2 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #include "krb5_locl.h"
39 * @page krb5_ccache_intro The credential cache functions
40 * @section section_krb5_ccache Kerberos credential caches
42 * krb5_ccache structure holds a Kerberos credential cache.
44 * Heimdal support the follow types of credential caches:
47 * Store the credential in a database
49 * Store the credential in memory
51 * Store the credential in memory
53 * A credential cache server based solution for Mac OS X
55 * A credential cache server based solution for all platforms
59 * This is a minimalistic version of klist:
64 main (int argc, char **argv)
67 krb5_cc_cursor cursor;
72 if (krb5_init_context (&context) != 0)
73 errx(1, "krb5_context");
75 ret = krb5_cc_default (context, &id);
77 krb5_err(context, 1, ret, "krb5_cc_default");
79 ret = krb5_cc_start_seq_get(context, id, &cursor);
81 krb5_err(context, 1, ret, "krb5_cc_start_seq_get");
83 while((ret = krb5_cc_next_cred(context, id, &cursor, &creds)) == 0){
86 krb5_unparse_name(context, creds.server, &principal);
87 printf("principal: %s\\n", principal);
89 krb5_free_cred_contents (context, &creds);
91 ret = krb5_cc_end_seq_get(context, id, &cursor);
93 krb5_err(context, 1, ret, "krb5_cc_end_seq_get");
95 krb5_cc_close(context, id);
97 krb5_free_context(context);
104 * Add a new ccache type with operations `ops', overwriting any
105 * existing one if `override'.
107 * @param context a Keberos context
108 * @param ops type of plugin symbol
109 * @param override flag to select if the registration is to overide
110 * an existing ops with the same name.
112 * @return Return an error code or 0, see krb5_get_error_message().
114 * @ingroup krb5_ccache
117 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
118 krb5_cc_register(krb5_context context
,
119 const krb5_cc_ops
*ops
,
120 krb5_boolean override
)
124 for(i
= 0; i
< context
->num_cc_ops
&& context
->cc_ops
[i
]->prefix
; i
++) {
125 if(strcmp(context
->cc_ops
[i
]->prefix
, ops
->prefix
) == 0) {
127 krb5_set_error_message(context
,
129 N_("cache type %s already exists", "type"),
131 return KRB5_CC_TYPE_EXISTS
;
136 if(i
== context
->num_cc_ops
) {
137 const krb5_cc_ops
**o
= realloc(rk_UNCONST(context
->cc_ops
),
138 (context
->num_cc_ops
+ 1) *
139 sizeof(context
->cc_ops
[0]));
141 krb5_set_error_message(context
, KRB5_CC_NOMEM
,
142 N_("malloc: out of memory", ""));
143 return KRB5_CC_NOMEM
;
146 context
->cc_ops
[context
->num_cc_ops
] = NULL
;
147 context
->num_cc_ops
++;
149 context
->cc_ops
[i
] = ops
;
154 * Allocate the memory for a `id' and the that function table to
155 * `ops'. Returns 0 or and error code.
159 _krb5_cc_allocate(krb5_context context
,
160 const krb5_cc_ops
*ops
,
165 p
= malloc (sizeof(*p
));
167 krb5_set_error_message(context
, KRB5_CC_NOMEM
,
168 N_("malloc: out of memory", ""));
169 return KRB5_CC_NOMEM
;
178 * Allocate memory for a new ccache in `id' with operations `ops'
179 * and name `residual'. Return 0 or an error code.
182 static krb5_error_code
183 allocate_ccache (krb5_context context
,
184 const krb5_cc_ops
*ops
,
185 const char *residual
,
189 #ifdef KRB5_USE_PATH_TOKENS
190 char * exp_residual
= NULL
;
192 ret
= _krb5_expand_path_tokens(context
, residual
, &exp_residual
);
196 residual
= exp_residual
;
199 ret
= _krb5_cc_allocate(context
, ops
, id
);
201 #ifdef KRB5_USE_PATH_TOKENS
208 ret
= (*id
)->ops
->resolve(context
, id
, residual
);
214 #ifdef KRB5_USE_PATH_TOKENS
223 is_possible_path_name(const char * name
)
227 if ((colon
= strchr(name
, ':')) == NULL
)
231 /* <drive letter>:\path\to\cache ? */
233 if (colon
== name
+ 1 &&
234 strchr(colon
+ 1, ':') == NULL
)
242 * Find and allocate a ccache in `id' from the specification in `residual'.
243 * If the ccache name doesn't contain any colon, interpret it as a file name.
245 * @param context a Keberos context.
246 * @param name string name of a credential cache.
247 * @param id return pointer to a found credential cache.
249 * @return Return 0 or an error code. In case of an error, id is set
250 * to NULL, see krb5_get_error_message().
252 * @ingroup krb5_ccache
256 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
257 krb5_cc_resolve(krb5_context context
,
265 for(i
= 0; i
< context
->num_cc_ops
&& context
->cc_ops
[i
]->prefix
; i
++) {
266 size_t prefix_len
= strlen(context
->cc_ops
[i
]->prefix
);
268 if(strncmp(context
->cc_ops
[i
]->prefix
, name
, prefix_len
) == 0
269 && name
[prefix_len
] == ':') {
270 return allocate_ccache (context
, context
->cc_ops
[i
],
271 name
+ prefix_len
+ 1,
275 if (is_possible_path_name(name
))
276 return allocate_ccache (context
, &krb5_fcc_ops
, name
, id
);
278 krb5_set_error_message(context
, KRB5_CC_UNKNOWN_TYPE
,
279 N_("unknown ccache type %s", "name"), name
);
280 return KRB5_CC_UNKNOWN_TYPE
;
285 * Generates a new unique ccache of `type` in `id'. If `type' is NULL,
286 * the library chooses the default credential cache type. The supplied
287 * `hint' (that can be NULL) is a string that the credential cache
288 * type can use to base the name of the credential on, this is to make
289 * it easier for the user to differentiate the credentials.
291 * @return Return an error code or 0, see krb5_get_error_message().
293 * @ingroup krb5_ccache
296 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
297 krb5_cc_new_unique(krb5_context context
, const char *type
,
298 const char *hint
, krb5_ccache
*id
)
300 const krb5_cc_ops
*ops
;
303 ops
= krb5_cc_get_prefix_ops(context
, type
);
305 krb5_set_error_message(context
, KRB5_CC_UNKNOWN_TYPE
,
306 "Credential cache type %s is unknown", type
);
307 return KRB5_CC_UNKNOWN_TYPE
;
310 ret
= _krb5_cc_allocate(context
, ops
, id
);
313 ret
= (*id
)->ops
->gen_new(context
, id
);
322 * Return the name of the ccache `id'
324 * @ingroup krb5_ccache
328 KRB5_LIB_FUNCTION
const char* KRB5_LIB_CALL
329 krb5_cc_get_name(krb5_context context
,
332 return id
->ops
->get_name(context
, id
);
336 * Return the type of the ccache `id'.
338 * @ingroup krb5_ccache
342 KRB5_LIB_FUNCTION
const char* KRB5_LIB_CALL
343 krb5_cc_get_type(krb5_context context
,
346 return id
->ops
->prefix
;
350 * Return the complete resolvable name the cache
352 * @param context a Keberos context
353 * @param id return pointer to a found credential cache
354 * @param str the returned name of a credential cache, free with krb5_xfree()
356 * @return Returns 0 or an error (and then *str is set to NULL).
358 * @ingroup krb5_ccache
362 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
363 krb5_cc_get_full_name(krb5_context context
,
367 const char *type
, *name
;
371 type
= krb5_cc_get_type(context
, id
);
373 krb5_set_error_message(context
, KRB5_CC_UNKNOWN_TYPE
,
374 "cache have no name of type");
375 return KRB5_CC_UNKNOWN_TYPE
;
378 name
= krb5_cc_get_name(context
, id
);
380 krb5_set_error_message(context
, KRB5_CC_BADNAME
,
381 "cache of type %s have no name", type
);
382 return KRB5_CC_BADNAME
;
385 if (asprintf(str
, "%s:%s", type
, name
) == -1) {
386 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
394 * Return krb5_cc_ops of a the ccache `id'.
396 * @ingroup krb5_ccache
400 KRB5_LIB_FUNCTION
const krb5_cc_ops
* KRB5_LIB_CALL
401 krb5_cc_get_ops(krb5_context context
, krb5_ccache id
)
407 * Expand variables in `str' into `res'
411 _krb5_expand_default_cc_name(krb5_context context
, const char *str
, char **res
)
413 return _krb5_expand_path_tokens(context
, str
, res
);
417 * Return non-zero if envirnoment that will determine default krb5cc
422 environment_changed(krb5_context context
)
426 /* if the cc name was set, don't change it */
427 if (context
->default_cc_name_set
)
430 /* XXX performance: always ask KCM/API if default name has changed */
431 if (context
->default_cc_name
&&
432 (strncmp(context
->default_cc_name
, "KCM:", 4) == 0 ||
433 strncmp(context
->default_cc_name
, "API:", 4) == 0))
439 e
= getenv("KRB5CCNAME");
441 if (context
->default_cc_name_env
) {
442 free(context
->default_cc_name_env
);
443 context
->default_cc_name_env
= NULL
;
447 if (context
->default_cc_name_env
== NULL
)
449 if (strcmp(e
, context
->default_cc_name_env
) != 0)
456 * Switch the default default credential cache for a specific
457 * credcache type (and name for some implementations).
459 * @return Return an error code or 0, see krb5_get_error_message().
461 * @ingroup krb5_ccache
464 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
465 krb5_cc_switch(krb5_context context
, krb5_ccache id
)
468 if (id
->ops
->set_default
== NULL
)
471 return (*id
->ops
->set_default
)(context
, id
);
475 * Return true if the default credential cache support switch
477 * @ingroup krb5_ccache
480 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
481 krb5_cc_support_switch(krb5_context context
, const char *type
)
483 const krb5_cc_ops
*ops
;
485 ops
= krb5_cc_get_prefix_ops(context
, type
);
486 if (ops
&& ops
->set_default
)
492 * Set the default cc name for `context' to `name'.
494 * @ingroup krb5_ccache
497 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
498 krb5_cc_set_default_name(krb5_context context
, const char *name
)
500 krb5_error_code ret
= 0;
501 char *p
= NULL
, *exp_p
= NULL
;
504 const char *e
= NULL
;
507 e
= getenv("KRB5CCNAME");
510 if (context
->default_cc_name_env
)
511 free(context
->default_cc_name_env
);
512 context
->default_cc_name_env
= strdup(e
);
518 e
= p
= _krb5_get_default_cc_name_from_registry();
522 e
= krb5_config_get_string(context
, NULL
, "libdefaults",
523 "default_cc_name", NULL
);
525 ret
= _krb5_expand_default_cc_name(context
, e
, &p
);
530 const krb5_cc_ops
*ops
= KRB5_DEFAULT_CCTYPE
;
531 e
= krb5_config_get_string(context
, NULL
, "libdefaults",
532 "default_cc_type", NULL
);
534 ops
= krb5_cc_get_prefix_ops(context
, e
);
536 krb5_set_error_message(context
,
537 KRB5_CC_UNKNOWN_TYPE
,
538 "Credential cache type %s "
540 return KRB5_CC_UNKNOWN_TYPE
;
543 ret
= (*ops
->get_default_name
)(context
, &p
);
548 context
->default_cc_name_set
= 0;
551 context
->default_cc_name_set
= 1;
555 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
559 ret
= _krb5_expand_path_tokens(context
, p
, &exp_p
);
564 if (context
->default_cc_name
)
565 free(context
->default_cc_name
);
567 context
->default_cc_name
= exp_p
;
573 * Return a pointer to a context static string containing the default
576 * @return String to the default credential cache name.
578 * @ingroup krb5_ccache
582 KRB5_LIB_FUNCTION
const char* KRB5_LIB_CALL
583 krb5_cc_default_name(krb5_context context
)
585 if (context
->default_cc_name
== NULL
|| environment_changed(context
))
586 krb5_cc_set_default_name(context
, NULL
);
588 return context
->default_cc_name
;
592 * Open the default ccache in `id'.
594 * @return Return an error code or 0, see krb5_get_error_message().
596 * @ingroup krb5_ccache
600 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
601 krb5_cc_default(krb5_context context
,
604 const char *p
= krb5_cc_default_name(context
);
607 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
610 return krb5_cc_resolve(context
, p
, id
);
614 * Create a new ccache in `id' for `primary_principal'.
616 * @return Return an error code or 0, see krb5_get_error_message().
618 * @ingroup krb5_ccache
622 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
623 krb5_cc_initialize(krb5_context context
,
625 krb5_principal primary_principal
)
627 return (*id
->ops
->init
)(context
, id
, primary_principal
);
632 * Remove the ccache `id'.
634 * @return Return an error code or 0, see krb5_get_error_message().
636 * @ingroup krb5_ccache
640 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
641 krb5_cc_destroy(krb5_context context
,
646 ret
= (*id
->ops
->destroy
)(context
, id
);
647 krb5_cc_close (context
, id
);
652 * Stop using the ccache `id' and free the related resources.
654 * @return Return an error code or 0, see krb5_get_error_message().
656 * @ingroup krb5_ccache
660 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
661 krb5_cc_close(krb5_context context
,
665 ret
= (*id
->ops
->close
)(context
, id
);
671 * Store `creds' in the ccache `id'.
673 * @return Return an error code or 0, see krb5_get_error_message().
675 * @ingroup krb5_ccache
679 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
680 krb5_cc_store_cred(krb5_context context
,
684 return (*id
->ops
->store
)(context
, id
, creds
);
688 * Retrieve the credential identified by `mcreds' (and `whichfields')
689 * from `id' in `creds'. 'creds' must be free by the caller using
690 * krb5_free_cred_contents.
692 * @param context A Kerberos 5 context
693 * @param id a Kerberos 5 credential cache
694 * @param whichfields what fields to use for matching credentials, same
695 * flags as whichfields in krb5_compare_creds()
696 * @param mcreds template credential to use for comparing
697 * @param creds returned credential, free with krb5_free_cred_contents()
699 * @return Return an error code or 0, see krb5_get_error_message().
701 * @ingroup krb5_ccache
705 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
706 krb5_cc_retrieve_cred(krb5_context context
,
708 krb5_flags whichfields
,
709 const krb5_creds
*mcreds
,
713 krb5_cc_cursor cursor
;
715 if (id
->ops
->retrieve
!= NULL
) {
716 return (*id
->ops
->retrieve
)(context
, id
, whichfields
,
720 ret
= krb5_cc_start_seq_get(context
, id
, &cursor
);
723 while((ret
= krb5_cc_next_cred(context
, id
, &cursor
, creds
)) == 0){
724 if(krb5_compare_creds(context
, whichfields
, mcreds
, creds
)){
728 krb5_free_cred_contents (context
, creds
);
730 krb5_cc_end_seq_get(context
, id
, &cursor
);
735 * Return the principal of `id' in `principal'.
737 * @return Return an error code or 0, see krb5_get_error_message().
739 * @ingroup krb5_ccache
743 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
744 krb5_cc_get_principal(krb5_context context
,
746 krb5_principal
*principal
)
748 return (*id
->ops
->get_princ
)(context
, id
, principal
);
752 * Start iterating over `id', `cursor' is initialized to the
753 * beginning. Caller must free the cursor with krb5_cc_end_seq_get().
755 * @return Return an error code or 0, see krb5_get_error_message().
757 * @ingroup krb5_ccache
761 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
762 krb5_cc_start_seq_get (krb5_context context
,
763 const krb5_ccache id
,
764 krb5_cc_cursor
*cursor
)
766 return (*id
->ops
->get_first
)(context
, id
, cursor
);
770 * Retrieve the next cred pointed to by (`id', `cursor') in `creds'
771 * and advance `cursor'.
773 * @return Return an error code or 0, see krb5_get_error_message().
775 * @ingroup krb5_ccache
779 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
780 krb5_cc_next_cred (krb5_context context
,
781 const krb5_ccache id
,
782 krb5_cc_cursor
*cursor
,
785 return (*id
->ops
->get_next
)(context
, id
, cursor
, creds
);
789 * Destroy the cursor `cursor'.
791 * @ingroup krb5_ccache
795 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
796 krb5_cc_end_seq_get (krb5_context context
,
797 const krb5_ccache id
,
798 krb5_cc_cursor
*cursor
)
800 return (*id
->ops
->end_get
)(context
, id
, cursor
);
804 * Remove the credential identified by `cred', `which' from `id'.
806 * @ingroup krb5_ccache
810 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
811 krb5_cc_remove_cred(krb5_context context
,
816 if(id
->ops
->remove_cred
== NULL
) {
817 krb5_set_error_message(context
,
819 "ccache %s does not support remove_cred",
821 return EACCES
; /* XXX */
823 return (*id
->ops
->remove_cred
)(context
, id
, which
, cred
);
827 * Set the flags of `id' to `flags'.
829 * @ingroup krb5_ccache
833 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
834 krb5_cc_set_flags(krb5_context context
,
838 return (*id
->ops
->set_flags
)(context
, id
, flags
);
842 * Get the flags of `id', store them in `flags'.
844 * @ingroup krb5_ccache
847 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
848 krb5_cc_get_flags(krb5_context context
,
857 * Copy the contents of `from' to `to' if the given match function
860 * @param context A Kerberos 5 context.
861 * @param from the cache to copy data from.
862 * @param to the cache to copy data to.
863 * @param match a match function that should return TRUE if cred argument should be copied, if NULL, all credentials are copied.
864 * @param matchctx context passed to match function.
865 * @param matched set to true if there was a credential that matched, may be NULL.
867 * @return Return an error code or 0, see krb5_get_error_message().
869 * @ingroup krb5_ccache
872 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
873 krb5_cc_copy_match_f(krb5_context context
,
874 const krb5_ccache from
,
876 krb5_boolean (*match
)(krb5_context
, void *, const krb5_creds
*),
878 unsigned int *matched
)
881 krb5_cc_cursor cursor
;
883 krb5_principal princ
;
888 ret
= krb5_cc_get_principal(context
, from
, &princ
);
891 ret
= krb5_cc_initialize(context
, to
, princ
);
893 krb5_free_principal(context
, princ
);
896 ret
= krb5_cc_start_seq_get(context
, from
, &cursor
);
898 krb5_free_principal(context
, princ
);
902 while ((ret
= krb5_cc_next_cred(context
, from
, &cursor
, &cred
)) == 0) {
903 if (match
== NULL
|| (*match
)(context
, matchctx
, &cred
) == 0) {
906 ret
= krb5_cc_store_cred(context
, to
, &cred
);
910 krb5_free_cred_contents(context
, &cred
);
912 krb5_cc_end_seq_get(context
, from
, &cursor
);
913 krb5_free_principal(context
, princ
);
914 if (ret
== KRB5_CC_END
)
920 * Just like krb5_cc_copy_match_f(), but copy everything.
922 * @ingroup @krb5_ccache
925 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
926 krb5_cc_copy_cache(krb5_context context
,
927 const krb5_ccache from
,
930 return krb5_cc_copy_match_f(context
, from
, to
, NULL
, NULL
, NULL
);
934 * Return the version of `id'.
936 * @ingroup krb5_ccache
940 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
941 krb5_cc_get_version(krb5_context context
,
942 const krb5_ccache id
)
944 if(id
->ops
->get_version
)
945 return (*id
->ops
->get_version
)(context
, id
);
951 * Clear `mcreds' so it can be used with krb5_cc_retrieve_cred
953 * @ingroup krb5_ccache
957 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
958 krb5_cc_clear_mcred(krb5_creds
*mcred
)
960 memset(mcred
, 0, sizeof(*mcred
));
964 * Get the cc ops that is registered in `context' to handle the
965 * prefix. prefix can be a complete credential cache name or a
966 * prefix, the function will only use part up to the first colon (:)
967 * if there is one. If prefix the argument is NULL, the default ccache
968 * implemtation is returned.
970 * @return Returns NULL if ops not found.
972 * @ingroup krb5_ccache
976 KRB5_LIB_FUNCTION
const krb5_cc_ops
* KRB5_LIB_CALL
977 krb5_cc_get_prefix_ops(krb5_context context
, const char *prefix
)
983 return KRB5_DEFAULT_CCTYPE
;
984 if (prefix
[0] == '/')
985 return &krb5_fcc_ops
;
989 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
996 for(i
= 0; i
< context
->num_cc_ops
&& context
->cc_ops
[i
]->prefix
; i
++) {
997 if(strcmp(context
->cc_ops
[i
]->prefix
, p
) == 0) {
999 return context
->cc_ops
[i
];
1006 struct krb5_cc_cache_cursor_data
{
1007 const krb5_cc_ops
*ops
;
1008 krb5_cc_cursor cursor
;
1012 * Start iterating over all caches of specified type. See also
1013 * krb5_cccol_cursor_new().
1015 * @param context A Kerberos 5 context
1016 * @param type optional type to iterate over, if NULL, the default cache is used.
1017 * @param cursor cursor should be freed with krb5_cc_cache_end_seq_get().
1019 * @return Return an error code or 0, see krb5_get_error_message().
1021 * @ingroup krb5_ccache
1025 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1026 krb5_cc_cache_get_first (krb5_context context
,
1028 krb5_cc_cache_cursor
*cursor
)
1030 const krb5_cc_ops
*ops
;
1031 krb5_error_code ret
;
1034 type
= krb5_cc_default_name(context
);
1036 ops
= krb5_cc_get_prefix_ops(context
, type
);
1038 krb5_set_error_message(context
, KRB5_CC_UNKNOWN_TYPE
,
1039 "Unknown type \"%s\" when iterating "
1040 "trying to iterate the credential caches", type
);
1041 return KRB5_CC_UNKNOWN_TYPE
;
1044 if (ops
->get_cache_first
== NULL
) {
1045 krb5_set_error_message(context
, KRB5_CC_NOSUPP
,
1046 N_("Credential cache type %s doesn't support "
1047 "iterations over caches", "type"),
1049 return KRB5_CC_NOSUPP
;
1052 *cursor
= calloc(1, sizeof(**cursor
));
1053 if (*cursor
== NULL
) {
1054 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
1058 (*cursor
)->ops
= ops
;
1060 ret
= ops
->get_cache_first(context
, &(*cursor
)->cursor
);
1069 * Retrieve the next cache pointed to by (`cursor') in `id'
1070 * and advance `cursor'.
1072 * @param context A Kerberos 5 context
1073 * @param cursor the iterator cursor, returned by krb5_cc_cache_get_first()
1074 * @param id next ccache
1076 * @return Return 0 or an error code. Returns KRB5_CC_END when the end
1077 * of caches is reached, see krb5_get_error_message().
1079 * @ingroup krb5_ccache
1083 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1084 krb5_cc_cache_next (krb5_context context
,
1085 krb5_cc_cache_cursor cursor
,
1088 return cursor
->ops
->get_cache_next(context
, cursor
->cursor
, id
);
1092 * Destroy the cursor `cursor'.
1094 * @return Return an error code or 0, see krb5_get_error_message().
1096 * @ingroup krb5_ccache
1100 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1101 krb5_cc_cache_end_seq_get (krb5_context context
,
1102 krb5_cc_cache_cursor cursor
)
1104 krb5_error_code ret
;
1105 ret
= cursor
->ops
->end_cache_get(context
, cursor
->cursor
);
1112 * Search for a matching credential cache that have the
1113 * `principal' as the default principal. On success, `id' needs to be
1114 * freed with krb5_cc_close() or krb5_cc_destroy().
1116 * @param context A Kerberos 5 context
1117 * @param client The principal to search for
1118 * @param id the returned credential cache
1120 * @return On failure, error code is returned and `id' is set to NULL.
1122 * @ingroup krb5_ccache
1126 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1127 krb5_cc_cache_match (krb5_context context
,
1128 krb5_principal client
,
1131 krb5_cccol_cursor cursor
;
1132 krb5_error_code ret
;
1133 krb5_ccache cache
= NULL
;
1137 ret
= krb5_cccol_cursor_new (context
, &cursor
);
1141 while (krb5_cccol_cursor_next (context
, cursor
, &cache
) == 0 && cache
!= NULL
) {
1142 krb5_principal principal
;
1144 ret
= krb5_cc_get_principal(context
, cache
, &principal
);
1148 match
= krb5_principal_compare(context
, principal
, client
);
1149 krb5_free_principal(context
, principal
);
1154 krb5_cc_close(context
, cache
);
1158 krb5_cccol_cursor_free(context
, &cursor
);
1160 if (cache
== NULL
) {
1163 krb5_unparse_name(context
, client
, &str
);
1165 krb5_set_error_message(context
, KRB5_CC_NOTFOUND
,
1166 N_("Principal %s not found in any "
1167 "credential cache", ""),
1168 str
? str
: "<out of memory>");
1171 return KRB5_CC_NOTFOUND
;
1179 * Move the content from one credential cache to another. The
1180 * operation is an atomic switch.
1182 * @param context a Keberos context
1183 * @param from the credential cache to move the content from
1184 * @param to the credential cache to move the content to
1186 * @return On sucess, from is freed. On failure, error code is
1187 * returned and from and to are both still allocated, see krb5_get_error_message().
1189 * @ingroup krb5_ccache
1192 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1193 krb5_cc_move(krb5_context context
, krb5_ccache from
, krb5_ccache to
)
1195 krb5_error_code ret
;
1197 if (strcmp(from
->ops
->prefix
, to
->ops
->prefix
) != 0) {
1198 krb5_set_error_message(context
, KRB5_CC_NOSUPP
,
1199 N_("Moving credentials between diffrent "
1200 "types not yet supported", ""));
1201 return KRB5_CC_NOSUPP
;
1204 ret
= (*to
->ops
->move
)(context
, from
, to
);
1206 memset(from
, 0, sizeof(*from
));
1212 #define KRB5_CONF_NAME "krb5_ccache_conf_data"
1213 #define KRB5_REALM_NAME "X-CACHECONF:"
1215 static krb5_error_code
1216 build_conf_principals(krb5_context context
, krb5_ccache id
,
1217 krb5_const_principal principal
,
1218 const char *name
, krb5_creds
*cred
)
1220 krb5_principal client
;
1221 krb5_error_code ret
;
1224 memset(cred
, 0, sizeof(*cred
));
1226 ret
= krb5_cc_get_principal(context
, id
, &client
);
1231 ret
= krb5_unparse_name(context
, principal
, &pname
);
1236 ret
= krb5_make_principal(context
, &cred
->server
,
1238 KRB5_CONF_NAME
, name
, pname
, NULL
);
1241 krb5_free_principal(context
, client
);
1244 ret
= krb5_copy_principal(context
, client
, &cred
->client
);
1245 krb5_free_principal(context
, client
);
1250 * Return TRUE (non zero) if the principal is a configuration
1251 * principal (generated part of krb5_cc_set_config()). Returns FALSE
1252 * (zero) if not a configuration principal.
1254 * @param context a Keberos context
1255 * @param principal principal to check if it a configuration principal
1257 * @ingroup krb5_ccache
1260 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
1261 krb5_is_config_principal(krb5_context context
,
1262 krb5_const_principal principal
)
1264 if (strcmp(principal
->realm
, KRB5_REALM_NAME
) != 0)
1267 if (principal
->name
.name_string
.len
== 0 ||
1268 strcmp(principal
->name
.name_string
.val
[0], KRB5_CONF_NAME
) != 0)
1275 * Store some configuration for the credential cache in the cache.
1276 * Existing configuration under the same name is over-written.
1278 * @param context a Keberos context
1279 * @param id the credential cache to store the data for
1280 * @param principal configuration for a specific principal, if
1281 * NULL, global for the whole cache.
1282 * @param name name under which the configuraion is stored.
1283 * @param data data to store, if NULL, configure is removed.
1285 * @ingroup krb5_ccache
1288 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1289 krb5_cc_set_config(krb5_context context
, krb5_ccache id
,
1290 krb5_const_principal principal
,
1291 const char *name
, krb5_data
*data
)
1293 krb5_error_code ret
;
1296 ret
= build_conf_principals(context
, id
, principal
, name
, &cred
);
1300 /* Remove old configuration */
1301 ret
= krb5_cc_remove_cred(context
, id
, 0, &cred
);
1302 if (ret
&& ret
!= KRB5_CC_NOTFOUND
)
1306 /* not that anyone care when this expire */
1307 cred
.times
.authtime
= time(NULL
);
1308 cred
.times
.endtime
= cred
.times
.authtime
+ 3600 * 24 * 30;
1310 ret
= krb5_data_copy(&cred
.ticket
, data
->data
, data
->length
);
1314 ret
= krb5_cc_store_cred(context
, id
, &cred
);
1318 krb5_free_cred_contents (context
, &cred
);
1323 * Get some configuration for the credential cache in the cache.
1325 * @param context a Keberos context
1326 * @param id the credential cache to store the data for
1327 * @param principal configuration for a specific principal, if
1328 * NULL, global for the whole cache.
1329 * @param name name under which the configuraion is stored.
1330 * @param data data to fetched, free with krb5_data_free()
1332 * @ingroup krb5_ccache
1336 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1337 krb5_cc_get_config(krb5_context context
, krb5_ccache id
,
1338 krb5_const_principal principal
,
1339 const char *name
, krb5_data
*data
)
1341 krb5_creds mcred
, cred
;
1342 krb5_error_code ret
;
1344 memset(&cred
, 0, sizeof(cred
));
1345 krb5_data_zero(data
);
1347 ret
= build_conf_principals(context
, id
, principal
, name
, &mcred
);
1351 ret
= krb5_cc_retrieve_cred(context
, id
, 0, &mcred
, &cred
);
1355 ret
= krb5_data_copy(data
, cred
.ticket
.data
, cred
.ticket
.length
);
1358 krb5_free_cred_contents (context
, &cred
);
1359 krb5_free_cred_contents (context
, &mcred
);
1367 struct krb5_cccol_cursor_data
{
1369 krb5_cc_cache_cursor cursor
;
1373 * Get a new cache interation cursor that will interate over all
1374 * credentials caches independent of type.
1376 * @param context a Keberos context
1377 * @param cursor passed into krb5_cccol_cursor_next() and free with krb5_cccol_cursor_free().
1379 * @return Returns 0 or and error code, see krb5_get_error_message().
1381 * @ingroup krb5_ccache
1384 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1385 krb5_cccol_cursor_new(krb5_context context
, krb5_cccol_cursor
*cursor
)
1387 *cursor
= calloc(1, sizeof(**cursor
));
1388 if (*cursor
== NULL
) {
1389 krb5_set_error_message(context
, ENOMEM
, N_("malloc: out of memory", ""));
1393 (*cursor
)->cursor
= NULL
;
1399 * Get next credential cache from the iteration.
1401 * @param context A Kerberos 5 context
1402 * @param cursor the iteration cursor
1403 * @param cache the returned cursor, pointer is set to NULL on failure
1404 * and a cache on success. The returned cache needs to be freed
1405 * with krb5_cc_close() or destroyed with krb5_cc_destroy().
1406 * MIT Kerberos behavies slightly diffrent and sets cache to NULL
1407 * when all caches are iterated over and return 0.
1409 * @return Return 0 or and error, KRB5_CC_END is returned at the end
1410 * of iteration. See krb5_get_error_message().
1412 * @ingroup krb5_ccache
1416 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1417 krb5_cccol_cursor_next(krb5_context context
, krb5_cccol_cursor cursor
,
1420 krb5_error_code ret
;
1424 while (cursor
->idx
< context
->num_cc_ops
) {
1426 if (cursor
->cursor
== NULL
) {
1427 ret
= krb5_cc_cache_get_first (context
,
1428 context
->cc_ops
[cursor
->idx
]->prefix
,
1435 ret
= krb5_cc_cache_next(context
, cursor
->cursor
, cache
);
1439 krb5_cc_cache_end_seq_get(context
, cursor
->cursor
);
1440 cursor
->cursor
= NULL
;
1441 if (ret
!= KRB5_CC_END
)
1446 if (cursor
->idx
>= context
->num_cc_ops
) {
1447 krb5_set_error_message(context
, KRB5_CC_END
,
1448 N_("Reached end of credential caches", ""));
1456 * End an iteration and free all resources, can be done before end is reached.
1458 * @param context A Kerberos 5 context
1459 * @param cursor the iteration cursor to be freed.
1461 * @return Return 0 or and error, KRB5_CC_END is returned at the end
1462 * of iteration. See krb5_get_error_message().
1464 * @ingroup krb5_ccache
1467 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1468 krb5_cccol_cursor_free(krb5_context context
, krb5_cccol_cursor
*cursor
)
1470 krb5_cccol_cursor c
= *cursor
;
1475 krb5_cc_cache_end_seq_get(context
, c
->cursor
);
1482 * Return the last time the credential cache was modified.
1484 * @param context A Kerberos 5 context
1485 * @param id The credential cache to probe
1486 * @param mtime the last modification time, set to 0 on error.
1488 * @return Return 0 or and error. See krb5_get_error_message().
1490 * @ingroup krb5_ccache
1494 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1495 krb5_cc_last_change_time(krb5_context context
,
1497 krb5_timestamp
*mtime
)
1500 return (*id
->ops
->lastchange
)(context
, id
, mtime
);
1504 * Return the last modfication time for a cache collection. The query
1505 * can be limited to a specific cache type. If the function return 0
1506 * and mtime is 0, there was no credentials in the caches.
1508 * @param context A Kerberos 5 context
1509 * @param type The credential cache to probe, if NULL, all type are traversed.
1510 * @param mtime the last modification time, set to 0 on error.
1512 * @return Return 0 or and error. See krb5_get_error_message().
1514 * @ingroup krb5_ccache
1517 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1518 krb5_cccol_last_change_time(krb5_context context
,
1520 krb5_timestamp
*mtime
)
1522 krb5_cccol_cursor cursor
;
1523 krb5_error_code ret
;
1525 krb5_timestamp t
= 0;
1529 ret
= krb5_cccol_cursor_new (context
, &cursor
);
1533 while (krb5_cccol_cursor_next(context
, cursor
, &id
) == 0 && id
!= NULL
) {
1535 if (type
&& strcmp(krb5_cc_get_type(context
, id
), type
) != 0)
1538 ret
= krb5_cc_last_change_time(context
, id
, &t
);
1539 krb5_cc_close(context
, id
);
1546 krb5_cccol_cursor_free(context
, &cursor
);
1551 * Return a friendly name on credential cache. Free the result with krb5_xfree().
1553 * @return Return an error code or 0, see krb5_get_error_message().
1555 * @ingroup krb5_ccache
1558 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1559 krb5_cc_get_friendly_name(krb5_context context
,
1563 krb5_error_code ret
;
1566 ret
= krb5_cc_get_config(context
, id
, NULL
, "FriendlyName", &data
);
1568 krb5_principal principal
;
1569 ret
= krb5_cc_get_principal(context
, id
, &principal
);
1572 ret
= krb5_unparse_name(context
, principal
, name
);
1573 krb5_free_principal(context
, principal
);
1575 ret
= asprintf(name
, "%.*s", (int)data
.length
, (char *)data
.data
);
1576 krb5_data_free(&data
);
1579 krb5_set_error_message(context
, ret
, N_("malloc: out of memory", ""));
1588 * Set the friendly name on credential cache.
1590 * @return Return an error code or 0, see krb5_get_error_message().
1592 * @ingroup krb5_ccache
1595 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1596 krb5_cc_set_friendly_name(krb5_context context
,
1602 data
.data
= rk_UNCONST(name
);
1603 data
.length
= strlen(name
);
1605 return krb5_cc_set_config(context
, id
, NULL
, "FriendlyName", &data
);
1609 * Get the lifetime of the initial ticket in the cache
1611 * Get the lifetime of the initial ticket in the cache, if the initial
1612 * ticket was not found, the error code KRB5_CC_END is returned.
1614 * @param context A Kerberos 5 context.
1615 * @param id a credential cache
1616 * @param t the relative lifetime of the initial ticket
1618 * @return Return an error code or 0, see krb5_get_error_message().
1620 * @ingroup krb5_ccache
1623 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1624 krb5_cc_get_lifetime(krb5_context context
, krb5_ccache id
, time_t *t
)
1626 krb5_cc_cursor cursor
;
1627 krb5_error_code ret
;
1634 ret
= krb5_cc_start_seq_get(context
, id
, &cursor
);
1638 while ((ret
= krb5_cc_next_cred(context
, id
, &cursor
, &cred
)) == 0) {
1639 if (cred
.flags
.b
.initial
) {
1640 if (now
< cred
.times
.endtime
)
1641 *t
= cred
.times
.endtime
- now
;
1642 krb5_free_cred_contents(context
, &cred
);
1645 krb5_free_cred_contents(context
, &cred
);
1648 krb5_cc_end_seq_get(context
, id
, &cursor
);
1654 * Set the time offset betwen the client and the KDC
1656 * If the backend doesn't support KDC offset, use the context global setting.
1658 * @param context A Kerberos 5 context.
1659 * @param id a credential cache
1660 * @param offset the offset in seconds
1662 * @return Return an error code or 0, see krb5_get_error_message().
1664 * @ingroup krb5_ccache
1667 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1668 krb5_cc_set_kdc_offset(krb5_context context
, krb5_ccache id
, krb5_deltat offset
)
1670 if (id
->ops
->set_kdc_offset
== NULL
) {
1671 context
->kdc_sec_offset
= offset
;
1672 context
->kdc_usec_offset
= 0;
1675 return (*id
->ops
->set_kdc_offset
)(context
, id
, offset
);
1679 * Get the time offset betwen the client and the KDC
1681 * If the backend doesn't support KDC offset, use the context global setting.
1683 * @param context A Kerberos 5 context.
1684 * @param id a credential cache
1685 * @param offset the offset in seconds
1687 * @return Return an error code or 0, see krb5_get_error_message().
1689 * @ingroup krb5_ccache
1692 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1693 krb5_cc_get_kdc_offset(krb5_context context
, krb5_ccache id
, krb5_deltat
*offset
)
1695 if (id
->ops
->get_kdc_offset
== NULL
) {
1696 *offset
= context
->kdc_sec_offset
;
1699 return (*id
->ops
->get_kdc_offset
)(context
, id
, offset
);
1706 _krb5_get_default_cc_name_from_registry()
1710 char * ccname
= NULL
;
1712 code
= RegOpenKeyEx(HKEY_CURRENT_USER
,
1713 "Software\\MIT\\Kerberos5",
1714 0, KEY_READ
, &hk_k5
);
1716 if (code
!= ERROR_SUCCESS
)
1719 ccname
= _krb5_parse_reg_value_as_string(NULL
, hk_k5
, "ccname",