source: heimdal/trunk/kadmin/ank.c

Last change on this file was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 7.5 KB
Line 
1/*
2 * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "kadmin_locl.h"
35#include "kadmin-commands.h"
36
37/*
38 * fetch the default principal corresponding to `princ'
39 */
40
41static krb5_error_code
42get_default (kadm5_server_context *contextp,
43 krb5_principal princ,
44 kadm5_principal_ent_t default_ent)
45{
46 krb5_error_code ret;
47 krb5_principal def_principal;
48 krb5_const_realm realm = krb5_principal_get_realm(contextp->context, princ);
49
50 ret = krb5_make_principal (contextp->context, &def_principal,
51 realm, "default", NULL);
52 if (ret)
53 return ret;
54 ret = kadm5_get_principal (contextp, def_principal, default_ent,
55 KADM5_PRINCIPAL_NORMAL_MASK);
56 krb5_free_principal (contextp->context, def_principal);
57 return ret;
58}
59
60/*
61 * Add the principal `name' to the database.
62 * Prompt for all data not given by the input parameters.
63 */
64
65static krb5_error_code
66add_one_principal (const char *name,
67 int rand_key,
68 int rand_password,
69 int use_defaults,
70 char *password,
71 krb5_key_data *key_data,
72 const char *max_ticket_life,
73 const char *max_renewable_life,
74 const char *attributes,
75 const char *expiration,
76 const char *pw_expiration)
77{
78 krb5_error_code ret;
79 kadm5_principal_ent_rec princ, defrec;
80 kadm5_principal_ent_rec *default_ent = NULL;
81 krb5_principal princ_ent = NULL;
82 int mask = 0;
83 int default_mask = 0;
84 char pwbuf[1024];
85
86 memset(&princ, 0, sizeof(princ));
87 ret = krb5_parse_name(context, name, &princ_ent);
88 if (ret) {
89 krb5_warn(context, ret, "krb5_parse_name");
90 return ret;
91 }
92 princ.principal = princ_ent;
93 mask |= KADM5_PRINCIPAL;
94
95 ret = set_entry(context, &princ, &mask,
96 max_ticket_life, max_renewable_life,
97 expiration, pw_expiration, attributes);
98 if (ret)
99 goto out;
100
101 default_ent = &defrec;
102 ret = get_default (kadm_handle, princ_ent, default_ent);
103 if (ret) {
104 default_ent = NULL;
105 default_mask = 0;
106 } else {
107 default_mask = KADM5_ATTRIBUTES | KADM5_MAX_LIFE | KADM5_MAX_RLIFE |
108 KADM5_PRINC_EXPIRE_TIME | KADM5_PW_EXPIRATION;
109 }
110
111 if(use_defaults)
112 set_defaults(&princ, &mask, default_ent, default_mask);
113 else
114 if(edit_entry(&princ, &mask, default_ent, default_mask))
115 goto out;
116 if(rand_key || key_data) {
117 princ.attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
118 mask |= KADM5_ATTRIBUTES;
119 random_password (pwbuf, sizeof(pwbuf));
120 password = pwbuf;
121 } else if (rand_password) {
122 random_password (pwbuf, sizeof(pwbuf));
123 password = pwbuf;
124 } else if(password == NULL) {
125 char *princ_name;
126 char *prompt;
127
128 krb5_unparse_name(context, princ_ent, &princ_name);
129 asprintf (&prompt, "%s's Password: ", princ_name);
130 free (princ_name);
131 ret = UI_UTIL_read_pw_string (pwbuf, sizeof(pwbuf), prompt, 1);
132 free (prompt);
133 if (ret) {
134 ret = KRB5_LIBOS_BADPWDMATCH;
135 krb5_set_error_message(context, ret, "failed to verify password");
136 goto out;
137 }
138 password = pwbuf;
139 }
140
141 ret = kadm5_create_principal(kadm_handle, &princ, mask, password);
142 if(ret) {
143 krb5_warn(context, ret, "kadm5_create_principal");
144 goto out;
145 }
146 if(rand_key) {
147 krb5_keyblock *new_keys;
148 int n_keys, i;
149 ret = kadm5_randkey_principal(kadm_handle, princ_ent,
150 &new_keys, &n_keys);
151 if(ret){
152 krb5_warn(context, ret, "kadm5_randkey_principal");
153 n_keys = 0;
154 }
155 for(i = 0; i < n_keys; i++)
156 krb5_free_keyblock_contents(context, &new_keys[i]);
157 if (n_keys > 0)
158 free(new_keys);
159 kadm5_get_principal(kadm_handle, princ_ent, &princ,
160 KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES);
161 princ.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX);
162 princ.kvno = 1;
163 kadm5_modify_principal(kadm_handle, &princ,
164 KADM5_ATTRIBUTES | KADM5_KVNO);
165 kadm5_free_principal_ent(kadm_handle, &princ);
166 } else if (key_data) {
167 ret = kadm5_chpass_principal_with_key (kadm_handle, princ_ent,
168 3, key_data);
169 if (ret) {
170 krb5_warn(context, ret, "kadm5_chpass_principal_with_key");
171 }
172 kadm5_get_principal(kadm_handle, princ_ent, &princ,
173 KADM5_PRINCIPAL | KADM5_ATTRIBUTES);
174 princ.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX);
175 kadm5_modify_principal(kadm_handle, &princ, KADM5_ATTRIBUTES);
176 kadm5_free_principal_ent(kadm_handle, &princ);
177 } else if (rand_password) {
178 char *princ_name;
179
180 krb5_unparse_name(context, princ_ent, &princ_name);
181 printf ("added %s with password \"%s\"\n", princ_name, password);
182 free (princ_name);
183 }
184out:
185 if (princ_ent)
186 krb5_free_principal (context, princ_ent);
187 if(default_ent)
188 kadm5_free_principal_ent (kadm_handle, default_ent);
189 if (password != NULL)
190 memset (password, 0, strlen(password));
191 return ret;
192}
193
194/*
195 * parse the string `key_string' into `key', returning 0 iff succesful.
196 */
197
198/*
199 * the ank command
200 */
201
202/*
203 * Parse arguments and add all the principals.
204 */
205
206int
207add_new_key(struct add_options *opt, int argc, char **argv)
208{
209 krb5_error_code ret = 0;
210 int i;
211 int num;
212 krb5_key_data key_data[3];
213 krb5_key_data *kdp = NULL;
214
215 num = 0;
216 if (opt->random_key_flag)
217 ++num;
218 if (opt->random_password_flag)
219 ++num;
220 if (opt->password_string)
221 ++num;
222 if (opt->key_string)
223 ++num;
224
225 if (num > 1) {
226 fprintf (stderr, "give only one of "
227 "--random-key, --random-password, --password, --key\n");
228 return 1;
229 }
230
231 if (opt->key_string) {
232 const char *error;
233
234 if (parse_des_key (opt->key_string, key_data, &error)) {
235 fprintf (stderr, "failed parsing key \"%s\": %s\n",
236 opt->key_string, error);
237 return 1;
238 }
239 kdp = key_data;
240 }
241
242 for(i = 0; i < argc; i++) {
243 ret = add_one_principal (argv[i],
244 opt->random_key_flag,
245 opt->random_password_flag,
246 opt->use_defaults_flag,
247 opt->password_string,
248 kdp,
249 opt->max_ticket_life_string,
250 opt->max_renewable_life_string,
251 opt->attributes_string,
252 opt->expiration_time_string,
253 opt->pw_expiration_time_string);
254 if (ret) {
255 krb5_warn (context, ret, "adding %s", argv[i]);
256 break;
257 }
258 }
259 if (kdp) {
260 int16_t dummy = 3;
261 kadm5_free_key_data (kadm_handle, &dummy, key_data);
262 }
263 return ret != 0;
264}
Note: See TracBrowser for help on using the repository browser.