auth/credentials/pycredentials.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation; either version 3 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 #include <Python.h>
  20 #include "python/py3compat.h"
  21 #include "includes.h"
  22 #include "python/modules.h"
  23 #include "pycredentials.h"
  24 #include "param/param.h"
  25 #include "lib/cmdline/credentials.h"
  26 #include "auth/credentials/credentials_internal.h"
  27 #include "librpc/gen_ndr/samr.h" /* for struct samr_Password */
  28 #include "librpc/gen_ndr/netlogon.h"
  29 #include "libcli/util/pyerrors.h"
  30 #include "libcli/auth/libcli_auth.h"
  31 #include "param/pyparam.h"
  32 #include <tevent.h>
  33 #include "libcli/auth/libcli_auth.h"
  34 #include "auth/credentials/credentials_internal.h"
  35 #include "system/kerberos.h"
  36 #include "auth/kerberos/kerberos.h"
  37
  38 void initcredentials(void);
  39
  40 static PyObject *py_creds_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
  41 {
  42         return pytalloc_steal(type, cli_credentials_init(NULL));
  43 }
  44
  45 static PyObject *py_creds_get_username(PyObject *self, PyObject *unused)
  46 {
  47         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
  48         if (creds == NULL) {
  49                 PyErr_Format(PyExc_TypeError, "Credentials expected");
  50                 return NULL;
  51         }
  52         return PyString_FromStringOrNULL(cli_credentials_get_username(creds));
  53 }
  54
  55 static PyObject *py_creds_set_username(PyObject *self, PyObject *args)
  56 {
  57         char *newval;
  58         enum credentials_obtained obt = CRED_SPECIFIED;
  59         int _obt = obt;
  60         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
  61         if (creds == NULL) {
  62                 PyErr_Format(PyExc_TypeError, "Credentials expected");
  63                 return NULL;
  64         }
  65
  66         if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
  67                 return NULL;
  68         }
  69         obt = _obt;
  70
  71         return PyBool_FromLong(cli_credentials_set_username(creds, newval, obt));
  72 }
  73
  74 static PyObject *py_creds_get_ntlm_username_domain(PyObject *self, PyObject *unused)
  75 {
  76         TALLOC_CTX *frame = talloc_stackframe();
  77         const char *user = NULL;
  78         const char *domain = NULL;
  79         PyObject *ret = NULL;
  80         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
  81         if (creds == NULL) {
  82                 PyErr_Format(PyExc_TypeError, "Credentials expected");
  83                 return NULL;
  84         }
  85         cli_credentials_get_ntlm_username_domain(creds,
  86                                                  frame, &user, &domain);
  87         ret = Py_BuildValue("(ss)",
  88                             user,
  89                             domain);
  90
  91         TALLOC_FREE(frame);
  92         return ret;
  93 }
  94
  95 static PyObject *py_creds_get_ntlm_response(PyObject *self, PyObject *args, PyObject *kwargs)
  96 {
  97         TALLOC_CTX *frame = talloc_stackframe();
  98         PyObject *ret = NULL;
  99         int flags;
 100         struct timeval tv_now;
 101         NTTIME server_timestamp;
 102         DATA_BLOB challenge = data_blob_null;
 103         DATA_BLOB target_info = data_blob_null;
 104         NTSTATUS status;
 105         DATA_BLOB lm_response = data_blob_null;
 106         DATA_BLOB nt_response = data_blob_null;
 107         DATA_BLOB lm_session_key = data_blob_null;
 108         DATA_BLOB nt_session_key = data_blob_null;
 109         const char *kwnames[] = { "flags", "challenge",
 110                                   "target_info",
 111                                   NULL };
 112         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 113         if (creds == NULL) {
 114                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 115                 return NULL;
 116         }
 117
 118         tv_now = timeval_current();
 119         server_timestamp = timeval_to_nttime(&tv_now);
 120
 121         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "is#|s#",
 122                                          discard_const_p(char *, kwnames),
 123                                          &flags,
 124                                          &challenge.data,
 125                                          &challenge.length,
 126                                          &target_info.data,
 127                                          &target_info.length)) {
 128                 return NULL;
 129         }
 130
 131         status = cli_credentials_get_ntlm_response(creds,
 132                                                    frame, &flags,
 133                                                    challenge,
 134                                                    &server_timestamp,
 135                                                    target_info,
 136                                                    &lm_response, &nt_response,
 137                                                    &lm_session_key, &nt_session_key);
 138
 139         if (!NT_STATUS_IS_OK(status)) {
 140                 PyErr_SetNTSTATUS(status);
 141                 TALLOC_FREE(frame);
 142                 return NULL;
 143         }
 144
 145         ret = Py_BuildValue("{sis" PYARG_BYTES_LEN "s" PYARG_BYTES_LEN
 146                                     "s" PYARG_BYTES_LEN "s" PYARG_BYTES_LEN "}",
 147                             "flags", flags,
 148                             "lm_response",
 149                             (const char *)lm_response.data, lm_response.length,
 150                             "nt_response",
 151                             (const char *)nt_response.data, nt_response.length,
 152                             "lm_session_key",
 153                             (const char *)lm_session_key.data, lm_session_key.length,
 154                             "nt_session_key",
 155                             (const char *)nt_session_key.data, nt_session_key.length);
 156         TALLOC_FREE(frame);
 157         return ret;
 158 }
 159
 160 static PyObject *py_creds_get_principal(PyObject *self, PyObject *unused)
 161 {
 162         TALLOC_CTX *frame = talloc_stackframe();
 163         PyObject *ret = NULL;
 164         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 165         if (creds == NULL) {
 166                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 167                 return NULL;
 168         }
 169         ret = PyString_FromStringOrNULL(cli_credentials_get_principal(creds, frame));
 170         TALLOC_FREE(frame);
 171         return ret;
 172 }
 173
 174 static PyObject *py_creds_set_principal(PyObject *self, PyObject *args)
 175 {
 176         char *newval;
 177         enum credentials_obtained obt = CRED_SPECIFIED;
 178         int _obt = obt;
 179         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 180         if (creds == NULL) {
 181                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 182                 return NULL;
 183         }
 184
 185         if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 186                 return NULL;
 187         }
 188         obt = _obt;
 189
 190         return PyBool_FromLong(cli_credentials_set_principal(creds, newval, obt));
 191 }
 192
 193 static PyObject *py_creds_get_password(PyObject *self, PyObject *unused)
 194 {
 195         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 196         if (creds == NULL) {
 197                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 198                 return NULL;
 199         }
 200         return PyString_FromStringOrNULL(cli_credentials_get_password(creds));
 201 }
 202
 203 static PyObject *py_creds_set_password(PyObject *self, PyObject *args)
 204 {
 205         const char *newval = NULL;
 206         enum credentials_obtained obt = CRED_SPECIFIED;
 207         int _obt = obt;
 208         PyObject *result = NULL;
 209         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 210         if (creds == NULL) {
 211                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 212                 return NULL;
 213         }
 214
 215         if (!PyArg_ParseTuple(args, PYARG_STR_UNI"|i", "utf8", &newval, &_obt)) {
 216                 return NULL;
 217         }
 218         obt = _obt;
 219
 220         result = PyBool_FromLong(cli_credentials_set_password(creds, newval, obt));
 221         PyMem_Free(discard_const_p(void*, newval));
 222         return result;
 223 }
 224
 225 static PyObject *py_creds_set_utf16_password(PyObject *self, PyObject *args)
 226 {
 227         enum credentials_obtained obt = CRED_SPECIFIED;
 228         int _obt = obt;
 229         PyObject *newval = NULL;
 230         DATA_BLOB blob = data_blob_null;
 231         Py_ssize_t size =  0;
 232         int result;
 233         bool ok;
 234         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 235         if (creds == NULL) {
 236                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 237                 return NULL;
 238         }
 239
 240         if (!PyArg_ParseTuple(args, "O|i", &newval, &_obt)) {
 241                 return NULL;
 242         }
 243         obt = _obt;
 244
 245         result = PyBytes_AsStringAndSize(newval, (char **)&blob.data, &size);
 246         if (result != 0) {
 247                 PyErr_SetString(PyExc_RuntimeError, "Failed to convert passed value to Bytes");
 248                 return NULL;
 249         }
 250         blob.length = size;
 251
 252         ok = cli_credentials_set_utf16_password(creds,
 253                                                 &blob, obt);
 254
 255         return PyBool_FromLong(ok);
 256 }
 257
 258 static PyObject *py_creds_get_old_password(PyObject *self, PyObject *unused)
 259 {
 260         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 261         if (creds == NULL) {
 262                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 263                 return NULL;
 264         }
 265         return PyString_FromStringOrNULL(cli_credentials_get_old_password(creds));
 266 }
 267
 268 static PyObject *py_creds_set_old_password(PyObject *self, PyObject *args)
 269 {
 270         char *oldval;
 271         enum credentials_obtained obt = CRED_SPECIFIED;
 272         int _obt = obt;
 273         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 274         if (creds == NULL) {
 275                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 276                 return NULL;
 277         }
 278
 279         if (!PyArg_ParseTuple(args, "s|i", &oldval, &_obt)) {
 280                 return NULL;
 281         }
 282         obt = _obt;
 283
 284         return PyBool_FromLong(cli_credentials_set_old_password(creds, oldval, obt));
 285 }
 286
 287 static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
 288 {
 289         PyObject *oldval = NULL;
 290         DATA_BLOB blob = data_blob_null;
 291         Py_ssize_t size =  0;
 292         int result;
 293         bool ok;
 294         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 295         if (creds == NULL) {
 296                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 297                 return NULL;
 298         }
 299
 300         if (!PyArg_ParseTuple(args, "O", &oldval)) {
 301                 return NULL;
 302         }
 303
 304         result = PyBytes_AsStringAndSize(oldval, (char **)&blob.data, &size);
 305         if (result != 0) {
 306                 PyErr_SetString(PyExc_RuntimeError, "Failed to convert passed value to Bytes");
 307                 return NULL;
 308         }
 309         blob.length = size;
 310
 311         ok = cli_credentials_set_old_utf16_password(creds,
 312                                                     &blob);
 313
 314         return PyBool_FromLong(ok);
 315 }
 316
 317 static PyObject *py_creds_get_domain(PyObject *self, PyObject *unused)
 318 {
 319         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 320         if (creds == NULL) {
 321                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 322                 return NULL;
 323         }
 324         return PyString_FromStringOrNULL(cli_credentials_get_domain(creds));
 325 }
 326
 327 static PyObject *py_creds_set_domain(PyObject *self, PyObject *args)
 328 {
 329         char *newval;
 330         enum credentials_obtained obt = CRED_SPECIFIED;
 331         int _obt = obt;
 332         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 333         if (creds == NULL) {
 334                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 335                 return NULL;
 336         }
 337
 338         if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 339                 return NULL;
 340         }
 341         obt = _obt;
 342
 343         return PyBool_FromLong(cli_credentials_set_domain(creds, newval, obt));
 344 }
 345
 346 static PyObject *py_creds_get_realm(PyObject *self, PyObject *unused)
 347 {
 348         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 349         if (creds == NULL) {
 350                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 351                 return NULL;
 352         }
 353         return PyString_FromStringOrNULL(cli_credentials_get_realm(creds));
 354 }
 355
 356 static PyObject *py_creds_set_realm(PyObject *self, PyObject *args)
 357 {
 358         char *newval;
 359         enum credentials_obtained obt = CRED_SPECIFIED;
 360         int _obt = obt;
 361         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 362         if (creds == NULL) {
 363                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 364                 return NULL;
 365         }
 366
 367         if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 368                 return NULL;
 369         }
 370         obt = _obt;
 371
 372         return PyBool_FromLong(cli_credentials_set_realm(creds, newval, obt));
 373 }
 374
 375 static PyObject *py_creds_get_bind_dn(PyObject *self, PyObject *unused)
 376 {
 377         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 378         if (creds == NULL) {
 379                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 380                 return NULL;
 381         }
 382         return PyString_FromStringOrNULL(cli_credentials_get_bind_dn(creds));
 383 }
 384
 385 static PyObject *py_creds_set_bind_dn(PyObject *self, PyObject *args)
 386 {
 387         char *newval;
 388         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 389         if (creds == NULL) {
 390                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 391                 return NULL;
 392         }
 393         if (!PyArg_ParseTuple(args, "s", &newval))
 394                 return NULL;
 395
 396         return PyBool_FromLong(cli_credentials_set_bind_dn(creds, newval));
 397 }
 398
 399 static PyObject *py_creds_get_workstation(PyObject *self, PyObject *unused)
 400 {
 401         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 402         if (creds == NULL) {
 403                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 404                 return NULL;
 405         }
 406         return PyString_FromStringOrNULL(cli_credentials_get_workstation(creds));
 407 }
 408
 409 static PyObject *py_creds_set_workstation(PyObject *self, PyObject *args)
 410 {
 411         char *newval;
 412         enum credentials_obtained obt = CRED_SPECIFIED;
 413         int _obt = obt;
 414         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 415         if (creds == NULL) {
 416                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 417                 return NULL;
 418         }
 419
 420         if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 421                 return NULL;
 422         }
 423         obt = _obt;
 424
 425         return PyBool_FromLong(cli_credentials_set_workstation(creds, newval, obt));
 426 }
 427
 428 static PyObject *py_creds_is_anonymous(PyObject *self, PyObject *unused)
 429 {
 430         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 431         if (creds == NULL) {
 432                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 433                 return NULL;
 434         }
 435         return PyBool_FromLong(cli_credentials_is_anonymous(creds));
 436 }
 437
 438 static PyObject *py_creds_set_anonymous(PyObject *self, PyObject *unused)
 439 {
 440         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 441         if (creds == NULL) {
 442                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 443                 return NULL;
 444         }
 445         cli_credentials_set_anonymous(creds);
 446         Py_RETURN_NONE;
 447 }
 448
 449 static PyObject *py_creds_authentication_requested(PyObject *self, PyObject *unused)
 450 {
 451         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 452         if (creds == NULL) {
 453                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 454                 return NULL;
 455         }
 456         return PyBool_FromLong(cli_credentials_authentication_requested(creds));
 457 }
 458
 459 static PyObject *py_creds_wrong_password(PyObject *self, PyObject *unused)
 460 {
 461         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 462         if (creds == NULL) {
 463                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 464                 return NULL;
 465         }
 466          return PyBool_FromLong(cli_credentials_wrong_password(creds));
 467 }
 468
 469 static PyObject *py_creds_set_cmdline_callbacks(PyObject *self, PyObject *unused)
 470 {
 471         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 472         if (creds == NULL) {
 473                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 474                 return NULL;
 475         }
 476         return PyBool_FromLong(cli_credentials_set_cmdline_callbacks(creds));
 477 }
 478
 479 static PyObject *py_creds_parse_string(PyObject *self, PyObject *args)
 480 {
 481         char *newval;
 482         enum credentials_obtained obt = CRED_SPECIFIED;
 483         int _obt = obt;
 484         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 485         if (creds == NULL) {
 486                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 487                 return NULL;
 488         }
 489
 490         if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 491                 return NULL;
 492         }
 493         obt = _obt;
 494
 495         cli_credentials_parse_string(creds, newval, obt);
 496         Py_RETURN_NONE;
 497 }
 498
 499 static PyObject *py_creds_parse_file(PyObject *self, PyObject *args)
 500 {
 501         char *newval;
 502         enum credentials_obtained obt = CRED_SPECIFIED;
 503         int _obt = obt;
 504         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 505         if (creds == NULL) {
 506                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 507                 return NULL;
 508         }
 509
 510         if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 511                 return NULL;
 512         }
 513         obt = _obt;
 514
 515         cli_credentials_parse_file(creds, newval, obt);
 516         Py_RETURN_NONE;
 517 }
 518
 519 static PyObject *py_cli_credentials_set_password_will_be_nt_hash(PyObject *self, PyObject *args)
 520 {
 521         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 522         PyObject *py_val = NULL;
 523         bool val = false;
 524
 525         if (!PyArg_ParseTuple(args, "O!", &PyBool_Type, &py_val)) {
 526                 return NULL;
 527         }
 528         val = PyObject_IsTrue(py_val);
 529
 530         cli_credentials_set_password_will_be_nt_hash(creds, val);
 531         Py_RETURN_NONE;
 532 }
 533
 534 static PyObject *py_creds_get_nt_hash(PyObject *self, PyObject *unused)
 535 {
 536         PyObject *ret;
 537         struct samr_Password *ntpw = NULL;
 538         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 539         if (creds == NULL) {
 540                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 541                 return NULL;
 542         }
 543         ntpw = cli_credentials_get_nt_hash(creds, creds);
 544
 545         ret = PyBytes_FromStringAndSize(discard_const_p(char, ntpw->hash), 16);
 546         TALLOC_FREE(ntpw);
 547         return ret;
 548 }
 549
 550 static PyObject *py_creds_get_kerberos_state(PyObject *self, PyObject *unused)
 551 {
 552         int state;
 553         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 554         if (creds == NULL) {
 555                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 556                 return NULL;
 557         }
 558         state = cli_credentials_get_kerberos_state(creds);
 559         return PyInt_FromLong(state);
 560 }
 561
 562 static PyObject *py_creds_set_kerberos_state(PyObject *self, PyObject *args)
 563 {
 564         int state;
 565         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 566         if (creds == NULL) {
 567                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 568                 return NULL;
 569         }
 570         if (!PyArg_ParseTuple(args, "i", &state))
 571                 return NULL;
 572
 573         cli_credentials_set_kerberos_state(creds, state);
 574         Py_RETURN_NONE;
 575 }
 576
 577 static PyObject *py_creds_set_krb_forwardable(PyObject *self, PyObject *args)
 578 {
 579         int state;
 580         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 581         if (creds == NULL) {
 582                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 583                 return NULL;
 584         }
 585         if (!PyArg_ParseTuple(args, "i", &state))
 586                 return NULL;
 587
 588         cli_credentials_set_krb_forwardable(creds, state);
 589         Py_RETURN_NONE;
 590 }
 591
 592
 593 static PyObject *py_creds_get_forced_sasl_mech(PyObject *self, PyObject *unused)
 594 {
 595         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 596         if (creds == NULL) {
 597                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 598                 return NULL;
 599         }
 600         return PyString_FromStringOrNULL(cli_credentials_get_forced_sasl_mech(creds));
 601 }
 602
 603 static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args)
 604 {
 605         char *newval;
 606         enum credentials_obtained obt = CRED_SPECIFIED;
 607         int _obt = obt;
 608         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 609         if (creds == NULL) {
 610                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 611                 return NULL;
 612         }
 613
 614         if (!PyArg_ParseTuple(args, "s", &newval)) {
 615                 return NULL;
 616         }
 617         obt = _obt;
 618
 619         cli_credentials_set_forced_sasl_mech(creds, newval);
 620         Py_RETURN_NONE;
 621 }
 622
 623 static PyObject *py_creds_guess(PyObject *self, PyObject *args)
 624 {
 625         PyObject *py_lp_ctx = Py_None;
 626         struct loadparm_context *lp_ctx;
 627         TALLOC_CTX *mem_ctx;
 628         struct cli_credentials *creds;
 629
 630         creds = PyCredentials_AsCliCredentials(self);
 631         if (creds == NULL) {
 632                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 633                 return NULL;
 634         }
 635
 636         if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
 637                 return NULL;
 638
 639         mem_ctx = talloc_new(NULL);
 640         if (mem_ctx == NULL) {
 641                 PyErr_NoMemory();
 642                 return NULL;
 643         }
 644
 645         lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
 646         if (lp_ctx == NULL) {
 647                 talloc_free(mem_ctx);
 648                 return NULL;
 649         }
 650
 651         cli_credentials_guess(creds, lp_ctx);
 652
 653         talloc_free(mem_ctx);
 654
 655         Py_RETURN_NONE;
 656 }
 657
 658 static PyObject *py_creds_set_machine_account(PyObject *self, PyObject *args)
 659 {
 660         PyObject *py_lp_ctx = Py_None;
 661         struct loadparm_context *lp_ctx;
 662         NTSTATUS status;
 663         struct cli_credentials *creds;
 664         TALLOC_CTX *mem_ctx;
 665
 666         creds = PyCredentials_AsCliCredentials(self);
 667         if (creds == NULL) {
 668                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 669                 return NULL;
 670         }
 671
 672         if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
 673                 return NULL;
 674
 675         mem_ctx = talloc_new(NULL);
 676         if (mem_ctx == NULL) {
 677                 PyErr_NoMemory();
 678                 return NULL;
 679         }
 680
 681         lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
 682         if (lp_ctx == NULL) {
 683                 talloc_free(mem_ctx);
 684                 return NULL;
 685         }
 686
 687         status = cli_credentials_set_machine_account(creds, lp_ctx);
 688         talloc_free(mem_ctx);
 689
 690         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 691
 692         Py_RETURN_NONE;
 693 }
 694
 695 static PyObject *PyCredentialCacheContainer_from_ccache_container(struct ccache_container *ccc)
 696 {
 697         return pytalloc_reference(&PyCredentialCacheContainer, ccc);
 698 }
 699
 700
 701 static PyObject *py_creds_get_named_ccache(PyObject *self, PyObject *args)
 702 {
 703         PyObject *py_lp_ctx = Py_None;
 704         char *ccache_name = NULL;
 705         struct loadparm_context *lp_ctx;
 706         struct ccache_container *ccc;
 707         struct tevent_context *event_ctx;
 708         int ret;
 709         const char *error_string;
 710         struct cli_credentials *creds;
 711         TALLOC_CTX *mem_ctx;
 712
 713         creds = PyCredentials_AsCliCredentials(self);
 714         if (creds == NULL) {
 715                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 716                 return NULL;
 717         }
 718
 719         if (!PyArg_ParseTuple(args, "|Os", &py_lp_ctx, &ccache_name))
 720                 return NULL;
 721
 722         mem_ctx = talloc_new(NULL);
 723         if (mem_ctx == NULL) {
 724                 PyErr_NoMemory();
 725                 return NULL;
 726         }
 727
 728         lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
 729         if (lp_ctx == NULL) {
 730                 talloc_free(mem_ctx);
 731                 return NULL;
 732         }
 733
 734         event_ctx = samba_tevent_context_init(mem_ctx);
 735
 736         ret = cli_credentials_get_named_ccache(creds, event_ctx, lp_ctx,
 737                                                ccache_name, &ccc, &error_string);
 738         talloc_unlink(mem_ctx, lp_ctx);
 739         if (ret == 0) {
 740                 talloc_steal(ccc, event_ctx);
 741                 talloc_free(mem_ctx);
 742                 return PyCredentialCacheContainer_from_ccache_container(ccc);
 743         }
 744
 745         PyErr_SetString(PyExc_RuntimeError, error_string?error_string:"NULL");
 746
 747         talloc_free(mem_ctx);
 748         return NULL;
 749 }
 750
 751 static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args)
 752 {
 753         struct loadparm_context *lp_ctx = NULL;
 754         enum credentials_obtained obt = CRED_SPECIFIED;
 755         const char *error_string = NULL;
 756         TALLOC_CTX *mem_ctx = NULL;
 757         char *newval = NULL;
 758         PyObject *py_lp_ctx = Py_None;
 759         int _obt = obt;
 760         int ret;
 761         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 762         if (creds == NULL) {
 763                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 764                 return NULL;
 765         }
 766
 767         if (!PyArg_ParseTuple(args, "s|iO", &newval, &_obt, &py_lp_ctx))
 768                 return NULL;
 769
 770         mem_ctx = talloc_new(NULL);
 771         if (mem_ctx == NULL) {
 772                 PyErr_NoMemory();
 773                 return NULL;
 774         }
 775
 776         lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
 777         if (lp_ctx == NULL) {
 778                 talloc_free(mem_ctx);
 779                 return NULL;
 780         }
 781
 782         ret = cli_credentials_set_ccache(creds,
 783                                          lp_ctx,
 784                                          newval, CRED_SPECIFIED,
 785                                          &error_string);
 786
 787         if (ret != 0) {
 788                 PyErr_SetString(PyExc_RuntimeError,
 789                                 error_string != NULL ? error_string : "NULL");
 790                 talloc_free(mem_ctx);
 791                 return NULL;
 792         }
 793
 794         talloc_free(mem_ctx);
 795         Py_RETURN_NONE;
 796 }
 797
 798 static PyObject *py_creds_set_gensec_features(PyObject *self, PyObject *args)
 799 {
 800         unsigned int gensec_features;
 801         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 802         if (creds == NULL) {
 803                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 804                 return NULL;
 805         }
 806
 807         if (!PyArg_ParseTuple(args, "I", &gensec_features))
 808                 return NULL;
 809
 810         cli_credentials_set_gensec_features(creds, gensec_features);
 811
 812         Py_RETURN_NONE;
 813 }
 814
 815 static PyObject *py_creds_get_gensec_features(PyObject *self, PyObject *args)
 816 {
 817         unsigned int gensec_features;
 818         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 819         if (creds == NULL) {
 820                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 821                 return NULL;
 822         }
 823
 824         gensec_features = cli_credentials_get_gensec_features(creds);
 825         return PyInt_FromLong(gensec_features);
 826 }
 827
 828 static PyObject *py_creds_new_client_authenticator(PyObject *self,
 829                                                    PyObject *args)
 830 {
 831         struct netr_Authenticator auth;
 832         struct cli_credentials *creds = NULL;
 833         struct netlogon_creds_CredentialState *nc = NULL;
 834         PyObject *ret = NULL;
 835         NTSTATUS status;
 836
 837         creds = PyCredentials_AsCliCredentials(self);
 838         if (creds == NULL) {
 839                 PyErr_SetString(PyExc_RuntimeError,
 840                                 "Failed to get credentials from python");
 841                 return NULL;
 842         }
 843
 844         nc = creds->netlogon_creds;
 845         if (nc == NULL) {
 846                 PyErr_SetString(PyExc_ValueError,
 847                                 "No netlogon credentials cannot make "
 848                                 "client authenticator");
 849                 return NULL;
 850         }
 851
 852         status = netlogon_creds_client_authenticator(nc, &auth);
 853         if (!NT_STATUS_IS_OK(status)) {
 854                 PyErr_SetString(PyExc_ValueError,
 855                                 "Failed to create client authenticator");
 856                 return NULL;
 857         }
 858
 859         ret = Py_BuildValue("{s"PYARG_BYTES_LEN"si}",
 860                             "credential",
 861                             (const char *) &auth.cred, sizeof(auth.cred),
 862                             "timestamp", auth.timestamp);
 863         return ret;
 864 }
 865
 866 static PyObject *py_creds_set_secure_channel_type(PyObject *self, PyObject *args)
 867 {
 868         unsigned int channel_type;
 869         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 870         if (creds == NULL) {
 871                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 872                 return NULL;
 873         }
 874
 875         if (!PyArg_ParseTuple(args, "I", &channel_type))
 876                 return NULL;
 877
 878         cli_credentials_set_secure_channel_type(
 879                 creds,
 880                 channel_type);
 881
 882         Py_RETURN_NONE;
 883 }
 884
 885 static PyObject *py_creds_get_secure_channel_type(PyObject *self, PyObject *args)
 886 {
 887         enum netr_SchannelType channel_type = SEC_CHAN_NULL;
 888         struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
 889         if (creds == NULL) {
 890                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 891                 return NULL;
 892         }
 893
 894         channel_type = cli_credentials_get_secure_channel_type(creds);
 895
 896         return PyInt_FromLong(channel_type);
 897 }
 898
 899 static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self,
 900                                                       PyObject *args)
 901 {
 902         DATA_BLOB data = data_blob_null;
 903         struct cli_credentials    *creds  = NULL;
 904         struct netr_CryptPassword *pwd    = NULL;
 905         NTSTATUS status;
 906         PyObject *py_cp = Py_None;
 907
 908         creds = PyCredentials_AsCliCredentials(self);
 909         if (creds == NULL) {
 910                 PyErr_Format(PyExc_TypeError, "Credentials expected");
 911                 return NULL;
 912         }
 913
 914         if (!PyArg_ParseTuple(args, "O", &py_cp)) {
 915                 return NULL;
 916         }
 917
 918         pwd = pytalloc_get_type(py_cp, struct netr_CryptPassword);
 919         if (pwd == NULL) {
 920                 /* pytalloc_get_type sets TypeError */
 921                 return NULL;
 922         }
 923         data.length = sizeof(struct netr_CryptPassword);
 924         data.data   = (uint8_t *)pwd;
 925         status = netlogon_creds_session_encrypt(creds->netlogon_creds, data);
 926
 927         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 928
 929         Py_RETURN_NONE;
 930 }
 931
 932 static PyMethodDef py_creds_methods[] = {
 933         {
 934                 .ml_name  = "get_username",
 935                 .ml_meth  = py_creds_get_username,
 936                 .ml_flags = METH_NOARGS,
 937                 .ml_doc   = "S.get_username() -> username\nObtain username.",
 938         },
 939         {
 940                 .ml_name  = "set_username",
 941                 .ml_meth  = py_creds_set_username,
 942                 .ml_flags = METH_VARARGS,
 943                 .ml_doc   = "S.set_username(name[, credentials.SPECIFIED]) -> None\n"
 944                             "Change username.",
 945         },
 946         {
 947                 .ml_name  = "get_principal",
 948                 .ml_meth  = py_creds_get_principal,
 949                 .ml_flags = METH_NOARGS,
 950                 .ml_doc   = "S.get_principal() -> user@realm\nObtain user principal.",
 951         },
 952         {
 953                 .ml_name  = "set_principal",
 954                 .ml_meth  = py_creds_set_principal,
 955                 .ml_flags = METH_VARARGS,
 956                 .ml_doc   = "S.set_principal(name[, credentials.SPECIFIED]) -> None\n"
 957                             "Change principal.",
 958         },
 959         {
 960                 .ml_name  = "get_password",
 961                 .ml_meth  = py_creds_get_password,
 962                 .ml_flags = METH_NOARGS,
 963                 .ml_doc   = "S.get_password() -> password\n"
 964                             "Obtain password.",
 965         },
 966         {
 967                 .ml_name  = "get_ntlm_username_domain",
 968                 .ml_meth  = py_creds_get_ntlm_username_domain,
 969                 .ml_flags = METH_NOARGS,
 970                 .ml_doc   = "S.get_ntlm_username_domain() -> (domain, username)\n"
 971                             "Obtain NTLM username and domain, split up either as (DOMAIN, user) or (\"\", \"user@realm\").",
 972         },
 973         {
 974                 .ml_name  = "get_ntlm_response",
 975                 .ml_meth  = PY_DISCARD_FUNC_SIG(PyCFunction,
 976                                                 py_creds_get_ntlm_response),
 977                 .ml_flags = METH_VARARGS | METH_KEYWORDS,
 978                 .ml_doc   = "S.get_ntlm_response"
 979                             "(flags, challenge[, target_info]) -> "
 980                             "(flags, lm_response, nt_response, lm_session_key, nt_session_key)\n"
 981                             "Obtain LM or NTLM response.",
 982         },
 983         {
 984                 .ml_name  = "set_password",
 985                 .ml_meth  = py_creds_set_password,
 986                 .ml_flags = METH_VARARGS,
 987                 .ml_doc   = "S.set_password(password[, credentials.SPECIFIED]) -> None\n"
 988                             "Change password.",
 989         },
 990         {
 991                 .ml_name  = "set_utf16_password",
 992                 .ml_meth  = py_creds_set_utf16_password,
 993                 .ml_flags = METH_VARARGS,
 994                 .ml_doc   = "S.set_utf16_password(password[, credentials.SPECIFIED]) -> None\n"
 995                             "Change password.",
 996         },
 997         {
 998                 .ml_name  = "get_old_password",
 999                 .ml_meth  = py_creds_get_old_password,
1000                 .ml_flags = METH_NOARGS,
1001                 .ml_doc   = "S.get_old_password() -> password\n"
1002                             "Obtain old password.",
1003         },
1004         {
1005                 .ml_name  = "set_old_password",
1006                 .ml_meth  = py_creds_set_old_password,
1007                 .ml_flags = METH_VARARGS,
1008                 .ml_doc   = "S.set_old_password(password[, credentials.SPECIFIED]) -> None\n"
1009                             "Change old password.",
1010         },
1011         {
1012                 .ml_name  = "set_old_utf16_password",
1013                 .ml_meth  = py_creds_set_old_utf16_password,
1014                 .ml_flags = METH_VARARGS,
1015                 .ml_doc   = "S.set_old_utf16_password(password[, credentials.SPECIFIED]) -> None\n"
1016                             "Change old password.",
1017         },
1018         {
1019                 .ml_name  = "get_domain",
1020                 .ml_meth  = py_creds_get_domain,
1021                 .ml_flags = METH_NOARGS,
1022                 .ml_doc   = "S.get_domain() -> domain\n"
1023                             "Obtain domain name.",
1024         },
1025         {
1026                 .ml_name  = "set_domain",
1027                 .ml_meth  = py_creds_set_domain,
1028                 .ml_flags = METH_VARARGS,
1029                 .ml_doc   = "S.set_domain(domain[, credentials.SPECIFIED]) -> None\n"
1030                             "Change domain name.",
1031         },
1032         {
1033                 .ml_name  = "get_realm",
1034                 .ml_meth  = py_creds_get_realm,
1035                 .ml_flags = METH_NOARGS,
1036                 .ml_doc   = "S.get_realm() -> realm\n"
1037                             "Obtain realm name.",
1038         },
1039         {
1040                 .ml_name  = "set_realm",
1041                 .ml_meth  = py_creds_set_realm,
1042                 .ml_flags = METH_VARARGS,
1043                 .ml_doc   = "S.set_realm(realm[, credentials.SPECIFIED]) -> None\n"
1044                             "Change realm name.",
1045         },
1046         {
1047                 .ml_name  = "get_bind_dn",
1048                 .ml_meth  = py_creds_get_bind_dn,
1049                 .ml_flags = METH_NOARGS,
1050                 .ml_doc   = "S.get_bind_dn() -> bind dn\n"
1051                             "Obtain bind DN.",
1052         },
1053         {
1054                 .ml_name  = "set_bind_dn",
1055                 .ml_meth  = py_creds_set_bind_dn,
1056                 .ml_flags = METH_VARARGS,
1057                 .ml_doc   = "S.set_bind_dn(bind_dn) -> None\n"
1058                             "Change bind DN.",
1059         },
1060         {
1061                 .ml_name  = "is_anonymous",
1062                 .ml_meth  = py_creds_is_anonymous,
1063                 .ml_flags = METH_NOARGS,
1064         },
1065         {
1066                 .ml_name  = "set_anonymous",
1067                 .ml_meth  = py_creds_set_anonymous,
1068                 .ml_flags = METH_NOARGS,
1069                 .ml_doc   = "S.set_anonymous() -> None\n"
1070                             "Use anonymous credentials.",
1071         },
1072         {
1073                 .ml_name  = "get_workstation",
1074                 .ml_meth  = py_creds_get_workstation,
1075                 .ml_flags = METH_NOARGS,
1076         },
1077         {
1078                 .ml_name  = "set_workstation",
1079                 .ml_meth  = py_creds_set_workstation,
1080                 .ml_flags = METH_VARARGS,
1081         },
1082         {
1083                 .ml_name  = "authentication_requested",
1084                 .ml_meth  = py_creds_authentication_requested,
1085                 .ml_flags = METH_NOARGS,
1086         },
1087         {
1088                 .ml_name  = "wrong_password",
1089                 .ml_meth  = py_creds_wrong_password,
1090                 .ml_flags = METH_NOARGS,
1091                 .ml_doc   = "S.wrong_password() -> bool\n"
1092                             "Indicate the returned password was incorrect.",
1093         },
1094         {
1095                 .ml_name  = "set_cmdline_callbacks",
1096                 .ml_meth  = py_creds_set_cmdline_callbacks,
1097                 .ml_flags = METH_NOARGS,
1098                 .ml_doc   = "S.set_cmdline_callbacks() -> bool\n"
1099                             "Use command-line to obtain credentials not explicitly set.",
1100         },
1101         {
1102                 .ml_name  = "parse_string",
1103                 .ml_meth  = py_creds_parse_string,
1104                 .ml_flags = METH_VARARGS,
1105                 .ml_doc   = "S.parse_string(text[, credentials.SPECIFIED]) -> None\n"
1106                             "Parse credentials string.",
1107         },
1108         {
1109                 .ml_name  = "parse_file",
1110                 .ml_meth  = py_creds_parse_file,
1111                 .ml_flags = METH_VARARGS,
1112                 .ml_doc   = "S.parse_file(filename[, credentials.SPECIFIED]) -> None\n"
1113                             "Parse credentials file.",
1114         },
1115         {
1116                 .ml_name  = "set_password_will_be_nt_hash",
1117                 .ml_meth  = py_cli_credentials_set_password_will_be_nt_hash,
1118                 .ml_flags = METH_VARARGS,
1119                 .ml_doc   = "S.set_password_will_be_nt_hash(bool) -> None\n"
1120                             "Alters the behaviour of S.set_password() "
1121                             "to expect the NTHASH as hexstring.",
1122         },
1123         {
1124                 .ml_name  = "get_nt_hash",
1125                 .ml_meth  = py_creds_get_nt_hash,
1126                 .ml_flags = METH_NOARGS,
1127         },
1128         {
1129                 .ml_name  = "get_kerberos_state",
1130                 .ml_meth  = py_creds_get_kerberos_state,
1131                 .ml_flags = METH_NOARGS,
1132         },
1133         {
1134                 .ml_name  = "set_kerberos_state",
1135                 .ml_meth  = py_creds_set_kerberos_state,
1136                 .ml_flags = METH_VARARGS,
1137         },
1138         {
1139                 .ml_name  = "set_krb_forwardable",
1140                 .ml_meth  = py_creds_set_krb_forwardable,
1141                 .ml_flags = METH_VARARGS,
1142         },
1143         {
1144                 .ml_name  = "guess",
1145                 .ml_meth  = py_creds_guess,
1146                 .ml_flags = METH_VARARGS,
1147         },
1148         {
1149                 .ml_name  = "set_machine_account",
1150                 .ml_meth  = py_creds_set_machine_account,
1151                 .ml_flags = METH_VARARGS,
1152         },
1153         {
1154                 .ml_name  = "get_named_ccache",
1155                 .ml_meth  = py_creds_get_named_ccache,
1156                 .ml_flags = METH_VARARGS,
1157         },
1158         {
1159                 .ml_name  = "set_named_ccache",
1160                 .ml_meth  = py_creds_set_named_ccache,
1161                 .ml_flags = METH_VARARGS,
1162                 .ml_doc   = "S.set_named_ccache(krb5_ccache_name, obtained, lp) -> None\n"
1163                             "Set credentials to KRB5 Credentials Cache (by name).",
1164         },
1165         {
1166                 .ml_name  = "set_gensec_features",
1167                 .ml_meth  = py_creds_set_gensec_features,
1168                 .ml_flags = METH_VARARGS,
1169         },
1170         {
1171                 .ml_name  = "get_gensec_features",
1172                 .ml_meth  = py_creds_get_gensec_features,
1173                 .ml_flags = METH_NOARGS,
1174         },
1175         {
1176                 .ml_name  = "get_forced_sasl_mech",
1177                 .ml_meth  = py_creds_get_forced_sasl_mech,
1178                 .ml_flags = METH_NOARGS,
1179                 .ml_doc   = "S.get_forced_sasl_mech() -> SASL mechanism\nObtain forced SASL mechanism.",
1180         },
1181         {
1182                 .ml_name  = "set_forced_sasl_mech",
1183                 .ml_meth  = py_creds_set_forced_sasl_mech,
1184                 .ml_flags = METH_VARARGS,
1185                 .ml_doc   = "S.set_forced_sasl_mech(name) -> None\n"
1186                             "Set forced SASL mechanism.",
1187         },
1188         {
1189                 .ml_name  = "new_client_authenticator",
1190                 .ml_meth  = py_creds_new_client_authenticator,
1191                 .ml_flags = METH_NOARGS,
1192                 .ml_doc   = "S.new_client_authenticator() -> Authenticator\n"
1193                             "Get a new client NETLOGON_AUTHENTICATOR"},
1194         {
1195                 .ml_name  = "set_secure_channel_type",
1196                 .ml_meth  = py_creds_set_secure_channel_type,
1197                 .ml_flags = METH_VARARGS,
1198         },
1199         {
1200                 .ml_name  = "get_secure_channel_type",
1201                 .ml_meth  = py_creds_get_secure_channel_type,
1202                 .ml_flags = METH_VARARGS,
1203         },
1204         {
1205                 .ml_name  = "encrypt_netr_crypt_password",
1206                 .ml_meth  = py_creds_encrypt_netr_crypt_password,
1207                 .ml_flags = METH_VARARGS,
1208                 .ml_doc   = "S.encrypt_netr_crypt_password(password) -> NTSTATUS\n"
1209                             "Encrypt the supplied password using the session key and\n"
1210                             "the negotiated encryption algorithm in place\n"
1211                             "i.e. it overwrites the original data"},
1212         { .ml_name = NULL }
1213 };
1214
1215 static struct PyModuleDef moduledef = {
1216     PyModuleDef_HEAD_INIT,
1217     .m_name = "credentials",
1218     .m_doc = "Credentials management.",
1219     .m_size = -1,
1220     .m_methods = py_creds_methods,
1221 };
1222
1223 PyTypeObject PyCredentials = {
1224         .tp_name = "credentials.Credentials",
1225         .tp_new = py_creds_new,
1226         .tp_flags = Py_TPFLAGS_DEFAULT,
1227         .tp_methods = py_creds_methods,
1228 };
1229
1230 static PyObject *py_ccache_name(PyObject *self, PyObject *unused)
1231 {
1232         struct ccache_container *ccc = NULL;
1233         char *name = NULL;
1234         PyObject *py_name = NULL;
1235         int ret;
1236
1237         ccc = pytalloc_get_type(self, struct ccache_container);
1238
1239         ret = krb5_cc_get_full_name(ccc->smb_krb5_context->krb5_context,
1240                                     ccc->ccache, &name);
1241         if (ret == 0) {
1242                 py_name = PyString_FromStringOrNULL(name);
1243                 SAFE_FREE(name);
1244         } else {
1245                 PyErr_SetString(PyExc_RuntimeError,
1246                                 "Failed to get ccache name");
1247                 return NULL;
1248         }
1249         return py_name;
1250 }
1251
1252 static PyMethodDef py_ccache_container_methods[] = {
1253         { "get_name", py_ccache_name, METH_NOARGS,
1254           "S.get_name() -> name\nObtain KRB5 credentials cache name." },
1255         { NULL }
1256 };
1257
1258 PyTypeObject PyCredentialCacheContainer = {
1259         .tp_name = "credentials.CredentialCacheContainer",
1260         .tp_flags = Py_TPFLAGS_DEFAULT,
1261         .tp_methods = py_ccache_container_methods,
1262 };
1263
1264 MODULE_INIT_FUNC(credentials)
1265 {
1266         PyObject *m;
1267         if (pytalloc_BaseObject_PyType_Ready(&PyCredentials) < 0)
1268                 return NULL;
1269
1270         if (pytalloc_BaseObject_PyType_Ready(&PyCredentialCacheContainer) < 0)
1271                 return NULL;
1272
1273         m = PyModule_Create(&moduledef);
1274         if (m == NULL)
1275                 return NULL;
1276
1277         PyModule_AddObject(m, "UNINITIALISED", PyInt_FromLong(CRED_UNINITIALISED));
1278         PyModule_AddObject(m, "CALLBACK", PyInt_FromLong(CRED_CALLBACK));
1279         PyModule_AddObject(m, "GUESS_ENV", PyInt_FromLong(CRED_GUESS_ENV));
1280         PyModule_AddObject(m, "GUESS_FILE", PyInt_FromLong(CRED_GUESS_FILE));
1281         PyModule_AddObject(m, "CALLBACK_RESULT", PyInt_FromLong(CRED_CALLBACK_RESULT));
1282         PyModule_AddObject(m, "SPECIFIED", PyInt_FromLong(CRED_SPECIFIED));
1283
1284         PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyInt_FromLong(CRED_AUTO_USE_KERBEROS));
1285         PyModule_AddObject(m, "DONT_USE_KERBEROS", PyInt_FromLong(CRED_DONT_USE_KERBEROS));
1286         PyModule_AddObject(m, "MUST_USE_KERBEROS", PyInt_FromLong(CRED_MUST_USE_KERBEROS));
1287
1288         PyModule_AddObject(m, "AUTO_KRB_FORWARDABLE",  PyInt_FromLong(CRED_AUTO_KRB_FORWARDABLE));
1289         PyModule_AddObject(m, "NO_KRB_FORWARDABLE",    PyInt_FromLong(CRED_NO_KRB_FORWARDABLE));
1290         PyModule_AddObject(m, "FORCE_KRB_FORWARDABLE", PyInt_FromLong(CRED_FORCE_KRB_FORWARDABLE));
1291         PyModule_AddObject(m, "CLI_CRED_NTLM2", PyInt_FromLong(CLI_CRED_NTLM2));
1292         PyModule_AddObject(m, "CLI_CRED_NTLMv2_AUTH", PyInt_FromLong(CLI_CRED_NTLMv2_AUTH));
1293         PyModule_AddObject(m, "CLI_CRED_LANMAN_AUTH", PyInt_FromLong(CLI_CRED_LANMAN_AUTH));
1294         PyModule_AddObject(m, "CLI_CRED_NTLM_AUTH", PyInt_FromLong(CLI_CRED_NTLM_AUTH));
1295         PyModule_AddObject(m, "CLI_CRED_CLEAR_AUTH", PyInt_FromLong(CLI_CRED_CLEAR_AUTH));
1296
1297         Py_INCREF(&PyCredentials);
1298         PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials);
1299         Py_INCREF(&PyCredentialCacheContainer);
1300         PyModule_AddObject(m, "CredentialCacheContainer", (PyObject *)&PyCredentialCacheContainer);
1301         return m;
1302 }