1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /*
3 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
4 *
5 * $Source$
6 */
7
8 /*
9 * Copyright (C) 1998 by the FundsXpress, INC.
10 *
11 * All rights reserved.
12 *
13 * Export of this software from the United States of America may require
14 * a specific license from the United States Government. It is the
15 * responsibility of any person or organization contemplating export to
16 * obtain such a license before exporting.
17 *
18 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
19 * distribute this software and its documentation for any purpose and
20 * without fee is hereby granted, provided that the above copyright
21 * notice appear in all copies and that both that copyright notice and
22 * this permission notice appear in supporting documentation, and that
23 * the name of FundsXpress. not be used in advertising or publicity pertaining
24 * to distribution of the software without specific, written prior
25 * permission. FundsXpress makes no representations about the suitability of
26 * this software for any purpose. It is provided "as is" without express
27 * or implied warranty.
28 *
29 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
30 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
31 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
32 */
33
34 #include <k5-int.h>
35 #include <ctype.h>
36 #include <kdb.h>
37 #include <kadm5/admin.h>
38 #include <adm_proto.h>
39
40 #include "fake-addrinfo.h"
41
42
43 #include <krb5.h>
44 #include <kdb.h>
45 #include "kdb5_util.h"
46
47 static int add_admin_princ(void *handle, krb5_context context,
48 char *name, char *realm, int attrs, int lifetime);
49 static int add_admin_princs(void *handle, krb5_context context, char *realm);
50
51 #define ERR 1
52 #define OK 0
53
54 #define ADMIN_LIFETIME 60*60*3 /* 3 hours */
55 #define CHANGEPW_LIFETIME 60*5 /* 5 minutes */
56
57 /*
58 * Function: kadm5_create
59 *
60 * Purpose: create admin principals in KDC database
61 *
62 * Arguments: params (r) configuration parameters to use
63 *
64 * Effects: Creates KADM5_ADMIN_SERVICE and KADM5_CHANGEPW_SERVICE
65 * principals in the KDC database and sets their attributes
66 * appropriately.
67 */
kadm5_create(kadm5_config_params * params)68 int kadm5_create(kadm5_config_params *params)
69 {
70 int retval;
71 kadm5_config_params lparams;
72
73 /*
74 * The lock file has to exist before calling kadm5_init, but
75 * params->admin_lockfile may not be set yet...
76 */
77 retval = kadm5_get_config_params(util_context, 1, params, &lparams);
78 if (retval) {
79 com_err(progname, retval, _("while looking up the Kerberos "
80 "configuration"));
81 return 1;
82 }
83
84 retval = kadm5_create_magic_princs(&lparams, util_context);
85
86 kadm5_free_config_params(util_context, &lparams);
87
88 return retval;
89 }
90
kadm5_create_magic_princs(kadm5_config_params * params,krb5_context context)91 int kadm5_create_magic_princs(kadm5_config_params *params,
92 krb5_context context)
93 {
94 int retval;
95 void *handle;
96
97 retval = krb5_klog_init(context, "admin_server", progname, 0);
98 if (retval)
99 return retval;
100 if ((retval = kadm5_init(context, progname, NULL, NULL, params,
101 KADM5_STRUCT_VERSION,
102 KADM5_API_VERSION_4,
103 db5util_db_args,
104 &handle))) {
105 com_err(progname, retval, _("while initializing the Kerberos admin "
106 "interface"));
107 return retval;
108 }
109
110 retval = add_admin_princs(handle, context, params->realm);
111
112 kadm5_destroy(handle);
113
114 krb5_klog_close(context);
115
116 return retval;
117 }
118
119 /*
120 * Function: add_admin_princs
121 *
122 * Purpose: create admin principals
123 *
124 * Arguments:
125 *
126 * rseed (input) random seed
127 * realm (input) realm, or NULL for default realm
128 * <return value> (output) status, 0 for success, 1 for serious error
129 *
130 * Requires:
131 *
132 * Effects:
133 *
134 * add_admin_princs creates KADM5_ADMIN_SERVICE,
135 * KADM5_CHANGEPW_SERVICE. If any of these exist a message is
136 * printed. If any of these existing principal do not have the proper
137 * attributes, a warning message is printed.
138 */
add_admin_princs(void * handle,krb5_context context,char * realm)139 static int add_admin_princs(void *handle, krb5_context context, char *realm)
140 {
141 krb5_error_code ret = 0;
142
143 if ((ret = add_admin_princ(handle, context,
144 KADM5_ADMIN_SERVICE, realm,
145 KRB5_KDB_DISALLOW_TGT_BASED |
146 KRB5_KDB_LOCKDOWN_KEYS,
147 ADMIN_LIFETIME)))
148 return ret;
149
150 return add_admin_princ(handle, context, KADM5_CHANGEPW_SERVICE, realm,
151 KRB5_KDB_DISALLOW_TGT_BASED |
152 KRB5_KDB_PWCHANGE_SERVICE | KRB5_KDB_LOCKDOWN_KEYS,
153 CHANGEPW_LIFETIME);
154 }
155
156 /*
157 * Function: add_admin_princ
158 *
159 * Arguments:
160 *
161 * creator (r) principal to use as "mod_by"
162 * rseed (r) seed for random key generator
163 * name (r) principal name
164 * realm (r) realm name for principal
165 * attrs (r) principal's attributes
166 * lifetime (r) principal's max life, or 0
167 * not_unique (r) error message for multiple entries, never used
168 * exists (r) warning message for principal exists
169 * wrong_attrs (r) warning message for wrong attributes
170 *
171 * Returns:
172 *
173 * OK on success
174 * ERR on serious errors
175 *
176 * Effects:
177 *
178 * If the principal is not unique, not_unique is printed (but this
179 * never happens). If the principal exists, then exists is printed
180 * and if the principals attributes != attrs, wrong_attrs is printed.
181 * Otherwise, the principal is created with mod_by creator and
182 * attributes attrs and max life of lifetime (if not zero).
183 */
184
add_admin_princ(void * handle,krb5_context context,char * name,char * realm,int attrs,int lifetime)185 int add_admin_princ(void *handle, krb5_context context,
186 char *name, char *realm, int attrs, int lifetime)
187 {
188 char *fullname = NULL;
189 krb5_error_code ret;
190 kadm5_principal_ent_rec ent;
191 long flags;
192 int fret;
193
194 memset(&ent, 0, sizeof(ent));
195
196 if (asprintf(&fullname, "%s@%s", name, realm) < 0) {
197 com_err(progname, ENOMEM, _("while appending realm to principal"));
198 fret = ERR;
199 goto cleanup;
200 }
201 ret = krb5_parse_name(context, fullname, &ent.principal);
202 if (ret) {
203 com_err(progname, ret, _("while parsing admin principal name"));
204 fret = ERR;
205 goto cleanup;
206 }
207 ent.max_life = lifetime;
208 ent.attributes = attrs;
209
210 flags = KADM5_PRINCIPAL | KADM5_ATTRIBUTES;
211 if (lifetime)
212 flags |= KADM5_MAX_LIFE;
213 ret = kadm5_create_principal(handle, &ent, flags, NULL);
214 if (ret && ret != KADM5_DUP) {
215 com_err(progname, ret, _("while creating principal %s"), fullname);
216 fret = ERR;
217 goto cleanup;
218 }
219
220 fret = OK;
221 cleanup:
222 krb5_free_principal(context, ent.principal);
223 free(fullname);
224 return fret;
225 }
226