1 /* 2 * kdc/policy.c 3 * 4 * Copyright 1990 by the Massachusetts Institute of Technology. 5 * 6 * Export of this software from the United States of America may 7 * require a specific license from the United States Government. 8 * It is the responsibility of any person or organization contemplating 9 * export to obtain such a license before exporting. 10 * 11 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 12 * distribute this software and its documentation for any purpose and 13 * without fee is hereby granted, provided that the above copyright 14 * notice appear in all copies and that both that copyright notice and 15 * this permission notice appear in supporting documentation, and that 16 * the name of M.I.T. not be used in advertising or publicity pertaining 17 * to distribution of the software without specific, written prior 18 * permission. Furthermore if you modify this software you must label 19 * your software as modified software and not distribute it in such a 20 * fashion that it might be confused with the original M.I.T. software. 21 * M.I.T. makes no representations about the suitability of 22 * this software for any purpose. It is provided "as is" without express 23 * or implied warranty. 24 * 25 * 26 * Policy decision routines for KDC. 27 */ 28 29 #include "k5-int.h" 30 #include "kdc_util.h" 31 32 int 33 against_local_policy_as(register krb5_kdc_req *request, krb5_db_entry client, 34 krb5_db_entry server, krb5_timestamp kdc_time, 35 const char **status) 36 { 37 #if 0 38 /* An AS request must include the addresses field */ 39 if (request->addresses == 0) { 40 *status = "NO ADDRESS"; 41 return KRB5KDC_ERR_POLICY; 42 } 43 #endif 44 45 return 0; /* not against policy */ 46 } 47 48 /* 49 * This is where local policy restrictions for the TGS should placed. 50 */ 51 krb5_error_code 52 against_local_policy_tgs(register krb5_kdc_req *request, krb5_db_entry server, 53 krb5_ticket *ticket, const char **status) 54 { 55 #if 0 56 /* 57 * For example, if your site wants to disallow ticket forwarding, 58 * you might do something like this: 59 */ 60 61 if (isflagset(request->kdc_options, KDC_OPT_FORWARDED)) { 62 *status = "FORWARD POLICY"; 63 return KRB5KDC_ERR_POLICY; 64 } 65 #endif 66 67 return 0; /* not against policy */ 68 } 69 70 71 72 73 74 75 76