lib/kadm5/ad.c

   1 /*
   2  * Copyright (c) 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #define HAVE_TSASL 1
  35
  36 #include "kadm5_locl.h"
  37 #if 1
  38 #undef OPENLDAP
  39 #undef HAVE_TSASL
  40 #endif
  41 #ifdef OPENLDAP
  42 #include <ldap.h>
  43 #ifdef HAVE_TSASL
  44 #include <tsasl.h>
  45 #endif
  46 #include <resolve.h>
  47 #include <base64.h>
  48 #endif
  49
  50 RCSID("$Id$");
  51
  52 #ifdef OPENLDAP
  53
  54 #define CTX2LP(context) ((LDAP *)((context)->ldap_conn))
  55 #define CTX2BASE(context) ((context)->base_dn)
  56
  57 /*
  58  * userAccountControl
  59  */
  60
  61 #define UF_SCRIPT                               0x00000001
  62 #define UF_ACCOUNTDISABLE                       0x00000002
  63 #define UF_UNUSED_0                             0x00000004
  64 #define UF_HOMEDIR_REQUIRED                     0x00000008
  65 #define UF_LOCKOUT                              0x00000010
  66 #define UF_PASSWD_NOTREQD                       0x00000020
  67 #define UF_PASSWD_CANT_CHANGE                   0x00000040
  68 #define UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED      0x00000080
  69 #define UF_TEMP_DUPLICATE_ACCOUNT               0x00000100
  70 #define UF_NORMAL_ACCOUNT                       0x00000200
  71 #define UF_UNUSED_1                             0x00000400
  72 #define UF_INTERDOMAIN_TRUST_ACCOUNT            0x00000800
  73 #define UF_WORKSTATION_TRUST_ACCOUNT            0x00001000
  74 #define UF_SERVER_TRUST_ACCOUNT                 0x00002000
  75 #define UF_UNUSED_2                             0x00004000
  76 #define UF_UNUSED_3                             0x00008000
  77 #define UF_PASSWD_NOT_EXPIRE                    0x00010000
  78 #define UF_MNS_LOGON_ACCOUNT                    0x00020000
  79 #define UF_SMARTCARD_REQUIRED                   0x00040000
  80 #define UF_TRUSTED_FOR_DELEGATION               0x00080000
  81 #define UF_NOT_DELEGATED                        0x00100000
  82 #define UF_USE_DES_KEY_ONLY                     0x00200000
  83 #define UF_DONT_REQUIRE_PREAUTH                 0x00400000
  84 #define UF_UNUSED_4                             0x00800000
  85 #define UF_UNUSED_5                             0x01000000
  86 #define UF_UNUSED_6                             0x02000000
  87 #define UF_UNUSED_7                             0x04000000
  88 #define UF_UNUSED_8                             0x08000000
  89 #define UF_UNUSED_9                             0x10000000
  90 #define UF_UNUSED_10                            0x20000000
  91 #define UF_UNUSED_11                            0x40000000
  92 #define UF_UNUSED_12                            0x80000000
  93
  94 /*
  95  *
  96  */
  97
  98 #ifndef HAVE_TSASL
  99 static int
 100 sasl_interact(LDAP *ld, unsigned flags, void *defaults, void *interact)
 101 {
 102     return LDAP_SUCCESS;
 103 }
 104 #endif
 105
 106 #if 0
 107 static Sockbuf_IO ldap_tsasl_io = {
 108     NULL,                       /* sbi_setup */
 109     NULL,                       /* sbi_remove */
 110     NULL,                       /* sbi_ctrl */
 111     NULL,                       /* sbi_read */
 112     NULL,                       /* sbi_write */
 113     NULL                        /* sbi_close */
 114 };
 115 #endif
 116
 117 #ifdef HAVE_TSASL
 118 static int
 119 ldap_tsasl_bind_s(LDAP *ld,
 120                   LDAP_CONST char *dn,
 121                   LDAPControl **serverControls,
 122                   LDAPControl **clientControls,
 123                   const char *host)
 124 {
 125     char *attrs[] = { "supportedSASLMechanisms", NULL };
 126     struct tsasl_peer *peer = NULL;
 127     struct tsasl_buffer in, out;
 128     struct berval ccred, *scred;
 129     LDAPMessage *m, *m0;
 130     const char *mech;
 131     char **vals;
 132     int ret, rc;
 133
 134     ret = tsasl_peer_init(TSASL_FLAGS_INITIATOR | TSASL_FLAGS_CLEAR,
 135                           "ldap", host, &peer);
 136     if (ret != TSASL_DONE) {
 137         rc = LDAP_LOCAL_ERROR;
 138         goto out;
 139     }
 140
 141     rc = ldap_search_s(ld, "", LDAP_SCOPE_BASE, NULL, attrs, 0, &m0);
 142     if (rc != LDAP_SUCCESS)
 143         goto out;
 144
 145     m = ldap_first_entry(ld, m0);
 146     if (m == NULL) {
 147         ldap_msgfree(m0);
 148         goto out;
 149     }
 150
 151     vals = ldap_get_values(ld, m, "supportedSASLMechanisms");
 152     if (vals == NULL) {
 153         ldap_msgfree(m0);
 154         goto out;
 155     }
 156
 157     ret = tsasl_find_best_mech(peer, vals, &mech);
 158     if (ret) {
 159         ldap_msgfree(m0);
 160         goto out;
 161     }
 162
 163     ldap_msgfree(m0);
 164
 165     ret = tsasl_select_mech(peer, mech);
 166     if (ret != TSASL_DONE) {
 167         rc = LDAP_LOCAL_ERROR;
 168         goto out;
 169     }
 170
 171     in.tb_data = NULL;
 172     in.tb_size = 0;
 173
 174     do {
 175         ret = tsasl_request(peer, &in, &out);
 176         if (in.tb_size != 0) {
 177             free(in.tb_data);
 178             in.tb_data = NULL;
 179             in.tb_size = 0;
 180         }
 181         if (ret != TSASL_DONE && ret != TSASL_CONTINUE) {
 182             rc = LDAP_AUTH_UNKNOWN;
 183             goto out;
 184         }
 185
 186         ccred.bv_val = out.tb_data;
 187         ccred.bv_len = out.tb_size;
 188
 189         rc = ldap_sasl_bind_s(ld, dn, mech, &ccred,
 190                               serverControls, clientControls, &scred);
 191         tsasl_buffer_free(&out);
 192
 193         if (rc != LDAP_SUCCESS && rc != LDAP_SASL_BIND_IN_PROGRESS) {
 194             if(scred && scred->bv_len)
 195                 ber_bvfree(scred);
 196             goto out;
 197         }
 198
 199         in.tb_data = malloc(scred->bv_len);
 200         if (in.tb_data == NULL) {
 201             rc = LDAP_LOCAL_ERROR;
 202             goto out;
 203         }
 204         memcpy(in.tb_data, scred->bv_val, scred->bv_len);
 205         in.tb_size = scred->bv_len;
 206         ber_bvfree(scred);
 207
 208     } while (rc == LDAP_SASL_BIND_IN_PROGRESS);
 209
 210  out:
 211     if (rc == LDAP_SUCCESS) {
 212 #if 0
 213         ber_sockbuf_add_io(ld->ld_conns->lconn_sb, &ldap_tsasl_io,
 214                            LBER_SBIOD_LEVEL_APPLICATION, peer);
 215
 216 #endif
 217     } else if (peer != NULL)
 218         tsasl_peer_free(peer);
 219
 220     return rc;
 221 }
 222 #endif /* HAVE_TSASL */
 223
 224
 225 static int
 226 check_ldap(kadm5_ad_context *context, int ret)
 227 {
 228     switch (ret) {
 229     case LDAP_SUCCESS:
 230         return 0;
 231     case LDAP_SERVER_DOWN: {
 232         LDAP *lp = CTX2LP(context);
 233         ldap_unbind(lp);
 234         context->ldap_conn = NULL;
 235         free(context->base_dn);
 236         context->base_dn = NULL;
 237         return 1;
 238     }
 239     default:
 240         return 1;
 241     }
 242 }
 243
 244 /*
 245  *
 246  */
 247
 248 static void
 249 laddattr(char ***al, int *attrlen, char *attr)
 250 {
 251     char **a;
 252     a = realloc(*al, (*attrlen + 2) * sizeof(**al));
 253     if (a == NULL)
 254         return;
 255     a[*attrlen] = attr;
 256     a[*attrlen + 1] = NULL;
 257     (*attrlen)++;
 258     *al = a;
 259 }
 260
 261 static kadm5_ret_t
 262 _kadm5_ad_connect(void *server_handle)
 263 {
 264     kadm5_ad_context *context = server_handle;
 265     struct {
 266         char *server;
 267         int port;
 268     } *s, *servers = NULL;
 269     int i, num_servers = 0;
 270
 271     if (context->ldap_conn)
 272         return 0;
 273
 274     {
 275         struct dns_reply *r;
 276         struct resource_record *rr;
 277         char *domain;
 278
 279         asprintf(&domain, "_ldap._tcp.%s", context->realm);
 280         if (domain == NULL) {
 281             krb5_set_error_message(context->context, KADM5_NO_SRV, "malloc");
 282             return KADM5_NO_SRV;
 283         }
 284
 285         r = dns_lookup(domain, "SRV");
 286         free(domain);
 287         if (r == NULL) {
 288             krb5_set_error_message(context->context, KADM5_NO_SRV, "Didn't find ldap dns");
 289             return KADM5_NO_SRV;
 290         }
 291
 292         for (rr = r->head ; rr != NULL; rr = rr->next) {
 293             if (rr->type != rk_ns_t_srv)
 294                 continue;
 295             s = realloc(servers, sizeof(*servers) * (num_servers + 1));
 296             if (s == NULL) {
 297                 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "malloc");
 298                 dns_free_data(r);
 299                 goto fail;
 300             }
 301             servers = s;
 302             num_servers++;
 303             servers[num_servers - 1].port =  rr->u.srv->port;
 304             servers[num_servers - 1].server =  strdup(rr->u.srv->target);
 305         }
 306         dns_free_data(r);
 307     }
 308
 309     if (num_servers == 0) {
 310         krb5_set_error_message(context->context, KADM5_NO_SRV, "No AD server found in DNS");
 311         return KADM5_NO_SRV;
 312     }
 313
 314     for (i = 0; i < num_servers; i++) {
 315         int lret, version = LDAP_VERSION3;
 316         LDAP *lp;
 317
 318         lp = ldap_init(servers[i].server, servers[i].port);
 319         if (lp == NULL)
 320             continue;
 321
 322         if (ldap_set_option(lp, LDAP_OPT_PROTOCOL_VERSION, &version)) {
 323             ldap_unbind(lp);
 324             continue;
 325         }
 326
 327         if (ldap_set_option(lp, LDAP_OPT_REFERRALS, LDAP_OPT_OFF)) {
 328             ldap_unbind(lp);
 329             continue;
 330         }
 331
 332 #ifdef HAVE_TSASL
 333         lret = ldap_tsasl_bind_s(lp, NULL, NULL, NULL, servers[i].server);
 334
 335 #else
 336         lret = ldap_sasl_interactive_bind_s(lp, NULL, NULL, NULL, NULL,
 337                                             LDAP_SASL_QUIET,
 338                                             sasl_interact, NULL);
 339 #endif
 340         if (lret != LDAP_SUCCESS) {
 341             krb5_set_error_message(context->context, 0,
 342                                    "Couldn't contact any AD servers: %s",
 343                                    ldap_err2string(lret));
 344             ldap_unbind(lp);
 345             continue;
 346         }
 347
 348         context->ldap_conn = lp;
 349         break;
 350     }
 351     if (i >= num_servers) {
 352         goto fail;
 353     }
 354
 355     {
 356         LDAPMessage *m, *m0;
 357         char **attr = NULL;
 358         int attrlen = 0;
 359         char **vals;
 360         int ret;
 361
 362         laddattr(&attr, &attrlen, "defaultNamingContext");
 363
 364         ret = ldap_search_s(CTX2LP(context), "", LDAP_SCOPE_BASE,
 365                             "objectclass=*", attr, 0, &m);
 366         free(attr);
 367         if (check_ldap(context, ret))
 368             goto fail;
 369
 370         if (ldap_count_entries(CTX2LP(context), m) > 0) {
 371             m0 = ldap_first_entry(CTX2LP(context), m);
 372             if (m0 == NULL) {
 373                 krb5_set_error_message(context->context, KADM5_RPC_ERROR,
 374                                        "Error in AD ldap responce");
 375                 ldap_msgfree(m);
 376                 goto fail;
 377             }
 378             vals = ldap_get_values(CTX2LP(context),
 379                                    m0, "defaultNamingContext");
 380             if (vals == NULL) {
 381                 krb5_set_error_message(context->context, KADM5_RPC_ERROR,
 382                                        "No naming context found");
 383                 goto fail;
 384             }
 385             context->base_dn = strdup(vals[0]);
 386         } else
 387             goto fail;
 388         ldap_msgfree(m);
 389     }
 390
 391     for (i = 0; i < num_servers; i++)
 392         free(servers[i].server);
 393     free(servers);
 394
 395     return 0;
 396
 397  fail:
 398     for (i = 0; i < num_servers; i++)
 399         free(servers[i].server);
 400     free(servers);
 401
 402     if (context->ldap_conn) {
 403         ldap_unbind(CTX2LP(context));
 404         context->ldap_conn = NULL;
 405     }
 406     return KADM5_RPC_ERROR;
 407 }
 408
 409 #define NTTIME_EPOCH 0x019DB1DED53E8000LL
 410
 411 static time_t
 412 nt2unixtime(const char *str)
 413 {
 414     unsigned long long t;
 415     t = strtoll(str, NULL, 10);
 416     t = ((t - NTTIME_EPOCH) / (long long)10000000);
 417     if (t > (((time_t)(~(long long)0)) >> 1))
 418         return 0;
 419     return (time_t)t;
 420 }
 421
 422 static long long
 423 unix2nttime(time_t unix_time)
 424 {
 425     long long wt;
 426     wt = unix_time * (long long)10000000 + (long long)NTTIME_EPOCH;
 427     return wt;
 428 }
 429
 430 /* XXX create filter in a better way */
 431
 432 static int
 433 ad_find_entry(kadm5_ad_context *context,
 434               const char *fqdn,
 435               const char *pn,
 436               char **name)
 437 {
 438     LDAPMessage *m, *m0;
 439     char *attr[] = { "distinguishedName", NULL };
 440     char *filter;
 441     int ret;
 442
 443     if (name)
 444         *name = NULL;
 445
 446     if (fqdn)
 447         asprintf(&filter,
 448                  "(&(objectClass=computer)(|(dNSHostName=%s)(servicePrincipalName=%s)))",
 449                  fqdn, pn);
 450     else if(pn)
 451         asprintf(&filter, "(&(objectClass=account)(userPrincipalName=%s))", pn);
 452     else
 453         return KADM5_RPC_ERROR;
 454
 455     ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
 456                         LDAP_SCOPE_SUBTREE,
 457                         filter, attr, 0, &m);
 458     free(filter);
 459     if (check_ldap(context, ret))
 460         return KADM5_RPC_ERROR;
 461
 462     if (ldap_count_entries(CTX2LP(context), m) > 0) {
 463         char **vals;
 464         m0 = ldap_first_entry(CTX2LP(context), m);
 465         vals = ldap_get_values(CTX2LP(context), m0, "distinguishedName");
 466         if (vals == NULL || vals[0] == NULL) {
 467             ldap_msgfree(m);
 468             return KADM5_RPC_ERROR;
 469         }
 470         if (name)
 471             *name = strdup(vals[0]);
 472         ldap_msgfree(m);
 473     } else
 474         return KADM5_UNK_PRINC;
 475
 476     return 0;
 477 }
 478
 479 #endif /* OPENLDAP */
 480
 481 static kadm5_ret_t
 482 ad_get_cred(kadm5_ad_context *context, const char *password)
 483 {
 484     kadm5_ret_t ret;
 485     krb5_ccache cc;
 486     char *service;
 487     int aret;
 488
 489     if (context->ccache)
 490         return 0;
 491
 492     aret = asprintf(&service, "%s/%s@%s", KRB5_TGS_NAME,
 493                     context->realm, context->realm);
 494     if (aret == -1 || service == NULL)
 495         return krb5_enomem(context->context);
 496
 497     ret = _kadm5_c_get_cred_cache(context->context,
 498                                   context->client_name,
 499                                   service,
 500                                   password, krb5_prompter_posix,
 501                                   NULL, NULL, &cc);
 502     free(service);
 503     if(ret)
 504         return ret; /* XXX */
 505     context->ccache = cc;
 506     return 0;
 507 }
 508
 509 static kadm5_ret_t
 510 kadm5_ad_chpass_principal(void *server_handle,
 511                           krb5_principal principal,
 512                           int keepold,
 513                           int n_ks_tuple,
 514                           krb5_key_salt_tuple *ks_tuple,
 515                           const char *password)
 516 {
 517     kadm5_ad_context *context = server_handle;
 518     krb5_data result_code_string, result_string;
 519     int result_code;
 520     kadm5_ret_t ret;
 521
 522     if (keepold)
 523         return KADM5_KEEPOLD_NOSUPP;
 524
 525     if (n_ks_tuple > 0)
 526        return KADM5_KS_TUPLE_NOSUPP;
 527
 528     ret = ad_get_cred(context, NULL);
 529     if (ret)
 530         return ret;
 531
 532     krb5_data_zero (&result_code_string);
 533     krb5_data_zero (&result_string);
 534
 535     ret = krb5_set_password_using_ccache (context->context,
 536                                           context->ccache,
 537                                           password,
 538                                           principal,
 539                                           &result_code,
 540                                           &result_code_string,
 541                                           &result_string);
 542
 543     krb5_data_free (&result_code_string);
 544     krb5_data_free (&result_string);
 545
 546     /* XXX do mapping here on error codes */
 547
 548     return ret;
 549 }
 550
 551 #ifdef OPENLDAP
 552 static const char *
 553 get_fqdn(krb5_context context, const krb5_principal p)
 554 {
 555     const char *s, *hosttypes[] = { "host", "ldap", "gc", "cifs", "dns" };
 556     int i;
 557
 558     s = krb5_principal_get_comp_string(context, p, 0);
 559     if (p == NULL)
 560         return NULL;
 561
 562     for (i = 0; i < sizeof(hosttypes)/sizeof(hosttypes[0]); i++) {
 563         if (strcasecmp(s, hosttypes[i]) == 0)
 564             return krb5_principal_get_comp_string(context, p, 1);
 565     }
 566     return 0;
 567 }
 568 #endif
 569
 570
 571 static kadm5_ret_t
 572 kadm5_ad_create_principal(void *server_handle,
 573                           kadm5_principal_ent_t entry,
 574                           uint32_t mask,
 575                           int n_ks_tuple,
 576                           krb5_key_salt_tuple *ks_tuple,
 577                           const char *password)
 578 {
 579     kadm5_ad_context *context = server_handle;
 580
 581     /*
 582      * KADM5_PRINC_EXPIRE_TIME
 583      *
 584      * return 0 || KADM5_DUP;
 585      */
 586
 587 #ifdef OPENLDAP
 588     LDAPMod *attrs[8], rattrs[7], *a;
 589     char *useraccvals[2] = { NULL, NULL },
 590         *samvals[2], *dnsvals[2], *spnvals[5], *upnvals[2], *tv[2];
 591     char *ocvals_spn[] = { "top", "person", "organizationalPerson",
 592                            "user", "computer", NULL};
 593     char *p, *realmless_p, *p_msrealm = NULL, *dn = NULL;
 594     const char *fqdn;
 595     char *s, *samname = NULL, *short_spn = NULL;
 596     int ret, i;
 597     int32_t uf_flags = 0;
 598
 599     if ((mask & KADM5_PRINCIPAL) == 0)
 600         return KADM5_BAD_MASK;
 601
 602     /*
 603      * We should get around to implementing this...  At the moment, the
 604      * the server side API is implemented but the wire protocol has not
 605      * been updated.
 606      */
 607     if (n_ks_tuple > 0)
 608        return KADM5_KS_TUPLE_NOSUPP;
 609
 610     for (i = 0; i < sizeof(rattrs)/sizeof(rattrs[0]); i++)
 611         attrs[i] = &rattrs[i];
 612     attrs[i] = NULL;
 613
 614     ret = ad_get_cred(context, NULL);
 615     if (ret)
 616         return ret;
 617
 618     ret = _kadm5_ad_connect(server_handle);
 619     if (ret)
 620         return ret;
 621
 622     fqdn = get_fqdn(context->context, entry->principal);
 623
 624     ret = krb5_unparse_name(context->context, entry->principal, &p);
 625     if (ret)
 626         return ret;
 627
 628     if (ad_find_entry(context, fqdn, p, NULL) == 0) {
 629         free(p);
 630         return KADM5_DUP;
 631     }
 632
 633     if (mask & KADM5_ATTRIBUTES) {
 634         if (entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)
 635             uf_flags |= UF_ACCOUNTDISABLE|UF_LOCKOUT;
 636         if ((entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH) == 0)
 637             uf_flags |= UF_DONT_REQUIRE_PREAUTH;
 638         if (entry->attributes & KRB5_KDB_REQUIRES_HW_AUTH)
 639             uf_flags |= UF_SMARTCARD_REQUIRED;
 640     }
 641
 642     realmless_p = strdup(p);
 643     if (realmless_p == NULL) {
 644         ret = krb5_enomem(context->context);
 645         goto out;
 646     }
 647     s = strrchr(realmless_p, '@');
 648     if (s)
 649         *s = '\0';
 650
 651     if (fqdn) {
 652         /* create computer account */
 653         asprintf(&samname, "%s$", fqdn);
 654         if (samname == NULL) {
 655             ret = krb5_enomem(context->context);
 656             goto out;
 657         }
 658         s = strchr(samname, '.');
 659         if (s) {
 660             s[0] = '$';
 661             s[1] = '\0';
 662         }
 663
 664         short_spn = strdup(p);
 665         if (short_spn == NULL) {
 666             ret = krb5_enomem(context->context);
 667             goto out;
 668         }
 669         s = strchr(short_spn, '.');
 670         if (s) {
 671             *s = '\0';
 672         } else {
 673             free(short_spn);
 674             short_spn = NULL;
 675         }
 676
 677         p_msrealm = strdup(p);
 678         if (p_msrealm == NULL) {
 679             ret = krb5_enomem(context->context);
 680             goto out;
 681         }
 682         s = strrchr(p_msrealm, '@');
 683         if (s) {
 684             *s = '/';
 685         } else {
 686             free(p_msrealm);
 687             p_msrealm = NULL;
 688         }
 689
 690         asprintf(&dn, "cn=%s, cn=Computers, %s", fqdn, CTX2BASE(context));
 691         if (dn == NULL) {
 692             ret = krb5_enomem(context->context);
 693             goto out;
 694         }
 695
 696         a = &rattrs[0];
 697         a->mod_op = LDAP_MOD_ADD;
 698         a->mod_type = "objectClass";
 699         a->mod_values = ocvals_spn;
 700         a++;
 701
 702         a->mod_op = LDAP_MOD_ADD;
 703         a->mod_type = "userAccountControl";
 704         a->mod_values = useraccvals;
 705         asprintf(&useraccvals[0], "%d",
 706                  uf_flags |
 707                  UF_PASSWD_NOT_EXPIRE |
 708                  UF_WORKSTATION_TRUST_ACCOUNT);
 709         useraccvals[1] = NULL;
 710         a++;
 711
 712         a->mod_op = LDAP_MOD_ADD;
 713         a->mod_type = "sAMAccountName";
 714         a->mod_values = samvals;
 715         samvals[0] = samname;
 716         samvals[1] = NULL;
 717         a++;
 718
 719         a->mod_op = LDAP_MOD_ADD;
 720         a->mod_type = "dNSHostName";
 721         a->mod_values = dnsvals;
 722         dnsvals[0] = (char *)fqdn;
 723         dnsvals[1] = NULL;
 724         a++;
 725
 726         /* XXX  add even more spn's */
 727         a->mod_op = LDAP_MOD_ADD;
 728         a->mod_type = "servicePrincipalName";
 729         a->mod_values = spnvals;
 730         i = 0;
 731         spnvals[i++] = p;
 732         spnvals[i++] = realmless_p;
 733         if (short_spn)
 734             spnvals[i++] = short_spn;
 735         if (p_msrealm)
 736             spnvals[i++] = p_msrealm;
 737         spnvals[i++] = NULL;
 738         a++;
 739
 740         a->mod_op = LDAP_MOD_ADD;
 741         a->mod_type = "userPrincipalName";
 742         a->mod_values = upnvals;
 743         upnvals[0] = p;
 744         upnvals[1] = NULL;
 745         a++;
 746
 747         a->mod_op = LDAP_MOD_ADD;
 748         a->mod_type = "accountExpires";
 749         a->mod_values = tv;
 750         tv[0] = "9223372036854775807"; /* "never" */
 751         tv[1] = NULL;
 752         a++;
 753
 754     } else {
 755         /* create user account */
 756
 757         a = &rattrs[0];
 758         a->mod_op = LDAP_MOD_ADD;
 759         a->mod_type = "userAccountControl";
 760         a->mod_values = useraccvals;
 761         asprintf(&useraccvals[0], "%d",
 762                  uf_flags |
 763                  UF_PASSWD_NOT_EXPIRE);
 764         useraccvals[1] = NULL;
 765         a++;
 766
 767         a->mod_op = LDAP_MOD_ADD;
 768         a->mod_type = "sAMAccountName";
 769         a->mod_values = samvals;
 770         samvals[0] = realmless_p;
 771         samvals[1] = NULL;
 772         a++;
 773
 774         a->mod_op = LDAP_MOD_ADD;
 775         a->mod_type = "userPrincipalName";
 776         a->mod_values = upnvals;
 777         upnvals[0] = p;
 778         upnvals[1] = NULL;
 779         a++;
 780
 781         a->mod_op = LDAP_MOD_ADD;
 782         a->mod_type = "accountExpires";
 783         a->mod_values = tv;
 784         tv[0] = "9223372036854775807"; /* "never" */
 785         tv[1] = NULL;
 786         a++;
 787     }
 788
 789     attrs[a - &rattrs[0]] = NULL;
 790
 791     ret = ldap_add_s(CTX2LP(context), dn, attrs);
 792
 793  out:
 794     if (useraccvals[0])
 795         free(useraccvals[0]);
 796     if (realmless_p)
 797         free(realmless_p);
 798     if (samname)
 799         free(samname);
 800     if (short_spn)
 801         free(short_spn);
 802     if (p_msrealm)
 803         free(p_msrealm);
 804     free(p);
 805
 806     if (check_ldap(context, ret))
 807         return KADM5_RPC_ERROR;
 808
 809     return 0;
 810 #else
 811     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
 812     return KADM5_RPC_ERROR;
 813 #endif
 814 }
 815
 816 static kadm5_ret_t
 817 kadm5_ad_delete_principal(void *server_handle, krb5_principal principal)
 818 {
 819     kadm5_ad_context *context = server_handle;
 820 #ifdef OPENLDAP
 821     char *p, *dn = NULL;
 822     const char *fqdn;
 823     int ret;
 824
 825     ret = ad_get_cred(context, NULL);
 826     if (ret)
 827         return ret;
 828
 829     ret = _kadm5_ad_connect(server_handle);
 830     if (ret)
 831         return ret;
 832
 833     fqdn = get_fqdn(context->context, principal);
 834
 835     ret = krb5_unparse_name(context->context, principal, &p);
 836     if (ret)
 837         return ret;
 838
 839     if (ad_find_entry(context, fqdn, p, &dn) != 0) {
 840         free(p);
 841         return KADM5_UNK_PRINC;
 842     }
 843
 844     ret = ldap_delete_s(CTX2LP(context), dn);
 845
 846     free(dn);
 847     free(p);
 848
 849     if (check_ldap(context, ret))
 850         return KADM5_RPC_ERROR;
 851     return 0;
 852 #else
 853     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
 854     return KADM5_RPC_ERROR;
 855 #endif
 856 }
 857
 858 static kadm5_ret_t
 859 kadm5_ad_destroy(void *server_handle)
 860 {
 861     kadm5_ad_context *context = server_handle;
 862
 863     if (context->ccache)
 864         krb5_cc_destroy(context->context, context->ccache);
 865
 866 #ifdef OPENLDAP
 867     {
 868         LDAP *lp = CTX2LP(context);
 869         if (lp)
 870             ldap_unbind(lp);
 871         if (context->base_dn)
 872             free(context->base_dn);
 873     }
 874 #endif
 875     free(context->realm);
 876     free(context->client_name);
 877     krb5_free_principal(context->context, context->caller);
 878     if(context->my_context)
 879         krb5_free_context(context->context);
 880     return 0;
 881 }
 882
 883 static kadm5_ret_t
 884 kadm5_ad_flush(void *server_handle)
 885 {
 886     kadm5_ad_context *context = server_handle;
 887     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
 888     return KADM5_RPC_ERROR;
 889 }
 890
 891 static kadm5_ret_t
 892 kadm5_ad_get_principal(void *server_handle,
 893                        krb5_principal principal,
 894                        kadm5_principal_ent_t entry,
 895                        uint32_t mask)
 896 {
 897     kadm5_ad_context *context = server_handle;
 898 #ifdef OPENLDAP
 899     LDAPMessage *m, *m0;
 900     char **attr = NULL;
 901     int attrlen = 0;
 902     char *filter, *p, *q, *u;
 903     int ret;
 904
 905     /*
 906      * principal
 907      * KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES
 908      */
 909
 910     /*
 911      * return 0 || KADM5_DUP;
 912      */
 913
 914     memset(entry, 0, sizeof(*entry));
 915
 916     if (mask & KADM5_KVNO)
 917         laddattr(&attr, &attrlen, "msDS-KeyVersionNumber");
 918
 919     if (mask & KADM5_PRINCIPAL) {
 920         laddattr(&attr, &attrlen, "userPrincipalName");
 921         laddattr(&attr, &attrlen, "servicePrincipalName");
 922     }
 923     laddattr(&attr, &attrlen, "objectClass");
 924     laddattr(&attr, &attrlen, "lastLogon");
 925     laddattr(&attr, &attrlen, "badPwdCount");
 926     laddattr(&attr, &attrlen, "badPasswordTime");
 927     laddattr(&attr, &attrlen, "pwdLastSet");
 928     laddattr(&attr, &attrlen, "accountExpires");
 929     laddattr(&attr, &attrlen, "userAccountControl");
 930
 931     krb5_unparse_name_short(context->context, principal, &p);
 932     krb5_unparse_name(context->context, principal, &u);
 933
 934     /* replace @ in domain part with a / */
 935     q = strrchr(p, '@');
 936     if (q && (p != q && *(q - 1) != '\\'))
 937         *q = '/';
 938
 939     asprintf(&filter,
 940              "(|(userPrincipalName=%s)(servicePrincipalName=%s)(servicePrincipalName=%s))",
 941              u, p, u);
 942     free(p);
 943     free(u);
 944
 945     ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
 946                         LDAP_SCOPE_SUBTREE,
 947                         filter, attr, 0, &m);
 948     free(attr);
 949     if (check_ldap(context, ret))
 950         return KADM5_RPC_ERROR;
 951
 952     if (ldap_count_entries(CTX2LP(context), m) > 0) {
 953         char **vals;
 954         m0 = ldap_first_entry(CTX2LP(context), m);
 955         if (m0 == NULL) {
 956             ldap_msgfree(m);
 957             goto fail;
 958         }
 959 #if 0
 960         vals = ldap_get_values(CTX2LP(context), m0, "servicePrincipalName");
 961         if (vals)
 962             printf("servicePrincipalName %s\n", vals[0]);
 963         vals = ldap_get_values(CTX2LP(context), m0, "userPrincipalName");
 964         if (vals)
 965             printf("userPrincipalName %s\n", vals[0]);
 966         vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
 967         if (vals)
 968             printf("userAccountControl %s\n", vals[0]);
 969 #endif
 970         entry->princ_expire_time = 0;
 971         if (mask & KADM5_PRINC_EXPIRE_TIME) {
 972             vals = ldap_get_values(CTX2LP(context), m0, "accountExpires");
 973             if (vals)
 974                 entry->princ_expire_time = nt2unixtime(vals[0]);
 975         }
 976         entry->last_success = 0;
 977         if (mask & KADM5_LAST_SUCCESS) {
 978             vals = ldap_get_values(CTX2LP(context), m0, "lastLogon");
 979             if (vals)
 980                 entry->last_success = nt2unixtime(vals[0]);
 981         }
 982         if (mask & KADM5_LAST_FAILED) {
 983             vals = ldap_get_values(CTX2LP(context), m0, "badPasswordTime");
 984             if (vals)
 985                 entry->last_failed = nt2unixtime(vals[0]);
 986         }
 987         if (mask & KADM5_LAST_PWD_CHANGE) {
 988             vals = ldap_get_values(CTX2LP(context), m0, "pwdLastSet");
 989             if (vals)
 990                 entry->last_pwd_change = nt2unixtime(vals[0]);
 991         }
 992         if (mask & KADM5_FAIL_AUTH_COUNT) {
 993             vals = ldap_get_values(CTX2LP(context), m0, "badPwdCount");
 994             if (vals)
 995                 entry->fail_auth_count = atoi(vals[0]);
 996         }
 997         if (mask & KADM5_ATTRIBUTES) {
 998             vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
 999             if (vals) {
1000                 uint32_t i;
1001                 i = atoi(vals[0]);
1002                 if (i & (UF_ACCOUNTDISABLE|UF_LOCKOUT))
1003                     entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
1004                 if ((i & UF_DONT_REQUIRE_PREAUTH) == 0)
1005                     entry->attributes |= KRB5_KDB_REQUIRES_PRE_AUTH;
1006                 if (i & UF_SMARTCARD_REQUIRED)
1007                     entry->attributes |= KRB5_KDB_REQUIRES_HW_AUTH;
1008                 if ((i & UF_WORKSTATION_TRUST_ACCOUNT) == 0)
1009                     entry->attributes |= KRB5_KDB_DISALLOW_SVR;
1010             }
1011         }
1012         if (mask & KADM5_KVNO) {
1013             vals = ldap_get_values(CTX2LP(context), m0,
1014                                    "msDS-KeyVersionNumber");
1015             if (vals)
1016                 entry->kvno = atoi(vals[0]);
1017             else
1018                 entry->kvno = 0;
1019         }
1020         ldap_msgfree(m);
1021     } else {
1022         return KADM5_UNK_PRINC;
1023     }
1024
1025     if (mask & KADM5_PRINCIPAL)
1026         krb5_copy_principal(context->context, principal, &entry->principal);
1027
1028     return 0;
1029  fail:
1030     return KADM5_RPC_ERROR;
1031 #else
1032     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1033     return KADM5_RPC_ERROR;
1034 #endif
1035 }
1036
1037 static kadm5_ret_t
1038 kadm5_ad_get_principals(void *server_handle,
1039                         const char *expression,
1040                         char ***principals,
1041                         int *count)
1042 {
1043     kadm5_ad_context *context = server_handle;
1044
1045     /*
1046      * KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES
1047      */
1048
1049 #ifdef OPENLDAP
1050     kadm5_ret_t ret;
1051
1052     ret = ad_get_cred(context, NULL);
1053     if (ret)
1054         return ret;
1055
1056     ret = _kadm5_ad_connect(server_handle);
1057     if (ret)
1058         return ret;
1059
1060     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1061     return KADM5_RPC_ERROR;
1062 #else
1063     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1064     return KADM5_RPC_ERROR;
1065 #endif
1066 }
1067
1068 static kadm5_ret_t
1069 kadm5_ad_iter_principals(void *server_handle,
1070                          const char *expression,
1071                          int (*cb)(void *, const char *),
1072                          void *cbdata)
1073 {
1074     kadm5_ad_context *context = server_handle;
1075
1076 #ifdef OPENLDAP
1077     kadm5_ret_t ret;
1078
1079     ret = ad_get_cred(context, NULL);
1080     if (ret)
1081         return ret;
1082
1083     ret = _kadm5_ad_connect(server_handle);
1084     if (ret)
1085         return ret;
1086
1087     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1088     return KADM5_RPC_ERROR;
1089 #else
1090     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1091     return KADM5_RPC_ERROR;
1092 #endif
1093 }
1094
1095 static kadm5_ret_t
1096 kadm5_ad_get_privs(void *server_handle, uint32_t*privs)
1097 {
1098     kadm5_ad_context *context = server_handle;
1099     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1100     return KADM5_RPC_ERROR;
1101 }
1102
1103 static kadm5_ret_t
1104 kadm5_ad_modify_principal(void *server_handle,
1105                           kadm5_principal_ent_t entry,
1106                           uint32_t mask)
1107 {
1108     kadm5_ad_context *context = server_handle;
1109
1110     /*
1111      * KADM5_ATTRIBUTES
1112      * KRB5_KDB_DISALLOW_ALL_TIX (| KADM5_KVNO)
1113      */
1114
1115 #ifdef OPENLDAP
1116     LDAPMessage *m = NULL, *m0;
1117     kadm5_ret_t ret;
1118     char **attr = NULL;
1119     int attrlen = 0;
1120     char *p = NULL, *s = NULL, *q;
1121     char **vals;
1122     LDAPMod *attrs[4], rattrs[3], *a;
1123     char *uaf[2] = { NULL, NULL };
1124     char *kvno[2] = { NULL, NULL };
1125     char *tv[2] = { NULL, NULL };
1126     char *filter, *dn;
1127     int i;
1128
1129     for (i = 0; i < sizeof(rattrs)/sizeof(rattrs[0]); i++)
1130         attrs[i] = &rattrs[i];
1131     attrs[i] = NULL;
1132     a = &rattrs[0];
1133
1134     ret = _kadm5_ad_connect(server_handle);
1135     if (ret)
1136         return ret;
1137
1138     if (mask & KADM5_KVNO)
1139         laddattr(&attr, &attrlen, "msDS-KeyVersionNumber");
1140     if (mask & KADM5_PRINC_EXPIRE_TIME)
1141         laddattr(&attr, &attrlen, "accountExpires");
1142     if (mask & KADM5_ATTRIBUTES)
1143         laddattr(&attr, &attrlen, "userAccountControl");
1144     laddattr(&attr, &attrlen, "distinguishedName");
1145
1146     krb5_unparse_name(context->context, entry->principal, &p);
1147
1148     s = strdup(p);
1149
1150     q = strrchr(s, '@');
1151     if (q && (p != q && *(q - 1) != '\\'))
1152         *q = '\0';
1153
1154     asprintf(&filter,
1155              "(|(userPrincipalName=%s)(servicePrincipalName=%s))",
1156              s, s);
1157     free(p);
1158     free(s);
1159
1160     ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
1161                         LDAP_SCOPE_SUBTREE,
1162                         filter, attr, 0, &m);
1163     free(attr);
1164     free(filter);
1165     if (check_ldap(context, ret))
1166         return KADM5_RPC_ERROR;
1167
1168     if (ldap_count_entries(CTX2LP(context), m) <= 0) {
1169         ret = KADM5_RPC_ERROR;
1170         goto out;
1171     }
1172
1173     m0 = ldap_first_entry(CTX2LP(context), m);
1174
1175     if (mask & KADM5_ATTRIBUTES) {
1176         int32_t i;
1177
1178         vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
1179         if (vals == NULL) {
1180             ret = KADM5_RPC_ERROR;
1181             goto out;
1182         }
1183
1184         i = atoi(vals[0]);
1185         if (i == 0)
1186             return KADM5_RPC_ERROR;
1187
1188         if (entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)
1189             i |= (UF_ACCOUNTDISABLE|UF_LOCKOUT);
1190         else
1191             i &= ~(UF_ACCOUNTDISABLE|UF_LOCKOUT);
1192         if (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)
1193             i &= ~UF_DONT_REQUIRE_PREAUTH;
1194         else
1195             i |= UF_DONT_REQUIRE_PREAUTH;
1196         if (entry->attributes & KRB5_KDB_REQUIRES_HW_AUTH)
1197             i |= UF_SMARTCARD_REQUIRED;
1198         else
1199             i &= ~UF_SMARTCARD_REQUIRED;
1200         if (entry->attributes & KRB5_KDB_DISALLOW_SVR)
1201             i &= ~UF_WORKSTATION_TRUST_ACCOUNT;
1202         else
1203             i |= UF_WORKSTATION_TRUST_ACCOUNT;
1204
1205         asprintf(&uaf[0], "%d", i);
1206
1207         a->mod_op = LDAP_MOD_REPLACE;
1208         a->mod_type = "userAccountControl";
1209         a->mod_values = uaf;
1210         a++;
1211     }
1212
1213     if (mask & KADM5_KVNO) {
1214         vals = ldap_get_values(CTX2LP(context), m0, "msDS-KeyVersionNumber");
1215         if (vals == NULL) {
1216             entry->kvno = 0;
1217         } else {
1218             asprintf(&kvno[0], "%d", entry->kvno);
1219
1220             a->mod_op = LDAP_MOD_REPLACE;
1221             a->mod_type = "msDS-KeyVersionNumber";
1222             a->mod_values = kvno;
1223             a++;
1224         }
1225     }
1226
1227     if (mask & KADM5_PRINC_EXPIRE_TIME) {
1228         long long wt;
1229         vals = ldap_get_values(CTX2LP(context), m0, "accountExpires");
1230         if (vals == NULL) {
1231             ret = KADM5_RPC_ERROR;
1232             goto out;
1233         }
1234
1235         wt = unix2nttime(entry->princ_expire_time);
1236
1237         asprintf(&tv[0], "%llu", wt);
1238
1239         a->mod_op = LDAP_MOD_REPLACE;
1240         a->mod_type = "accountExpires";
1241         a->mod_values = tv;
1242         a++;
1243     }
1244
1245     vals = ldap_get_values(CTX2LP(context), m0, "distinguishedName");
1246     if (vals == NULL) {
1247         ret = KADM5_RPC_ERROR;
1248         goto out;
1249     }
1250     dn = vals[0];
1251
1252     attrs[a - &rattrs[0]] = NULL;
1253
1254     ret = ldap_modify_s(CTX2LP(context), dn, attrs);
1255     if (check_ldap(context, ret))
1256         return KADM5_RPC_ERROR;
1257
1258  out:
1259     if (m)
1260         ldap_msgfree(m);
1261     if (uaf[0])
1262         free(uaf[0]);
1263     if (kvno[0])
1264         free(kvno[0]);
1265     if (tv[0])
1266         free(tv[0]);
1267     return ret;
1268 #else
1269     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1270     return KADM5_RPC_ERROR;
1271 #endif
1272 }
1273
1274 /*ARGSUSED*/
1275 static kadm5_ret_t
1276 kadm5_ad_randkey_principal(void *server_handle,
1277                            krb5_principal principal,
1278                            krb5_boolean keepold,
1279                            int n_ks_tuple,
1280                            krb5_key_salt_tuple *ks_tuple,
1281                            krb5_keyblock **keys,
1282                            int *n_keys)
1283 {
1284     kadm5_ad_context *context = server_handle;
1285
1286     if (keepold)
1287         return KADM5_KEEPOLD_NOSUPP;
1288
1289     /*
1290      * random key
1291      */
1292
1293 #ifdef OPENLDAP
1294     krb5_data result_code_string, result_string;
1295     int result_code, plen;
1296     kadm5_ret_t ret;
1297     char *password;
1298
1299     *keys = NULL;
1300     *n_keys = 0;
1301
1302     {
1303         char p[64];
1304         krb5_generate_random_block(p, sizeof(p));
1305         plen = rk_base64_encode(p, sizeof(p), &password);
1306         if (plen < 0)
1307             return krb5_enomem(context->context);
1308     }
1309
1310     ret = ad_get_cred(context, NULL);
1311     if (ret) {
1312         free(password);
1313         return ret;
1314     }
1315
1316     krb5_data_zero(&result_code_string);
1317     krb5_data_zero(&result_string);
1318
1319     ret = krb5_set_password_using_ccache(context->context,
1320                                          context->ccache,
1321                                          password,
1322                                          principal,
1323                                          &result_code,
1324                                          &result_code_string,
1325                                          &result_string);
1326     krb5_data_free(&result_code_string);
1327     krb5_data_free(&result_string);
1328
1329     if (ret)
1330         goto out;
1331
1332     *keys = malloc(sizeof(**keys) * 1);
1333     if (*keys == NULL) {
1334         ret = krb5_enomem(context->context);
1335         goto out;
1336     }
1337     *n_keys = 1;
1338
1339     ret = krb5_string_to_key(context->context,
1340                              ENCTYPE_ARCFOUR_HMAC_MD5,
1341                              password,
1342                              principal,
1343                              &(*keys)[0]);
1344     if (ret) {
1345         free(*keys);
1346         *keys = NULL;
1347         *n_keys = 0;
1348         goto out;
1349     }
1350
1351  out:
1352     memset(password, 0, plen);
1353     free(password);
1354     return ret;
1355 #else
1356     *keys = NULL;
1357     *n_keys = 0;
1358
1359     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1360     return KADM5_RPC_ERROR;
1361 #endif
1362 }
1363
1364 static kadm5_ret_t
1365 kadm5_ad_rename_principal(void *server_handle,
1366                           krb5_principal from,
1367                           krb5_principal to)
1368 {
1369     kadm5_ad_context *context = server_handle;
1370     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1371     return KADM5_RPC_ERROR;
1372 }
1373
1374 static kadm5_ret_t
1375 kadm5_ad_chpass_principal_with_key(void *server_handle,
1376                                    krb5_principal princ,
1377                                    int keepold,
1378                                    int n_key_data,
1379                                    krb5_key_data *key_data)
1380 {
1381     kadm5_ad_context *context = server_handle;
1382     krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1383     return KADM5_RPC_ERROR;
1384 }
1385
1386 static kadm5_ret_t
1387 kadm5_ad_lock(void *server_handle)
1388 {
1389     return ENOTSUP;
1390 }
1391
1392 static kadm5_ret_t
1393 kadm5_ad_unlock(void *server_handle)
1394 {
1395     return ENOTSUP;
1396 }
1397
1398 static void
1399 set_funcs(kadm5_ad_context *c)
1400 {
1401 #define SET(C, F) (C)->funcs.F = kadm5_ad_ ## F
1402 #define SETNOTIMP(C, F) (C)->funcs.F = 0
1403     SET(c, chpass_principal);
1404     SET(c, chpass_principal_with_key);
1405     SET(c, create_principal);
1406     SET(c, delete_principal);
1407     SET(c, destroy);
1408     SET(c, flush);
1409     SET(c, get_principal);
1410     SET(c, get_principals);
1411     SET(c, get_privs);
1412     SET(c, modify_principal);
1413     SET(c, randkey_principal);
1414     SET(c, rename_principal);
1415     SET(c, lock);
1416     SET(c, unlock);
1417     SETNOTIMP(c, setkey_principal_3);
1418     SETNOTIMP(c, prune_principal);
1419     SET(c, iter_principals);
1420     SET(c, dup_context);
1421 }
1422
1423 kadm5_ret_t
1424 kadm5_ad_init_with_password_ctx(krb5_context context,
1425                                 const char *client_name,
1426                                 const char *password,
1427                                 const char *service_name,
1428                                 kadm5_config_params *realm_params,
1429                                 unsigned long struct_version,
1430                                 unsigned long api_version,
1431                                 void **server_handle)
1432 {
1433     kadm5_ret_t ret;
1434     kadm5_ad_context *ctx;
1435
1436     ctx = malloc(sizeof(*ctx));
1437     if (ctx == NULL)
1438         return krb5_enomem(context);
1439     memset(ctx, 0, sizeof(*ctx));
1440     set_funcs(ctx);
1441
1442     ctx->context = context;
1443     krb5_add_et_list (context, initialize_kadm5_error_table_r);
1444
1445     ret = krb5_parse_name(ctx->context, client_name, &ctx->caller);
1446     if(ret) {
1447         free(ctx);
1448         return ret;
1449     }
1450
1451     if(realm_params->mask & KADM5_CONFIG_REALM) {
1452         ret = 0;
1453         ctx->realm = strdup(realm_params->realm);
1454         if (ctx->realm == NULL)
1455             ret = krb5_enomem(context);
1456     } else
1457         ret = krb5_get_default_realm(ctx->context, &ctx->realm);
1458     if (ret) {
1459         free(ctx);
1460         return ret;
1461     }
1462
1463     ctx->client_name = strdup(client_name);
1464
1465     if(password != NULL && *password != '\0')
1466         ret = ad_get_cred(ctx, password);
1467     else
1468         ret = ad_get_cred(ctx, NULL);
1469     if(ret) {
1470         kadm5_ad_destroy(ctx);
1471         free(ctx);
1472         return ret;
1473     }
1474
1475 #ifdef OPENLDAP
1476     ret = _kadm5_ad_connect(ctx);
1477     if (ret) {
1478         kadm5_ad_destroy(ctx);
1479         free(ctx);
1480         return ret;
1481     }
1482 #endif
1483
1484     *server_handle = ctx;
1485     return 0;
1486 }
1487
1488 kadm5_ret_t
1489 kadm5_ad_dup_context(void *in, void **out)
1490 {
1491     return ENOTSUP;
1492 }
1493
1494 kadm5_ret_t
1495 kadm5_ad_init_with_password(const char *client_name,
1496                             const char *password,
1497                             const char *service_name,
1498                             kadm5_config_params *realm_params,
1499                             unsigned long struct_version,
1500                             unsigned long api_version,
1501                             void **server_handle)
1502 {
1503     krb5_context context;
1504     kadm5_ret_t ret;
1505     kadm5_ad_context *ctx;
1506
1507     ret = krb5_init_context(&context);
1508     if (ret)
1509         return ret;
1510     ret = kadm5_ad_init_with_password_ctx(context,
1511                                           client_name,
1512                                           password,
1513                                           service_name,
1514                                           realm_params,
1515                                           struct_version,
1516                                           api_version,
1517                                           server_handle);
1518     if(ret) {
1519         krb5_free_context(context);
1520         return ret;
1521     }
1522     ctx = *server_handle;
1523     ctx->my_context = 1;
1524     return 0;
1525 }