source3/libads/kerberos_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    krb5 set password implementation
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001 (remuskoos@yahoo.com)
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smb_krb5.h"
  23 #include "ads.h"
  24
  25 #ifdef HAVE_KRB5
  26
  27 /* run kinit to setup our ccache */
  28 int ads_kinit_password(ADS_STRUCT *ads)
  29 {
  30         char *s;
  31         int ret;
  32         const char *account_name;
  33         fstring acct_name;
  34
  35         if (ads->auth.flags & ADS_AUTH_USER_CREDS) {
  36                 account_name = ads->auth.user_name;
  37                 goto got_accountname;
  38         }
  39
  40         if ( IS_DC ) {
  41                 /* this will end up getting a ticket for DOMAIN@RUSTED.REA.LM */
  42                 account_name = lp_workgroup();
  43         } else {
  44                 /* always use the sAMAccountName for security = domain */
  45                 /* lp_netbios_name()$@REA.LM */
  46                 if ( lp_security() == SEC_DOMAIN ) {
  47                         fstr_sprintf( acct_name, "%s$", lp_netbios_name() );
  48                         account_name = acct_name;
  49                 }
  50                 else
  51                         /* This looks like host/lp_netbios_name()@REA.LM */
  52                         account_name = ads->auth.user_name;
  53         }
  54
  55  got_accountname:
  56         if (asprintf(&s, "%s@%s", account_name, ads->auth.realm) == -1) {
  57                 return KRB5_CC_NOMEM;
  58         }
  59
  60         if (!ads->auth.password) {
  61                 SAFE_FREE(s);
  62                 return KRB5_LIBOS_CANTREADPWD;
  63         }
  64
  65         ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
  66                         &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable,
  67                         NULL);
  68
  69         if (ret) {
  70                 DEBUG(0,("kerberos_kinit_password %s failed: %s\n",
  71                          s, error_message(ret)));
  72         }
  73         SAFE_FREE(s);
  74         return ret;
  75 }
  76
  77 #endif