2 * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
41 #include <heim_asn1.h>
46 enum hdb_lockop
{ HDB_RLOCK
, HDB_WLOCK
};
48 /* flags for various functions */
49 #define HDB_F_DECRYPT 1 /* decrypt keys */
50 #define HDB_F_REPLACE 2 /* replace entry */
51 #define HDB_F_GET_CLIENT 4 /* fetch client */
52 #define HDB_F_GET_SERVER 8 /* fetch server */
53 #define HDB_F_GET_KRBTGT 16 /* fetch krbtgt */
54 #define HDB_F_GET_ANY 28 /* fetch any of client,server,krbtgt */
55 #define HDB_F_CANON 32 /* want canonicalition */
56 #define HDB_F_ADMIN_DATA 64 /* want data that kdc don't use */
58 /* hdb_capability_flags */
59 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
60 #define HDB_CAP_F_HANDLE_PASSWORDS 2
61 #define HDB_CAP_F_PASSWORD_UPDATE_KEYS 4
63 /* auth status values */
64 #define HDB_AUTH_SUCCESS 0
65 #define HDB_AUTH_WRONG_PASSWORD 1
66 #define HDB_AUTH_INVALID_SIGNATURE 2
68 /* key usage for master key */
69 #define HDB_KU_MKEY 0x484442
71 typedef struct hdb_master_key_data
*hdb_master_key
;
73 typedef struct hdb_entry_ex
{
76 void (*free_entry
)(krb5_context
, struct hdb_entry_ex
*);
81 * HDB backend function pointer structure
83 * The HDB structure is what the KDC and kadmind framework uses to
84 * query the backend database when talking about principals.
89 void *hdb_dbc
; /** don't use, only for DB3 */
91 int hdb_master_key_set
;
92 hdb_master_key hdb_master_key
;
94 int hdb_capability_flags
;
96 * Open (or create) the a Kerberos database.
98 * Open (or create) the a Kerberos database that was resolved with
99 * hdb_create(). The third and fourth flag to the function are the
100 * same as open(), thus passing O_CREAT will create the data base
101 * if it doesn't exists.
103 * Then done the caller should call hdb_close(), and to release
104 * all resources hdb_destroy().
106 krb5_error_code (*hdb_open
)(krb5_context
, struct HDB
*, int, mode_t
);
108 * Close the database for transaction
110 * Closes the database for further transactions, wont release any
111 * permanant resources. the database can be ->hdb_open-ed again.
113 krb5_error_code (*hdb_close
)(krb5_context
, struct HDB
*);
115 * Free an entry after use.
117 void (*hdb_free
)(krb5_context
, struct HDB
*, hdb_entry_ex
*);
119 * Fetch an entry from the backend
121 * Fetch an entry from the backend, flags are what type of entry
122 * should be fetch: client, server, krbtgt.
124 krb5_error_code (*hdb_fetch
)(krb5_context
, struct HDB
*,
125 krb5_const_principal
, unsigned,
128 * Store an entry to database
130 krb5_error_code (*hdb_store
)(krb5_context
, struct HDB
*,
131 unsigned, hdb_entry_ex
*);
133 * Remove an entry from the database.
135 krb5_error_code (*hdb_remove
)(krb5_context
, struct HDB
*,
136 krb5_const_principal
);
138 * As part of iteration, fetch one entry
140 krb5_error_code (*hdb_firstkey
)(krb5_context
, struct HDB
*,
141 unsigned, hdb_entry_ex
*);
143 * As part of iteration, fetch next entry
145 krb5_error_code (*hdb_nextkey
)(krb5_context
, struct HDB
*,
146 unsigned, hdb_entry_ex
*);
150 * A lock can only be held by one consumers. Transaction can still
151 * happen on the database while the lock is held, so the entry is
152 * only useful for syncroning creation of the database and renaming of the database.
154 krb5_error_code (*hdb_lock
)(krb5_context
, struct HDB
*, int);
158 krb5_error_code (*hdb_unlock
)(krb5_context
, struct HDB
*);
160 * Rename the data base.
162 * Assume that the database is not hdb_open'ed and not locked.
164 krb5_error_code (*hdb_rename
)(krb5_context
, struct HDB
*, const char*);
166 * Get an hdb_entry from a classical DB backend
168 * If the database is a classical DB (ie BDB, NDBM, GDBM, etc)
169 * backend, this function will take a principal key (krb5_data)
170 * and return all data related to principal in the return
171 * krb5_data. The returned encoded entry is of type hdb_entry or
174 krb5_error_code (*hdb__get
)(krb5_context
, struct HDB
*,
175 krb5_data
, krb5_data
*);
177 * Store an hdb_entry from a classical DB backend
179 * Same discussion as in @ref HDB::hdb__get
181 krb5_error_code (*hdb__put
)(krb5_context
, struct HDB
*, int,
182 krb5_data
, krb5_data
);
184 * Delete and hdb_entry from a classical DB backend
186 * Same discussion as in @ref HDB::hdb__get
188 krb5_error_code (*hdb__del
)(krb5_context
, struct HDB
*, krb5_data
);
190 * Destroy the handle to the database.
192 * Destroy the handle to the database, deallocate all memory and
193 * related resources. Does not remove any permanent data. Its the
194 * logical reverse of hdb_create() function that is the entry
195 * point for the module.
197 krb5_error_code (*hdb_destroy
)(krb5_context
, struct HDB
*);
199 * Get the list of realms this backend handles.
200 * This call is optional to support. The returned realms are used
201 * for announcing the realms over bonjour. Free returned array
202 * with krb5_free_host_realm().
204 krb5_error_code (*hdb_get_realms
)(krb5_context
, struct HDB
*, krb5_realm
**);
208 * Will update keys for the entry when given password. The new
209 * keys must be written into the entry and and will then later be
210 * ->hdb_store() into the database. The backend will still perform
211 * all other operations, increasing the kvno, and update
212 * modification timestamp.
214 * The backen need to call _kadm5_set_keys() and perform password
217 krb5_error_code (*hdb_password
)(krb5_context
, struct HDB
*, hdb_entry_ex
*, const char *, int);
222 * This is a feedback call that allows backends that provides
223 * lockout functionality to register failure and/or successes.
225 * In case the entry is locked out, the backend should set the
226 * hdb_entry.flags.locked-out flag.
228 krb5_error_code (*hdb_auth_status
)(krb5_context
, struct HDB
*, hdb_entry_ex
*, int);
230 * Check is delegation is allowed.
232 krb5_error_code (*hdb_check_constrained_delegation
)(krb5_context
, struct HDB
*, hdb_entry_ex
*, krb5_const_principal
);
235 * Check if this name is an alias for the supplied client for PKINIT userPrinicpalName logins
237 krb5_error_code (*hdb_check_pkinit_ms_upn_match
)(krb5_context
, struct HDB
*, hdb_entry_ex
*, krb5_const_principal
);
240 #define HDB_INTERFACE_VERSION 6
242 struct hdb_so_method
{
245 krb5_error_code (*create
)(krb5_context
, HDB
**, const char *filename
);
248 typedef krb5_error_code (*hdb_foreach_func_t
)(krb5_context
, HDB
*,
249 hdb_entry_ex
*, void*);
250 extern krb5_kt_ops hdb_kt_ops
;
253 int interface_version
;
255 krb5_error_code (*create
)(krb5_context
, HDB
**, const char *filename
);
258 extern const int hdb_interface_version
;
260 #include <hdb-protos.h>
262 #endif /* __HDB_H__ */