1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ 2 /* plugins/kdb/ldap/libkdb_ldap/ldap_principal.h */ 3 /* 4 * Copyright (c) 2004-2005, Novell, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions are met: 9 * 10 * * Redistributions of source code must retain the above copyright notice, 11 * this list of conditions and the following disclaimer. 12 * * Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * * The copyright holder's name is not used to endorse or promote products 16 * derived from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 19 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #ifndef _LDAP_PRINCIPAL_H 32 #define _LDAP_PRINCIPAL_H 1 33 34 #include "ldap_tkt_policy.h" 35 #include "princ_xdr.h" 36 37 #define KEYHEADER 12 38 39 #define NOOFKEYS(ptr) ((ptr[10]<<8) | ptr[11]) 40 41 #define PRINCIPALLEN(ptr) ((ptr[0]<<8) | ptr[1]) 42 #define PRINCIPALNAME(ptr) (ptr + KEYHEADER + (NOOFKEYS(ptr) *8)) 43 44 #define KEYBODY(ptr) PRINCIPALNAME(ptr) + PRINCIPALLEN(ptr) 45 46 #define PKEYVER(ptr) ((ptr[2]<<8) | ptr[3]) 47 #define MKEYVER(ptr) ((ptr[4]<<8) | ptr[5]) 48 49 #define KEYTYPE(ptr,j) ((ptr[KEYHEADER+(j*8)]<<8) | ptr[KEYHEADER+1+(j*8)]) 50 #define KEYLENGTH(ptr,j) ((ptr[KEYHEADER+2+(j*8)]<<8) | ptr[KEYHEADER+3+(j*8)]) 51 #define SALTTYPE(ptr,j) ((ptr[KEYHEADER+4+(j*8)]<<8) | ptr[KEYHEADER+5+(j*8)]) 52 #define SALTLENGTH(ptr,j) ((ptr[KEYHEADER+6+(j*8)]<<8) | ptr[KEYHEADER+7+(j*8)]) 53 54 #define MAX_KEY_LENGTH 1024 55 #define CONTAINERDN_ARG "containerdn" 56 #define USERDN_ARG "dn" 57 #define TKTPOLICY_ARG "tktpolicy" 58 #define LINKDN_ARG "linkdn" 59 60 /* #define FILTER "(&(objectclass=krbprincipalaux)(krbprincipalname=" */ 61 #define FILTER "(&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal))(krbprincipalname=" 62 63 #define KDB_USER_PRINCIPAL 0x01 64 #define KDB_SERVICE_PRINCIPAL 0x02 65 #define KDB_STANDALONE_PRINCIPAL_OBJECT 0x01 66 67 /* these will be consumed only by krb5_ldap_delete_principal*/ 68 /* these will be set by krb5_ldap_get_principal and fed into the tl_data */ 69 70 /* See also attributes_set[] in ldap_principal.c. */ 71 #define KDB_MAX_LIFE_ATTR 0x000001 72 #define KDB_MAX_RLIFE_ATTR 0x000002 73 #define KDB_TKT_FLAGS_ATTR 0x000004 74 #define KDB_PRINC_EXPIRE_TIME_ATTR 0x000008 75 #define KDB_POL_REF_ATTR 0x000010 76 #define KDB_AUTH_IND_ATTR 0x000020 77 #define KDB_PWD_POL_REF_ATTR 0x000040 78 #define KDB_PWD_EXPIRE_TIME_ATTR 0x000080 79 #define KDB_SECRET_KEY_ATTR 0x000100 80 #define KDB_LAST_PWD_CHANGE_ATTR 0x000200 81 #define KDB_EXTRA_DATA_ATTR 0x000400 82 #define KDB_LAST_SUCCESS_ATTR 0x000800 83 #define KDB_LAST_FAILED_ATTR 0x001000 84 #define KDB_FAIL_AUTH_COUNT_ATTR 0x002000 85 #define KDB_LAST_ADMIN_UNLOCK_ATTR 0x004000 86 #define KDB_PWD_HISTORY_ATTR 0x008000 87 88 /* 89 * This is a private contract between krb5_ldap_lockout_audit() 90 * and krb5_ldap_put_principal(). If present, it means that the 91 * krbPwdMaxFailure attribute should be incremented by one. 92 */ 93 #define KADM5_FAIL_AUTH_COUNT_INCREMENT 0x080000 /* KADM5_CPW_FUNCTION */ 94 95 extern struct timeval timeout; 96 extern char *policyclass[]; 97 98 krb5_error_code 99 krb5_ldap_put_principal(krb5_context, krb5_db_entry *, char **); 100 101 krb5_error_code 102 krb5_ldap_get_principal(krb5_context , krb5_const_principal , 103 unsigned int, krb5_db_entry **); 104 105 krb5_error_code 106 krb5_ldap_delete_principal(krb5_context, krb5_const_principal); 107 108 krb5_error_code 109 krb5_ldap_rename_principal(krb5_context context, krb5_const_principal source, 110 krb5_const_principal target); 111 112 krb5_error_code 113 krb5_ldap_iterate(krb5_context, char *, 114 krb5_error_code (*)(krb5_pointer, krb5_db_entry *), 115 krb5_pointer, krb5_flags); 116 117 void 118 k5_free_key_data(krb5_int16 n_key_data, krb5_key_data *key_data); 119 120 void 121 krb5_dbe_free_contents(krb5_context context, krb5_db_entry *entry); 122 123 void 124 krb5_dbe_free_contents(krb5_context, krb5_db_entry *); 125 126 krb5_error_code 127 krb5_ldap_unparse_name(krb5_context context, krb5_const_principal princ, 128 char **user_out); 129 130 krb5_error_code 131 krb5_ldap_parse_name(krb5_context context, const char *username, 132 krb5_principal *out); 133 134 struct berval** 135 krb5_encode_krbsecretkey(krb5_key_data *key_data, int n_key_data, 136 krb5_kvno mkvno); 137 138 krb5_error_code 139 krb5_decode_histkey(krb5_context, struct berval **, osa_princ_ent_rec *); 140 141 krb5_error_code 142 krb5_decode_krbsecretkey(krb5_context, krb5_db_entry *, struct berval **, 143 krb5_kvno *); 144 145 void 146 free_berdata(struct berval **array); 147 148 krb5_error_code 149 berval2tl_data(struct berval *in, krb5_tl_data **out); 150 151 krb5_error_code 152 krb5_read_tkt_policy(krb5_context, krb5_ldap_context *, krb5_db_entry *, 153 char *); 154 #endif 155