lib/kadm5/create_s.c

   1 /*
   2  * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadm5_locl.h"
  35
  36 RCSID("$Id$");
  37
  38 static kadm5_ret_t
  39 get_default(kadm5_server_context *context, krb5_principal princ,
  40             kadm5_principal_ent_t def)
  41 {
  42     kadm5_ret_t ret;
  43     krb5_principal def_principal;
  44     krb5_const_realm realm = krb5_principal_get_realm(context->context, princ);
  45
  46     ret = krb5_make_principal(context->context, &def_principal,
  47                               realm, "default", NULL);
  48     if (ret)
  49         return ret;
  50     ret = kadm5_s_get_principal(context, def_principal, def,
  51                                 KADM5_PRINCIPAL_NORMAL_MASK);
  52     krb5_free_principal (context->context, def_principal);
  53
  54     if (ret) {
  55         /* Copy defaults from kadmin/init.c */
  56         memset(def, 0, sizeof(*def));
  57         def->max_life = 24 * 60 * 60;
  58         def->max_renewable_life = 7 * def->max_life;
  59         def->attributes = KRB5_KDB_DISALLOW_ALL_TIX;
  60     }
  61     return ret;
  62 }
  63
  64 static kadm5_ret_t
  65 create_principal(kadm5_server_context *context,
  66                  kadm5_principal_ent_t princ,
  67                  uint32_t mask,
  68                  hdb_entry *ent,
  69                  uint32_t required_mask,
  70                  uint32_t forbidden_mask)
  71 {
  72     kadm5_ret_t ret;
  73     kadm5_principal_ent_rec defrec, *defent;
  74     uint32_t def_mask;
  75
  76     memset(ent, 0, sizeof(*ent));
  77     if((mask & required_mask) != required_mask)
  78         return KADM5_BAD_MASK;
  79     if((mask & forbidden_mask))
  80         return KADM5_BAD_MASK;
  81     if((mask & KADM5_POLICY) && strcmp(princ->policy, "default"))
  82         /* XXX no real policies for now */
  83         return KADM5_UNK_POLICY;
  84     ret  = krb5_copy_principal(context->context, princ->principal,
  85                                &ent->principal);
  86     if(ret)
  87         return ret;
  88
  89     defent = &defrec;
  90     ret = get_default(context, princ->principal, defent);
  91     if(ret) {
  92         defent   = NULL;
  93         def_mask = 0;
  94     } else {
  95         def_mask = KADM5_ATTRIBUTES | KADM5_MAX_LIFE | KADM5_MAX_RLIFE;
  96     }
  97
  98     ret = _kadm5_setup_entry(context,
  99                              ent, mask | def_mask,
 100                              princ, mask,
 101                              defent, def_mask);
 102     if(defent)
 103         kadm5_free_principal_ent(context, defent);
 104     if (ret)
 105         return ret;
 106
 107     ent->created_by.time = time(NULL);
 108
 109     return krb5_copy_principal(context->context, context->caller,
 110                                &ent->created_by.principal);
 111 }
 112
 113 struct create_principal_hook_ctx {
 114     kadm5_server_context *context;
 115     enum kadm5_hook_stage stage;
 116     krb5_error_code code;
 117     kadm5_principal_ent_t princ;
 118     uint32_t mask;
 119     const char *password;
 120 };
 121
 122 static krb5_error_code KRB5_LIB_CALL
 123 create_principal_hook_cb(krb5_context context,
 124                          const void *hook,
 125                          void *hookctx,
 126                          void *userctx)
 127 {
 128     krb5_error_code ret;
 129     const struct kadm5_hook_ftable *ftable = hook;
 130     struct create_principal_hook_ctx *ctx = userctx;
 131
 132     ret = ftable->create(context, hookctx,
 133                          ctx->stage, ctx->code, ctx->princ,
 134                          ctx->mask, ctx->password);
 135     if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE)
 136         _kadm5_s_set_hook_error_message(ctx->context, ret, "create",
 137                                         hook, ctx->stage);
 138
 139     /* only pre-commit plugins can abort */
 140     if (ret == 0 || ctx->stage == KADM5_HOOK_STAGE_POSTCOMMIT)
 141         ret = KRB5_PLUGIN_NO_HANDLE;
 142
 143     return ret;
 144 }
 145
 146 static kadm5_ret_t
 147 create_principal_hook(kadm5_server_context *context,
 148                       enum kadm5_hook_stage stage,
 149                       krb5_error_code code,
 150                       kadm5_principal_ent_t princ,
 151                       uint32_t mask,
 152                       const char *password)
 153 {
 154     krb5_error_code ret;
 155     struct create_principal_hook_ctx ctx;
 156
 157     ctx.context = context;
 158     ctx.stage = stage;
 159     ctx.code = code;
 160     ctx.princ = princ;
 161     ctx.mask = mask;
 162     ctx.password = password;
 163
 164     ret = _krb5_plugin_run_f(context->context, &kadm5_hook_plugin_data,
 165                              0, &ctx, create_principal_hook_cb);
 166     if (ret == KRB5_PLUGIN_NO_HANDLE)
 167         ret = 0;
 168
 169     return ret;
 170 }
 171
 172 kadm5_ret_t
 173 kadm5_s_create_principal_with_key(void *server_handle,
 174                                   kadm5_principal_ent_t princ,
 175                                   uint32_t mask)
 176 {
 177     kadm5_ret_t ret;
 178     hdb_entry ent;
 179     kadm5_server_context *context = server_handle;
 180
 181     if ((mask & KADM5_KVNO) == 0) {
 182         /* create_principal() through _kadm5_setup_entry(), will need this */
 183         princ->kvno = 1;
 184         mask |= KADM5_KVNO;
 185     }
 186
 187     ret = create_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT,
 188                                 0, princ, mask, NULL);
 189     if (ret)
 190         return ret;
 191
 192     ret = create_principal(context, princ, mask, &ent,
 193                            KADM5_PRINCIPAL | KADM5_KEY_DATA,
 194                            KADM5_LAST_PWD_CHANGE | KADM5_MOD_TIME
 195                            | KADM5_MOD_NAME | KADM5_MKVNO
 196                            | KADM5_AUX_ATTRIBUTES
 197                            | KADM5_POLICY_CLR | KADM5_LAST_SUCCESS
 198                            | KADM5_LAST_FAILED | KADM5_FAIL_AUTH_COUNT);
 199     if (ret)
 200         return ret;
 201
 202     if (!context->keep_open) {
 203         ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
 204         if (ret) {
 205             hdb_free_entry(context->context, context->db, &ent);
 206             return ret;
 207         }
 208     }
 209
 210     ret = kadm5_log_init(context);
 211     if (ret)
 212         goto out;
 213
 214     ret = hdb_seal_keys(context->context, context->db, &ent);
 215     if (ret)
 216         goto out2;
 217
 218     /*
 219      * This logs the change for iprop and writes to the HDB.
 220      *
 221      * Creation of would-be virtual principals w/o the materialize flag will be
 222      * rejected in kadm5_log_create().
 223      */
 224     ret = kadm5_log_create(context, &ent);
 225
 226     (void) create_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT,
 227                                  ret, princ, mask, NULL);
 228
 229  out2:
 230     (void) kadm5_log_end(context);
 231  out:
 232     if (!context->keep_open) {
 233         kadm5_ret_t ret2;
 234         ret2 = context->db->hdb_close(context->context, context->db);
 235         if (ret == 0 && ret2 != 0)
 236             ret = ret2;
 237     }
 238     hdb_free_entry(context->context, context->db, &ent);
 239     return _kadm5_error_code(ret);
 240 }
 241
 242
 243 kadm5_ret_t
 244 kadm5_s_create_principal(void *server_handle,
 245                          kadm5_principal_ent_t princ,
 246                          uint32_t mask,
 247                          int n_ks_tuple,
 248                          krb5_key_salt_tuple *ks_tuple,
 249                          const char *password)
 250 {
 251     kadm5_ret_t ret;
 252     hdb_entry ent;
 253     kadm5_server_context *context = server_handle;
 254     int use_pw = 1;
 255
 256     if ((mask & KADM5_ATTRIBUTES) &&
 257         (princ->attributes & (KRB5_KDB_VIRTUAL_KEYS | KRB5_KDB_VIRTUAL)) &&
 258         !(princ->attributes & KRB5_KDB_MATERIALIZE)) {
 259         return _kadm5_error_code(KADM5_DUP); /* XXX More like EINVAL */
 260     }
 261     if ((mask & KADM5_ATTRIBUTES) &&
 262         (princ->attributes & KRB5_KDB_VIRTUAL_KEYS) &&
 263         (princ->attributes & KRB5_KDB_VIRTUAL)) {
 264         return _kadm5_error_code(KADM5_DUP); /* XXX More like EINVAL */
 265     }
 266
 267     if ((mask & KADM5_ATTRIBUTES) &&
 268         (princ->attributes & KRB5_KDB_VIRTUAL) &&
 269         (princ->attributes & KRB5_KDB_MATERIALIZE))
 270         princ->attributes &= ~(KRB5_KDB_MATERIALIZE | KRB5_KDB_VIRTUAL);
 271
 272     if (password[0] == '\0' && (mask & KADM5_KEY_DATA) && princ->n_key_data &&
 273         !kadm5_all_keys_are_bogus(princ->n_key_data, princ->key_data))
 274         use_pw = 0;
 275
 276     if (use_pw && _kadm5_enforce_pwqual_on_admin_set_p(context)) {
 277         krb5_data pwd_data;
 278         const char *pwd_reason;
 279
 280         pwd_data.data = rk_UNCONST(password);
 281         pwd_data.length = strlen(password);
 282
 283         pwd_reason = kadm5_check_password_quality(context->context,
 284                                                   princ->principal, &pwd_data);
 285         if (pwd_reason != NULL) {
 286             krb5_set_error_message(context->context, KADM5_PASS_Q_DICT, "%s", pwd_reason);
 287             return KADM5_PASS_Q_DICT;
 288         }
 289     }
 290
 291     if ((mask & KADM5_KVNO) == 0) {
 292         /* create_principal() through _kadm5_setup_entry(), will need this */
 293         princ->kvno = 1;
 294         mask |= KADM5_KVNO;
 295     }
 296
 297     ret = create_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT,
 298                                 0, princ, mask, password);
 299     if (ret)
 300         return ret;
 301
 302     if (use_pw)
 303         ret = create_principal(context, princ, mask, &ent,
 304                                KADM5_PRINCIPAL,
 305                                KADM5_LAST_PWD_CHANGE | KADM5_MOD_TIME
 306                                | KADM5_MOD_NAME | KADM5_MKVNO
 307                                | KADM5_AUX_ATTRIBUTES | KADM5_KEY_DATA
 308                                | KADM5_POLICY_CLR | KADM5_LAST_SUCCESS
 309                                | KADM5_LAST_FAILED | KADM5_FAIL_AUTH_COUNT);
 310     else
 311         ret = create_principal(context, princ, mask, &ent,
 312                                KADM5_PRINCIPAL | KADM5_KEY_DATA,
 313                                KADM5_LAST_PWD_CHANGE | KADM5_MOD_TIME
 314                                | KADM5_MOD_NAME | KADM5_MKVNO
 315                                | KADM5_AUX_ATTRIBUTES
 316                                | KADM5_POLICY_CLR | KADM5_LAST_SUCCESS
 317                                | KADM5_LAST_FAILED | KADM5_FAIL_AUTH_COUNT);
 318     if (ret)
 319         return ret;
 320
 321     if (!context->keep_open) {
 322         ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
 323         if (ret) {
 324             hdb_free_entry(context->context, context->db, &ent);
 325             return ret;
 326         }
 327     }
 328
 329     ret = kadm5_log_init(context);
 330     if (ret)
 331         goto out;
 332
 333     free_Keys(&ent.keys);
 334
 335     if (use_pw) {
 336         ret = _kadm5_set_keys(context, &ent, n_ks_tuple, ks_tuple, password);
 337         if (ret)
 338             goto out2;
 339     }
 340
 341     ret = hdb_seal_keys(context->context, context->db, &ent);
 342     if (ret)
 343         goto out2;
 344
 345     /* This logs the change for iprop and writes to the HDB */
 346     ret = kadm5_log_create(context, &ent);
 347
 348     (void) create_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT,
 349                                  ret, princ, mask, password);
 350
 351  out2:
 352     (void) kadm5_log_end(context);
 353  out:
 354     if (!context->keep_open) {
 355         kadm5_ret_t ret2;
 356         ret2 = context->db->hdb_close(context->context, context->db);
 357         if (ret == 0 && ret2 != 0)
 358             ret = ret2;
 359     }
 360     hdb_free_entry(context->context, context->db, &ent);
 361     return _kadm5_error_code(ret);
 362 }
 363