2 * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadm5_locl.h"
39 get_default(kadm5_server_context
*context
, krb5_principal princ
,
40 kadm5_principal_ent_t def
)
43 krb5_principal def_principal
;
44 krb5_const_realm realm
= krb5_principal_get_realm(context
->context
, princ
);
46 ret
= krb5_make_principal(context
->context
, &def_principal
,
47 realm
, "default", NULL
);
50 ret
= kadm5_s_get_principal(context
, def_principal
, def
,
51 KADM5_PRINCIPAL_NORMAL_MASK
);
52 krb5_free_principal (context
->context
, def_principal
);
57 create_principal(kadm5_server_context
*context
,
58 kadm5_principal_ent_t princ
,
61 uint32_t required_mask
,
62 uint32_t forbidden_mask
)
65 kadm5_principal_ent_rec defrec
, *defent
;
68 memset(ent
, 0, sizeof(*ent
));
69 if((mask
& required_mask
) != required_mask
)
70 return KADM5_BAD_MASK
;
71 if((mask
& forbidden_mask
))
72 return KADM5_BAD_MASK
;
73 if((mask
& KADM5_POLICY
) && strcmp(princ
->policy
, "default"))
74 /* XXX no real policies for now */
75 return KADM5_UNK_POLICY
;
76 ret
= krb5_copy_principal(context
->context
, princ
->principal
,
77 &ent
->entry
.principal
);
82 ret
= get_default(context
, princ
->principal
, defent
);
87 def_mask
= KADM5_ATTRIBUTES
| KADM5_MAX_LIFE
| KADM5_MAX_RLIFE
;
90 ret
= _kadm5_setup_entry(context
,
95 kadm5_free_principal_ent(context
, defent
);
99 ent
->entry
.created_by
.time
= time(NULL
);
101 return krb5_copy_principal(context
->context
, context
->caller
,
102 &ent
->entry
.created_by
.principal
);
106 kadm5_s_create_principal_with_key(void *server_handle
,
107 kadm5_principal_ent_t princ
,
112 kadm5_server_context
*context
= server_handle
;
114 if ((mask
& KADM5_KVNO
) == 0) {
115 /* create_principal() through _kadm5_setup_entry(), will need this */
120 ret
= create_principal(context
, princ
, mask
, &ent
,
121 KADM5_PRINCIPAL
| KADM5_KEY_DATA
,
122 KADM5_LAST_PWD_CHANGE
| KADM5_MOD_TIME
123 | KADM5_MOD_NAME
| KADM5_MKVNO
124 | KADM5_AUX_ATTRIBUTES
125 | KADM5_POLICY_CLR
| KADM5_LAST_SUCCESS
126 | KADM5_LAST_FAILED
| KADM5_FAIL_AUTH_COUNT
);
130 if (!context
->keep_open
) {
131 ret
= context
->db
->hdb_open(context
->context
, context
->db
, O_RDWR
, 0);
133 hdb_free_entry(context
->context
, &ent
);
138 ret
= kadm5_log_init(context
);
142 ret
= hdb_seal_keys(context
->context
, context
->db
, &ent
.entry
);
146 /* This logs the change for iprop and writes to the HDB */
147 ret
= kadm5_log_create(context
, &ent
.entry
);
150 (void) kadm5_log_end(context
);
152 if (!context
->keep_open
) {
154 ret2
= context
->db
->hdb_close(context
->context
, context
->db
);
155 if (ret
== 0 && ret2
!= 0)
158 hdb_free_entry(context
->context
, &ent
);
159 return _kadm5_error_code(ret
);
164 kadm5_s_create_principal(void *server_handle
,
165 kadm5_principal_ent_t princ
,
168 krb5_key_salt_tuple
*ks_tuple
,
169 const char *password
)
173 kadm5_server_context
*context
= server_handle
;
175 if ((mask
& KADM5_KVNO
) == 0) {
176 /* create_principal() through _kadm5_setup_entry(), will need this */
181 ret
= create_principal(context
, princ
, mask
, &ent
,
183 KADM5_LAST_PWD_CHANGE
| KADM5_MOD_TIME
184 | KADM5_MOD_NAME
| KADM5_MKVNO
185 | KADM5_AUX_ATTRIBUTES
| KADM5_KEY_DATA
186 | KADM5_POLICY_CLR
| KADM5_LAST_SUCCESS
187 | KADM5_LAST_FAILED
| KADM5_FAIL_AUTH_COUNT
);
191 if (!context
->keep_open
) {
192 ret
= context
->db
->hdb_open(context
->context
, context
->db
, O_RDWR
, 0);
194 hdb_free_entry(context
->context
, &ent
);
199 ret
= kadm5_log_init(context
);
203 ent
.entry
.keys
.len
= 0;
204 ent
.entry
.keys
.val
= NULL
;
206 ret
= _kadm5_set_keys(context
, &ent
.entry
, n_ks_tuple
, ks_tuple
, password
);
210 ret
= hdb_seal_keys(context
->context
, context
->db
, &ent
.entry
);
214 /* This logs the change for iprop and writes to the HDB */
215 ret
= kadm5_log_create(context
, &ent
.entry
);
218 (void) kadm5_log_end(context
);
220 if (!context
->keep_open
) {
222 ret2
= context
->db
->hdb_close(context
->context
, context
->db
);
223 if (ret
== 0 && ret2
!= 0)
226 hdb_free_entry(context
->context
, &ent
);
227 return _kadm5_error_code(ret
);