1 /* 2 * kdc/policy.c 3 * 4 * Copyright 1990 by the Massachusetts Institute of Technology. 5 * 6 * Export of this software from the United States of America may 7 * require a specific license from the United States Government. 8 * It is the responsibility of any person or organization contemplating 9 * export to obtain such a license before exporting. 10 * 11 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 12 * distribute this software and its documentation for any purpose and 13 * without fee is hereby granted, provided that the above copyright 14 * notice appear in all copies and that both that copyright notice and 15 * this permission notice appear in supporting documentation, and that 16 * the name of M.I.T. not be used in advertising or publicity pertaining 17 * to distribution of the software without specific, written prior 18 * permission. Furthermore if you modify this software you must label 19 * your software as modified software and not distribute it in such a 20 * fashion that it might be confused with the original M.I.T. software. 21 * M.I.T. makes no representations about the suitability of 22 * this software for any purpose. It is provided "as is" without express 23 * or implied warranty. 24 * 25 * 26 * Policy decision routines for KDC. 27 */ 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 32 #include "k5-int.h" 33 #include "kdc_util.h" 34 35 int 36 against_local_policy_as(register krb5_kdc_req *request, krb5_db_entry client, 37 krb5_db_entry server, krb5_timestamp kdc_time, 38 const char **status) 39 { 40 #if 0 41 /* An AS request must include the addresses field */ 42 if (request->addresses == 0) { 43 *status = "NO ADDRESS"; 44 return KRB5KDC_ERR_POLICY; 45 } 46 #endif 47 48 return 0; /* not against policy */ 49 } 50 51 /* 52 * This is where local policy restrictions for the TGS should placed. 53 */ 54 krb5_error_code 55 against_local_policy_tgs(register krb5_kdc_req *request, krb5_db_entry server, 56 krb5_ticket *ticket, const char **status) 57 { 58 #if 0 59 /* 60 * For example, if your site wants to disallow ticket forwarding, 61 * you might do something like this: 62 */ 63 64 if (isflagset(request->kdc_options, KDC_OPT_FORWARDED)) { 65 *status = "FORWARD POLICY"; 66 return KRB5KDC_ERR_POLICY; 67 } 68 #endif 69 70 return 0; /* not against policy */ 71 } 72 73 74 75 76 77 78 79