1 /* 2 * Copyright (c) 1997-1999 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 /* $Id: admin.h,v 1.15 1999/12/02 17:05:05 joda Exp $ */ 34 35 #ifndef __KADM5_ADMIN_H__ 36 #define __KADM5_ADMIN_H__ 37 38 #define KADM5_API_VERSION_1 1 39 #define KADM5_API_VERSION_2 2 40 41 #ifndef USE_KADM5_API_VERSION 42 #define USE_KADM5_API_VERSION KADM5_API_VERSION_2 43 #endif 44 45 #if USE_KADM5_API_VERSION != KADM5_API_VERSION_2 46 #error No support for API versions other than 2 47 #endif 48 49 #define KADM5_STRUCT_VERSION 0 50 51 #include <krb5.h> 52 53 #define KRB5_KDB_DISALLOW_POSTDATED 0x00000001 54 #define KRB5_KDB_DISALLOW_FORWARDABLE 0x00000002 55 #define KRB5_KDB_DISALLOW_TGT_BASED 0x00000004 56 #define KRB5_KDB_DISALLOW_RENEWABLE 0x00000008 57 #define KRB5_KDB_DISALLOW_PROXIABLE 0x00000010 58 #define KRB5_KDB_DISALLOW_DUP_SKEY 0x00000020 59 #define KRB5_KDB_DISALLOW_ALL_TIX 0x00000040 60 #define KRB5_KDB_REQUIRES_PRE_AUTH 0x00000080 61 #define KRB5_KDB_REQUIRES_HW_AUTH 0x00000100 62 #define KRB5_KDB_REQUIRES_PWCHANGE 0x00000200 63 #define KRB5_KDB_DISALLOW_SVR 0x00001000 64 #define KRB5_KDB_PWCHANGE_SERVICE 0x00002000 65 #define KRB5_KDB_SUPPORT_DESMD5 0x00004000 66 #define KRB5_KDB_NEW_PRINC 0x00008000 67 68 #define KADM5_PRINCIPAL 0x000001 69 #define KADM5_PRINC_EXPIRE_TIME 0x000002 70 #define KADM5_PW_EXPIRATION 0x000004 71 #define KADM5_LAST_PWD_CHANGE 0x000008 72 #define KADM5_ATTRIBUTES 0x000010 73 #define KADM5_MAX_LIFE 0x000020 74 #define KADM5_MOD_TIME 0x000040 75 #define KADM5_MOD_NAME 0x000080 76 #define KADM5_KVNO 0x000100 77 #define KADM5_MKVNO 0x000200 78 #define KADM5_AUX_ATTRIBUTES 0x000400 79 #define KADM5_POLICY 0x000800 80 #define KADM5_POLICY_CLR 0x001000 81 #define KADM5_MAX_RLIFE 0x002000 82 #define KADM5_LAST_SUCCESS 0x004000 83 #define KADM5_LAST_FAILED 0x008000 84 #define KADM5_FAIL_AUTH_COUNT 0x010000 85 #define KADM5_KEY_DATA 0x020000 86 #define KADM5_TL_DATA 0x040000 87 88 #define KADM5_PRINCIPAL_NORMAL_MASK (~(KADM5_KEY_DATA | KADM5_TL_DATA)) 89 90 #define KADM5_PW_MAX_LIFE 0x004000 91 #define KADM5_PW_MIN_LIFE 0x008000 92 #define KADM5_PW_MIN_LENGTH 0x010000 93 #define KADM5_PW_MIN_CLASSES 0x020000 94 #define KADM5_PW_HISTORY_NUM 0x040000 95 #define KADM5_REF_COUNT 0x080000 96 97 #define KADM5_POLICY_NORMAL_MASK (~0) 98 99 #define KADM5_ADMIN_SERVICE "kadmin/admin" 100 #define KADM5_HIST_PRINCIPAL "kadmin/history" 101 #define KADM5_CHANGEPW_SERVICE "kadmin/changepw" 102 103 typedef struct _krb5_key_data { 104 int16_t key_data_ver; /* Version */ 105 int16_t key_data_kvno; /* Key Version */ 106 int16_t key_data_type[2]; /* Array of types */ 107 int16_t key_data_length[2]; /* Array of lengths */ 108 void** key_data_contents[2];/* Array of pointers */ 109 } krb5_key_data; 110 111 typedef struct _krb5_tl_data { 112 struct _krb5_tl_data* tl_data_next; 113 int16_t tl_data_type; 114 int16_t tl_data_length; 115 void **tl_data_contents; 116 } krb5_tl_data; 117 118 typedef struct _kadm5_principal_ent_t { 119 krb5_principal principal; 120 121 krb5_timestamp princ_expire_time; 122 krb5_timestamp last_pwd_change; 123 krb5_timestamp pw_expiration; 124 krb5_deltat max_life; 125 krb5_principal mod_name; 126 krb5_timestamp mod_date; 127 krb5_flags attributes; 128 krb5_kvno kvno; 129 krb5_kvno mkvno; 130 131 char * policy; 132 u_int32_t aux_attributes; 133 134 krb5_deltat max_renewable_life; 135 krb5_timestamp last_success; 136 krb5_timestamp last_failed; 137 krb5_kvno fail_auth_count; 138 int16_t n_key_data; 139 int16_t n_tl_data; 140 krb5_tl_data *tl_data; 141 krb5_key_data *key_data; 142 } kadm5_principal_ent_rec, *kadm5_principal_ent_t; 143 144 typedef struct _kadm5_policy_ent_t { 145 char *policy; 146 147 u_int32_t pw_min_life; 148 u_int32_t pw_max_life; 149 u_int32_t pw_min_length; 150 u_int32_t pw_min_classes; 151 u_int32_t pw_history_num; 152 u_int32_t policy_refcnt; 153 } kadm5_policy_ent_rec, *kadm5_policy_ent_t; 154 155 #define KADM5_CONFIG_REALM (1 << 0) 156 #define KADM5_CONFIG_PROFILE (1 << 1) 157 #define KADM5_CONFIG_KADMIND_PORT (1 << 2) 158 #define KADM5_CONFIG_ADMIN_SERVER (1 << 3) 159 #define KADM5_CONFIG_DBNAME (1 << 4) 160 #define KADM5_CONFIG_ADBNAME (1 << 5) 161 #define KADM5_CONFIG_ADB_LOCKFILE (1 << 6) 162 #define KADM5_CONFIG_ACL_FILE (1 << 7) 163 #define KADM5_CONFIG_DICT_FILE (1 << 8) 164 #define KADM5_CONFIG_ADMIN_KEYTAB (1 << 9) 165 #define KADM5_CONFIG_MKEY_FROM_KEYBOARD (1 << 10) 166 #define KADM5_CONFIG_STASH_FILE (1 << 11) 167 #define KADM5_CONFIG_MKEY_NAME (1 << 12) 168 #define KADM5_CONFIG_ENCTYPE (1 << 13) 169 #define KADM5_CONFIG_MAX_LIFE (1 << 14) 170 #define KADM5_CONFIG_MAX_RLIFE (1 << 15) 171 #define KADM5_CONFIG_EXPIRATION (1 << 16) 172 #define KADM5_CONFIG_FLAGS (1 << 17) 173 #define KADM5_CONFIG_ENCTYPES (1 << 18) 174 175 #define KADM5_PRIV_GET (1 << 0) 176 #define KADM5_PRIV_ADD (1 << 1) 177 #define KADM5_PRIV_MODIFY (1 << 2) 178 #define KADM5_PRIV_DELETE (1 << 3) 179 #define KADM5_PRIV_LIST (1 << 4) 180 #define KADM5_PRIV_CPW (1 << 5) 181 #define KADM5_PRIV_ALL (KADM5_PRIV_GET | KADM5_PRIV_ADD | KADM5_PRIV_MODIFY | KADM5_PRIV_DELETE | KADM5_PRIV_LIST | KADM5_PRIV_CPW) 182 183 typedef struct { 184 int XXX; 185 }krb5_key_salt_tuple; 186 187 typedef struct _kadm5_config_params { 188 u_int32_t mask; 189 190 /* Client and server fields */ 191 char *realm; 192 int kadmind_port; 193 194 /* client fields */ 195 char *admin_server; 196 197 /* server fields */ 198 char *dbname; 199 char *acl_file; 200 201 /* server library (database) fields */ 202 char *stash_file; 203 } kadm5_config_params; 204 205 typedef krb5_error_code kadm5_ret_t; 206 207 kadm5_ret_t 208 kadm5_c_chpass_principal __P(( 209 void *server_handle, 210 krb5_principal princ, 211 char *password)); 212 213 kadm5_ret_t 214 kadm5_c_create_principal __P(( 215 void *server_handle, 216 kadm5_principal_ent_t princ, 217 u_int32_t mask, 218 char *password)); 219 220 kadm5_ret_t 221 kadm5_c_delete_principal __P(( 222 void *server_handle, 223 krb5_principal princ)); 224 225 kadm5_ret_t 226 kadm5_c_destroy __P((void *server_handle)); 227 228 kadm5_ret_t 229 kadm5_c_flush __P((void *server_handle)); 230 231 kadm5_ret_t 232 kadm5_c_get_principal __P(( 233 void *server_handle, 234 krb5_principal princ, 235 kadm5_principal_ent_t out, 236 u_int32_t mask)); 237 238 kadm5_ret_t 239 kadm5_c_get_principals __P(( 240 void *server_handle, 241 const char *exp, 242 char ***princs, 243 int *count)); 244 245 kadm5_ret_t 246 kadm5_c_get_privs __P(( 247 void *server_handle, 248 u_int32_t *privs)); 249 250 kadm5_ret_t 251 kadm5_c_init_with_creds __P(( 252 const char *client_name, 253 krb5_ccache ccache, 254 const char *service_name, 255 kadm5_config_params *realm_params, 256 unsigned long struct_version, 257 unsigned long api_version, 258 void **server_handle)); 259 260 kadm5_ret_t 261 kadm5_c_init_with_creds_ctx __P(( 262 krb5_context context, 263 const char *client_name, 264 krb5_ccache ccache, 265 const char *service_name, 266 kadm5_config_params *realm_params, 267 unsigned long struct_version, 268 unsigned long api_version, 269 void **server_handle)); 270 271 kadm5_ret_t 272 kadm5_c_init_with_password __P(( 273 const char *client_name, 274 const char *password, 275 const char *service_name, 276 kadm5_config_params *realm_params, 277 unsigned long struct_version, 278 unsigned long api_version, 279 void **server_handle)); 280 281 kadm5_ret_t 282 kadm5_c_init_with_password_ctx __P(( 283 krb5_context context, 284 const char *client_name, 285 const char *password, 286 const char *service_name, 287 kadm5_config_params *realm_params, 288 unsigned long struct_version, 289 unsigned long api_version, 290 void **server_handle)); 291 292 kadm5_ret_t 293 kadm5_c_init_with_skey __P(( 294 const char *client_name, 295 const char *keytab, 296 const char *service_name, 297 kadm5_config_params *realm_params, 298 unsigned long struct_version, 299 unsigned long api_version, 300 void **server_handle)); 301 302 kadm5_ret_t 303 kadm5_c_init_with_skey_ctx __P(( 304 krb5_context context, 305 const char *client_name, 306 const char *keytab, 307 const char *service_name, 308 kadm5_config_params *realm_params, 309 unsigned long struct_version, 310 unsigned long api_version, 311 void **server_handle)); 312 313 kadm5_ret_t 314 kadm5_c_modify_principal __P(( 315 void *server_handle, 316 kadm5_principal_ent_t princ, 317 u_int32_t mask)); 318 319 kadm5_ret_t 320 kadm5_c_randkey_principal __P(( 321 void *server_handle, 322 krb5_principal princ, 323 krb5_keyblock **new_keys, 324 int *n_keys)); 325 326 kadm5_ret_t 327 kadm5_c_rename_principal __P(( 328 void *server_handle, 329 krb5_principal source, 330 krb5_principal target)); 331 332 kadm5_ret_t 333 kadm5_chpass_principal __P(( 334 void *server_handle, 335 krb5_principal princ, 336 char *password)); 337 338 kadm5_ret_t 339 kadm5_create_principal __P(( 340 void *server_handle, 341 kadm5_principal_ent_t princ, 342 u_int32_t mask, 343 char *password)); 344 345 kadm5_ret_t 346 kadm5_delete_principal __P(( 347 void *server_handle, 348 krb5_principal princ)); 349 350 kadm5_ret_t 351 kadm5_destroy __P((void *server_handle)); 352 353 kadm5_ret_t 354 kadm5_flush __P((void *server_handle)); 355 356 void 357 kadm5_free_key_data __P(( 358 void *server_handle, 359 int16_t *n_key_data, 360 krb5_key_data *key_data)); 361 362 void 363 kadm5_free_name_list __P(( 364 void *server_handle, 365 char **names, 366 int *count)); 367 368 void 369 kadm5_free_principal_ent __P(( 370 void *server_handle, 371 kadm5_principal_ent_t princ)); 372 373 kadm5_ret_t 374 kadm5_get_principal __P(( 375 void *server_handle, 376 krb5_principal princ, 377 kadm5_principal_ent_t out, 378 u_int32_t mask)); 379 380 kadm5_ret_t 381 kadm5_get_principals __P(( 382 void *server_handle, 383 const char *exp, 384 char ***princs, 385 int *count)); 386 387 kadm5_ret_t 388 kadm5_get_privs __P(( 389 void *server_handle, 390 u_int32_t *privs)); 391 392 kadm5_ret_t 393 kadm5_init_with_creds __P(( 394 const char *client_name, 395 krb5_ccache ccache, 396 const char *service_name, 397 kadm5_config_params *realm_params, 398 unsigned long struct_version, 399 unsigned long api_version, 400 void **server_handle)); 401 402 kadm5_ret_t 403 kadm5_init_with_creds_ctx __P(( 404 krb5_context context, 405 const char *client_name, 406 krb5_ccache ccache, 407 const char *service_name, 408 kadm5_config_params *realm_params, 409 unsigned long struct_version, 410 unsigned long api_version, 411 void **server_handle)); 412 413 kadm5_ret_t 414 kadm5_init_with_password __P(( 415 const char *client_name, 416 const char *password, 417 const char *service_name, 418 kadm5_config_params *realm_params, 419 unsigned long struct_version, 420 unsigned long api_version, 421 void **server_handle)); 422 423 kadm5_ret_t 424 kadm5_init_with_password_ctx __P(( 425 krb5_context context, 426 const char *client_name, 427 const char *password, 428 const char *service_name, 429 kadm5_config_params *realm_params, 430 unsigned long struct_version, 431 unsigned long api_version, 432 void **server_handle)); 433 434 kadm5_ret_t 435 kadm5_init_with_skey __P(( 436 const char *client_name, 437 const char *keytab, 438 const char *service_name, 439 kadm5_config_params *realm_params, 440 unsigned long struct_version, 441 unsigned long api_version, 442 void **server_handle)); 443 444 kadm5_ret_t 445 kadm5_init_with_skey_ctx __P(( 446 krb5_context context, 447 const char *client_name, 448 const char *keytab, 449 const char *service_name, 450 kadm5_config_params *realm_params, 451 unsigned long struct_version, 452 unsigned long api_version, 453 void **server_handle)); 454 455 kadm5_ret_t 456 kadm5_modify_principal __P(( 457 void *server_handle, 458 kadm5_principal_ent_t princ, 459 u_int32_t mask)); 460 461 kadm5_ret_t 462 kadm5_randkey_principal __P(( 463 void *server_handle, 464 krb5_principal princ, 465 krb5_keyblock **new_keys, 466 int *n_keys)); 467 468 kadm5_ret_t 469 kadm5_rename_principal __P(( 470 void *server_handle, 471 krb5_principal source, 472 krb5_principal target)); 473 474 kadm5_ret_t 475 kadm5_ret_key_data __P(( 476 krb5_storage *sp, 477 krb5_key_data *key)); 478 479 kadm5_ret_t 480 kadm5_ret_principal_ent __P(( 481 krb5_storage *sp, 482 kadm5_principal_ent_t princ)); 483 484 kadm5_ret_t 485 kadm5_ret_principal_ent_mask __P(( 486 krb5_storage *sp, 487 kadm5_principal_ent_t princ, 488 u_int32_t *mask)); 489 490 kadm5_ret_t 491 kadm5_ret_tl_data __P(( 492 krb5_storage *sp, 493 krb5_tl_data *tl)); 494 495 kadm5_ret_t 496 kadm5_s_chpass_principal __P(( 497 void *server_handle, 498 krb5_principal princ, 499 char *password)); 500 501 kadm5_ret_t 502 kadm5_s_chpass_principal_with_key __P(( 503 void *server_handle, 504 krb5_principal princ, 505 int n_key_data, 506 krb5_key_data *key_data)); 507 508 kadm5_ret_t 509 kadm5_s_create_principal __P(( 510 void *server_handle, 511 kadm5_principal_ent_t princ, 512 u_int32_t mask, 513 char *password)); 514 515 kadm5_ret_t 516 kadm5_s_create_principal_with_key __P(( 517 void *server_handle, 518 kadm5_principal_ent_t princ, 519 u_int32_t mask)); 520 521 kadm5_ret_t 522 kadm5_s_delete_principal __P(( 523 void *server_handle, 524 krb5_principal princ)); 525 526 kadm5_ret_t 527 kadm5_s_destroy __P((void *server_handle)); 528 529 kadm5_ret_t 530 kadm5_s_flush __P((void *server_handle)); 531 532 kadm5_ret_t 533 kadm5_s_get_principal __P(( 534 void *server_handle, 535 krb5_principal princ, 536 kadm5_principal_ent_t out, 537 u_int32_t mask)); 538 539 kadm5_ret_t 540 kadm5_s_get_principals __P(( 541 void *server_handle, 542 const char *exp, 543 char ***princs, 544 int *count)); 545 546 kadm5_ret_t 547 kadm5_s_get_privs __P(( 548 void *server_handle, 549 u_int32_t *privs)); 550 551 kadm5_ret_t 552 kadm5_s_init_with_creds __P(( 553 const char *client_name, 554 krb5_ccache ccache, 555 const char *service_name, 556 kadm5_config_params *realm_params, 557 unsigned long struct_version, 558 unsigned long api_version, 559 void **server_handle)); 560 561 kadm5_ret_t 562 kadm5_s_init_with_creds_ctx __P(( 563 krb5_context context, 564 const char *client_name, 565 krb5_ccache ccache, 566 const char *service_name, 567 kadm5_config_params *realm_params, 568 unsigned long struct_version, 569 unsigned long api_version, 570 void **server_handle)); 571 572 kadm5_ret_t 573 kadm5_s_init_with_password __P(( 574 const char *client_name, 575 const char *password, 576 const char *service_name, 577 kadm5_config_params *realm_params, 578 unsigned long struct_version, 579 unsigned long api_version, 580 void **server_handle)); 581 582 kadm5_ret_t 583 kadm5_s_init_with_password_ctx __P(( 584 krb5_context context, 585 const char *client_name, 586 const char *password, 587 const char *service_name, 588 kadm5_config_params *realm_params, 589 unsigned long struct_version, 590 unsigned long api_version, 591 void **server_handle)); 592 593 kadm5_ret_t 594 kadm5_s_init_with_skey __P(( 595 const char *client_name, 596 const char *keytab, 597 const char *service_name, 598 kadm5_config_params *realm_params, 599 unsigned long struct_version, 600 unsigned long api_version, 601 void **server_handle)); 602 603 kadm5_ret_t 604 kadm5_s_init_with_skey_ctx __P(( 605 krb5_context context, 606 const char *client_name, 607 const char *keytab, 608 const char *service_name, 609 kadm5_config_params *realm_params, 610 unsigned long struct_version, 611 unsigned long api_version, 612 void **server_handle)); 613 614 kadm5_ret_t 615 kadm5_s_modify_principal __P(( 616 void *server_handle, 617 kadm5_principal_ent_t princ, 618 u_int32_t mask)); 619 620 kadm5_ret_t 621 kadm5_s_randkey_principal __P(( 622 void *server_handle, 623 krb5_principal princ, 624 krb5_keyblock **new_keys, 625 int *n_keys)); 626 627 kadm5_ret_t 628 kadm5_s_rename_principal __P(( 629 void *server_handle, 630 krb5_principal source, 631 krb5_principal target)); 632 633 kadm5_ret_t 634 kadm5_store_key_data __P(( 635 krb5_storage *sp, 636 krb5_key_data *key)); 637 638 kadm5_ret_t 639 kadm5_store_principal_ent __P(( 640 krb5_storage *sp, 641 kadm5_principal_ent_t princ)); 642 643 kadm5_ret_t 644 kadm5_store_principal_ent_mask __P(( 645 krb5_storage *sp, 646 kadm5_principal_ent_t princ, 647 u_int32_t mask)); 648 649 kadm5_ret_t 650 kadm5_store_tl_data __P(( 651 krb5_storage *sp, 652 krb5_tl_data *tl)); 653 654 void 655 kadm5_setup_passwd_quality_check(krb5_context context, 656 const char *check_library, 657 const char *check_function); 658 659 const char * 660 kadm5_check_password_quality (krb5_context context, 661 krb5_principal principal, 662 krb5_data *pwd_data); 663 664 #if 0 665 /* unimplemented functions */ 666 kadm5_ret_t 667 kadm5_decrypt_key(void *server_handle, 668 kadm5_principal_ent_t entry, int32_t 669 ktype, int32_t stype, int32_t 670 kvno, krb5_keyblock *keyblock, 671 krb5_keysalt *keysalt, int *kvnop); 672 673 kadm5_ret_t 674 kadm5_create_policy(void *server_handle, 675 kadm5_policy_ent_t policy, u_int32_t mask); 676 677 kadm5_ret_t 678 kadm5_delete_policy(void *server_handle, char *policy); 679 680 681 kadm5_ret_t 682 kadm5_modify_policy(void *server_handle, 683 kadm5_policy_ent_t policy, 684 u_int32_t mask); 685 686 kadm5_ret_t 687 kadm5_get_policy(void *server_handle, char *policy, kadm5_policy_ent_t ent); 688 689 kadm5_ret_t 690 kadm5_get_policies(void *server_handle, char *exp, 691 char ***pols, int *count); 692 693 void 694 kadm5_free_policy_ent(kadm5_policy_ent_t policy); 695 696 #endif 697 698 #endif /* __KADM5_ADMIN_H__ */ 699