lib/kadm5/admin.h

   1 /*
   2  * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33 /* $Id$ */
  34
  35 #ifndef __KADM5_ADMIN_H__
  36 #define __KADM5_ADMIN_H__
  37
  38 #define KADM5_API_VERSION_1 1
  39 #define KADM5_API_VERSION_2 2
  40
  41 #ifndef USE_KADM5_API_VERSION
  42 #define USE_KADM5_API_VERSION KADM5_API_VERSION_2
  43 #endif
  44
  45 #if USE_KADM5_API_VERSION != KADM5_API_VERSION_2
  46 #error No support for API versions other than 2
  47 #endif
  48
  49 #define KADM5_STRUCT_VERSION 0
  50
  51 /* For kadm5_log_get_version_fd() */
  52 #define LOG_VERSION_LAST -1
  53 #define LOG_VERSION_FIRST 1
  54 #define LOG_VERSION_UBER  0
  55
  56 #include <krb5.h>
  57
  58 #define KRB5_KDB_DISALLOW_POSTDATED     0x00000001
  59 #define KRB5_KDB_DISALLOW_FORWARDABLE   0x00000002
  60 #define KRB5_KDB_DISALLOW_TGT_BASED     0x00000004
  61 #define KRB5_KDB_DISALLOW_RENEWABLE     0x00000008
  62 #define KRB5_KDB_DISALLOW_PROXIABLE     0x00000010
  63 #define KRB5_KDB_DISALLOW_DUP_SKEY      0x00000020
  64 #define KRB5_KDB_DISALLOW_ALL_TIX       0x00000040
  65 #define KRB5_KDB_REQUIRES_PRE_AUTH      0x00000080
  66 #define KRB5_KDB_REQUIRES_HW_AUTH       0x00000100
  67 #define KRB5_KDB_REQUIRES_PWCHANGE      0x00000200
  68 #define KRB5_KDB_DISALLOW_SVR           0x00001000
  69 #define KRB5_KDB_PWCHANGE_SERVICE       0x00002000
  70 #define KRB5_KDB_SUPPORT_DESMD5         0x00004000
  71 #define KRB5_KDB_NEW_PRINC              0x00008000
  72 #define KRB5_KDB_OK_AS_DELEGATE         0x00010000 /* 0x00100000 in MIT */
  73 #define KRB5_KDB_TRUSTED_FOR_DELEGATION 0x00020000 /* MIT has as 0x00200000 */
  74 #define KRB5_KDB_ALLOW_KERBEROS4        0x00040000 /* MIT doesn't have this; XXX remove */
  75 #define KRB5_KDB_ALLOW_DIGEST           0x00080000 /* MIT doesn't have this */
  76 #define KRB5_KDB_MATERIALIZE            0x00100000 /* MIT doesn't have this */
  77 #define KRB5_KDB_VIRTUAL_KEYS           0x00200000 /* MIT doesn't have this */
  78 #define KRB5_KDB_VIRTUAL                0x00400000 /* MIT doesn't have this */
  79 #define KRB5_KDB_DISALLOW_CLIENT        0x00800000 /* MIT doesn't have this */
  80 #define KRB5_KDB_NO_AUTH_DATA_REQUIRED  0x01000000 /* 0x00400000 in MIT */
  81 #define KRB5_KDB_AUTH_DATA_REQUIRED     0x02000000
  82
  83 /*
  84  * MIT has:
  85  *
  86  *  - Same as our KRB5_KDB_TRUSTED_FOR_DELEGATION:
  87  *
  88  *    #define KRB5_KDB_OK_TO_AUTH_AS_DELEGATE 0x00200000 // S4U2Self OK
  89  *
  90  *  - Misc:
  91  *
  92  *    #define KRB5_KDB_NO_AUTH_DATA_REQUIRED  0x00400000 // Don't lookup / add
  93  *                                                       // authz data
  94  *    #define KRB5_KDB_LOCKDOWN_KEYS          0x00800000 // Don't allow
  95  *                                                       // deletion of princ
  96  */
  97
  98
  99 #define KADM5_PRINCIPAL         0x000001U
 100 #define KADM5_PRINC_EXPIRE_TIME 0x000002U
 101 #define KADM5_PW_EXPIRATION     0x000004U
 102 #define KADM5_LAST_PWD_CHANGE   0x000008U
 103 #define KADM5_ATTRIBUTES        0x000010U
 104 #define KADM5_MAX_LIFE          0x000020U
 105 #define KADM5_MOD_TIME          0x000040U
 106 #define KADM5_MOD_NAME          0x000080U
 107 #define KADM5_KVNO              0x000100U
 108 #define KADM5_MKVNO             0x000200U
 109 #define KADM5_AUX_ATTRIBUTES    0x000400U
 110 #define KADM5_POLICY            0x000800U
 111 #define KADM5_POLICY_CLR        0x001000U
 112 #define KADM5_MAX_RLIFE         0x002000U
 113 #define KADM5_LAST_SUCCESS      0x004000U
 114 #define KADM5_LAST_FAILED       0x008000U
 115 #define KADM5_FAIL_AUTH_COUNT   0x010000U
 116 #define KADM5_KEY_DATA          0x020000U
 117 #define KADM5_TL_DATA           0x040000U
 118
 119 #define KADM5_PRINCIPAL_NORMAL_MASK (~(KADM5_KEY_DATA | KADM5_TL_DATA))
 120
 121 #define KADM5_PW_MAX_LIFE       0x004000
 122 #define KADM5_PW_MIN_LIFE       0x008000
 123 #define KADM5_PW_MIN_LENGTH     0x010000
 124 #define KADM5_PW_MIN_CLASSES    0x020000
 125 #define KADM5_PW_HISTORY_NUM    0x040000
 126 #define KADM5_REF_COUNT         0x080000
 127
 128 #define KADM5_POLICY_NORMAL_MASK (~0)
 129
 130 #define KADM5_ADMIN_SERVICE     "kadmin/admin"
 131 #define KADM5_HIST_PRINCIPAL    "kadmin/history"
 132 #define KADM5_CHANGEPW_SERVICE  "kadmin/changepw"
 133
 134 typedef struct {
 135     int16_t key_data_ver;       /* Version */
 136     int16_t key_data_kvno;      /* Key Version */
 137     int16_t key_data_type[2];   /* Array of types */
 138     int16_t key_data_length[2]; /* Array of lengths */
 139     void*   key_data_contents[2];/* Array of pointers */
 140 } krb5_key_data;
 141
 142 typedef struct _krb5_keysalt {
 143     int16_t               type;
 144     krb5_data             data;                 /* Length, data */
 145 } krb5_keysalt;
 146
 147 typedef struct _krb5_tl_data {
 148     struct _krb5_tl_data* tl_data_next;
 149     int16_t tl_data_type;
 150     int16_t tl_data_length;
 151     void*   tl_data_contents;
 152 } krb5_tl_data;
 153
 154 #define KRB5_TL_LAST_PWD_CHANGE         0x0001
 155 #define KRB5_TL_MOD_PRINC               0x0002
 156 #define KRB5_TL_KADM_DATA               0x0003
 157 #define KRB5_TL_KADM5_E_DATA            0x0004
 158 #define KRB5_TL_RB1_CHALLENGE           0x0005
 159 #define KRB5_TL_SECURID_STATE           0x0006
 160 #define KRB5_TL_PASSWORD                0x0007
 161 #define KRB5_TL_EXTENSION               0x0008
 162 #define KRB5_TL_PKINIT_ACL              0x0009
 163 #define KRB5_TL_ALIASES                 0x000a
 164 #define KRB5_TL_HIST_KVNO_DIFF_CLNT     0x000b
 165 #define KRB5_TL_HIST_KVNO_DIFF_SVC      0x000c
 166 #define KRB5_TL_ETYPES                  0x000d
 167 #define KRB5_TL_KEY_ROTATION            0x000e
 168 #define KRB5_TL_KRB5_CONFIG             0x000f
 169
 170 typedef struct _kadm5_principal_ent_t {
 171     krb5_principal principal;
 172
 173     krb5_timestamp princ_expire_time;
 174     krb5_timestamp last_pwd_change;
 175     krb5_timestamp pw_expiration;
 176     krb5_deltat max_life;
 177     krb5_principal mod_name;
 178     krb5_timestamp mod_date;
 179     krb5_flags attributes;
 180     krb5_kvno kvno;
 181     krb5_kvno mkvno;
 182
 183     char * policy;
 184     uint32_t aux_attributes;
 185
 186     krb5_deltat max_renewable_life;
 187     krb5_timestamp last_success;
 188     krb5_timestamp last_failed;
 189     krb5_kvno fail_auth_count;
 190     int16_t n_key_data;
 191     int16_t n_tl_data;
 192     krb5_tl_data *tl_data;
 193     krb5_key_data *key_data;
 194 } kadm5_principal_ent_rec, *kadm5_principal_ent_t;
 195
 196 typedef struct _kadm5_policy_ent_t {
 197     char *policy;
 198
 199     uint32_t pw_min_life;
 200     uint32_t pw_max_life;
 201     uint32_t pw_min_length;
 202     uint32_t pw_min_classes;
 203     uint32_t pw_history_num;
 204     uint32_t policy_refcnt;
 205 } kadm5_policy_ent_rec, *kadm5_policy_ent_t;
 206
 207 #define KADM5_CONFIG_REALM                      (1 << 0)
 208 #define KADM5_CONFIG_PROFILE                    (1 << 1)
 209 #define KADM5_CONFIG_KADMIND_PORT               (1 << 2)
 210 #define KADM5_CONFIG_ADMIN_SERVER               (1 << 3)
 211 #define KADM5_CONFIG_DBNAME                     (1 << 4)
 212 #define KADM5_CONFIG_ADBNAME                    (1 << 5)
 213 #define KADM5_CONFIG_ADB_LOCKFILE               (1 << 6)
 214 #define KADM5_CONFIG_ACL_FILE                   (1 << 7)
 215 #define KADM5_CONFIG_DICT_FILE                  (1 << 8)
 216 #define KADM5_CONFIG_ADMIN_KEYTAB               (1 << 9)
 217 #define KADM5_CONFIG_MKEY_FROM_KEYBOARD         (1 << 10)
 218 #define KADM5_CONFIG_STASH_FILE                 (1 << 11)
 219 #define KADM5_CONFIG_MKEY_NAME                  (1 << 12)
 220 #define KADM5_CONFIG_ENCTYPE                    (1 << 13)
 221 #define KADM5_CONFIG_MAX_LIFE                   (1 << 14)
 222 #define KADM5_CONFIG_MAX_RLIFE                  (1 << 15)
 223 #define KADM5_CONFIG_EXPIRATION                 (1 << 16)
 224 #define KADM5_CONFIG_FLAGS                      (1 << 17)
 225 #define KADM5_CONFIG_ENCTYPES                   (1 << 18)
 226 #define KADM5_CONFIG_READONLY_ADMIN_SERVER      (1 << 19)
 227 #define KADM5_CONFIG_READONLY_KADMIN_PORT       (1 << 20)
 228
 229 #define KADM5_PRIV_GET          (1 << 0)
 230 #define KADM5_PRIV_ADD          (1 << 1)
 231 #define KADM5_PRIV_MODIFY       (1 << 2)
 232 #define KADM5_PRIV_DELETE       (1 << 3)
 233 #define KADM5_PRIV_LIST         (1 << 4)
 234 #define KADM5_PRIV_CPW          (1 << 5)
 235 #define KADM5_PRIV_GET_KEYS     (1 << 6)
 236
 237 /* Note: KADM5_PRIV_GET_KEYS not included */
 238 #define KADM5_PRIV_ALL          (KADM5_PRIV_GET | KADM5_PRIV_ADD | KADM5_PRIV_MODIFY | KADM5_PRIV_DELETE | KADM5_PRIV_LIST | KADM5_PRIV_CPW)
 239
 240 #define KADM5_BOGUS_KEY_DATA    "\xe5\xe5\xe5\xe5"
 241
 242 /*
 243  * ABI NOTE: We can add fields at the end of this provided that we define new
 244  * mask bits that must be set in the mask field when setting the new fields.
 245  */
 246 typedef struct _kadm5_config_params {
 247     uint32_t mask;
 248
 249     /* Client and server fields */
 250     char *realm;
 251     int kadmind_port;
 252
 253     /* client fields */
 254     char *admin_server;
 255
 256     /* server fields */
 257     char *dbname;
 258     char *acl_file;
 259
 260     /* server library (database) fields */
 261     char *stash_file;
 262
 263     /* read-only kadmin server */
 264     char *readonly_admin_server;
 265     int readonly_kadmind_port;
 266 } kadm5_config_params;
 267
 268 typedef krb5_error_code kadm5_ret_t;
 269
 270 #include "kadm5-protos.h"
 271
 272 #endif /* __KADM5_ADMIN_H__ */