lib/krb5/kuserok_plugin.h

   1 /*
   2  * Copyright (c) 2011, Secure Endpoints Inc.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * - Redistributions of source code must retain the above copyright
  10  *   notice, this list of conditions and the following disclaimer.
  11  *
  12  * - Redistributions in binary form must reproduce the above copyright
  13  *   notice, this list of conditions and the following disclaimer in
  14  *   the documentation and/or other materials provided with the
  15  *   distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  20  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  21  * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
  22  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  23  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  24  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  26  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  28  * OF THE POSSIBILITY OF SUCH DAMAGE.
  29  *
  30  */
  31
  32 #ifndef HEIMDAL_KRB5_KUSEROK_PLUGIN_H
  33 #define HEIMDAL_KRB5_KUSEROK_PLUGIN_H 1
  34
  35 #define KRB5_PLUGIN_KUSEROK "krb5_plugin_kuserok"
  36 #define KRB5_PLUGIN_KUSEROK_VERSION_0 0
  37
  38 /** @struct krb5plugin_kuserok_ftable_desc
  39  *
  40  * @brief Description of the krb5_kuserok(3) plugin facility.
  41  *
  42  * The krb5_kuserok(3) function is pluggable.  The plugin is named
  43  * KRB5_PLUGIN_KUSEROK ("krb5_plugin_kuserok"), with a single minor
  44  * version, KRB5_PLUGIN_KUSEROK_VERSION_0 (0).
  45  *
  46  * The plugin for krb5_kuserok(3) consists of a data symbol referencing
  47  * a structure of type krb5plugin_kuserok_ftable, with four fields:
  48  *
  49  * @param init          Plugin initialization function (see krb5-plugin(7))
  50  *
  51  * @param minor_version The plugin minor version number (0)
  52  *
  53  * @param fini          Plugin finalization function
  54  *
  55  * @param kuserok       Plugin kuserok function
  56  *
  57  * The kuserok field is the plugin entry point that performs the
  58  * traditional kuserok operation however the plugin desires.  It is
  59  * invoked in no particular order relative to other kuserok plugins, but
  60  * it has a 'rule' argument that indicates which plugin is intended to
  61  * act on the rule.  The plugin kuserok function must return
  62  * KRB5_PLUGIN_NO_HANDLE if the rule is not applicable to it.
  63  *
  64  * The plugin kuserok function has the following arguments, in this
  65  * order:
  66  *
  67  * -# plug_ctx, the context value output by the plugin's init function
  68  * -# context, a krb5_context
  69  * -# rule, the kuserok rule being evaluated (from krb5.conf(5))
  70  * -# flags
  71  * -# k5login_dir, configured location of k5login per-user files if any
  72  * -# luser, name of the local user account to which principal is attempting to access.
  73  * -# principal, the krb5_principal trying to access the luser account
  74  * -# result, a krb5_boolean pointer where the plugin will output its result
  75  *
  76  * @ingroup krb5_support
  77  */
  78 typedef struct krb5plugin_kuserok_ftable_desc {
  79     int                 minor_version;
  80     krb5_error_code     (KRB5_LIB_CALL *init)(krb5_context, void **);
  81     void                (KRB5_LIB_CALL *fini)(void *);
  82     krb5_error_code     (KRB5_LIB_CALL *kuserok)(void *, krb5_context, const char *,
  83                                    unsigned int, const char *, const char *,
  84                                    krb5_const_principal,
  85                                    krb5_boolean *);
  86 } krb5plugin_kuserok_ftable;
  87
  88 #define KUSEROK_ANAME_TO_LNAME_OK        1
  89 #define KUSEROK_K5LOGIN_IS_AUTHORITATIVE 2
  90
  91 #endif /* HEIMDAL_KRB5_KUSEROK_PLUGIN_H */