from
->ops
->prefix
, to
->ops
->prefix
) != 0) {
1181 krb5_set_error_message(context
, KRB5_CC_NOSUPP
,
1182 N_("Moving credentials between diffrent "
1183 "types not yet supported", ""));
1184 return KRB5_CC_NOSUPP
;
1187 ret
= (*to
->ops
->move
)(context
, from
, to
);
1189 memset(from
, 0, sizeof(*from
));
1195 #define KRB5_CONF_NAME "krb5_ccache_conf_data"
1196 #define KRB5_REALM_NAME "X-CACHECONF:"
1198 static krb5_error_code
1199 build_conf_principals(krb5_context context
, krb5_ccache id
,
1200 krb5_const_principal principal
,
1201 const char *name
, krb5_creds
*cred
)
1203 krb5_principal client
;
1204 krb5_error_code ret
;
1207 memset(cred
, 0, sizeof(*cred
));
1209 ret
= krb5_cc_get_principal(context
, id
, &client
);
1214 ret
= krb5_unparse_name(context
, principal
, &pname
);
1219 ret
= krb5_make_principal(context
, &cred
->server
,
1221 KRB5_CONF_NAME
, name
, pname
, NULL
);
1224 krb5_free_principal(context
, client
);
1227 ret
= krb5_copy_principal(context
, client
, &cred
->client
);
1228 krb5_free_principal(context
, client
);
1233 * Return TRUE (non zero) if the principal is a configuration
1234 * principal (generated part of krb5_cc_set_config()). Returns FALSE
1235 * (zero) if not a configuration principal.
1237 * @param context a Keberos context
1238 * @param principal principal to check if it a configuration principal
1240 * @ingroup krb5_ccache
1243 krb5_boolean KRB5_LIB_FUNCTION
1244 krb5_is_config_principal(krb5_context context
,
1245 krb5_const_principal principal
)
1247 if (strcmp(principal
->realm
, KRB5_REALM_NAME
) != 0)
1250 if (principal
->name
.name_string
.len
== 0 ||
1251 strcmp(principal
->name
.name_string
.val
[0], KRB5_CONF_NAME
) != 0)
1258 * Store some configuration for the credential cache in the cache.
1259 * Existing configuration under the same name is over-written.
1261 * @param context a Keberos context
1262 * @param id the credential cache to store the data for
1263 * @param principal configuration for a specific principal, if
1264 * NULL, global for the whole cache.
1265 * @param name name under which the configuraion is stored.
1266 * @param data data to store, if NULL, configure is removed.
1268 * @ingroup krb5_ccache
1271 krb5_error_code KRB5_LIB_FUNCTION
1272 krb5_cc_set_config(krb5_context context
, krb5_ccache id
,
1273 krb5_const_principal principal
,
1274 const char *name
, krb5_data
*data
)
1276 krb5_error_code ret
;
1279 ret
= build_conf_principals(context
, id
, principal
, name
, &cred
);
1283 /* Remove old configuration */
1284 ret
= krb5_cc_remove_cred(context
, id
, 0, &cred
);
1285 if (ret
&& ret
!= KRB5_CC_NOTFOUND
)
1289 /* not that anyone care when this expire */
1290 cred
.times
.authtime
= time(NULL
);
1291 cred
.times
.endtime
= cred
.times
.authtime
+ 3600 * 24 * 30;
1293 ret
= krb5_data_copy(&cred
.ticket
, data
->data
, data
->length
);
1297 ret
= krb5_cc_store_cred(context
, id
, &cred
);
1301 krb5_free_cred_contents (context
, &cred
);
1306 * Get some configuration for the credential cache in the cache.
1308 * @param context a Keberos context
1309 * @param id the credential cache to store the data for
1310 * @param principal configuration for a specific principal, if
1311 * NULL, global for the whole cache.
1312 * @param name name under which the configuraion is stored.
1313 * @param data data to fetched, free with krb5_data_free()
1315 * @ingroup krb5_ccache
1319 krb5_error_code KRB5_LIB_FUNCTION
1320 krb5_cc_get_config(krb5_context context
, krb5_ccache id
,
1321 krb5_const_principal principal
,
1322 const char *name
, krb5_data
*data
)
1324 krb5_creds mcred
, cred
;
1325 krb5_error_code ret
;
1327 memset(&cred
, 0, sizeof(cred
));
1328 krb5_data_zero(data
);
1330 ret
= build_conf_principals(context
, id
, principal
, name
, &mcred
);
1334 ret
= krb5_cc_retrieve_cred(context
, id
, 0, &mcred
, &cred
);
1338 ret
= krb5_data_copy(data
, cred
.ticket
.data
, cred
.ticket
.length
);
1341 krb5_free_cred_contents (context
, &cred
);
1342 krb5_free_cred_contents (context
, &mcred
);
1350 struct krb5_cccol_cursor
{
1352 krb5_cc_cache_cursor cursor
;
1356 * Get a new cache interation cursor that will interate over all
1357 * credentials caches independent of type.
1359 * @param context a Keberos context
1360 * @param cursor passed into krb5_cccol_cursor_next() and free with krb5_cccol_cursor_free().
1362 * @return Returns 0 or and error code, see krb5_get_error_message().
1364 * @ingroup krb5_ccache
1367 krb5_error_code KRB5_LIB_FUNCTION
1368 krb5_cccol_cursor_new(krb5_context context
, krb5_cccol_cursor
*cursor
)
1370 *cursor
= calloc(1, sizeof(**cursor
));
1371 if (*cursor
== NULL
) {
1372 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
1376 (*cursor
)->cursor
= NULL
;
1382 * Get next credential cache from the iteration.
1384 * @param context A Kerberos 5 context
1385 * @param cursor the iteration cursor
1386 * @param cache the returned cursor, pointer is set to NULL on failure
1387 * and a cache on success. The returned cache needs to be freed
1388 * with krb5_cc_close() or destroyed with krb5_cc_destroy().
1389 * MIT Kerberos behavies slightly diffrent and sets cache to NULL
1390 * when all caches are iterated over and return 0.
1392 * @return Return 0 or and error, KRB5_CC_END is returned at the end
1393 * of iteration. See krb5_get_error_message().
1395 * @ingroup krb5_ccache
1399 krb5_error_code KRB5_LIB_FUNCTION
1400 krb5_cccol_cursor_next(krb5_context context
, krb5_cccol_cursor cursor
,
1403 krb5_error_code ret
;
1407 while (cursor
->idx
< context
->num_cc_ops
) {
1409 if (cursor
->cursor
== NULL
) {
1410 ret
= krb5_cc_cache_get_first (context
,
1411 context
->cc_ops
[cursor
->idx
]->prefix
,
1418 ret
= krb5_cc_cache_next(context
, cursor
->cursor
, cache
);
1422 krb5_cc_cache_end_seq_get(context
, cursor
->cursor
);
1423 cursor
->cursor
= NULL
;
1424 if (ret
!= KRB5_CC_END
)
1429 if (cursor
->idx
>= context
->num_cc_ops
) {
1430 krb5_set_error_message(context
, KRB5_CC_END
,
1431 N_("Reached end of credential caches", ""));
1439 * End an iteration and free all resources, can be done before end is reached.
1441 * @param context A Kerberos 5 context
1442 * @param cursor the iteration cursor to be freed.
1444 * @return Return 0 or and error, KRB5_CC_END is returned at the end
1445 * of iteration. See krb5_get_error_message().
1447 * @ingroup krb5_ccache
1450 krb5_error_code KRB5_LIB_FUNCTION
1451 krb5_cccol_cursor_free(krb5_context context
, krb5_cccol_cursor
*cursor
)
1453 krb5_cccol_cursor c
= *cursor
;
1458 krb5_cc_cache_end_seq_get(context
, c
->cursor
);
1465 * Return the last time the credential cache was modified.
1467 * @param context A Kerberos 5 context
1468 * @param id The credential cache to probe
1469 * @param mtime the last modification time, set to 0 on error.
1471 * @return Return 0 or and error. See krb5_get_error_message().
1473 * @ingroup krb5_ccache
1477 krb5_error_code KRB5_LIB_FUNCTION
1478 krb5_cc_last_change_time(krb5_context context
,
1480 krb5_timestamp
*mtime
)
1483 return (*id
->ops
->lastchange
)(context
, id
, mtime
);
1487 * Return the last modfication time for a cache collection. The query
1488 * can be limited to a specific cache type. If the function return 0
1489 * and mtime is 0, there was no credentials in the caches.
1491 * @param context A Kerberos 5 context
1492 * @param type The credential cache to probe, if NULL, all type are traversed.
1493 * @param mtime the last modification time, set to 0 on error.
1495 * @return Return 0 or and error. See krb5_get_error_message().
1497 * @ingroup krb5_ccache
1500 krb5_error_code KRB5_LIB_FUNCTION
1501 krb5_cccol_last_change_time(krb5_context context
,
1503 krb5_timestamp
*mtime
)
1505 krb5_cccol_cursor cursor
;
1506 krb5_error_code ret
;
1508 krb5_timestamp t
= 0;
1512 ret
= krb5_cccol_cursor_new (context
, &cursor
);
1516 while (krb5_cccol_cursor_next(context
, cursor
, &id
) == 0 && id
!= NULL
) {
1518 if (type
&& strcmp(krb5_cc_get_type(context
, id
), type
) != 0)
1521 ret
= krb5_cc_last_change_time(context
, id
, &t
);
1522 krb5_cc_close(context
, id
);
1529 krb5_cccol_cursor_free(context
, &cursor
);
1534 * Return a friendly name on credential cache. Free the result with krb5_xfree().
1536 * @return Return an error code or 0, see krb5_get_error_message().
1538 * @ingroup krb5_ccache
1541 krb5_error_code KRB5_LIB_FUNCTION
1542 krb5_cc_get_friendly_name(krb5_context context
,
1546 krb5_error_code ret
;
1549 ret
= krb5_cc_get_config(context
, id
, NULL
, "FriendlyName", &data
);
1551 krb5_principal principal
;
1552 ret
= krb5_cc_get_principal(context
, id
, &principal
);
1555 ret
= krb5_unparse_name(context
, principal
, name
);
1556 krb5_free_principal(context
, principal
);
1558 ret
= asprintf(name
, "%.*s", (int)data
.length
, (char *)data
.data
);
1559 krb5_data_free(&data
);
1562 krb5_set_error_message(context
, ret
, N_("malloc: out of memory", ""));
1571 * Set the friendly name on credential cache.
1573 * @return Return an error code or 0, see krb5_get_error_message().
1575 * @ingroup krb5_ccache
1578 krb5_error_code KRB5_LIB_FUNCTION
1579 krb5_cc_set_friendly_name(krb5_context context
,
1585 data
.data
= rk_UNCONST(name
);
1586 data
.length
= strlen(name
);
1588 return krb5_cc_set_config(context
, id
, NULL
, "FriendlyName", &data
);
1592 * Get the lifetime of the initial ticket in the cache
1594 * Get the lifetime of the initial ticket in the cache, if the initial
1595 * ticket was not found, the error code KRB5_CC_END is returned.
1597 * @param context A Kerberos 5 context.
1598 * @param id a credential cache
1599 * @param t the relative lifetime of the initial ticket
1601 * @return Return an error code or 0, see krb5_get_error_message().
1603 * @ingroup krb5_ccache
1606 krb5_error_code KRB5_LIB_FUNCTION
1607 krb5_cc_get_lifetime(krb5_context context
, krb5_ccache id
, time_t *t
)
1609 krb5_cc_cursor cursor
;
1610 krb5_error_code ret
;
1617 ret
= krb5_cc_start_seq_get(context
, id
, &cursor
);
1621 while ((ret
= krb5_cc_next_cred(context
, id
, &cursor
, &cred
)) == 0) {
1622 if (cred
.flags
.b
.initial
) {
1623 if (now
< cred
.times
.endtime
)
1624 *t
= cred
.times
.endtime
- now
;
1625 krb5_free_cred_contents(context
, &cred
);
1628 krb5_free_cred_contents(context
, &cred
);
1632 krb5_cc_end_seq_get(context
, id
, &cursor
);