1 /* 2 * Copyright 2017 Gary Mills 3 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 4 * Use is subject to license terms. 5 */ 6 7 /* 8 * kadmin/ldap_util/kdb5_ldap_realm.c 9 * 10 * Copyright 1990,1991,2001, 2002 by the Massachusetts Institute of Technology. 11 * All Rights Reserved. 12 * 13 * Export of this software from the United States of America may 14 * require a specific license from the United States Government. 15 * It is the responsibility of any person or organization contemplating 16 * export to obtain such a license before exporting. 17 * 18 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 19 * distribute this software and its documentation for any purpose and 20 * without fee is hereby granted, provided that the above copyright 21 * notice appear in all copies and that both that copyright notice and 22 * this permission notice appear in supporting documentation, and that 23 * the name of M.I.T. not be used in advertising or publicity pertaining 24 * to distribution of the software without specific, written prior 25 * permission. Furthermore if you modify this software you must label 26 * your software as modified software and not distribute it in such a 27 * fashion that it might be confused with the original M.I.T. software. 28 * M.I.T. makes no representations about the suitability of 29 * this software for any purpose. It is provided "as is" without express 30 * or implied warranty. 31 */ 32 33 /* 34 * Copyright (C) 1998 by the FundsXpress, INC. 35 * 36 * All rights reserved. 37 * 38 * Export of this software from the United States of America may require 39 * a specific license from the United States Government. It is the 40 * responsibility of any person or organization contemplating export to 41 * obtain such a license before exporting. 42 * 43 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 44 * distribute this software and its documentation for any purpose and 45 * without fee is hereby granted, provided that the above copyright 46 * notice appear in all copies and that both that copyright notice and 47 * this permission notice appear in supporting documentation, and that 48 * the name of FundsXpress. not be used in advertising or publicity pertaining 49 * to distribution of the software without specific, written prior 50 * permission. FundsXpress makes no representations about the suitability of 51 * this software for any purpose. It is provided "as is" without express 52 * or implied warranty. 53 * 54 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 55 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 56 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 57 */ 58 59 /* Copyright (c) 2004-2005, Novell, Inc. 60 * All rights reserved. 61 * 62 * Redistribution and use in source and binary forms, with or without 63 * modification, are permitted provided that the following conditions are met: 64 * 65 * * Redistributions of source code must retain the above copyright notice, 66 * this list of conditions and the following disclaimer. 67 * * Redistributions in binary form must reproduce the above copyright 68 * notice, this list of conditions and the following disclaimer in the 69 * documentation and/or other materials provided with the distribution. 70 * * The copyright holder's name is not used to endorse or promote products 71 * derived from this software without specific prior written permission. 72 * 73 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 74 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 75 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 76 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 77 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 78 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 79 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 80 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 81 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 82 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 83 * POSSIBILITY OF SUCH DAMAGE. 84 */ 85 86 /* 87 * Create / Modify / Destroy / View / List realm(s) 88 */ 89 90 /* Needed for getting the definition of KRB5_TL_DB_ARGS */ 91 #define SECURID 92 93 #include <stdio.h> 94 #include <k5-int.h> 95 #include <kadm5/admin.h> 96 #include <libintl.h> 97 #include <locale.h> 98 #include "kdb5_ldap_util.h" 99 #include "kdb5_ldap_list.h" 100 #include <ldap_principal.h> 101 #include <ldap_krbcontainer.h> 102 extern time_t get_date(char *); /* kadmin/cli/getdate.o */ 103 104 char *yes = "yes\n"; /* \n to compare against result of fgets */ 105 krb5_key_salt_tuple def_kslist = {ENCTYPE_DES_CBC_CRC, KRB5_KDB_SALTTYPE_NORMAL}; 106 107 struct realm_info rblock = { 108 KRB5_KDB_MAX_LIFE, 109 KRB5_KDB_MAX_RLIFE, 110 KRB5_KDB_EXPIRATION, 111 KRB5_KDB_DEF_FLAGS, 112 (krb5_keyblock *) NULL, 113 1, 114 &def_kslist 115 }; 116 117 krb5_data tgt_princ_entries[] = { 118 {0, KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME}, 119 {0, 0, 0} }; 120 121 krb5_data db_creator_entries[] = { 122 {0, sizeof("db_creation")-1, "db_creation"} }; 123 124 125 static krb5_principal_data db_create_princ = { 126 0, /* magic number */ 127 {0, 0, 0}, /* krb5_data realm */ 128 db_creator_entries, /* krb5_data *data */ 129 1, /* int length */ 130 KRB5_NT_SRV_INST /* int type */ 131 }; 132 133 extern char *mkey_password; 134 extern char *progname; 135 extern kadm5_config_params global_params; 136 137 static void print_realm_params(krb5_ldap_realm_params *rparams, int mask); 138 static int kdb_ldap_create_principal (krb5_context context, krb5_principal 139 princ, enum ap_op op, struct realm_info *pblock); 140 141 142 static char *strdur(time_t duration); 143 static int get_ticket_policy(krb5_ldap_realm_params *rparams, int *i, char *argv[],int argc); 144 static krb5_error_code krb5_dbe_update_mod_princ_data_new (krb5_context context, krb5_db_entry *entry, krb5_timestamp mod_date, krb5_const_principal mod_princ); 145 static krb5_error_code krb5_dbe_update_tl_data_new ( krb5_context context, krb5_db_entry *entry, krb5_tl_data *new_tl_data); 146 147 #define ADMIN_LIFETIME 60*60*3 /* 3 hours */ 148 #define CHANGEPW_LIFETIME 60*5 /* 5 minutes */ 149 150 static int get_ticket_policy(rparams,i,argv,argc) 151 krb5_ldap_realm_params *rparams; 152 int *i; 153 char *argv[]; 154 int argc; 155 { 156 time_t date; 157 time_t now; 158 int mask = 0; 159 krb5_error_code retval = 0; 160 161 /* Solaris Kerberos */ 162 char *me = progname; 163 164 time(&now); 165 if (!strcmp(argv[*i], "-maxtktlife")) { 166 if (++(*i) > argc-1) 167 goto err; 168 date = get_date(argv[*i]); 169 if (date == (time_t)(-1)) { 170 retval = EINVAL; 171 com_err (me, retval, gettext("while providing time specification")); 172 goto err; 173 } 174 rparams->max_life = date-now; 175 mask |= LDAP_REALM_MAXTICKETLIFE; 176 } 177 178 179 else if (!strcmp(argv[*i], "-maxrenewlife")) { 180 if (++(*i) > argc-1) 181 goto err; 182 183 date = get_date(argv[*i]); 184 if (date == (time_t)(-1)) { 185 retval = EINVAL; 186 com_err (me, retval, gettext("while providing time specification")); 187 goto err; 188 } 189 rparams->max_renewable_life = date-now; 190 mask |= LDAP_REALM_MAXRENEWLIFE; 191 } else if (!strcmp((argv[*i] + 1), "allow_postdated")) { 192 if (*(argv[*i]) == '+') 193 rparams->tktflags &= (int)(~KRB5_KDB_DISALLOW_POSTDATED); 194 else if (*(argv[*i]) == '-') 195 rparams->tktflags |= KRB5_KDB_DISALLOW_POSTDATED; 196 else 197 goto err; 198 199 mask |= LDAP_REALM_KRBTICKETFLAGS; 200 } else if (!strcmp((argv[*i] + 1), "allow_forwardable")) { 201 if (*(argv[*i]) == '+') 202 rparams->tktflags &= (int)(~KRB5_KDB_DISALLOW_FORWARDABLE); 203 204 else if (*(argv[*i]) == '-') 205 rparams->tktflags |= KRB5_KDB_DISALLOW_FORWARDABLE; 206 else 207 goto err; 208 209 mask |= LDAP_REALM_KRBTICKETFLAGS; 210 } else if (!strcmp((argv[*i] + 1), "allow_renewable")) { 211 if (*(argv[*i]) == '+') 212 rparams->tktflags &= (int)(~KRB5_KDB_DISALLOW_RENEWABLE); 213 else if (*(argv[*i]) == '-') 214 rparams->tktflags |= KRB5_KDB_DISALLOW_RENEWABLE; 215 else 216 goto err; 217 218 mask |= LDAP_REALM_KRBTICKETFLAGS; 219 } else if (!strcmp((argv[*i] + 1), "allow_proxiable")) { 220 if (*(argv[*i]) == '+') 221 rparams->tktflags &= (int)(~KRB5_KDB_DISALLOW_PROXIABLE); 222 else if (*(argv[*i]) == '-') 223 rparams->tktflags |= KRB5_KDB_DISALLOW_PROXIABLE; 224 else 225 goto err; 226 227 mask |= LDAP_REALM_KRBTICKETFLAGS; 228 } else if (!strcmp((argv[*i] + 1), "allow_dup_skey")) { 229 if (*(argv[*i]) == '+') 230 rparams->tktflags &= (int)(~KRB5_KDB_DISALLOW_DUP_SKEY); 231 else if (*(argv[*i]) == '-') 232 rparams->tktflags |= KRB5_KDB_DISALLOW_DUP_SKEY; 233 else 234 goto err; 235 236 mask |= LDAP_REALM_KRBTICKETFLAGS; 237 } 238 239 else if (!strcmp((argv[*i] + 1), "requires_preauth")) { 240 if (*(argv[*i]) == '+') 241 rparams->tktflags |= KRB5_KDB_REQUIRES_PRE_AUTH; 242 else if (*(argv[*i]) == '-') 243 rparams->tktflags &= (int)(~KRB5_KDB_REQUIRES_PRE_AUTH); 244 else 245 goto err; 246 247 mask |= LDAP_REALM_KRBTICKETFLAGS; 248 } else if (!strcmp((argv[*i] + 1), "requires_hwauth")) { 249 if (*(argv[*i]) == '+') 250 rparams->tktflags |= KRB5_KDB_REQUIRES_HW_AUTH; 251 else if (*(argv[*i]) == '-') 252 rparams->tktflags &= (int)(~KRB5_KDB_REQUIRES_HW_AUTH); 253 else 254 goto err; 255 256 mask |= LDAP_REALM_KRBTICKETFLAGS; 257 } else if (!strcmp((argv[*i] + 1), "allow_svr")) { 258 if (*(argv[*i]) == '+') 259 rparams->tktflags &= (int)(~KRB5_KDB_DISALLOW_SVR); 260 else if (*(argv[*i]) == '-') 261 rparams->tktflags |= KRB5_KDB_DISALLOW_SVR; 262 else 263 goto err; 264 265 mask |= LDAP_REALM_KRBTICKETFLAGS; 266 } else if (!strcmp((argv[*i] + 1), "allow_tgs_req")) { 267 if (*(argv[*i]) == '+') 268 rparams->tktflags &= (int)(~KRB5_KDB_DISALLOW_TGT_BASED); 269 else if (*(argv[*i]) == '-') 270 rparams->tktflags |= KRB5_KDB_DISALLOW_TGT_BASED; 271 else 272 goto err; 273 274 mask |= LDAP_REALM_KRBTICKETFLAGS; 275 } else if (!strcmp((argv[*i] + 1), "allow_tix")) { 276 if (*(argv[*i]) == '+') 277 rparams->tktflags &= (int)(~KRB5_KDB_DISALLOW_ALL_TIX); 278 else if (*(argv[*i]) == '-') 279 rparams->tktflags |= KRB5_KDB_DISALLOW_ALL_TIX; 280 else 281 goto err; 282 283 mask |= LDAP_REALM_KRBTICKETFLAGS; 284 } else if (!strcmp((argv[*i] + 1), "needchange")) { 285 if (*(argv[*i]) == '+') 286 rparams->tktflags |= KRB5_KDB_REQUIRES_PWCHANGE; 287 else if (*(argv[*i]) == '-') 288 rparams->tktflags &= (int)(~KRB5_KDB_REQUIRES_PWCHANGE); 289 else 290 goto err; 291 292 mask |= LDAP_REALM_KRBTICKETFLAGS; 293 } else if (!strcmp((argv[*i] + 1), "password_changing_service")) { 294 if (*(argv[*i]) == '+') 295 rparams->tktflags |= KRB5_KDB_PWCHANGE_SERVICE; 296 else if (*(argv[*i]) == '-') 297 rparams->tktflags &= (int)(~KRB5_KDB_PWCHANGE_SERVICE); 298 else 299 goto err; 300 301 mask |=LDAP_REALM_KRBTICKETFLAGS; 302 } 303 304 err: 305 306 return mask; 307 } 308 309 /* 310 * This function will create a realm on the LDAP Server, with 311 * the specified attributes. 312 */ 313 void kdb5_ldap_create(argc, argv) 314 int argc; 315 char *argv[]; 316 { 317 krb5_error_code retval = 0; 318 krb5_keyblock master_keyblock; 319 krb5_ldap_realm_params *rparams = NULL; 320 krb5_principal master_princ = NULL; 321 kdb5_dal_handle *dal_handle = NULL; 322 krb5_ldap_context *ldap_context=NULL; 323 krb5_boolean realm_obj_created = FALSE; 324 krb5_boolean create_complete = FALSE; 325 krb5_boolean print_usage = FALSE; 326 krb5_boolean no_msg = FALSE; 327 char *oldcontainerref=NULL; 328 char pw_str[1024]; 329 int do_stash = 0; 330 int i = 0; 331 int mask = 0, ret_mask = 0; 332 char **list = NULL; 333 #ifdef HAVE_EDIRECTORY 334 int rightsmask = 0; 335 #endif 336 337 memset(&master_keyblock, 0, sizeof(master_keyblock)); 338 339 rparams = (krb5_ldap_realm_params *)malloc( 340 sizeof(krb5_ldap_realm_params)); 341 if (rparams == NULL) { 342 retval = ENOMEM; 343 goto cleanup; 344 } 345 memset(rparams, 0, sizeof(krb5_ldap_realm_params)); 346 347 /* Parse the arguments */ 348 for (i = 1; i < argc; i++) { 349 if (!strcmp(argv[i], "-subtrees")) { 350 if (++i > argc-1) 351 goto err_usage; 352 353 if(strncmp(argv[i], "", strlen(argv[i]))!=0) { 354 list = (char **) calloc(MAX_LIST_ENTRIES, sizeof(char *)); 355 if (list == NULL) { 356 retval = ENOMEM; 357 goto cleanup; 358 } 359 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list))) { 360 free(list); 361 list = NULL; 362 goto cleanup; 363 } 364 365 rparams->subtreecount=0; 366 while(list[rparams->subtreecount]!=NULL) 367 (rparams->subtreecount)++; 368 rparams->subtree = list; 369 } else if(strncmp(argv[i], "", strlen(argv[i]))==0) { 370 /* dont allow subtree value to be set at the root(NULL, "") of the tree */ 371 /* Solaris Kerberos */ 372 com_err(progname, EINVAL, 373 gettext("for subtree while creating realm '%s'"), 374 global_params.realm); 375 goto err_nomsg; 376 } 377 rparams->subtree[rparams->subtreecount] = NULL; 378 mask |= LDAP_REALM_SUBTREE; 379 } else if (!strcmp(argv[i], "-containerref")) { 380 if (++i > argc-1) 381 goto err_usage; 382 if(strncmp(argv[i], "", strlen(argv[i]))==0) { 383 /* dont allow containerref value to be set at the root(NULL, "") of the tree */ 384 /* Solaris Kerberos */ 385 com_err(progname, EINVAL, 386 gettext("for container reference while creating realm '%s'"), 387 global_params.realm); 388 goto err_nomsg; 389 } 390 rparams->containerref = strdup(argv[i]); 391 if (rparams->containerref == NULL) { 392 retval = ENOMEM; 393 goto cleanup; 394 } 395 mask |= LDAP_REALM_CONTREF; 396 } else if (!strcmp(argv[i], "-sscope")) { 397 if (++i > argc-1) 398 goto err_usage; 399 /* Possible values for search scope are 400 * one (or 1) and sub (or 2) 401 */ 402 if (!strcasecmp(argv[i], "one")) { 403 rparams->search_scope = 1; 404 } else if (!strcasecmp(argv[i], "sub")) { 405 rparams->search_scope = 2; 406 } else { 407 rparams->search_scope = atoi(argv[i]); 408 if ((rparams->search_scope != 1) && 409 (rparams->search_scope != 2)) { 410 /* Solaris Kerberos */ 411 com_err(progname, EINVAL, 412 gettext("invalid search scope while creating realm '%s'"), 413 global_params.realm); 414 goto err_nomsg; 415 } 416 } 417 mask |= LDAP_REALM_SEARCHSCOPE; 418 } 419 #ifdef HAVE_EDIRECTORY 420 else if (!strcmp(argv[i], "-kdcdn")) { 421 if (++i > argc-1) 422 goto err_usage; 423 rparams->kdcservers = (char **)malloc( 424 sizeof(char *) * MAX_LIST_ENTRIES); 425 if (rparams->kdcservers == NULL) { 426 retval = ENOMEM; 427 goto cleanup; 428 } 429 memset(rparams->kdcservers, 0, sizeof(char*)*MAX_LIST_ENTRIES); 430 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, 431 rparams->kdcservers))) { 432 goto cleanup; 433 } 434 mask |= LDAP_REALM_KDCSERVERS; 435 } else if (!strcmp(argv[i], "-admindn")) { 436 if (++i > argc-1) 437 goto err_usage; 438 rparams->adminservers = (char **)malloc( 439 sizeof(char *) * MAX_LIST_ENTRIES); 440 if (rparams->adminservers == NULL) { 441 retval = ENOMEM; 442 goto cleanup; 443 } 444 memset(rparams->adminservers, 0, sizeof(char*)*MAX_LIST_ENTRIES); 445 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, 446 rparams->adminservers))) { 447 goto cleanup; 448 } 449 mask |= LDAP_REALM_ADMINSERVERS; 450 } else if (!strcmp(argv[i], "-pwddn")) { 451 if (++i > argc-1) 452 goto err_usage; 453 rparams->passwdservers = (char **)malloc( 454 sizeof(char *) * MAX_LIST_ENTRIES); 455 if (rparams->passwdservers == NULL) { 456 retval = ENOMEM; 457 goto cleanup; 458 } 459 memset(rparams->passwdservers, 0, sizeof(char*)*MAX_LIST_ENTRIES); 460 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, 461 rparams->passwdservers))) { 462 goto cleanup; 463 } 464 mask |= LDAP_REALM_PASSWDSERVERS; 465 } 466 #endif 467 else if (!strcmp(argv[i], "-s")) { 468 do_stash = 1; 469 } else if ((ret_mask= get_ticket_policy(rparams,&i,argv,argc)) !=0) { 470 mask|=ret_mask; 471 } 472 473 else { 474 printf(gettext("'%s' is an invalid option\n"), argv[i]); 475 goto err_usage; 476 } 477 } 478 479 /* If the default enctype/salttype is not provided, use the 480 * default values and also add to the list of supported 481 * enctypes/salttype 482 */ 483 484 rblock.max_life = global_params.max_life; 485 rblock.max_rlife = global_params.max_rlife; 486 rblock.expiration = global_params.expiration; 487 rblock.flags = global_params.flags; 488 rblock.nkslist = global_params.num_keysalts; 489 rblock.kslist = global_params.keysalts; 490 491 krb5_princ_set_realm_data(util_context, &db_create_princ, global_params.realm); 492 krb5_princ_set_realm_length(util_context, &db_create_princ, strlen(global_params.realm)); 493 494 printf(gettext("Initializing database for realm '%s'\n"), global_params.realm); 495 496 if (!mkey_password) { 497 unsigned int pw_size; 498 printf(gettext("You will be prompted for the database Master Password.\n")); 499 printf(gettext("It is important that you NOT FORGET this password.\n")); 500 fflush(stdout); 501 502 pw_size = sizeof (pw_str); 503 memset(pw_str, 0, pw_size); 504 505 retval = krb5_read_password(util_context, KRB5_KDC_MKEY_1, KRB5_KDC_MKEY_2, 506 pw_str, &pw_size); 507 if (retval) { 508 /* Solaris Kerberos */ 509 com_err(progname, retval, gettext("while reading master key from keyboard")); 510 goto err_nomsg; 511 } 512 mkey_password = pw_str; 513 } 514 515 rparams->mkey.enctype = global_params.enctype; 516 /* We are sure that 'mkey_password' is a regular string ... */ 517 rparams->mkey.length = strlen(mkey_password) + 1; 518 rparams->mkey.contents = (krb5_octet *)strdup(mkey_password); 519 if (rparams->mkey.contents == NULL) { 520 retval = ENOMEM; 521 goto cleanup; 522 } 523 524 rparams->realm_name = strdup(global_params.realm); 525 if (rparams->realm_name == NULL) { 526 retval = ENOMEM; 527 /* Solaris Kerberos */ 528 com_err(progname, ENOMEM, gettext("while creating realm '%s'"), 529 global_params.realm); 530 goto err_nomsg; 531 } 532 533 dal_handle = (kdb5_dal_handle *) util_context->db_context; 534 ldap_context = (krb5_ldap_context *) dal_handle->db_context; 535 if (!ldap_context) { 536 retval = EINVAL; 537 goto cleanup; 538 } 539 540 /* read the kerberos container */ 541 if ((retval=krb5_ldap_read_krbcontainer_params (util_context, 542 &(ldap_context->krbcontainer))) == KRB5_KDB_NOENTRY) { 543 /* Prompt the user for entering the DN of Kerberos container */ 544 char krb_location[MAX_KRB_CONTAINER_LEN]; 545 krb5_ldap_krbcontainer_params kparams; 546 int krb_location_len = 0; 547 memset(&kparams, 0, sizeof(kparams)); 548 549 /* Read the kerberos container location from configuration file */ 550 if (ldap_context->conf_section) { 551 if ((retval=profile_get_string(util_context->profile, 552 KDB_MODULE_SECTION, ldap_context->conf_section, 553 "ldap_kerberos_container_dn", NULL, 554 &kparams.DN)) != 0) { 555 goto cleanup; 556 } 557 } 558 if (kparams.DN == NULL) { 559 if ((retval=profile_get_string(util_context->profile, 560 KDB_MODULE_DEF_SECTION, 561 "ldap_kerberos_container_dn", NULL, 562 NULL, &kparams.DN)) != 0) { 563 goto cleanup; 564 } 565 } 566 567 printf(gettext("\nKerberos container is missing. Creating now...\n")); 568 if (kparams.DN == NULL) { 569 #ifdef HAVE_EDIRECTORY 570 printf(gettext("Enter DN of Kerberos container [cn=Kerberos,cn=Security]: ")); 571 #else 572 printf(gettext("Enter DN of Kerberos container: ")); 573 #endif 574 if (fgets(krb_location, MAX_KRB_CONTAINER_LEN, stdin) != NULL) { 575 /* Remove the newline character at the end */ 576 krb_location_len = strlen(krb_location); 577 if ((krb_location[krb_location_len - 1] == '\n') || 578 (krb_location[krb_location_len - 1] == '\r')) { 579 krb_location[krb_location_len - 1] = '\0'; 580 krb_location_len--; 581 } 582 /* If the user has not given any input, take the default location */ 583 else if (krb_location[0] == '\0') 584 kparams.DN = NULL; 585 else 586 kparams.DN = krb_location; 587 } else 588 kparams.DN = NULL; 589 } 590 591 /* create the kerberos container */ 592 retval = krb5_ldap_create_krbcontainer(util_context, 593 ((kparams.DN != NULL) ? &kparams : NULL)); 594 if (retval) 595 goto cleanup; 596 597 retval = krb5_ldap_read_krbcontainer_params(util_context, 598 &(ldap_context->krbcontainer)); 599 if (retval) { 600 /* Solaris Kerberos */ 601 com_err(progname, retval, gettext("while reading kerberos container information")); 602 goto cleanup; 603 } 604 } else if (retval) { 605 /* Solaris Kerberos */ 606 com_err(progname, retval, gettext("while reading kerberos container information")); 607 goto cleanup; 608 } 609 610 if ((retval = krb5_ldap_create_realm(util_context, 611 /* global_params.realm, */ rparams, mask))) { 612 goto cleanup; 613 } 614 615 /* We just created the Realm container. Here starts our transaction tracking */ 616 realm_obj_created = TRUE; 617 618 if ((retval = krb5_ldap_read_realm_params(util_context, 619 global_params.realm, 620 &(ldap_context->lrparams), 621 &mask))) { 622 /* Solaris Kerberos */ 623 com_err(progname, retval, gettext("while reading information of realm '%s'"), 624 global_params.realm); 625 goto err_nomsg; 626 } 627 ldap_context->lrparams->realm_name = strdup(global_params.realm); 628 if (ldap_context->lrparams->realm_name == NULL) { 629 retval = ENOMEM; 630 goto cleanup; 631 } 632 633 /* assemble & parse the master key name */ 634 if ((retval = krb5_db_setup_mkey_name(util_context, 635 global_params.mkey_name, 636 global_params.realm, 637 0, &master_princ))) { 638 /* Solaris Kerberos */ 639 com_err(progname, retval, gettext("while setting up master key name")); 640 goto err_nomsg; 641 } 642 643 /* Obtain master key from master password */ 644 { 645 krb5_data master_salt, pwd; 646 647 pwd.data = mkey_password; 648 pwd.length = strlen(mkey_password); 649 retval = krb5_principal2salt(util_context, master_princ, &master_salt); 650 if (retval) { 651 /* Solaris Kerberos */ 652 com_err(progname, retval, gettext("while calculating master key salt")); 653 goto err_nomsg; 654 } 655 656 retval = krb5_c_string_to_key(util_context, rparams->mkey.enctype, 657 &pwd, &master_salt, &master_keyblock); 658 659 if (master_salt.data) 660 free(master_salt.data); 661 662 if (retval) { 663 /* Solaris Kerberos */ 664 com_err(progname, retval, gettext("while transforming master key from password")); 665 goto err_nomsg; 666 } 667 668 } 669 670 rblock.key = &master_keyblock; 671 ldap_context->lrparams->mkey = master_keyblock; 672 ldap_context->lrparams->mkey.contents = (krb5_octet *) malloc 673 (master_keyblock.length); 674 if (ldap_context->lrparams->mkey.contents == NULL) { 675 retval = ENOMEM; 676 goto cleanup; 677 } 678 memcpy (ldap_context->lrparams->mkey.contents, master_keyblock.contents, 679 master_keyblock.length); 680 681 /* Create special principals inside the realm subtree */ 682 { 683 char princ_name[MAX_PRINC_SIZE]; 684 krb5_principal_data tgt_princ = { 685 0, /* magic number */ 686 {0, 0, 0}, /* krb5_data realm */ 687 tgt_princ_entries, /* krb5_data *data */ 688 2, /* int length */ 689 KRB5_NT_SRV_INST /* int type */ 690 }; 691 krb5_principal p, temp_p=NULL; 692 693 krb5_princ_set_realm_data(util_context, &tgt_princ, global_params.realm); 694 krb5_princ_set_realm_length(util_context, &tgt_princ, strlen(global_params.realm)); 695 krb5_princ_component(util_context, &tgt_princ,1)->data = global_params.realm; 696 krb5_princ_component(util_context, &tgt_princ,1)->length = strlen(global_params.realm); 697 /* The container reference value is set to NULL, to avoid service principals 698 * getting created within the container reference at realm creation */ 699 if (ldap_context->lrparams->containerref != NULL) { 700 oldcontainerref = ldap_context->lrparams->containerref; 701 ldap_context->lrparams->containerref = NULL; 702 } 703 704 /* Create 'K/M' ... */ 705 rblock.flags |= KRB5_KDB_DISALLOW_ALL_TIX; 706 if ((retval = kdb_ldap_create_principal(util_context, master_princ, MASTER_KEY, &rblock))) { 707 /* Solaris Kerberos */ 708 com_err(progname, retval, gettext("while adding entries to the database")); 709 goto err_nomsg; 710 } 711 712 /* Create 'krbtgt' ... */ 713 rblock.flags = 0; /* reset the flags */ 714 if ((retval = kdb_ldap_create_principal(util_context, &tgt_princ, TGT_KEY, &rblock))) { 715 /* Solaris Kerberos */ 716 com_err(progname, retval, gettext("while adding entries to the database")); 717 goto err_nomsg; 718 } 719 /* 720 * Solaris Kerberos: 721 * The kadmin/admin principal is unused on Solaris. This principal is used 722 * in AUTH_GSSAPI but Solaris doesn't support AUTH_GSSAPI. RPCSEC_GSS can only 723 * be used with host-based principals. 724 * 725 */ 726 #if 0 /* ************ Begin IFDEF'ed OUT ***************************** */ 727 /* Create 'kadmin/admin' ... */ 728 snprintf(princ_name, sizeof(princ_name), "%s@%s", KADM5_ADMIN_SERVICE, global_params.realm); 729 if ((retval = krb5_parse_name(util_context, princ_name, &p))) { 730 /* Solaris Kerberos */ 731 com_err(progname, retval, gettext("while adding entries to the database")); 732 goto err_nomsg; 733 } 734 rblock.max_life = ADMIN_LIFETIME; 735 rblock.flags = KRB5_KDB_DISALLOW_TGT_BASED; 736 if ((retval = kdb_ldap_create_principal(util_context, p, TGT_KEY, &rblock))) { 737 krb5_free_principal(util_context, p); 738 /* Solaris Kerberos */ 739 com_err(progname, retval, gettext("while adding entries to the database")); 740 goto err_nomsg; 741 } 742 krb5_free_principal(util_context, p); 743 #endif /* ************** END IFDEF'ed OUT ***************************** */ 744 745 /* Create 'kadmin/changepw' ... */ 746 snprintf(princ_name, sizeof(princ_name), "%s@%s", KADM5_CHANGEPW_SERVICE, global_params.realm); 747 if ((retval = krb5_parse_name(util_context, princ_name, &p))) { 748 /* Solaris Kerberos */ 749 com_err(progname, retval, gettext("while adding entries to the database")); 750 goto err_nomsg; 751 } 752 rblock.max_life = CHANGEPW_LIFETIME; 753 rblock.flags = KRB5_KDB_DISALLOW_TGT_BASED | KRB5_KDB_PWCHANGE_SERVICE; 754 if ((retval = kdb_ldap_create_principal(util_context, p, TGT_KEY, &rblock))) { 755 krb5_free_principal(util_context, p); 756 /* Solaris Kerberos */ 757 com_err(progname, retval, gettext("while adding entries to the database")); 758 goto err_nomsg; 759 } 760 krb5_free_principal(util_context, p); 761 762 /* Create 'kadmin/history' ... */ 763 snprintf(princ_name, sizeof(princ_name), "%s@%s", KADM5_HIST_PRINCIPAL, global_params.realm); 764 if ((retval = krb5_parse_name(util_context, princ_name, &p))) { 765 /* Solaris Kerberos */ 766 com_err(progname, retval, gettext("while adding entries to the database")); 767 goto err_nomsg; 768 } 769 rblock.max_life = global_params.max_life; 770 rblock.flags = 0; 771 if ((retval = kdb_ldap_create_principal(util_context, p, TGT_KEY, &rblock))) { 772 krb5_free_principal(util_context, p); 773 /* Solaris Kerberos */ 774 com_err(progname, retval, gettext("while adding entries to the database")); 775 goto err_nomsg; 776 } 777 krb5_free_principal(util_context, p); 778 779 /* Create 'kadmin/<hostname>' ... */ 780 if ((retval=krb5_sname_to_principal(util_context, NULL, KADM5_ADMIN_HOST_SERVICE, KRB5_NT_SRV_HST, &p))) { 781 /* Solaris Kerberos */ 782 com_err(progname, retval, gettext("krb5_sname_to_principal, while adding entries to the database")); 783 goto err_nomsg; 784 } 785 786 if ((retval=krb5_copy_principal(util_context, p, &temp_p))) { 787 /* Solaris Kerberos */ 788 com_err(progname, retval, gettext("krb5_copy_principal, while adding entries to the database")); 789 goto err_nomsg; 790 } 791 792 /* change the realm portion to the default realm */ 793 free(temp_p->realm.data); 794 temp_p->realm.length = strlen(util_context->default_realm); 795 temp_p->realm.data = strdup(util_context->default_realm); 796 if (temp_p->realm.data == NULL) { 797 /* Solaris Kerberos */ 798 com_err(progname, ENOMEM, gettext("while adding entries to the database")); 799 goto err_nomsg; 800 } 801 802 rblock.max_life = ADMIN_LIFETIME; 803 rblock.flags = KRB5_KDB_DISALLOW_TGT_BASED; 804 if ((retval = kdb_ldap_create_principal(util_context, temp_p, TGT_KEY, &rblock))) { 805 krb5_free_principal(util_context, p); 806 /* Solaris Kerberos */ 807 com_err(progname, retval, gettext("while adding entries to the database")); 808 goto err_nomsg; 809 } 810 krb5_free_principal(util_context, temp_p); 811 krb5_free_principal(util_context, p); 812 813 /* Solaris Kerberos: Create 'changepw/<hostname>' ... */ 814 if ((retval=krb5_sname_to_principal(util_context, NULL, KADM5_CHANGEPW_HOST_SERVICE, KRB5_NT_SRV_HST, &p))) { 815 /* Solaris Kerberos */ 816 com_err(progname, retval, gettext("krb5_sname_to_principal, while adding entries to the database")); 817 goto err_nomsg; 818 } 819 820 if ((retval=krb5_copy_principal(util_context, p, &temp_p))) { 821 /* Solaris Kerberos */ 822 com_err(progname, retval, gettext("krb5_copy_principal, while adding entries to the database")); 823 goto err_nomsg; 824 } 825 826 /* change the realm portion to the default realm */ 827 free(temp_p->realm.data); 828 temp_p->realm.length = strlen(util_context->default_realm); 829 temp_p->realm.data = strdup(util_context->default_realm); 830 if (temp_p->realm.data == NULL) { 831 /* Solaris Kerberos */ 832 com_err(progname, ENOMEM, gettext("while adding entries to the database")); 833 goto err_nomsg; 834 } 835 836 rblock.max_life = ADMIN_LIFETIME; 837 rblock.flags = KRB5_KDB_DISALLOW_TGT_BASED | KRB5_KDB_PWCHANGE_SERVICE; 838 if ((retval = kdb_ldap_create_principal(util_context, temp_p, TGT_KEY, &rblock))) { 839 krb5_free_principal(util_context, p); 840 /* Solaris Kerberos */ 841 com_err(progname, retval, gettext("while adding entries to the database")); 842 goto err_nomsg; 843 } 844 krb5_free_principal(util_context, temp_p); 845 krb5_free_principal(util_context, p); 846 847 if (oldcontainerref != NULL) { 848 ldap_context->lrparams->containerref = oldcontainerref; 849 oldcontainerref=NULL; 850 } 851 } 852 853 #ifdef HAVE_EDIRECTORY 854 if ((mask & LDAP_REALM_KDCSERVERS) || (mask & LDAP_REALM_ADMINSERVERS) || 855 (mask & LDAP_REALM_PASSWDSERVERS)) { 856 857 printf(gettext("Changing rights for the service object. Please wait ... ")); 858 fflush(stdout); 859 860 rightsmask =0; 861 rightsmask |= LDAP_REALM_RIGHTS; 862 rightsmask |= LDAP_SUBTREE_RIGHTS; 863 if ((rparams != NULL) && (rparams->kdcservers != NULL)) { 864 for (i=0; (rparams->kdcservers[i] != NULL); i++) { 865 if ((retval=krb5_ldap_add_service_rights(util_context, 866 LDAP_KDC_SERVICE, rparams->kdcservers[i], 867 rparams->realm_name, rparams->subtree, rightsmask)) != 0) { 868 printf(gettext("failed\n")); 869 /* Solaris Kerberos */ 870 com_err(progname, retval, gettext("while assigning rights to '%s'"), 871 rparams->realm_name); 872 goto err_nomsg; 873 } 874 } 875 } 876 877 rightsmask = 0; 878 rightsmask |= LDAP_REALM_RIGHTS; 879 rightsmask |= LDAP_SUBTREE_RIGHTS; 880 if ((rparams != NULL) && (rparams->adminservers != NULL)) { 881 for (i=0; (rparams->adminservers[i] != NULL); i++) { 882 if ((retval=krb5_ldap_add_service_rights(util_context, 883 LDAP_ADMIN_SERVICE, rparams->adminservers[i], 884 rparams->realm_name, rparams->subtree, rightsmask)) != 0) { 885 printf(gettext("failed\n")); 886 /* Solaris Kerberos */ 887 com_err(progname, retval, gettext("while assigning rights to '%s'"), 888 rparams->realm_name); 889 goto err_nomsg; 890 } 891 } 892 } 893 894 rightsmask = 0; 895 rightsmask |= LDAP_REALM_RIGHTS; 896 rightsmask |= LDAP_SUBTREE_RIGHTS; 897 if ((rparams != NULL) && (rparams->passwdservers != NULL)) { 898 for (i=0; (rparams->passwdservers[i] != NULL); i++) { 899 if ((retval=krb5_ldap_add_service_rights(util_context, 900 LDAP_PASSWD_SERVICE, rparams->passwdservers[i], 901 rparams->realm_name, rparams->subtree, rightsmask)) != 0) { 902 printf(gettext("failed\n")); 903 /* Solaris Kerberos */ 904 com_err(progname, retval, gettext("while assigning rights to '%s'"), 905 rparams->realm_name); 906 goto err_nomsg; 907 } 908 } 909 } 910 911 printf(gettext("done\n")); 912 } 913 #endif 914 /* The Realm creation is completed. Here is the end of transaction */ 915 create_complete = TRUE; 916 917 /* Stash the master key only if '-s' option is specified */ 918 if (do_stash || global_params.mask & KADM5_CONFIG_STASH_FILE) { 919 retval = krb5_def_store_mkey(util_context, 920 global_params.stash_file, 921 master_princ, 922 &master_keyblock, NULL); 923 if (retval) { 924 /* Solaris Kerberos */ 925 com_err(progname, errno, gettext("while storing key")); 926 printf(gettext("Warning: couldn't stash master key.\n")); 927 } 928 } 929 930 goto cleanup; 931 932 933 err_usage: 934 print_usage = TRUE; 935 936 err_nomsg: 937 no_msg = TRUE; 938 939 cleanup: 940 /* If the Realm creation is not complete, do the roll-back here */ 941 if ((realm_obj_created) && (!create_complete)) 942 krb5_ldap_delete_realm(util_context, global_params.realm); 943 944 if (rparams) 945 krb5_ldap_free_realm_params(rparams); 946 947 memset (pw_str, 0, sizeof (pw_str)); 948 949 if (print_usage) 950 db_usage(CREATE_REALM); 951 952 if (retval) { 953 if (!no_msg) { 954 /* Solaris Kerberos */ 955 com_err(progname, retval, gettext("while creating realm '%s'"), 956 global_params.realm); 957 } 958 exit_status++; 959 } 960 961 return; 962 } 963 964 965 /* 966 * This function will modify the attributes of a given realm object 967 */ 968 void kdb5_ldap_modify(argc, argv) 969 int argc; 970 char *argv[]; 971 { 972 krb5_error_code retval = 0; 973 krb5_ldap_realm_params *rparams = NULL; 974 krb5_boolean print_usage = FALSE; 975 krb5_boolean no_msg = FALSE; 976 kdb5_dal_handle *dal_handle = NULL; 977 krb5_ldap_context *ldap_context=NULL; 978 int i = 0; 979 int mask = 0, rmask = 0, ret_mask = 0; 980 char **slist = {NULL}; 981 #ifdef HAVE_EDIRECTORY 982 int j = 0; 983 char *list[MAX_LIST_ENTRIES]; 984 int existing_entries = 0, list_entries = 0; 985 int newkdcdn = 0, newadmindn = 0, newpwddn = 0; 986 char **tempstr = NULL; 987 char **oldkdcdns = NULL; 988 char **oldadmindns = NULL; 989 char **oldpwddns = NULL; 990 char **newkdcdns = NULL; 991 char **newsubtrees = NULL; 992 char **newadmindns = NULL; 993 char **newpwddns = NULL; 994 char **oldsubtrees = {NULL}; 995 int rightsmask = 0; 996 int subtree_changed = 0; 997 #endif 998 999 dal_handle = (kdb5_dal_handle *) util_context->db_context; 1000 ldap_context = (krb5_ldap_context *) dal_handle->db_context; 1001 if (!(ldap_context)) { 1002 retval = EINVAL; 1003 goto cleanup; 1004 } 1005 1006 if ((retval = krb5_ldap_read_krbcontainer_params(util_context, 1007 &(ldap_context->krbcontainer)))) { 1008 /* Solaris Kerberos */ 1009 com_err(progname, retval, gettext("while reading Kerberos container information")); 1010 goto err_nomsg; 1011 } 1012 1013 retval = krb5_ldap_read_realm_params(util_context, 1014 global_params.realm, &rparams, &rmask); 1015 if (retval) 1016 goto cleanup; 1017 /* Parse the arguments */ 1018 for (i = 1; i < argc; i++) { 1019 int k = 0; 1020 if (!strcmp(argv[i], "-subtrees")) { 1021 if (++i > argc-1) 1022 goto err_usage; 1023 1024 if (rmask & LDAP_REALM_SUBTREE) { 1025 if (rparams->subtree) { 1026 #ifdef HAVE_EDIRECTORY 1027 oldsubtrees = (char **) calloc(rparams->subtreecount+1, sizeof(char *)); 1028 if (oldsubtrees == NULL) { 1029 retval = ENOMEM; 1030 goto cleanup; 1031 } 1032 for(k=0; rparams->subtree[k]!=NULL && rparams->subtreecount; k++) { 1033 oldsubtrees[k] = strdup(rparams->subtree[k]); 1034 if( oldsubtrees[k] == NULL ) { 1035 retval = ENOMEM; 1036 goto cleanup; 1037 } 1038 } 1039 #endif 1040 for(k=0; k<rparams->subtreecount && rparams->subtree[k]; k++) 1041 free(rparams->subtree[k]); 1042 rparams->subtreecount=0; 1043 } 1044 } 1045 if (strncmp(argv[i] ,"", strlen(argv[i]))!=0) { 1046 slist = (char **) calloc(MAX_LIST_ENTRIES, sizeof(char *)); 1047 if (slist == NULL) { 1048 retval = ENOMEM; 1049 goto cleanup; 1050 } 1051 if (( retval = krb5_parse_list(argv[i], LIST_DELIMITER, slist))) { 1052 free(slist); 1053 slist = NULL; 1054 goto cleanup; 1055 } 1056 1057 rparams->subtreecount=0; 1058 while(slist[rparams->subtreecount]!=NULL) 1059 (rparams->subtreecount)++; 1060 rparams->subtree = slist; 1061 } else if(strncmp(argv[i], "", strlen(argv[i]))==0) { 1062 /* dont allow subtree value to be set at the root(NULL, "") of the tree */ 1063 /* Solaris Kerberos */ 1064 com_err(progname, EINVAL, 1065 gettext("for subtree while modifying realm '%s'"), 1066 global_params.realm); 1067 goto err_nomsg; 1068 } 1069 rparams->subtree[rparams->subtreecount] = NULL; 1070 mask |= LDAP_REALM_SUBTREE; 1071 } else if (!strncmp(argv[i], "-containerref", strlen(argv[i]))) { 1072 if (++i > argc-1) 1073 goto err_usage; 1074 if(strncmp(argv[i], "", strlen(argv[i]))==0) { 1075 /* dont allow containerref value to be set at the root(NULL, "") of the tree */ 1076 /* Solaris Kerberos */ 1077 com_err(progname, EINVAL, 1078 gettext("for container reference while modifying realm '%s'"), 1079 global_params.realm); 1080 goto err_nomsg; 1081 } 1082 rparams->containerref = strdup(argv[i]); 1083 if (rparams->containerref == NULL) { 1084 retval = ENOMEM; 1085 goto cleanup; 1086 } 1087 mask |= LDAP_REALM_CONTREF; 1088 } else if (!strcmp(argv[i], "-sscope")) { 1089 if (++i > argc-1) 1090 goto err_usage; 1091 /* Possible values for search scope are 1092 * one (or 1) and sub (or 2) 1093 */ 1094 if (strcasecmp(argv[i], "one") == 0) { 1095 rparams->search_scope = 1; 1096 } else if (strcasecmp(argv[i], "sub") == 0) { 1097 rparams->search_scope = 2; 1098 } else { 1099 rparams->search_scope = atoi(argv[i]); 1100 if ((rparams->search_scope != 1) && 1101 (rparams->search_scope != 2)) { 1102 retval = EINVAL; 1103 /* Solaris Kerberos */ 1104 com_err(progname, retval, 1105 gettext("specified for search scope while modifying information of realm '%s'"), 1106 global_params.realm); 1107 goto err_nomsg; 1108 } 1109 } 1110 mask |= LDAP_REALM_SEARCHSCOPE; 1111 } 1112 #ifdef HAVE_EDIRECTORY 1113 else if (!strcmp(argv[i], "-kdcdn")) { 1114 if (++i > argc-1) 1115 goto err_usage; 1116 1117 if ((rmask & LDAP_REALM_KDCSERVERS) && (rparams->kdcservers)) { 1118 if (!oldkdcdns) { 1119 /* Store the old kdc dns list for removing rights */ 1120 oldkdcdns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1121 if (oldkdcdns == NULL) { 1122 retval = ENOMEM; 1123 goto cleanup; 1124 } 1125 1126 for (j=0; rparams->kdcservers[j] != NULL; j++) { 1127 oldkdcdns[j] = strdup(rparams->kdcservers[j]); 1128 if (oldkdcdns[j] == NULL) { 1129 retval = ENOMEM; 1130 goto cleanup; 1131 } 1132 } 1133 oldkdcdns[j] = NULL; 1134 } 1135 1136 krb5_free_list_entries(rparams->kdcservers); 1137 free(rparams->kdcservers); 1138 } 1139 1140 rparams->kdcservers = (char **)malloc( 1141 sizeof(char *) * MAX_LIST_ENTRIES); 1142 if (rparams->kdcservers == NULL) { 1143 retval = ENOMEM; 1144 goto cleanup; 1145 } 1146 memset(rparams->kdcservers, 0, sizeof(char *)*MAX_LIST_ENTRIES); 1147 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, 1148 rparams->kdcservers))) { 1149 goto cleanup; 1150 } 1151 mask |= LDAP_REALM_KDCSERVERS; 1152 /* Going to replace the existing value by this new value. Hence 1153 * setting flag indicating that add or clear options will be ignored 1154 */ 1155 newkdcdn = 1; 1156 } else if (!strcmp(argv[i], "-clearkdcdn")) { 1157 if (++i > argc-1) 1158 goto err_usage; 1159 if ((!newkdcdn) && (rmask & LDAP_REALM_KDCSERVERS) && (rparams->kdcservers)) { 1160 if (!oldkdcdns) { 1161 /* Store the old kdc dns list for removing rights */ 1162 oldkdcdns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1163 if (oldkdcdns == NULL) { 1164 retval = ENOMEM; 1165 goto cleanup; 1166 } 1167 1168 for (j=0; rparams->kdcservers[j] != NULL; j++) { 1169 oldkdcdns[j] = strdup(rparams->kdcservers[j]); 1170 if (oldkdcdns[j] == NULL) { 1171 retval = ENOMEM; 1172 goto cleanup; 1173 } 1174 } 1175 oldkdcdns[j] = NULL; 1176 } 1177 1178 memset(list, 0, sizeof(char *) * MAX_LIST_ENTRIES); 1179 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list))) { 1180 goto cleanup; 1181 } 1182 list_modify_str_array(&rparams->kdcservers, (const char **)list, 1183 LIST_MODE_DELETE); 1184 mask |= LDAP_REALM_KDCSERVERS; 1185 krb5_free_list_entries(list); 1186 } 1187 } else if (!strcmp(argv[i], "-addkdcdn")) { 1188 if (++i > argc-1) 1189 goto err_usage; 1190 if (!newkdcdn) { 1191 if ((rmask & LDAP_REALM_KDCSERVERS) && (rparams->kdcservers) && (!oldkdcdns)) { 1192 /* Store the old kdc dns list for removing rights */ 1193 oldkdcdns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1194 if (oldkdcdns == NULL) { 1195 retval = ENOMEM; 1196 goto cleanup; 1197 } 1198 1199 for (j = 0; rparams->kdcservers[j] != NULL; j++) { 1200 oldkdcdns[j] = strdup(rparams->kdcservers[j]); 1201 if (oldkdcdns[j] == NULL) { 1202 retval = ENOMEM; 1203 goto cleanup; 1204 } 1205 } 1206 oldkdcdns[j] = NULL; 1207 } 1208 1209 memset(list, 0, sizeof(char *) * MAX_LIST_ENTRIES); 1210 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list))) { 1211 goto cleanup; 1212 } 1213 existing_entries = list_count_str_array(rparams->kdcservers); 1214 list_entries = list_count_str_array(list); 1215 if (rmask & LDAP_REALM_KDCSERVERS) { 1216 tempstr = (char **)realloc( 1217 rparams->kdcservers, 1218 sizeof(char *) * (existing_entries+list_entries+1)); 1219 if (tempstr == NULL) { 1220 retval = ENOMEM; 1221 goto cleanup; 1222 } 1223 rparams->kdcservers = tempstr; 1224 } else { 1225 rparams->kdcservers = (char **)malloc(sizeof(char *) * (list_entries+1)); 1226 if (rparams->kdcservers == NULL) { 1227 retval = ENOMEM; 1228 goto cleanup; 1229 } 1230 memset(rparams->kdcservers, 0, sizeof(char *) * (list_entries+1)); 1231 } 1232 list_modify_str_array(&rparams->kdcservers, (const char **)list, 1233 LIST_MODE_ADD); 1234 mask |= LDAP_REALM_KDCSERVERS; 1235 } 1236 } else if (!strcmp(argv[i], "-admindn")) { 1237 if (++i > argc-1) 1238 goto err_usage; 1239 1240 if ((rmask & LDAP_REALM_ADMINSERVERS) && (rparams->adminservers)) { 1241 if (!oldadmindns) { 1242 /* Store the old admin dns list for removing rights */ 1243 oldadmindns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1244 if (oldadmindns == NULL) { 1245 retval = ENOMEM; 1246 goto cleanup; 1247 } 1248 1249 for (j=0; rparams->adminservers[j] != NULL; j++) { 1250 oldadmindns[j] = strdup(rparams->adminservers[j]); 1251 if (oldadmindns[j] == NULL) { 1252 retval = ENOMEM; 1253 goto cleanup; 1254 } 1255 } 1256 oldadmindns[j] = NULL; 1257 } 1258 1259 krb5_free_list_entries(rparams->adminservers); 1260 free(rparams->adminservers); 1261 } 1262 1263 rparams->adminservers = (char **)malloc( 1264 sizeof(char *) * MAX_LIST_ENTRIES); 1265 if (rparams->adminservers == NULL) { 1266 retval = ENOMEM; 1267 goto cleanup; 1268 } 1269 memset(rparams->adminservers, 0, sizeof(char *)*MAX_LIST_ENTRIES); 1270 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, 1271 rparams->adminservers))) { 1272 goto cleanup; 1273 } 1274 mask |= LDAP_REALM_ADMINSERVERS; 1275 /* Going to replace the existing value by this new value. Hence 1276 * setting flag indicating that add or clear options will be ignored 1277 */ 1278 newadmindn = 1; 1279 } else if (!strcmp(argv[i], "-clearadmindn")) { 1280 if (++i > argc-1) 1281 goto err_usage; 1282 1283 if ((!newadmindn) && (rmask & LDAP_REALM_ADMINSERVERS) && (rparams->adminservers)) { 1284 if (!oldadmindns) { 1285 /* Store the old admin dns list for removing rights */ 1286 oldadmindns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1287 if (oldadmindns == NULL) { 1288 retval = ENOMEM; 1289 goto cleanup; 1290 } 1291 1292 for (j=0; rparams->adminservers[j] != NULL; j++) { 1293 oldadmindns[j] = strdup(rparams->adminservers[j]); 1294 if (oldadmindns[j] == NULL) { 1295 retval = ENOMEM; 1296 goto cleanup; 1297 } 1298 } 1299 oldadmindns[j] = NULL; 1300 } 1301 1302 memset(list, 0, sizeof(char *) * MAX_LIST_ENTRIES); 1303 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list))) { 1304 goto cleanup; 1305 } 1306 list_modify_str_array(&rparams->adminservers, (const char **)list, 1307 LIST_MODE_DELETE); 1308 mask |= LDAP_REALM_ADMINSERVERS; 1309 krb5_free_list_entries(list); 1310 } 1311 } else if (!strcmp(argv[i], "-addadmindn")) { 1312 if (++i > argc-1) 1313 goto err_usage; 1314 if (!newadmindn) { 1315 if ((rmask & LDAP_REALM_ADMINSERVERS) && (rparams->adminservers) && (!oldadmindns)) { 1316 /* Store the old admin dns list for removing rights */ 1317 oldadmindns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1318 if (oldadmindns == NULL) { 1319 retval = ENOMEM; 1320 goto cleanup; 1321 } 1322 1323 for (j=0; rparams->adminservers[j] != NULL; j++) { 1324 oldadmindns[j] = strdup(rparams->adminservers[j]); 1325 if (oldadmindns[j] == NULL) { 1326 retval = ENOMEM; 1327 goto cleanup; 1328 } 1329 } 1330 oldadmindns[j] = NULL; 1331 } 1332 1333 memset(list, 0, sizeof(char *) * MAX_LIST_ENTRIES); 1334 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list))) { 1335 goto cleanup; 1336 } 1337 existing_entries = list_count_str_array(rparams->adminservers); 1338 list_entries = list_count_str_array(list); 1339 if (rmask & LDAP_REALM_ADMINSERVERS) { 1340 tempstr = (char **)realloc( 1341 rparams->adminservers, 1342 sizeof(char *) * (existing_entries+list_entries+1)); 1343 if (tempstr == NULL) { 1344 retval = ENOMEM; 1345 goto cleanup; 1346 } 1347 rparams->adminservers = tempstr; 1348 } else { 1349 rparams->adminservers = (char **)malloc(sizeof(char *) * (list_entries+1)); 1350 if (rparams->adminservers == NULL) { 1351 retval = ENOMEM; 1352 goto cleanup; 1353 } 1354 memset(rparams->adminservers, 0, sizeof(char *) * (list_entries+1)); 1355 } 1356 list_modify_str_array(&rparams->adminservers, (const char **)list, 1357 LIST_MODE_ADD); 1358 mask |= LDAP_REALM_ADMINSERVERS; 1359 } 1360 } else if (!strcmp(argv[i], "-pwddn")) { 1361 if (++i > argc-1) 1362 goto err_usage; 1363 1364 if ((rmask & LDAP_REALM_PASSWDSERVERS) && (rparams->passwdservers)) { 1365 if (!oldpwddns) { 1366 /* Store the old pwd dns list for removing rights */ 1367 oldpwddns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1368 if (oldpwddns == NULL) { 1369 retval = ENOMEM; 1370 goto cleanup; 1371 } 1372 1373 for (j=0; rparams->passwdservers[j] != NULL; j++) { 1374 oldpwddns[j] = strdup(rparams->passwdservers[j]); 1375 if (oldpwddns[j] == NULL) { 1376 retval = ENOMEM; 1377 goto cleanup; 1378 } 1379 } 1380 oldpwddns[j] = NULL; 1381 } 1382 1383 krb5_free_list_entries(rparams->passwdservers); 1384 free(rparams->passwdservers); 1385 } 1386 1387 rparams->passwdservers = (char **)malloc( 1388 sizeof(char *) * MAX_LIST_ENTRIES); 1389 if (rparams->passwdservers == NULL) { 1390 retval = ENOMEM; 1391 goto cleanup; 1392 } 1393 memset(rparams->passwdservers, 0, sizeof(char *)*MAX_LIST_ENTRIES); 1394 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, 1395 rparams->passwdservers))) { 1396 goto cleanup; 1397 } 1398 mask |= LDAP_REALM_PASSWDSERVERS; 1399 /* Going to replace the existing value by this new value. Hence 1400 * setting flag indicating that add or clear options will be ignored 1401 */ 1402 newpwddn = 1; 1403 } else if (!strcmp(argv[i], "-clearpwddn")) { 1404 if (++i > argc-1) 1405 goto err_usage; 1406 1407 if ((!newpwddn) && (rmask & LDAP_REALM_PASSWDSERVERS) && (rparams->passwdservers)) { 1408 if (!oldpwddns) { 1409 /* Store the old pwd dns list for removing rights */ 1410 oldpwddns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1411 if (oldpwddns == NULL) { 1412 retval = ENOMEM; 1413 goto cleanup; 1414 } 1415 1416 for (j=0; rparams->passwdservers[j] != NULL; j++) { 1417 oldpwddns[j] = strdup(rparams->passwdservers[j]); 1418 if (oldpwddns[j] == NULL) { 1419 retval = ENOMEM; 1420 goto cleanup; 1421 } 1422 } 1423 oldpwddns[j] = NULL; 1424 } 1425 1426 memset(list, 0, sizeof(char *) * MAX_LIST_ENTRIES); 1427 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list))) { 1428 goto cleanup; 1429 } 1430 list_modify_str_array(&rparams->passwdservers, (const char**)list, 1431 LIST_MODE_DELETE); 1432 mask |= LDAP_REALM_PASSWDSERVERS; 1433 krb5_free_list_entries(list); 1434 } 1435 } else if (!strcmp(argv[i], "-addpwddn")) { 1436 if (++i > argc-1) 1437 goto err_usage; 1438 if (!newpwddn) { 1439 if ((rmask & LDAP_REALM_PASSWDSERVERS) && (rparams->passwdservers) && (!oldpwddns)) { 1440 /* Store the old pwd dns list for removing rights */ 1441 oldpwddns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1442 if (oldpwddns == NULL) { 1443 retval = ENOMEM; 1444 goto cleanup; 1445 } 1446 1447 for (j=0; rparams->passwdservers[j] != NULL; j++) { 1448 oldpwddns[j] = strdup(rparams->passwdservers[j]); 1449 if (oldpwddns[j] == NULL) { 1450 retval = ENOMEM; 1451 goto cleanup; 1452 } 1453 } 1454 oldpwddns[j] = NULL; 1455 } 1456 1457 memset(list, 0, sizeof(char *) * MAX_LIST_ENTRIES); 1458 if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list))) { 1459 goto cleanup; 1460 } 1461 existing_entries = list_count_str_array(rparams->passwdservers); 1462 list_entries = list_count_str_array(list); 1463 if (rmask & LDAP_REALM_PASSWDSERVERS) { 1464 tempstr = (char **)realloc( 1465 rparams->passwdservers, 1466 sizeof(char *) * (existing_entries+list_entries+1)); 1467 if (tempstr == NULL) { 1468 retval = ENOMEM; 1469 goto cleanup; 1470 } 1471 rparams->passwdservers = tempstr; 1472 } else { 1473 rparams->passwdservers = (char **)malloc(sizeof(char *) * (list_entries+1)); 1474 if (rparams->passwdservers == NULL) { 1475 retval = ENOMEM; 1476 goto cleanup; 1477 } 1478 memset(rparams->passwdservers, 0, sizeof(char *) * (list_entries+1)); 1479 } 1480 list_modify_str_array(&rparams->passwdservers, (const char**)list, 1481 LIST_MODE_ADD); 1482 mask |= LDAP_REALM_PASSWDSERVERS; 1483 } 1484 } 1485 #endif 1486 else if ((ret_mask= get_ticket_policy(rparams,&i,argv,argc)) !=0) { 1487 mask|=ret_mask; 1488 } else { 1489 printf(gettext("'%s' is an invalid option\n"), argv[i]); 1490 goto err_usage; 1491 } 1492 } 1493 1494 if ((retval = krb5_ldap_modify_realm(util_context, 1495 /* global_params.realm, */ rparams, mask))) { 1496 goto cleanup; 1497 } 1498 1499 #ifdef HAVE_EDIRECTORY 1500 if ((mask & LDAP_REALM_SUBTREE) || (mask & LDAP_REALM_KDCSERVERS) || 1501 (mask & LDAP_REALM_ADMINSERVERS) || (mask & LDAP_REALM_PASSWDSERVERS)) { 1502 1503 printf(gettext("Changing rights for the service object. Please wait ... ")); 1504 fflush(stdout); 1505 1506 if (!(mask & LDAP_REALM_SUBTREE)) { 1507 if (rparams->subtree != NULL) { 1508 for(i=0; rparams->subtree[i]!=NULL;i++) { 1509 oldsubtrees[i] = strdup(rparams->subtree[i]); 1510 if( oldsubtrees[i] == NULL ) { 1511 retval = ENOMEM; 1512 goto cleanup; 1513 } 1514 } 1515 } 1516 } 1517 1518 if ((mask & LDAP_REALM_SUBTREE)) { 1519 int check_subtree = 1; 1520 1521 newsubtrees = (char**) calloc(rparams->subtreecount, sizeof(char*)); 1522 1523 if (newsubtrees == NULL) { 1524 retval = ENOMEM; 1525 goto cleanup; 1526 } 1527 1528 if ( (rparams != NULL) && (rparams->subtree != NULL) ) { 1529 for (j=0; j<rparams->subtreecount && rparams->subtree[j]!= NULL; j++) { 1530 newsubtrees[j] = strdup(rparams->subtree[j]); 1531 if (newsubtrees[j] == NULL) { 1532 retval = ENOMEM; 1533 goto cleanup; 1534 } 1535 } 1536 newsubtrees[j] = NULL; 1537 } 1538 for(j=0;oldsubtrees[j]!=NULL;j++) { 1539 check_subtree = 1; 1540 for(i=0; ( (oldsubtrees[j] && !rparams->subtree[i]) || 1541 (!oldsubtrees[j] && rparams->subtree[i])); i++) { 1542 if(strcasecmp( oldsubtrees[j], rparams->subtree[i]) == 0) { 1543 check_subtree = 0; 1544 continue; 1545 } 1546 } 1547 if (check_subtree != 0) { 1548 subtree_changed=1; 1549 break; 1550 } 1551 } 1552 /* this will return list of the disjoint members */ 1553 disjoint_members( oldsubtrees, newsubtrees); 1554 } 1555 1556 if ((mask & LDAP_REALM_SUBTREE) || (mask & LDAP_REALM_KDCSERVERS)) { 1557 1558 newkdcdns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1559 if (newkdcdns == NULL) { 1560 retval = ENOMEM; 1561 goto cleanup; 1562 } 1563 1564 if ((rparams != NULL) && (rparams->kdcservers != NULL)) { 1565 for (j=0; rparams->kdcservers[j]!= NULL; j++) { 1566 newkdcdns[j] = strdup(rparams->kdcservers[j]); 1567 if (newkdcdns[j] == NULL) { 1568 retval = ENOMEM; 1569 goto cleanup; 1570 } 1571 } 1572 newkdcdns[j] = NULL; 1573 } 1574 1575 if (!subtree_changed) { 1576 disjoint_members(oldkdcdns, newkdcdns); 1577 } else { /* Only the subtrees was changed. Remove the rights on the old subtrees. */ 1578 if (!(mask & LDAP_REALM_KDCSERVERS)) { 1579 1580 oldkdcdns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1581 if (oldkdcdns == NULL) { 1582 retval = ENOMEM; 1583 goto cleanup; 1584 } 1585 1586 if ((rparams != NULL) && (rparams->kdcservers != NULL)) { 1587 for (j=0; rparams->kdcservers[j]!= NULL; j++) { 1588 oldkdcdns[j] = strdup(rparams->kdcservers[j]); 1589 if (oldkdcdns[j] == NULL) { 1590 retval = ENOMEM; 1591 goto cleanup; 1592 } 1593 } 1594 oldkdcdns[j] = NULL; 1595 } 1596 } 1597 } 1598 1599 rightsmask =0; 1600 rightsmask |= LDAP_REALM_RIGHTS; 1601 rightsmask |= LDAP_SUBTREE_RIGHTS; 1602 /* Remove the rights on the old subtrees */ 1603 if (oldkdcdns) { 1604 for (i=0; (oldkdcdns[i] != NULL); i++) { 1605 if ((retval=krb5_ldap_delete_service_rights(util_context, 1606 LDAP_KDC_SERVICE, oldkdcdns[i], 1607 rparams->realm_name, oldsubtrees, rightsmask)) != 0) { 1608 printf(gettext("failed\n")); 1609 /* Solaris Kerberos */ 1610 com_err(progname, retval, gettext("while assigning rights '%s'"), 1611 rparams->realm_name); 1612 goto err_nomsg; 1613 } 1614 } 1615 } 1616 1617 rightsmask =0; 1618 rightsmask |= LDAP_REALM_RIGHTS; 1619 rightsmask |= LDAP_SUBTREE_RIGHTS; 1620 if (newkdcdns) { 1621 for (i=0; (newkdcdns[i] != NULL); i++) { 1622 1623 if ((retval=krb5_ldap_add_service_rights(util_context, 1624 LDAP_KDC_SERVICE, newkdcdns[i], rparams->realm_name, 1625 rparams->subtree, rightsmask)) != 0) { 1626 printf(gettext("failed\n")); 1627 /* Solaris Kerberos */ 1628 com_err(progname, retval, gettext("while assigning rights to '%s'"), 1629 rparams->realm_name); 1630 goto err_nomsg; 1631 } 1632 } 1633 } 1634 } 1635 1636 if ((mask & LDAP_REALM_SUBTREE) || (mask & LDAP_REALM_ADMINSERVERS)) { 1637 1638 newadmindns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1639 if (newadmindns == NULL) { 1640 retval = ENOMEM; 1641 goto cleanup; 1642 } 1643 1644 if ((rparams != NULL) && (rparams->adminservers != NULL)) { 1645 for (j=0; rparams->adminservers[j]!= NULL; j++) { 1646 newadmindns[j] = strdup(rparams->adminservers[j]); 1647 if (newadmindns[j] == NULL) { 1648 retval = ENOMEM; 1649 goto cleanup; 1650 } 1651 } 1652 newadmindns[j] = NULL; 1653 } 1654 1655 if (!subtree_changed) { 1656 disjoint_members(oldadmindns, newadmindns); 1657 } else { /* Only the subtrees was changed. Remove the rights on the old subtrees. */ 1658 if (!(mask & LDAP_REALM_ADMINSERVERS)) { 1659 1660 oldadmindns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1661 if (oldadmindns == NULL) { 1662 retval = ENOMEM; 1663 goto cleanup; 1664 } 1665 1666 if ((rparams != NULL) && (rparams->adminservers != NULL)) { 1667 for (j=0; rparams->adminservers[j]!= NULL; j++) { 1668 oldadmindns[j] = strdup(rparams->adminservers[j]); 1669 if (oldadmindns[j] == NULL) { 1670 retval = ENOMEM; 1671 goto cleanup; 1672 } 1673 } 1674 oldadmindns[j] = NULL; 1675 } 1676 } 1677 } 1678 1679 rightsmask = 0; 1680 rightsmask |= LDAP_REALM_RIGHTS; 1681 rightsmask |= LDAP_SUBTREE_RIGHTS; 1682 /* Remove the rights on the old subtrees */ 1683 if (oldadmindns) { 1684 for (i=0; (oldadmindns[i] != NULL); i++) { 1685 1686 if ((retval=krb5_ldap_delete_service_rights(util_context, 1687 LDAP_ADMIN_SERVICE, oldadmindns[i], 1688 rparams->realm_name, oldsubtrees, rightsmask)) != 0) { 1689 printf(gettext("failed\n")); 1690 /* Solaris Kerberos */ 1691 com_err(progname, retval, gettext("while assigning rights '%s'"), 1692 rparams->realm_name); 1693 goto err_nomsg; 1694 } 1695 } 1696 } 1697 1698 rightsmask = 0; 1699 rightsmask |= LDAP_REALM_RIGHTS; 1700 rightsmask |= LDAP_SUBTREE_RIGHTS; 1701 /* Add rights on the new subtree for all the kdc dns */ 1702 if (newadmindns) { 1703 for (i=0; (newadmindns[i] != NULL); i++) { 1704 1705 if ((retval=krb5_ldap_add_service_rights(util_context, 1706 LDAP_ADMIN_SERVICE, newadmindns[i], 1707 rparams->realm_name, rparams->subtree, rightsmask)) != 0) { 1708 printf(gettext("failed\n")); 1709 /* Solaris Kerberos */ 1710 com_err(progname, retval, gettext("while assigning rights to '%s'"), 1711 rparams->realm_name); 1712 goto err_nomsg; 1713 } 1714 } 1715 } 1716 } 1717 1718 1719 if ((mask & LDAP_REALM_SUBTREE) || (mask & LDAP_REALM_PASSWDSERVERS)) { 1720 1721 newpwddns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1722 if (newpwddns == NULL) { 1723 retval = ENOMEM; 1724 goto cleanup; 1725 } 1726 1727 if ((rparams != NULL) && (rparams->passwdservers != NULL)) { 1728 for (j=0; rparams->passwdservers[j]!= NULL; j++) { 1729 newpwddns[j] = strdup(rparams->passwdservers[j]); 1730 if (newpwddns[j] == NULL) { 1731 retval = ENOMEM; 1732 goto cleanup; 1733 } 1734 } 1735 newpwddns[j] = NULL; 1736 } 1737 1738 if (!subtree_changed) { 1739 disjoint_members(oldpwddns, newpwddns); 1740 } else { /* Only the subtrees was changed. Remove the rights on the old subtrees. */ 1741 if (!(mask & LDAP_REALM_ADMINSERVERS)) { 1742 1743 oldpwddns = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*)); 1744 if (oldpwddns == NULL) { 1745 retval = ENOMEM; 1746 goto cleanup; 1747 } 1748 1749 if ((rparams != NULL) && (rparams->passwdservers != NULL)) { 1750 for (j=0; rparams->passwdservers[j]!= NULL; j++) { 1751 oldpwddns[j] = strdup(rparams->passwdservers[j]); 1752 if (oldpwddns[j] == NULL) { 1753 retval = ENOMEM; 1754 goto cleanup; 1755 } 1756 } 1757 oldpwddns[j] = NULL; 1758 } 1759 } 1760 } 1761 1762 rightsmask =0; 1763 rightsmask |= LDAP_REALM_RIGHTS; 1764 rightsmask |= LDAP_SUBTREE_RIGHTS; 1765 /* Remove the rights on the old subtrees */ 1766 if (oldpwddns) { 1767 for (i=0; (oldpwddns[i] != NULL); i++) { 1768 if ((retval = krb5_ldap_delete_service_rights(util_context, 1769 LDAP_PASSWD_SERVICE, oldpwddns[i], 1770 rparams->realm_name, oldsubtrees, rightsmask))) { 1771 printf(gettext("failed\n")); 1772 /* Solaris Kerberos */ 1773 com_err(progname, retval, gettext("while assigning rights '%s'"), 1774 rparams->realm_name); 1775 goto err_nomsg; 1776 } 1777 } 1778 } 1779 1780 rightsmask =0; 1781 rightsmask |= LDAP_REALM_RIGHTS; 1782 rightsmask |= LDAP_SUBTREE_RIGHTS; 1783 /* Add rights on the new subtree for all the kdc dns */ 1784 if (newpwddns) { 1785 for (i=0; (newpwddns[i] != NULL); i++) { 1786 if ((retval = krb5_ldap_add_service_rights(util_context, 1787 LDAP_PASSWD_SERVICE, newpwddns[i], 1788 rparams->realm_name, rparams->subtree, rightsmask))) { 1789 printf(gettext("failed\n")); 1790 /* Solaris Kerberos */ 1791 com_err(progname, retval, gettext("while assigning rights to '%s'"), 1792 rparams->realm_name); 1793 goto err_nomsg; 1794 } 1795 } 1796 } 1797 } 1798 1799 printf(gettext("done\n")); 1800 } 1801 #endif 1802 1803 goto cleanup; 1804 1805 err_usage: 1806 print_usage = TRUE; 1807 1808 err_nomsg: 1809 no_msg = TRUE; 1810 1811 cleanup: 1812 krb5_ldap_free_realm_params(rparams); 1813 1814 1815 #ifdef HAVE_EDIRECTORY 1816 if (oldkdcdns) { 1817 for (i=0; oldkdcdns[i] != NULL; i++) 1818 free(oldkdcdns[i]); 1819 free(oldkdcdns); 1820 } 1821 if (oldpwddns) { 1822 for (i=0; oldpwddns[i] != NULL; i++) 1823 free(oldpwddns[i]); 1824 free(oldpwddns); 1825 } 1826 if (oldadmindns) { 1827 for (i=0; oldadmindns[i] != NULL; i++) 1828 free(oldadmindns[i]); 1829 free(oldadmindns); 1830 } 1831 if (newkdcdns) { 1832 for (i=0; newkdcdns[i] != NULL; i++) 1833 free(newkdcdns[i]); 1834 free(newkdcdns); 1835 } 1836 if (newpwddns) { 1837 for (i=0; newpwddns[i] != NULL; i++) 1838 free(newpwddns[i]); 1839 free(newpwddns); 1840 } 1841 if (newadmindns) { 1842 for (i=0; newadmindns[i] != NULL; i++) 1843 free(newadmindns[i]); 1844 free(newadmindns); 1845 } 1846 if (oldsubtrees) { 1847 for (i=0;oldsubtrees[i]!=NULL; i++) 1848 free(oldsubtrees[i]); 1849 free(oldsubtrees); 1850 } 1851 if (newsubtrees) { 1852 for (i=0;newsubtrees[i]!=NULL; i++) 1853 free(newsubtrees[i]); 1854 free(oldsubtrees); 1855 } 1856 #endif 1857 if (print_usage) { 1858 db_usage(MODIFY_REALM); 1859 } 1860 1861 if (retval) { 1862 if (!no_msg) { 1863 /* Solaris Kerberos */ 1864 com_err(progname, retval, gettext("while modifying information of realm '%s'"), 1865 global_params.realm); 1866 } 1867 exit_status++; 1868 } 1869 1870 return; 1871 } 1872 1873 1874 1875 /* 1876 * This function displays the attributes of a Realm 1877 */ 1878 void kdb5_ldap_view(argc, argv) 1879 int argc; 1880 char *argv[]; 1881 { 1882 krb5_ldap_realm_params *rparams = NULL; 1883 krb5_error_code retval = 0; 1884 kdb5_dal_handle *dal_handle=NULL; 1885 krb5_ldap_context *ldap_context=NULL; 1886 int mask = 0; 1887 1888 dal_handle = (kdb5_dal_handle *) util_context->db_context; 1889 ldap_context = (krb5_ldap_context *) dal_handle->db_context; 1890 if (!(ldap_context)) { 1891 retval = EINVAL; 1892 /* Solaris Kerberos */ 1893 com_err(progname, retval, gettext("while initializing database")); 1894 exit_status++; 1895 return; 1896 } 1897 1898 /* Read the kerberos container information */ 1899 if ((retval = krb5_ldap_read_krbcontainer_params(util_context, 1900 &(ldap_context->krbcontainer))) != 0) { 1901 /* Solaris Kerberos */ 1902 com_err(progname, retval, gettext("while reading kerberos container information")); 1903 exit_status++; 1904 return; 1905 } 1906 1907 if ((retval = krb5_ldap_read_realm_params(util_context, 1908 global_params.realm, &rparams, &mask)) || (!rparams)) { 1909 /* Solaris Kerberos */ 1910 com_err(progname, retval, gettext("while reading information of realm '%s'"), 1911 global_params.realm); 1912 exit_status++; 1913 return; 1914 } 1915 print_realm_params(rparams, mask); 1916 krb5_ldap_free_realm_params(rparams); 1917 1918 return; 1919 } 1920 1921 static char *strdur(duration) 1922 time_t duration; 1923 { 1924 static char out[50]; 1925 int neg, days, hours, minutes, seconds; 1926 1927 if (duration < 0) { 1928 duration *= -1; 1929 neg = 1; 1930 } else 1931 neg = 0; 1932 days = duration / (24 * 3600); 1933 duration %= 24 * 3600; 1934 hours = duration / 3600; 1935 duration %= 3600; 1936 minutes = duration / 60; 1937 duration %= 60; 1938 seconds = duration; 1939 snprintf(out, sizeof(out), "%s%d %s %02d:%02d:%02d", neg ? "-" : "", 1940 days, days == 1 ? gettext("day") : gettext("days"), 1941 hours, minutes, seconds); 1942 return out; 1943 } 1944 1945 /* 1946 * This function prints the attributes of a given realm to the 1947 * standard output. 1948 */ 1949 static void print_realm_params(krb5_ldap_realm_params *rparams, int mask) 1950 { 1951 char **slist = NULL; 1952 int num_entry_printed = 0, i = 0; 1953 1954 /* Print the Realm Attributes on the standard output */ 1955 printf("%25s: %-50s\n", gettext("Realm Name"), global_params.realm); 1956 if (mask & LDAP_REALM_SUBTREE) { 1957 for (i=0; rparams->subtree[i]!=NULL; i++) 1958 printf("%25s: %-50s\n", gettext("Subtree"), rparams->subtree[i]); 1959 } 1960 if (mask & LDAP_REALM_CONTREF) 1961 printf("%25s: %-50s\n", gettext("Principal Container Reference"), rparams->containerref); 1962 if (mask & LDAP_REALM_SEARCHSCOPE) { 1963 if ((rparams->search_scope != 1) && 1964 (rparams->search_scope != 2)) { 1965 printf("%25s: %-50s\n", gettext("SearchScope"), gettext("Invalid !")); 1966 } else { 1967 printf("%25s: %-50s\n", gettext("SearchScope"), 1968 (rparams->search_scope == 1) ? gettext("ONE") : gettext("SUB")); 1969 } 1970 } 1971 if (mask & LDAP_REALM_KDCSERVERS) { 1972 printf("%25s:", gettext("KDC Services")); 1973 if (rparams->kdcservers != NULL) { 1974 num_entry_printed = 0; 1975 for (slist = rparams->kdcservers; *slist != NULL; slist++) { 1976 if (num_entry_printed) 1977 printf(" %25s %-50s\n", " ", *slist); 1978 else 1979 printf(" %-50s\n", *slist); 1980 num_entry_printed++; 1981 } 1982 } 1983 if (num_entry_printed == 0) 1984 printf("\n"); 1985 } 1986 if (mask & LDAP_REALM_ADMINSERVERS) { 1987 printf("%25s:", gettext("Admin Services")); 1988 if (rparams->adminservers != NULL) { 1989 num_entry_printed = 0; 1990 for (slist = rparams->adminservers; *slist != NULL; slist++) { 1991 if (num_entry_printed) 1992 printf(" %25s %-50s\n", " ", *slist); 1993 else 1994 printf(" %-50s\n", *slist); 1995 num_entry_printed++; 1996 } 1997 } 1998 if (num_entry_printed == 0) 1999 printf("\n"); 2000 } 2001 if (mask & LDAP_REALM_PASSWDSERVERS) { 2002 printf("%25s:", gettext("Passwd Services")); 2003 if (rparams->passwdservers != NULL) { 2004 num_entry_printed = 0; 2005 for (slist = rparams->passwdservers; *slist != NULL; slist++) { 2006 if (num_entry_printed) 2007 printf(" %25s %-50s\n", " ", *slist); 2008 else 2009 printf(" %-50s\n", *slist); 2010 num_entry_printed++; 2011 } 2012 } 2013 if (num_entry_printed == 0) 2014 printf("\n"); 2015 } 2016 if (mask & LDAP_REALM_MAXTICKETLIFE) { 2017 printf("%25s:", gettext("Maximum Ticket Life")); 2018 printf(" %s \n", strdur(rparams->max_life)); 2019 } 2020 2021 if (mask & LDAP_REALM_MAXRENEWLIFE) { 2022 printf("%25s:", gettext("Maximum Renewable Life")); 2023 printf(" %s \n", strdur(rparams->max_renewable_life)); 2024 } 2025 2026 if (mask & LDAP_REALM_KRBTICKETFLAGS) { 2027 int ticketflags = rparams->tktflags; 2028 2029 printf("%25s: ", gettext("Ticket flags")); 2030 if (ticketflags & KRB5_KDB_DISALLOW_POSTDATED) 2031 printf("%s ","DISALLOW_POSTDATED"); 2032 2033 if (ticketflags & KRB5_KDB_DISALLOW_FORWARDABLE) 2034 printf("%s ","DISALLOW_FORWARDABLE"); 2035 2036 if (ticketflags & KRB5_KDB_DISALLOW_RENEWABLE) 2037 printf("%s ","DISALLOW_RENEWABLE"); 2038 2039 if (ticketflags & KRB5_KDB_DISALLOW_PROXIABLE) 2040 printf("%s ","DISALLOW_PROXIABLE"); 2041 2042 if (ticketflags & KRB5_KDB_DISALLOW_DUP_SKEY) 2043 printf("%s ","DISALLOW_DUP_SKEY"); 2044 2045 if (ticketflags & KRB5_KDB_REQUIRES_PRE_AUTH) 2046 printf("%s ","REQUIRES_PRE_AUTH"); 2047 2048 if (ticketflags & KRB5_KDB_REQUIRES_HW_AUTH) 2049 printf("%s ","REQUIRES_HW_AUTH"); 2050 2051 if (ticketflags & KRB5_KDB_DISALLOW_SVR) 2052 printf("%s ","DISALLOW_SVR"); 2053 2054 if (ticketflags & KRB5_KDB_DISALLOW_TGT_BASED) 2055 printf("%s ","DISALLOW_TGT_BASED"); 2056 2057 if (ticketflags & KRB5_KDB_DISALLOW_ALL_TIX) 2058 printf("%s ","DISALLOW_ALL_TIX"); 2059 2060 if (ticketflags & KRB5_KDB_REQUIRES_PWCHANGE) 2061 printf("%s ","REQUIRES_PWCHANGE"); 2062 2063 if (ticketflags & KRB5_KDB_PWCHANGE_SERVICE) 2064 printf("%s ","PWCHANGE_SERVICE"); 2065 2066 printf("\n"); 2067 } 2068 2069 2070 return; 2071 } 2072 2073 2074 2075 /* 2076 * This function lists the Realm(s) present under the Kerberos container 2077 * on the LDAP Server. 2078 */ 2079 void kdb5_ldap_list(argc, argv) 2080 int argc; 2081 char *argv[]; 2082 { 2083 char **list = NULL; 2084 char **plist = NULL; 2085 krb5_error_code retval = 0; 2086 kdb5_dal_handle *dal_handle=NULL; 2087 krb5_ldap_context *ldap_context=NULL; 2088 2089 dal_handle = (kdb5_dal_handle *)util_context->db_context; 2090 ldap_context = (krb5_ldap_context *) dal_handle->db_context; 2091 if (!(ldap_context)) { 2092 retval = EINVAL; 2093 exit_status++; 2094 return; 2095 } 2096 2097 /* Read the kerberos container information */ 2098 if ((retval = krb5_ldap_read_krbcontainer_params(util_context, 2099 &(ldap_context->krbcontainer))) != 0) { 2100 /* Solaris Kerberos */ 2101 com_err(progname, retval, gettext("while reading kerberos container information")); 2102 exit_status++; 2103 return; 2104 } 2105 2106 retval = krb5_ldap_list_realm(util_context, &list); 2107 if (retval != 0) { 2108 krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer); 2109 ldap_context->krbcontainer = NULL; 2110 /* Solaris Kerberos */ 2111 com_err (progname, retval, gettext("while listing realms")); 2112 exit_status++; 2113 return; 2114 } 2115 /* This is to handle the case of realm not present */ 2116 if (list == NULL) { 2117 krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer); 2118 ldap_context->krbcontainer = NULL; 2119 return; 2120 } 2121 2122 for (plist = list; *plist != NULL; plist++) { 2123 printf("%s\n", *plist); 2124 } 2125 krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer); 2126 ldap_context->krbcontainer = NULL; 2127 krb5_free_list_entries(list); 2128 free(list); 2129 2130 return; 2131 } 2132 2133 /* 2134 * Duplicating the following two functions here because 2135 * 'krb5_dbe_update_tl_data' uses backend specific memory allocation. The catch 2136 * here is that the backend is not initialized - kdb5_ldap_util doesn't go 2137 * through DAL. 2138 * 1. krb5_dbe_update_tl_data 2139 * 2. krb5_dbe_update_mod_princ_data 2140 */ 2141 2142 /* Start duplicate code ... */ 2143 2144 static krb5_error_code 2145 krb5_dbe_update_tl_data_new(context, entry, new_tl_data) 2146 krb5_context context; 2147 krb5_db_entry *entry; 2148 krb5_tl_data *new_tl_data; 2149 { 2150 krb5_tl_data *tl_data = NULL; 2151 krb5_octet *tmp; 2152 2153 /* copy the new data first, so we can fail cleanly if malloc() 2154 * fails */ 2155 /* 2156 if ((tmp = 2157 (krb5_octet *) krb5_db_alloc(context, NULL, 2158 new_tl_data->tl_data_length)) == NULL) 2159 */ 2160 if ((tmp = (krb5_octet *) malloc (new_tl_data->tl_data_length)) == NULL) 2161 return (ENOMEM); 2162 2163 /* Find an existing entry of the specified type and point at 2164 * it, or NULL if not found */ 2165 2166 if (new_tl_data->tl_data_type != KRB5_TL_DB_ARGS) { /* db_args can be multiple */ 2167 for (tl_data = entry->tl_data; tl_data; 2168 tl_data = tl_data->tl_data_next) 2169 if (tl_data->tl_data_type == new_tl_data->tl_data_type) 2170 break; 2171 } 2172 2173 /* if necessary, chain a new record in the beginning and point at it */ 2174 2175 if (!tl_data) { 2176 /* 2177 if ((tl_data = 2178 (krb5_tl_data *) krb5_db_alloc(context, NULL, 2179 sizeof(krb5_tl_data))) 2180 == NULL) { 2181 */ 2182 if ((tl_data = (krb5_tl_data *) malloc (sizeof(krb5_tl_data))) == NULL) { 2183 free(tmp); 2184 return (ENOMEM); 2185 } 2186 memset(tl_data, 0, sizeof(krb5_tl_data)); 2187 tl_data->tl_data_next = entry->tl_data; 2188 entry->tl_data = tl_data; 2189 entry->n_tl_data++; 2190 } 2191 2192 /* fill in the record */ 2193 2194 if (tl_data->tl_data_contents) 2195 krb5_db_free(context, tl_data->tl_data_contents); 2196 2197 tl_data->tl_data_type = new_tl_data->tl_data_type; 2198 tl_data->tl_data_length = new_tl_data->tl_data_length; 2199 tl_data->tl_data_contents = tmp; 2200 memcpy(tmp, new_tl_data->tl_data_contents, tl_data->tl_data_length); 2201 2202 return (0); 2203 } 2204 2205 static krb5_error_code 2206 krb5_dbe_update_mod_princ_data_new(context, entry, mod_date, mod_princ) 2207 krb5_context context; 2208 krb5_db_entry * entry; 2209 krb5_timestamp mod_date; 2210 krb5_const_principal mod_princ; 2211 { 2212 krb5_tl_data tl_data; 2213 2214 krb5_error_code retval = 0; 2215 krb5_octet * nextloc = 0; 2216 char * unparse_mod_princ = 0; 2217 unsigned int unparse_mod_princ_size; 2218 2219 if ((retval = krb5_unparse_name(context, mod_princ, 2220 &unparse_mod_princ))) 2221 return(retval); 2222 2223 unparse_mod_princ_size = strlen(unparse_mod_princ) + 1; 2224 2225 if ((nextloc = (krb5_octet *) malloc(unparse_mod_princ_size + 4)) 2226 == NULL) { 2227 free(unparse_mod_princ); 2228 return(ENOMEM); 2229 } 2230 2231 tl_data.tl_data_type = KRB5_TL_MOD_PRINC; 2232 tl_data.tl_data_length = unparse_mod_princ_size + 4; 2233 tl_data.tl_data_contents = nextloc; 2234 2235 /* Mod Date */ 2236 krb5_kdb_encode_int32(mod_date, nextloc); 2237 2238 /* Mod Princ */ 2239 memcpy(nextloc+4, unparse_mod_princ, unparse_mod_princ_size); 2240 2241 retval = krb5_dbe_update_tl_data_new(context, entry, &tl_data); 2242 2243 free(unparse_mod_princ); 2244 free(nextloc); 2245 2246 return(retval); 2247 } 2248 2249 static krb5_error_code 2250 kdb_ldap_tgt_keysalt_iterate(ksent, ptr) 2251 krb5_key_salt_tuple *ksent; 2252 krb5_pointer ptr; 2253 { 2254 krb5_context context; 2255 krb5_error_code kret; 2256 struct iterate_args *iargs; 2257 krb5_keyblock key; 2258 krb5_int32 ind; 2259 krb5_data pwd; 2260 krb5_db_entry *entry; 2261 2262 iargs = (struct iterate_args *) ptr; 2263 kret = 0; 2264 2265 context = iargs->ctx; 2266 entry = iargs->dbentp; 2267 2268 /* 2269 * Convert the master key password into a key for this particular 2270 * encryption system. 2271 */ 2272 pwd.data = mkey_password; 2273 pwd.length = strlen(mkey_password); 2274 kret = krb5_c_random_seed(context, &pwd); 2275 if (kret) 2276 return kret; 2277 2278 /*if (!(kret = krb5_dbe_create_key_data(iargs->ctx, iargs->dbentp))) {*/ 2279 if ((entry->key_data = 2280 (krb5_key_data *) realloc(entry->key_data, 2281 (sizeof(krb5_key_data) * 2282 (entry->n_key_data + 1)))) == NULL) 2283 return (ENOMEM); 2284 2285 memset(entry->key_data + entry->n_key_data, 0, sizeof(krb5_key_data)); 2286 ind = entry->n_key_data++; 2287 2288 if (!(kret = krb5_c_make_random_key(context, ksent->ks_enctype, 2289 &key))) { 2290 kret = krb5_dbekd_encrypt_key_data(context, 2291 iargs->rblock->key, 2292 &key, 2293 NULL, 2294 1, 2295 &entry->key_data[ind]); 2296 krb5_free_keyblock_contents(context, &key); 2297 } 2298 /*}*/ 2299 2300 return(kret); 2301 } 2302 /* End duplicate code */ 2303 2304 /* 2305 * This function creates service principals when 2306 * creating the realm object. 2307 */ 2308 static int 2309 kdb_ldap_create_principal (context, princ, op, pblock) 2310 krb5_context context; 2311 krb5_principal princ; 2312 enum ap_op op; 2313 struct realm_info *pblock; 2314 { 2315 int retval=0, currlen=0, princtype = 2 /* Service Principal */; 2316 unsigned char *curr=NULL; 2317 krb5_tl_data *tl_data=NULL; 2318 krb5_db_entry entry; 2319 int nentry=1; 2320 long mask = 0; 2321 krb5_keyblock key; 2322 int kvno = 0; 2323 kdb5_dal_handle *dal_handle = NULL; 2324 krb5_ldap_context *ldap_context=NULL; 2325 struct iterate_args iargs; 2326 krb5_data *pdata; 2327 2328 if ((pblock == NULL) || (context == NULL)) { 2329 retval = EINVAL; 2330 goto cleanup; 2331 } 2332 dal_handle = (kdb5_dal_handle *) context->db_context; 2333 ldap_context = (krb5_ldap_context *) dal_handle->db_context; 2334 if (!(ldap_context)) { 2335 retval = EINVAL; 2336 goto cleanup; 2337 } 2338 2339 memset(&entry, 0, sizeof(entry)); 2340 2341 tl_data = malloc(sizeof(*tl_data)); 2342 if (tl_data == NULL) { 2343 retval = ENOMEM; 2344 goto cleanup; 2345 } 2346 memset(tl_data, 0, sizeof(*tl_data)); 2347 tl_data->tl_data_length = 1 + 2 + 2 + 1 + 2 + 4; 2348 tl_data->tl_data_type = 7; /* KDB_TL_USER_INFO */ 2349 curr = tl_data->tl_data_contents = malloc(tl_data->tl_data_length); 2350 if (tl_data->tl_data_contents == NULL) { 2351 retval = ENOMEM; 2352 goto cleanup; 2353 } 2354 2355 memset(curr, 1, 1); /* Passing the mask as principal type */ 2356 curr += 1; 2357 currlen = 2; 2358 STORE16_INT(curr, currlen); 2359 curr += currlen; 2360 STORE16_INT(curr, princtype); 2361 curr += currlen; 2362 2363 mask |= KADM5_PRINCIPAL; 2364 mask |= KADM5_ATTRIBUTES ; 2365 mask |= KADM5_MAX_LIFE ; 2366 mask |= KADM5_MAX_RLIFE ; 2367 mask |= KADM5_PRINC_EXPIRE_TIME ; 2368 mask |= KADM5_KEY_DATA; 2369 2370 entry.tl_data = tl_data; 2371 entry.n_tl_data += 1; 2372 /* Set the creator's name */ 2373 { 2374 krb5_timestamp now; 2375 if ((retval = krb5_timeofday(context, &now))) 2376 goto cleanup; 2377 if ((retval = krb5_dbe_update_mod_princ_data_new(context, &entry, 2378 now, &db_create_princ))) 2379 goto cleanup; 2380 } 2381 entry.attributes = pblock->flags; 2382 entry.max_life = pblock->max_life; 2383 entry.max_renewable_life = pblock->max_rlife; 2384 entry.expiration = pblock->expiration; 2385 entry.mask = mask; 2386 if ((retval = krb5_copy_principal(context, princ, &entry.princ))) 2387 goto cleanup; 2388 2389 2390 switch (op) { 2391 case TGT_KEY: 2392 if ((pdata = krb5_princ_component(context, princ, 1)) && 2393 pdata->length == strlen("history") && 2394 !memcmp(pdata->data, "history", strlen("history"))) { 2395 2396 /* Allocate memory for storing the key */ 2397 if ((entry.key_data = (krb5_key_data *) malloc( 2398 sizeof(krb5_key_data))) == NULL) { 2399 retval = ENOMEM; 2400 goto cleanup; 2401 } 2402 2403 memset(entry.key_data, 0, sizeof(krb5_key_data)); 2404 entry.n_key_data++; 2405 2406 retval = krb5_c_make_random_key(context, global_params.enctype, &key); 2407 if (retval) { 2408 goto cleanup; 2409 } 2410 kvno = 1; /* New key is getting set */ 2411 retval = krb5_dbekd_encrypt_key_data(context, 2412 &ldap_context->lrparams->mkey, 2413 &key, NULL, kvno, 2414 &entry.key_data[entry.n_key_data - 1]); 2415 krb5_free_keyblock_contents(context, &key); 2416 if (retval) { 2417 goto cleanup; 2418 } 2419 } else { 2420 /*retval = krb5_c_make_random_key(context, 16, &key) ;*/ 2421 iargs.ctx = context; 2422 iargs.rblock = pblock; 2423 iargs.dbentp = &entry; 2424 2425 /* 2426 * create a set of random keys by iterating through the key/salt 2427 * list, ignoring salt types. 2428 */ 2429 if ((retval = krb5_keysalt_iterate(pblock->kslist, 2430 pblock->nkslist, 2431 1, 2432 kdb_ldap_tgt_keysalt_iterate, 2433 (krb5_pointer) &iargs))) 2434 return retval; 2435 } 2436 break; 2437 2438 case MASTER_KEY: 2439 /* Allocate memory for storing the key */ 2440 if ((entry.key_data = (krb5_key_data *) malloc( 2441 sizeof(krb5_key_data))) == NULL) { 2442 retval = ENOMEM; 2443 goto cleanup; 2444 } 2445 2446 memset(entry.key_data, 0, sizeof(krb5_key_data)); 2447 entry.n_key_data++; 2448 kvno = 1; /* New key is getting set */ 2449 retval = krb5_dbekd_encrypt_key_data(context, pblock->key, 2450 &ldap_context->lrparams->mkey, 2451 NULL, kvno, 2452 &entry.key_data[entry.n_key_data - 1]); 2453 if (retval) { 2454 goto cleanup; 2455 } 2456 break; 2457 2458 case NULL_KEY: 2459 default: 2460 break; 2461 } /* end of switch */ 2462 2463 retval = krb5_ldap_put_principal(context, &entry, &nentry, NULL); 2464 if (retval) { 2465 com_err(NULL, retval, gettext("while adding entries to database")); 2466 goto cleanup; 2467 } 2468 2469 cleanup: 2470 krb5_dbe_free_contents(context, &entry); 2471 return retval; 2472 } 2473 2474 2475 /* 2476 * This function destroys the realm object and the associated principals 2477 */ 2478 void 2479 kdb5_ldap_destroy(argc, argv) 2480 int argc; 2481 char *argv[]; 2482 { 2483 extern char *optarg; 2484 extern int optind; 2485 int optchar = 0; 2486 char buf[5] = {0}; 2487 krb5_error_code retval = 0; 2488 int force = 0; 2489 int mask = 0; 2490 kdb5_dal_handle *dal_handle = NULL; 2491 krb5_ldap_context *ldap_context = NULL; 2492 #ifdef HAVE_EDIRECTORY 2493 int i = 0, rightsmask = 0; 2494 krb5_ldap_realm_params *rparams = NULL; 2495 #endif 2496 /* Solaris Kerberos: to remove stash file */ 2497 char *stash_file = NULL; 2498 struct stat stb; 2499 2500 optind = 1; 2501 while ((optchar = getopt(argc, argv, "f")) != -1) { 2502 switch (optchar) { 2503 case 'f': 2504 force++; 2505 break; 2506 case '?': 2507 default: 2508 db_usage(DESTROY_REALM); 2509 return; 2510 /*NOTREACHED*/ 2511 } 2512 } 2513 2514 if (!force) { 2515 printf(gettext("Deleting KDC database of '%s', are you sure?\n"), global_params.realm); 2516 printf(gettext("(type 'yes' to confirm)? ")); 2517 if (fgets(buf, sizeof(buf), stdin) == NULL) { 2518 exit_status++; 2519 return; 2520 } 2521 if (strcmp(buf, yes)) { 2522 exit_status++; 2523 return; 2524 } 2525 printf(gettext("OK, deleting database of '%s'...\n"), global_params.realm); 2526 } 2527 2528 dal_handle = (kdb5_dal_handle *)util_context->db_context; 2529 ldap_context = (krb5_ldap_context *) dal_handle->db_context; 2530 if (!(ldap_context)) { 2531 /* Solaris Kerberos */ 2532 com_err(progname, EINVAL, gettext("while initializing database")); 2533 exit_status++; 2534 return; 2535 } 2536 2537 /* Read the kerberos container from the LDAP Server */ 2538 if ((retval = krb5_ldap_read_krbcontainer_params(util_context, 2539 &(ldap_context->krbcontainer))) != 0) { 2540 /* Solaris Kerberos */ 2541 com_err(progname, retval, gettext("while reading kerberos container information")); 2542 exit_status++; 2543 return; 2544 } 2545 2546 /* Read the Realm information from the LDAP Server */ 2547 if ((retval = krb5_ldap_read_realm_params(util_context, global_params.realm, 2548 &(ldap_context->lrparams), &mask)) != 0) { 2549 /* Solaris Kerberos */ 2550 com_err(progname, retval, gettext("while reading realm information")); 2551 exit_status++; 2552 return; 2553 } 2554 2555 #ifdef HAVE_EDIRECTORY 2556 if ((mask & LDAP_REALM_KDCSERVERS) || (mask & LDAP_REALM_ADMINSERVERS) || 2557 (mask & LDAP_REALM_PASSWDSERVERS)) { 2558 2559 printf(gettext("Changing rights for the service object. Please wait ... ")); 2560 fflush(stdout); 2561 2562 rparams = ldap_context->lrparams; 2563 rightsmask = 0; 2564 rightsmask |= LDAP_REALM_RIGHTS; 2565 rightsmask |= LDAP_SUBTREE_RIGHTS; 2566 if ((rparams != NULL) && (rparams->kdcservers != NULL)) { 2567 for (i=0; (rparams->kdcservers[i] != NULL); i++) { 2568 if ((retval = krb5_ldap_delete_service_rights(util_context, 2569 LDAP_KDC_SERVICE, rparams->kdcservers[i], 2570 rparams->realm_name, rparams->subtree, rightsmask)) != 0) { 2571 printf(gettext("failed\n")); 2572 /* Solaris Kerberos */ 2573 com_err(progname, retval, gettext("while assigning rights to '%s'"), 2574 rparams->realm_name); 2575 return; 2576 } 2577 } 2578 } 2579 rightsmask = 0; 2580 rightsmask |= LDAP_REALM_RIGHTS; 2581 rightsmask |= LDAP_SUBTREE_RIGHTS; 2582 if ((rparams != NULL) && (rparams->adminservers != NULL)) { 2583 for (i=0; (rparams->adminservers[i] != NULL); i++) { 2584 if ((retval = krb5_ldap_delete_service_rights(util_context, 2585 LDAP_ADMIN_SERVICE, rparams->adminservers[i], 2586 rparams->realm_name, rparams->subtree, rightsmask)) != 0) { 2587 printf(gettext("failed\n")); 2588 /* Solaris Kerberos */ 2589 com_err(progname, retval, gettext("while assigning rights to '%s'"), 2590 rparams->realm_name); 2591 return; 2592 } 2593 } 2594 } 2595 rightsmask = 0; 2596 rightsmask |= LDAP_REALM_RIGHTS; 2597 rightsmask |= LDAP_SUBTREE_RIGHTS; 2598 if ((rparams != NULL) && (rparams->passwdservers != NULL)) { 2599 for (i=0; (rparams->passwdservers[i] != NULL); i++) { 2600 if ((retval = krb5_ldap_delete_service_rights(util_context, 2601 LDAP_PASSWD_SERVICE, rparams->passwdservers[i], 2602 rparams->realm_name, rparams->subtree, rightsmask)) != 0) { 2603 printf(gettext("failed\n")); 2604 /* Solaris Kerberos */ 2605 com_err(progname, retval, gettext("while assigning rights to '%s'"), 2606 rparams->realm_name); 2607 return; 2608 } 2609 } 2610 } 2611 printf(gettext("done\n")); 2612 } 2613 #endif 2614 /* Delete the realm container and all the associated principals */ 2615 retval = krb5_ldap_delete_realm(util_context, global_params.realm); 2616 if (retval) { 2617 /* Solaris Kerberos */ 2618 com_err(progname, retval, gettext("deleting database of '%s'"), global_params.realm); 2619 exit_status++; 2620 return; 2621 } 2622 2623 /* 2624 * Solaris Kerberos: check for a stash file and delete it if necessary 2625 * This behavior exists in the Solaris version of kdb5_util destroy. 2626 */ 2627 if (global_params.stash_file == NULL) { 2628 char stashbuf[MAXPATHLEN+1]; 2629 int realm_len = strlen(global_params.realm); 2630 2631 (void) strlcpy(stashbuf, DEFAULT_KEYFILE_STUB, sizeof (stashbuf)); 2632 2633 if (realm_len <= (MAXPATHLEN-strlen(stashbuf))) { 2634 (void) strncat(stashbuf, global_params.realm, 2635 (MAXPATHLEN-strlen(stashbuf))); 2636 } else { 2637 /* Solaris Kerberos */ 2638 com_err(progname, EINVAL, 2639 gettext("can not determine stash file name for '%s'"), 2640 global_params.realm); 2641 exit_status++; 2642 return; 2643 } 2644 stash_file = stashbuf; 2645 } else { 2646 stash_file = global_params.stash_file; 2647 } 2648 /* Make sure stash_file is a regular file before unlinking */ 2649 if (stat(stash_file, &stb) == 0) { 2650 if ((stb.st_mode & S_IFMT) == S_IFREG) { 2651 (void)unlink(stash_file); 2652 } else { 2653 /* Solaris Kerberos */ 2654 com_err(progname, EINVAL, 2655 gettext("stash file '%s' not a regular file, can not delete"), 2656 stash_file); 2657 exit_status++; 2658 return; 2659 } 2660 } else if (errno != ENOENT) { 2661 /* 2662 * If the error is something other than the file doesn't exist set an 2663 * error. 2664 */ 2665 /* Solaris Kerberos */ 2666 com_err(progname, EINVAL, 2667 gettext("could not stat stash file '%s', could not delete"), 2668 stash_file); 2669 exit_status++; 2670 return; 2671 } 2672 2673 printf(gettext("** Database of '%s' destroyed.\n"), global_params.realm); 2674 2675 return; 2676 } 2677