2 * Copyright (c) 2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #ifndef HEIMDAL_KDC_KDC_PLUGIN_H
37 #define HEIMDAL_KDC_KDC_PLUGIN_H 1
45 * Allocate a PAC for the given client with krb5_pac_init(),
46 * and fill its contents in with krb5_pac_add_buffer().
49 typedef krb5_error_code
50 (KRB5_CALLCONV
*krb5plugin_kdc_pac_generate
)(void *, krb5_context
,
51 struct hdb_entry_ex
*, /* client */
52 struct hdb_entry_ex
*, /* server */
53 const krb5_keyblock
*, /* pk_replykey */
54 uint64_t, /* pac_attributes */
58 * Verify the PAC KDC signatures by fetching the appropriate TGS key
59 * and calling krb5_pac_verify() with that key. Optionally update the
60 * PAC buffers on success.
63 typedef krb5_error_code
64 (KRB5_CALLCONV
*krb5plugin_kdc_pac_verify
)(void *, krb5_context
,
65 const krb5_principal
, /* new ticket client */
66 const krb5_principal
, /* delegation proxy */
67 struct hdb_entry_ex
*,/* client */
68 struct hdb_entry_ex
*,/* server */
69 struct hdb_entry_ex
*,/* krbtgt */
73 * Authorize the client principal's access to the Authentication Service (AS).
74 * This function is called after any pre-authentication has completed.
77 typedef krb5_error_code
78 (KRB5_CALLCONV
*krb5plugin_kdc_client_access
)(void *, astgs_request_t
);
81 * A referral policy plugin can either rewrite the server principal
82 * by resetting priv->server_princ, or it can disable referral
83 * processing entirely by returning an error.
85 * The error code from the previous server lookup is available as r->ret.
87 * If the function returns KRB5_PLUGIN_NO_HANDLE, the TGS will continue
88 * with its default referral handling.
90 * Note well: the plugin should free priv->server_princ is replacing.
93 typedef krb5_error_code
94 (KRB5_CALLCONV
*krb5plugin_kdc_referral_policy
)(void *, astgs_request_t
);
97 * Update the AS or TGS reply immediately prior to encoding.
100 typedef krb5_error_code
101 (KRB5_CALLCONV
*krb5plugin_kdc_finalize_reply
)(void *, astgs_request_t
);
104 * Audit an AS or TGS request. This function is called after encoding the
105 * reply (on success), or before encoding the error message. If a HDB audit
106 * function is also present, it is called after this one.
108 * The request should not be modified by the plugin.
111 typedef krb5_error_code
112 (KRB5_CALLCONV
*krb5plugin_kdc_audit
)(void *, astgs_request_t
);
115 * Plugins should carefully check API contract notes for changes
116 * between plugin API versions.
118 #define KRB5_PLUGIN_KDC_VERSION_9 9
120 typedef struct krb5plugin_kdc_ftable
{
122 krb5_error_code (KRB5_CALLCONV
*init
)(krb5_context
, void **);
123 void (KRB5_CALLCONV
*fini
)(void *);
124 krb5plugin_kdc_pac_generate pac_generate
;
125 krb5plugin_kdc_pac_verify pac_verify
;
126 krb5plugin_kdc_client_access client_access
;
127 krb5plugin_kdc_referral_policy referral_policy
;
128 krb5plugin_kdc_finalize_reply finalize_reply
;
129 krb5plugin_kdc_audit audit
;
130 } krb5plugin_kdc_ftable
;
132 #endif /* HEIMDAL_KDC_KDC_PLUGIN_H */