1 /* 2 * kdc/policy.c 3 * 4 * Copyright 1990 by the Massachusetts Institute of Technology. 5 * 6 * Export of this software from the United States of America may 7 * require a specific license from the United States Government. 8 * It is the responsibility of any person or organization contemplating 9 * export to obtain such a license before exporting. 10 * 11 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 12 * distribute this software and its documentation for any purpose and 13 * without fee is hereby granted, provided that the above copyright 14 * notice appear in all copies and that both that copyright notice and 15 * this permission notice appear in supporting documentation, and that 16 * the name of M.I.T. not be used in advertising or publicity pertaining 17 * to distribution of the software without specific, written prior 18 * permission. Furthermore if you modify this software you must label 19 * your software as modified software and not distribute it in such a 20 * fashion that it might be confused with the original M.I.T. software. 21 * M.I.T. makes no representations about the suitability of 22 * this software for any purpose. It is provided "as is" without express 23 * or implied warranty. 24 * 25 * 26 * Policy decision routines for KDC. 27 */ 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 32 #include "k5-int.h" 33 #include "kdc_util.h" 34 35 int 36 against_local_policy_as(request, client, server, kdc_time, status) 37 register krb5_kdc_req *request; 38 krb5_db_entry client; 39 krb5_db_entry server; 40 krb5_timestamp kdc_time; 41 const char **status; 42 { 43 #if 0 44 /* An AS request must include the addresses field */ 45 if (request->addresses == 0) { 46 *status = "NO ADDRESS"; 47 return KRB5KDC_ERR_POLICY; 48 } 49 #endif 50 51 return 0; /* not against policy */ 52 } 53 54 /* 55 * This is where local policy restrictions for the TGS should placed. 56 */ 57 krb5_error_code 58 against_local_policy_tgs(request, server, ticket, status) 59 register krb5_kdc_req *request; 60 krb5_db_entry server; 61 krb5_ticket *ticket; 62 const char **status; 63 { 64 #if 0 65 /* 66 * For example, if your site wants to disallow ticket forwarding, 67 * you might do something like this: 68 */ 69 70 if (isflagset(request->kdc_options, KDC_OPT_FORWARDED)) { 71 *status = "FORWARD POLICY"; 72 return KRB5KDC_ERR_POLICY; 73 } 74 #endif 75 76 return 0; /* not against policy */ 77 } 78 79 80 81 82 83 84 85