2 * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "krb5_locl.h"
36 static krb5_error_code
37 verify_common (krb5_context context
,
38 krb5_principal principal
,
46 krb5_principal server
;
47 krb5_verify_init_creds_opt vopt
;
50 ret
= krb5_sname_to_principal (context
, NULL
, service
, KRB5_NT_SRV_HST
,
55 krb5_verify_init_creds_opt_init(&vopt
);
56 krb5_verify_init_creds_opt_set_ap_req_nofail(&vopt
, secure
);
58 ret
= krb5_verify_init_creds(context
,
64 krb5_free_principal(context
, server
);
68 ret
= krb5_cc_default (context
, &id
);
72 ret
= krb5_cc_initialize(context
, id
, principal
);
74 ret
= krb5_cc_store_cred(context
, id
, cred
);
77 krb5_cc_close(context
, id
);
83 * Verify user `principal' with `password'.
85 * If `secure', also verify against local service key for `service'.
87 * As a side effect, fresh tickets are obtained and stored in `ccache'.
90 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
91 krb5_verify_opt_init(krb5_verify_opt
*opt
)
93 memset(opt
, 0, sizeof(*opt
));
95 opt
->service
= "host";
98 KRB5_LIB_FUNCTION
int KRB5_LIB_CALL
99 krb5_verify_opt_alloc(krb5_context context
, krb5_verify_opt
**opt
)
101 *opt
= calloc(1, sizeof(**opt
));
103 return krb5_enomem(context
);
104 krb5_verify_opt_init(*opt
);
108 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
109 krb5_verify_opt_free(krb5_verify_opt
*opt
)
114 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
115 krb5_verify_opt_set_ccache(krb5_verify_opt
*opt
, krb5_ccache ccache
)
117 opt
->ccache
= ccache
;
120 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
121 krb5_verify_opt_set_keytab(krb5_verify_opt
*opt
, krb5_keytab keytab
)
123 opt
->keytab
= keytab
;
126 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
127 krb5_verify_opt_set_secure(krb5_verify_opt
*opt
, krb5_boolean secure
)
129 opt
->secure
= secure
;
132 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
133 krb5_verify_opt_set_service(krb5_verify_opt
*opt
, const char *service
)
135 opt
->service
= service
;
138 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
139 krb5_verify_opt_set_flags(krb5_verify_opt
*opt
, unsigned int flags
)
144 static krb5_error_code
145 verify_user_opt_int(krb5_context context
,
146 krb5_principal principal
,
147 const char *password
,
148 krb5_verify_opt
*vopt
)
152 krb5_get_init_creds_opt
*opt
;
155 ret
= krb5_get_init_creds_opt_alloc (context
, &opt
);
158 krb5_get_init_creds_opt_set_default_flags(context
, NULL
,
159 krb5_principal_get_realm(context
, principal
),
161 ret
= krb5_get_init_creds_password (context
,
170 krb5_get_init_creds_opt_free(context
, opt
);
173 #define OPT(V, D) ((vopt && (vopt->V)) ? (vopt->V) : (D))
174 ret
= verify_common (context
, principal
, OPT(ccache
, NULL
),
175 OPT(keytab
, NULL
), vopt
? vopt
->secure
: TRUE
,
176 OPT(service
, "host"), &cred
);
178 krb5_free_cred_contents(context
, &cred
);
182 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
183 krb5_verify_user_opt(krb5_context context
,
184 krb5_principal principal
,
185 const char *password
,
186 krb5_verify_opt
*opt
)
190 if(opt
&& (opt
->flags
& KRB5_VERIFY_LREALMS
)) {
191 krb5_realm
*realms
, *r
;
192 ret
= krb5_get_default_realms (context
, &realms
);
195 ret
= KRB5_CONFIG_NODEFREALM
;
197 for (r
= realms
; *r
!= NULL
&& ret
!= 0; ++r
) {
198 ret
= krb5_principal_set_realm(context
, principal
, *r
);
200 krb5_free_host_realm (context
, realms
);
204 ret
= verify_user_opt_int(context
, principal
, password
, opt
);
206 krb5_free_host_realm (context
, realms
);
210 ret
= verify_user_opt_int(context
, principal
, password
, opt
);
214 /* compat function that calls above */
216 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
217 krb5_verify_user(krb5_context context
,
218 krb5_principal principal
,
220 const char *password
,
226 krb5_verify_opt_init(&opt
);
228 krb5_verify_opt_set_ccache(&opt
, ccache
);
229 krb5_verify_opt_set_secure(&opt
, secure
);
230 krb5_verify_opt_set_service(&opt
, service
);
232 return krb5_verify_user_opt(context
, principal
, password
, &opt
);
236 * A variant of `krb5_verify_user'. The realm of `principal' is
237 * ignored and all the local realms are tried.
240 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
241 krb5_verify_user_lrealm(krb5_context context
,
242 krb5_principal principal
,
244 const char *password
,
250 krb5_verify_opt_init(&opt
);
252 krb5_verify_opt_set_ccache(&opt
, ccache
);
253 krb5_verify_opt_set_secure(&opt
, secure
);
254 krb5_verify_opt_set_service(&opt
, service
);
255 krb5_verify_opt_set_flags(&opt
, KRB5_VERIFY_LREALMS
);
257 return krb5_verify_user_opt(context
, principal
, password
, &opt
);