2 * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
45 #include <heim_asn1.h>
47 typedef HDB_keyset hdb_keyset
;
48 typedef HDB_entry hdb_entry
;
49 typedef HDB_entry_alias hdb_entry_alias
;
53 enum hdb_lockop
{ HDB_RLOCK
, HDB_WLOCK
};
55 /* flags for various functions */
56 #define HDB_F_DECRYPT 1 /* decrypt keys */
57 #define HDB_F_REPLACE 2 /* replace entry */
58 #define HDB_F_GET_CLIENT 4 /* fetch client */
59 #define HDB_F_GET_SERVER 8 /* fetch server */
60 #define HDB_F_GET_KRBTGT 16 /* fetch krbtgt */
61 #define HDB_F_GET_ANY 28 /* fetch any of client,server,krbtgt */
62 #define HDB_F_CANON 32 /* want canonicalition */
63 #define HDB_F_ADMIN_DATA 64 /* want data that kdc don't use */
64 #define HDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */
65 #define HDB_F_CURRENT_KVNO 256 /* we want the current KVNO */
66 #define HDB_F_LIVE_CLNT_KVNOS 512 /* we want all live keys for pre-auth */
67 #define HDB_F_LIVE_SVC_KVNOS 1024 /* we want all live keys for tix */
68 #define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */
69 #define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */
70 #define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */
71 #define HDB_F_PRECHECK 16384 /* check that the operation would succeed */
72 #define HDB_F_DELAY_NEW_KEYS 32768 /* apply [hdb] new_service_key_delay */
73 #define HDB_F_SYNTHETIC_OK 65536 /* synthetic principal for PKINIT OK */
74 #define HDB_F_GET_FAST_COOKIE 131072 /* fetch the FX-COOKIE key (not a normal principal) */
76 /* hdb_capability_flags */
77 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
78 #define HDB_CAP_F_HANDLE_PASSWORDS 2
79 #define HDB_CAP_F_PASSWORD_UPDATE_KEYS 4
80 #define HDB_CAP_F_SHARED_DIRECTORY 8
82 /* auth status values */
83 #define HDB_AUTH_SUCCESS 0
84 #define HDB_AUTH_WRONG_PASSWORD 1
85 #define HDB_AUTH_INVALID_SIGNATURE 2
87 /* key usage for master key */
88 #define HDB_KU_MKEY 0x484442
91 * Second component of WELLKNOWN namespace principals, the third component is
92 * the common DNS suffix of the implied virtual hosts.
94 #define HDB_WK_NAMESPACE "HOSTBASED-NAMESPACE"
96 typedef struct hdb_master_key_data
*hdb_master_key
;
99 * hdb_entry_ex is a wrapper structure around the hdb_entry structure
100 * that allows backends to keep a pointer to the backing store, ie in
101 * ->hdb_fetch_kvno(), so that we the kadmin/kpasswd backend gets around to
102 * ->hdb_store(), the backend doesn't need to lookup the entry again.
105 typedef struct hdb_entry_ex
{
108 void (*free_entry
)(krb5_context
, struct hdb_entry_ex
*);
113 * HDB backend function pointer structure
115 * The HDB structure is what the KDC and kadmind framework uses to
116 * query the backend database when talking about principals.
121 void *hdb_dbc
; /** don't use, only for DB3 */
122 const char *hdb_method_name
;
124 int hdb_master_key_set
;
125 hdb_master_key hdb_master_key
;
127 int hdb_capability_flags
;
131 * These fields cache config values.
133 * XXX Move these into a structure that we point to so that we
134 * don't need to break the ABI every time we add a field.
136 int enable_virtual_hostbased_princs
;
137 size_t virtual_hostbased_princ_ndots
; /* Min. # of .s in hostname */
138 size_t virtual_hostbased_princ_maxdots
; /* Max. # of .s in namespace */
139 char **virtual_hostbased_princ_svcs
; /* Which svcs are not wildcarded */
140 time_t new_service_key_delay
; /* Delay for new keys */
142 * Open (or create) the a Kerberos database.
144 * Open (or create) the a Kerberos database that was resolved with
145 * hdb_create(). The third and fourth flag to the function are the
146 * same as open(), thus passing O_CREAT will create the data base
147 * if it doesn't exists.
149 * Then done the caller should call hdb_close(), and to release
150 * all resources hdb_destroy().
152 krb5_error_code (*hdb_open
)(krb5_context
, struct HDB
*, int, mode_t
);
154 * Close the database for transaction
156 * Closes the database for further transactions, wont release any
157 * permanant resources. the database can be ->hdb_open-ed again.
159 krb5_error_code (*hdb_close
)(krb5_context
, struct HDB
*);
161 * Free an entry after use.
163 void (*hdb_free
)(krb5_context
, struct HDB
*, hdb_entry_ex
*);
165 * Fetch an entry from the backend
167 * Fetch an entry from the backend, flags are what type of entry
168 * should be fetch: client, server, krbtgt.
169 * knvo (if specified and flags HDB_F_KVNO_SPECIFIED set) is the kvno to get
171 krb5_error_code (*hdb_fetch_kvno
)(krb5_context
, struct HDB
*,
172 krb5_const_principal
, unsigned, krb5_kvno
,
175 * Store an entry to database
177 krb5_error_code (*hdb_store
)(krb5_context
, struct HDB
*,
178 unsigned, hdb_entry_ex
*);
180 * Remove an entry from the database.
182 krb5_error_code (*hdb_remove
)(krb5_context
, struct HDB
*,
183 unsigned, krb5_const_principal
);
185 * As part of iteration, fetch one entry
187 krb5_error_code (*hdb_firstkey
)(krb5_context
, struct HDB
*,
188 unsigned, hdb_entry_ex
*);
190 * As part of iteration, fetch next entry
192 krb5_error_code (*hdb_nextkey
)(krb5_context
, struct HDB
*,
193 unsigned, hdb_entry_ex
*);
197 * A lock can only be held by one consumers. Transaction can still
198 * happen on the database while the lock is held, so the entry is
199 * only useful for syncroning creation of the database and renaming of the database.
201 krb5_error_code (*hdb_lock
)(krb5_context
, struct HDB
*, int);
205 krb5_error_code (*hdb_unlock
)(krb5_context
, struct HDB
*);
207 * Rename the data base.
209 * Assume that the database is not hdb_open'ed and not locked.
211 krb5_error_code (*hdb_rename
)(krb5_context
, struct HDB
*, const char*);
213 * Get an hdb_entry from a classical DB backend
215 * This function takes a principal key (krb5_data) and returns all
216 * data related to principal in the return krb5_data. The returned
217 * encoded entry is of type hdb_entry or hdb_entry_alias.
219 krb5_error_code (*hdb__get
)(krb5_context
, struct HDB
*,
220 krb5_data
, krb5_data
*);
222 * Store an hdb_entry from a classical DB backend
224 * This function takes a principal key (krb5_data) and encoded
225 * hdb_entry or hdb_entry_alias as the data to store.
227 * For a file-based DB, this must synchronize to disk when done.
228 * This is sub-optimal for kadm5_s_rename_principal(), and for
229 * kadm5_s_modify_principal() when using principal aliases; to
230 * improve this so that only one fsync() need be done
231 * per-transaction will require HDB API extensions.
233 krb5_error_code (*hdb__put
)(krb5_context
, struct HDB
*, int,
234 krb5_data
, krb5_data
);
236 * Delete and hdb_entry from a classical DB backend
238 * This function takes a principal key (krb5_data) naming the record
241 * Same discussion as in @ref HDB::hdb__put
243 krb5_error_code (*hdb__del
)(krb5_context
, struct HDB
*, krb5_data
);
245 * Destroy the handle to the database.
247 * Destroy the handle to the database, deallocate all memory and
248 * related resources. Does not remove any permanent data. Its the
249 * logical reverse of hdb_create() function that is the entry
250 * point for the module.
252 krb5_error_code (*hdb_destroy
)(krb5_context
, struct HDB
*);
254 * Get the list of realms this backend handles.
255 * This call is optional to support. The returned realms are used
256 * for announcing the realms over bonjour. Free returned array
257 * with krb5_free_host_realm().
259 krb5_error_code (*hdb_get_realms
)(krb5_context
, struct HDB
*, krb5_realm
**);
263 * Will update keys for the entry when given password. The new
264 * keys must be written into the entry and will then later be
265 * ->hdb_store() into the database. The backend will still perform
266 * all other operations, increasing the kvno, and update
267 * modification timestamp.
269 * The backend needs to call _kadm5_set_keys() and perform password
272 krb5_error_code (*hdb_password
)(krb5_context
, struct HDB
*, hdb_entry_ex
*, const char *, int);
277 * This is a feedback call that allows backends that provides
278 * lockout functionality to register failure and/or successes.
280 * In case the entry is locked out, the backend should set the
281 * hdb_entry.flags.locked-out flag.
283 krb5_error_code (*hdb_auth_status
)(krb5_context
, struct HDB
*, hdb_entry_ex
*, int);
285 * Check if delegation is allowed.
287 krb5_error_code (*hdb_check_constrained_delegation
)(krb5_context
, struct HDB
*, hdb_entry_ex
*, krb5_const_principal
);
290 * Check if this name is an alias for the supplied client for PKINIT userPrinicpalName logins
292 krb5_error_code (*hdb_check_pkinit_ms_upn_match
)(krb5_context
, struct HDB
*, hdb_entry_ex
*, krb5_const_principal
);
295 * Check if s4u2self is allowed from this client to this server
297 krb5_error_code (*hdb_check_s4u2self
)(krb5_context
, struct HDB
*, hdb_entry_ex
*, krb5_const_principal
);
300 * Enable/disable synchronous updates
302 * Calling this with 0 disables sync. Calling it with non-zero enables
303 * sync and does an fsync().
305 krb5_error_code (*hdb_set_sync
)(krb5_context
, struct HDB
*, int);
308 #define HDB_INTERFACE_VERSION 11
312 unsigned int is_file_based
:1;
313 unsigned int can_taste
:1;
314 krb5_error_code (*init
)(krb5_context
, void **);
315 void (*fini
)(void *);
317 krb5_error_code (*create
)(krb5_context
, HDB
**, const char *filename
);
320 /* dump entry format, for hdb_print_entry() */
321 typedef enum hdb_dump_format
{
322 HDB_DUMP_HEIMDAL
= 0,
326 struct hdb_print_entry_arg
{
328 hdb_dump_format_t fmt
;
331 typedef krb5_error_code (*hdb_foreach_func_t
)(krb5_context
, HDB
*,
332 hdb_entry_ex
*, void*);
333 extern krb5_kt_ops hdb_kt_ops
;
334 extern krb5_kt_ops hdb_get_kt_ops
;
336 extern const int hdb_interface_version
;
338 #include <hdb-protos.h>
340 #endif /* __HDB_H__ */