xref: /onnv-gate/usr/src/cmd/krb5/ldap_util/kdb5_ldap_services.c (revision 8092:19771b16f0a8)

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * kadmin/ldap_util/kdb5_ldap_services.c
 */

/* Copyright (c) 2004-2005, Novell, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 *   * Redistributions of source code must retain the above copyright notice,
 *       this list of conditions and the following disclaimer.
 *   * Redistributions in binary form must reproduce the above copyright
 *       notice, this list of conditions and the following disclaimer in the
 *       documentation and/or other materials provided with the distribution.
 *   * The copyright holder's name is not used to endorse or promote products
 *       derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * Create / Delete / Modify / View / List service objects.
 */

/*
 * Service objects have rights over realm objects and principals. The following
 * functions manage the service objects.
 */

#include <stdio.h>
#include <k5-int.h>
#include <libintl.h> /* Solaris Kerberos */
#include <locale.h> /* Solaris Kerberos */
#include "kdb5_ldap_util.h"
#include "kdb5_ldap_list.h"

#ifdef HAVE_EDIRECTORY

krb5_error_code
rem_service_entry_from_file(int argc,
			    char *argv[],
			    char *file_name,
			    char *service_object);

extern char *yes;
extern krb5_boolean db_inited;

static int process_host_list(char **host_list, int servicetype)
{
    krb5_error_code retval = 0;
    char *pchr = NULL;
    char host_str[MAX_LEN_LIST_ENTRY] = "", proto_str[PROTOCOL_STR_LEN + 1] = "", port_str[PORT_STR_LEN + 1] = "";
    int j = 0;

    /* Protocol and port number processing */
    for (j = 0; host_list[j]; j++) {
	/* Look for one hash */
	if ((pchr = strchr(host_list[j], HOST_INFO_DELIMITER))) {
	    unsigned int hostname_len = pchr - host_list[j];

	    /* Check input for buffer overflow */
	    if (hostname_len >= MAX_LEN_LIST_ENTRY) {
		retval = EINVAL;
		goto cleanup;
	    }

	    /* First copy off the host name portion */
	    strncpy (host_str, host_list[j], hostname_len);

	    /* Parse for the protocol string and translate to number */
	    strncpy (proto_str, pchr + 1, PROTOCOL_STR_LEN);
	    if (!strcmp(proto_str, "udp"))
		sprintf (proto_str, "%d", PROTOCOL_NUM_UDP);
	    else if (!strcmp(proto_str, "tcp"))
		sprintf (proto_str, "%d", PROTOCOL_NUM_TCP);
	    else
		proto_str[0] = '\0'; /* Make the string null if invalid */

	    /* Look for one more hash */
	    if ((pchr = strchr(pchr + 1, HOST_INFO_DELIMITER))) {
		/* Parse for the port string and check if it is numeric */
		strncpy (port_str, pchr + 1, PORT_STR_LEN);
		if (!strtol(port_str, NULL, 10)) /* Not a valid number */
		    port_str[0] = '\0';
	    } else
		port_str[0] = '\0';
	} else { /* We have only host name */
	    strncpy (host_str, host_list[j], MAX_LEN_LIST_ENTRY - 1);
	    proto_str[0] = '\0';
	    port_str[0] = '\0';
	}

	/* Now, based on service type, fill in suitable protocol
	   and port values if they are absent or not matching */
	if (servicetype == LDAP_KDC_SERVICE) {
	    if (proto_str[0] == '\0')
		sprintf (proto_str, "%d", PROTOCOL_DEFAULT_KDC);

	    if (port_str[0] == '\0')
		sprintf (port_str, "%d", PORT_DEFAULT_KDC);
	} else if (servicetype == LDAP_ADMIN_SERVICE) {
	    if (proto_str[0] == '\0')
		sprintf (proto_str, "%d", PROTOCOL_DEFAULT_ADM);
	    else if (strcmp(proto_str, "1")) {
		sprintf (proto_str, "%d", PROTOCOL_DEFAULT_ADM);

		/* Print warning message */
		printf (gettext("Admin Server supports only TCP protocol, hence setting that\n"));
	    }

	    if (port_str[0] == '\0')
		sprintf (port_str, "%d", PORT_DEFAULT_ADM);
	} else if (servicetype == LDAP_PASSWD_SERVICE) {
	    if (proto_str[0] == '\0')
		sprintf (proto_str, "%d", PROTOCOL_DEFAULT_PWD);
	    else if (strcmp(proto_str, "0")) {
		sprintf (proto_str, "%d", PROTOCOL_DEFAULT_PWD);

		/* Print warning message */
		printf (gettext("Password Server supports only UDP protocol, hence setting that\n"));
	    }

	    if (port_str[0] == '\0')
		sprintf (port_str, "%d", PORT_DEFAULT_PWD);
	}

	/* Finally form back the string */
	free (host_list[j]);
	host_list[j] = (char*) malloc(sizeof(char) *
				      (strlen(host_str) + strlen(proto_str) + strlen(port_str) + 2 + 1));
	if (host_list[j] == NULL) {
	    retval = ENOMEM;
	    goto cleanup;
	}
	snprintf (host_list[j], strlen(host_str) + strlen(proto_str) + strlen(port_str) + 2 + 1,
		  "%s#%s#%s", host_str, proto_str, port_str);
    }

cleanup:
    return retval;
}


/*
 * Given a realm name, this function will convert it to a DN by appending the
 * Kerberos container location.
 */
static krb5_error_code
convert_realm_name2dn_list(list, krbcontainer_loc)
    char **list;
    const char *krbcontainer_loc;
{
    krb5_error_code retval = 0;
    char temp_str[MAX_DN_CHARS] = "\0";
    char *temp_node = NULL;
    int i = 0;

    if (list == NULL) {
	return EINVAL;
    }

    for (i = 0; (list[i] != NULL) && (i < MAX_LIST_ENTRIES); i++) {
	/* Restrict copying to max. length to avoid buffer overflow */
	snprintf (temp_str, MAX_DN_CHARS, "cn=%s,%s", list[i], krbcontainer_loc);

	/* Make copy of string to temporary node */
	temp_node = strdup(temp_str);
	if (list[i] == NULL) {
	    retval = ENOMEM;
	    goto cleanup;
	}

	/* On success, free list node and attach new one */
	free (list[i]);
	list[i] = temp_node;
	temp_node = NULL;
    }

cleanup:
    return retval;
}


/*
 * This function will create a service object on the LDAP Server, with the
 * specified attributes.
 */
void kdb5_ldap_create_service(argc, argv)
    int argc;
    char *argv[];
{
    /* Solaris Kerberos */
    char *me = progname;
    krb5_error_code retval = 0;
    krb5_ldap_service_params *srvparams = NULL;
    krb5_boolean print_usage = FALSE;
    krb5_boolean no_msg = FALSE;
    int mask = 0;
    char **extra_argv = NULL;
    int extra_argc = 0;
    int i = 0;
    krb5_ldap_realm_params *rparams = NULL;
    int rmask = 0;
    int rightsmask =0;
    char **temprdns = NULL;
    char *realmName = NULL;
    kdb5_dal_handle *dal_handle = NULL;
    krb5_ldap_context *ldap_context=NULL;
    krb5_boolean service_obj_created = FALSE;

    /* Check for number of arguments */
    if ((argc < 3) || (argc > 10)) {
	exit_status++;
	goto err_usage;
    }

    /* Allocate memory for service parameters structure */
    srvparams = (krb5_ldap_service_params*) calloc(1, sizeof(krb5_ldap_service_params));
    if (srvparams == NULL) {
	retval = ENOMEM;
	goto cleanup;
    }

    dal_handle = (kdb5_dal_handle *) util_context->db_context;
    ldap_context = (krb5_ldap_context *) dal_handle->db_context;

    /* Allocate memory for extra arguments to be used for setting
       password -- it's OK to allocate as much as the total number
       of arguments */
    extra_argv = (char **) calloc((unsigned int)argc, sizeof(char*));
    if (extra_argv == NULL) {
	retval = ENOMEM;
	goto cleanup;
    }

    /* Set first of the extra arguments as the program name */
    extra_argv[0] = me;
    extra_argc++;

    /* Read Kerberos container info, to construct realm DN from name
     * and for assigning rights
     */
    if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
						     &(ldap_context->krbcontainer)))) {
	com_err(me, retval, gettext("while reading Kerberos container information"));
	goto cleanup;
    }

    /* Parse all arguments */
    for (i = 1; i < argc; i++) {
	if (!strcmp(argv[i], "-kdc")) {
	    srvparams->servicetype = LDAP_KDC_SERVICE;
	} else if (!strcmp(argv[i], "-admin")) {
	    srvparams->servicetype = LDAP_ADMIN_SERVICE;
	} else if (!strcmp(argv[i], "-pwd")) {
	    srvparams->servicetype = LDAP_PASSWD_SERVICE;
	} else if (!strcmp(argv[i], "-servicehost")) {
	    if (++i > argc - 1)
		goto err_usage;

	    srvparams->krbhostservers = (char **)calloc(MAX_LIST_ENTRIES,
							sizeof(char *));
	    if (srvparams->krbhostservers == NULL) {
		retval = ENOMEM;
		goto cleanup;
	    }

	    if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER,
					  srvparams->krbhostservers))) {
		goto cleanup;
	    }

	    if ((retval = process_host_list (srvparams->krbhostservers,
					     srvparams->servicetype))) {
		goto cleanup;
	    }

	    mask |= LDAP_SERVICE_HOSTSERVER;
	} else if (!strcmp(argv[i], "-realm")) {
	    if (++i > argc - 1)
		goto err_usage;

	    srvparams->krbrealmreferences = (char **)calloc(MAX_LIST_ENTRIES,
							    sizeof(char *));
	    if (srvparams->krbrealmreferences == NULL) {
		retval = ENOMEM;
		goto cleanup;
	    }

	    if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER,
					  srvparams->krbrealmreferences))) {
		goto cleanup;
	    }

	    /* Convert realm names to realm DNs */
	    if ((retval = convert_realm_name2dn_list(
		     srvparams->krbrealmreferences,
		     ldap_context->krbcontainer->DN))) {
		goto cleanup;
	    }

	    mask |= LDAP_SERVICE_REALMREFERENCE;
	}
	/* If argument is none of the above and beginning with '-',
	 * it must be related to password -- collect it
	 * to pass onto kdb5_ldap_set_service_password()
	 */
	else if (*(argv[i]) == '-') {
	    /* Checking for options of setting the password for the
	     * service (by using 'setsrvpw') is not modular. --need to
	     * have a common function that can be shared with 'setsrvpw'
	     */
	    if (!strcmp(argv[i], "-randpw")) {
		extra_argv[extra_argc] = argv[i];
		extra_argc++;
	    } else if (!strcmp(argv[i], "-fileonly")) {
		extra_argv[extra_argc] = argv[i];
		extra_argc++;
	    }
	    /* For '-f' option alone, pick up the following argument too */
	    else if (!strcmp(argv[i], "-f")) {
		extra_argv[extra_argc] = argv[i];
		extra_argc++;

		if (++i > argc - 1)
		    goto err_usage;

		extra_argv[extra_argc] = argv[i];
		extra_argc++;
	    } else { /* Any other option is invalid */
		exit_status++;
		goto err_usage;
	    }
	} else { /* Any other argument must be service DN */
	    /* First check if service DN is already provided --
	     * if so, there's a usage error
	     */
	    if (srvparams->servicedn != NULL) {
		com_err(me, EINVAL, gettext("while creating service object"));
		goto err_usage;
	    }

	    /* If not present already, fill up service DN */
	    srvparams->servicedn = strdup(argv[i]);
	    if (srvparams->servicedn == NULL) {
		com_err(me, ENOMEM, gettext("while creating service object"));
		goto err_nomsg;
	    }
	}
    }

    /* No point in proceeding further if service DN value is not available */
    if (srvparams->servicedn == NULL) {
	com_err(me, EINVAL, gettext("while creating service object"));
	goto err_usage;
    }

    if (srvparams->servicetype == 0) { /* Not provided and hence not set */
	com_err(me, EINVAL, gettext("while creating service object"));
	goto err_usage;
    }

    /* Create object with all attributes provided */
    if ((retval = krb5_ldap_create_service(util_context, srvparams, mask)))
	goto cleanup;

    service_obj_created = TRUE;

    /* ** NOTE ** srvparams structure should not be modified, as it is
     * used for deletion of the service object in case of any failures
     * from now on.
     */

    /* Set password too */
    if (extra_argc >= 1) {
	/* Set service DN as the last argument */
	extra_argv[extra_argc] = strdup(srvparams->servicedn);
	if (extra_argv[extra_argc] == NULL) {
            retval = ENOMEM;
            goto cleanup;
        }
	extra_argc++;

	if ((retval = kdb5_ldap_set_service_password(extra_argc, extra_argv)) != 0) {
	    goto err_nomsg;
	}
    }
    /* Rights assignment */
    if (mask & LDAP_SERVICE_REALMREFERENCE) {

	printf("%s", gettext("Changing rights for the service object. Please wait ... "));
	fflush(stdout);

	rightsmask =0;
	rightsmask |= LDAP_REALM_RIGHTS;
	rightsmask |= LDAP_SUBTREE_RIGHTS;

	if ((srvparams != NULL) && (srvparams->krbrealmreferences != NULL)) {
	    for (i=0; (srvparams->krbrealmreferences[i] != NULL); i++) {

		/* Get the realm name, not the dn */
		temprdns = ldap_explode_dn(srvparams->krbrealmreferences[i], 1);

		if (temprdns[0] == NULL) {
		    retval = EINVAL;
		    goto cleanup;
		}

		realmName = strdup(temprdns[0]);
		if (realmName == NULL) {
		    retval = ENOMEM;
		    goto cleanup;
		}

		if ((retval = krb5_ldap_read_realm_params(util_context,
							  realmName, &rparams, &rmask))) {
		    com_err(me, retval, gettext("while reading information of realm '%s'"),
			    realmName);
		    goto cleanup;
		}

		if ((retval = krb5_ldap_add_service_rights(util_context,
							   srvparams->servicetype, srvparams->servicedn,
							   realmName, rparams->subtree, rightsmask))) {
		    printf(gettext("failed\n"));
		    com_err(me, retval, gettext("while assigning rights '%s'"),
			    srvparams->servicedn);
		    goto cleanup;
		}

		if (rparams)
		    krb5_ldap_free_realm_params(rparams);
	    }
	}
	printf(gettext("done\n"));
    }
    goto cleanup;

err_usage:
    print_usage = TRUE;

err_nomsg:
    no_msg = TRUE;

cleanup:

    if ((retval != 0) && (service_obj_created == TRUE)) {
	/* This is for deleting the service object if something goes
	 * wrong in creating the service object
	 */

	/* srvparams is populated from the user input and should be correct as
	 * we were successful in creating a service object. Reusing the same
	 */
	krb5_ldap_delete_service(util_context, srvparams, srvparams->servicedn);
    }

    /* Clean-up structure */
    krb5_ldap_free_service (util_context, srvparams);

    if (extra_argv) {
	free (extra_argv);
	extra_argv = NULL;
    }
    if (realmName) {
	free(realmName);
	realmName = NULL;
    }
    if (print_usage)
	db_usage (CREATE_SERVICE);

    if (retval) {
	if (!no_msg)
	    com_err(me, retval, gettext("while creating service object"));

	exit_status++;
    }

    return;
}


/*
 * This function will modify the attributes of a given service
 * object on the LDAP Server
 */
void kdb5_ldap_modify_service(argc, argv)
    int argc;
    char *argv[];
{
    /* Solaris Kerberos */
    char *me = progname;
    krb5_error_code retval = 0;
    krb5_ldap_service_params *srvparams = NULL;
    krb5_boolean print_usage = FALSE;
    krb5_boolean no_msg = FALSE;
    char *servicedn = NULL;
    int i = 0;
    int in_mask = 0, out_mask = 0;
    int srvhost_flag = 0, realmdn_flag = 0;
    char **list = NULL;
    int existing_entries = 0, new_entries = 0;
    char **temp_ptr = NULL;
    krb5_ldap_realm_params *rparams = NULL;
    int j = 0;
    int rmask = 0;
    int rightsmask =0;
    char **oldrealmrefs = NULL;
    char **newrealmrefs = NULL;
    char **temprdns = NULL;
    char *realmName = NULL;
    kdb5_dal_handle *dal_handle = NULL;
    krb5_ldap_context *ldap_context=NULL;

    /* Check for number of arguments */
    if ((argc < 3) || (argc > 10)) {
	exit_status++;
	goto err_usage;
    }

    dal_handle = (kdb5_dal_handle *) util_context->db_context;
    ldap_context = (krb5_ldap_context *) dal_handle->db_context;

    /* Parse all arguments, only to pick up service DN (Pass 1) */
    for (i = 1; i < argc; i++) {
	/* Skip arguments next to 'servicehost'
	   and 'realmdn' arguments */
	if (!strcmp(argv[i], "-servicehost")) {
	    ++i;
	} else if (!strcmp(argv[i], "-clearservicehost")) {
	    ++i;
	} else if (!strcmp(argv[i], "-addservicehost")) {
	    ++i;
	} else if (!strcmp(argv[i], "-realm")) {
	    ++i;
	} else if (!strcmp(argv[i], "-clearrealm")) {
	    ++i;
	} else if (!strcmp(argv[i], "-addrealm")) {
	    ++i;
	} else { /* Any other argument must be service DN */
	    /* First check if service DN is already provided --
	       if so, there's a usage error */
	    if (servicedn != NULL) {
		com_err(me, EINVAL, gettext("while modifying service object"));
		goto err_usage;
	    }

	    /* If not present already, fill up service DN */
	    servicedn = strdup(argv[i]);
	    if (servicedn == NULL) {
		com_err(me, ENOMEM, gettext("while modifying service object"));
		goto err_nomsg;
	    }
	}
    }

    /* No point in proceeding further if service DN value is not available */
    if (servicedn == NULL) {
	com_err(me, EINVAL, gettext("while modifying service object"));
	goto err_usage;
    }

    retval = krb5_ldap_read_service(util_context, servicedn, &srvparams, &in_mask);
    if (retval) {
	/* Solaris Kerberos */
	com_err(me, retval, gettext("while reading information of service '%s'"),
		servicedn);
	goto err_nomsg;
    }

    /* Read Kerberos container info, to construct realm DN from name
     * and for assigning rights
     */
    if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
						     &(ldap_context->krbcontainer)))) {
	com_err(me, retval, gettext("while reading Kerberos container information"));
	goto cleanup;
    }

    /* Parse all arguments, but skip the service DN (Pass 2) */
    for (i = 1; i < argc; i++) {
	if (!strcmp(argv[i], "-servicehost")) {
	    if (++i > argc - 1)
		goto err_usage;

	    /* Free the old list if available */
	    if (srvparams->krbhostservers) {
		krb5_free_list_entries (srvparams->krbhostservers);
		free (srvparams->krbhostservers);
	    }

	    srvparams->krbhostservers = (char **)calloc(MAX_LIST_ENTRIES,
							sizeof(char *));
	    if (srvparams->krbhostservers == NULL) {
		retval = ENOMEM;
		goto cleanup;
	    }

	    if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER,
					  srvparams->krbhostservers))) {
		goto cleanup;
	    }

	    if ((retval = process_host_list (srvparams->krbhostservers,
					     srvparams->servicetype))) {
		goto cleanup;
	    }

	    out_mask |= LDAP_SERVICE_HOSTSERVER;

	    /* Set flag to ignore 'add' and 'clear' */
	    srvhost_flag = 1;
	} else if (!strcmp(argv[i], "-clearservicehost")) {
	    if (++i > argc - 1)
		goto err_usage;

	    if (!srvhost_flag) {
		/* If attribute doesn't exist, don't permit 'clear' option */
		if ((in_mask & LDAP_SERVICE_HOSTSERVER) == 0) {
		    /* Send out some proper error message here */
		    com_err(me, EINVAL, gettext("service host list is empty\n"));
		    goto err_nomsg;
		}

		/* Allocate list for processing */
		list = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*));
		if (list == NULL) {
		    retval = ENOMEM;
		    goto cleanup;
		}

		if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list)))
		    goto cleanup;

		if ((retval = process_host_list (list, srvparams->servicetype))) {
		    goto cleanup;
		}

		list_modify_str_array(&(srvparams->krbhostservers),
				      (const char**)list, LIST_MODE_DELETE);

		out_mask |= LDAP_SERVICE_HOSTSERVER;

		/* Clean up */
		free (list);
		list = NULL;
	    }
	} else if (!strcmp(argv[i], "-addservicehost")) {
	    if (++i > argc - 1)
		goto err_usage;

	    if (!srvhost_flag) {
		/* Allocate list for processing */
		list = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*));
		if (list == NULL) {
		    retval = ENOMEM;
		    goto cleanup;
		}

		if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list)))
		    goto cleanup;

		if ((retval = process_host_list (list, srvparams->servicetype))) {
		    goto cleanup;
		}

		/* Call list_modify_str_array() only if host server attribute
		 * exists already --Actually, it's better to handle this
		 * within list_modify_str_array()
		 */
		if (in_mask & LDAP_SERVICE_HOSTSERVER) {
		    /* Re-size existing list */
		    existing_entries = list_count_str_array(srvparams->krbhostservers);
		    new_entries = list_count_str_array(list);
		    temp_ptr = (char **) realloc(srvparams->krbhostservers,
						 sizeof(char *) * (existing_entries + new_entries + 1));
		    if (temp_ptr == NULL) {
			retval = ENOMEM;
			goto cleanup;
		    }
		    srvparams->krbhostservers = temp_ptr;

		    list_modify_str_array(&(srvparams->krbhostservers),
					  (const char**)list, LIST_MODE_ADD);

		    /* Clean up */
		    free (list);
		    list = NULL;
		} else
		    srvparams->krbhostservers = list;

		out_mask |= LDAP_SERVICE_HOSTSERVER;
	    }
	} else if (!strcmp(argv[i], "-realm")) {
	    if (++i > argc - 1)
		goto err_usage;

	    if ((in_mask & LDAP_SERVICE_REALMREFERENCE) && (srvparams->krbrealmreferences)) {
		if (!oldrealmrefs) {
		    /* Store the old realm list for removing rights */
		    oldrealmrefs = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*));
		    if (oldrealmrefs == NULL) {
			retval = ENOMEM;
			goto cleanup;
		    }

		    for (j = 0; srvparams->krbrealmreferences[j] != NULL; j++) {
			oldrealmrefs[j] = strdup(srvparams->krbrealmreferences[j]);
			if (oldrealmrefs[j] == NULL) {
			    retval = ENOMEM;
			    goto cleanup;
			}
		    }
		    oldrealmrefs[j] = NULL;
		}

		/* Free the old list if available */
		krb5_free_list_entries (srvparams->krbrealmreferences);
		free (srvparams->krbrealmreferences);
	    }

	    srvparams->krbrealmreferences = (char **)calloc(MAX_LIST_ENTRIES,
							    sizeof(char *));
	    if (srvparams->krbrealmreferences == NULL) {
		retval = ENOMEM;
		goto cleanup;
	    }

	    if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER,
					  srvparams->krbrealmreferences))) {
		goto cleanup;
	    }

	    /* Convert realm names to realm DNs */
	    if ((retval = convert_realm_name2dn_list(
		     srvparams->krbrealmreferences,
		     ldap_context->krbcontainer->DN))) {
		goto cleanup;
	    }

	    out_mask |= LDAP_SERVICE_REALMREFERENCE;

	    /* Set flag to ignore 'add' and 'clear' */
	    realmdn_flag = 1;
	} else if (!strcmp(argv[i], "-clearrealm")) {
	    if (++i > argc - 1)
		goto err_usage;

	    if (!realmdn_flag) {
		/* If attribute doesn't exist, don't permit 'clear' option */
		if (((in_mask & LDAP_SERVICE_REALMREFERENCE) == 0) || (srvparams->krbrealmreferences == NULL)) {
		    /* Send out some proper error message here */
		    goto err_nomsg;
		}

		if (!oldrealmrefs) {
		    /* Store the old realm list for removing rights */
		    oldrealmrefs = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*));
		    if (oldrealmrefs == NULL) {
			retval = ENOMEM;
			goto cleanup;
		    }

		    for (j = 0; srvparams->krbrealmreferences[j] != NULL; j++) {
			oldrealmrefs[j] = strdup(srvparams->krbrealmreferences[j]);
			if (oldrealmrefs[j] == NULL) {
			    retval = ENOMEM;
			    goto cleanup;
			}
		    }
		    oldrealmrefs[j] = NULL;
		}

		/* Allocate list for processing */
		list = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*));
		if (list == NULL) {
		    retval = ENOMEM;
		    goto cleanup;
		}

		if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list)))
		    goto cleanup;

		/* Convert realm names to realm DNs */
		if ((retval = convert_realm_name2dn_list(list,
							 ldap_context->krbcontainer->DN))) {
		    goto cleanup;
		}

		list_modify_str_array(&(srvparams->krbrealmreferences),
				      (const char**)list, LIST_MODE_DELETE);

		out_mask |= LDAP_SERVICE_REALMREFERENCE;

		/* Clean up */
		free (list);
		list = NULL;
	    }
	} else if (!strcmp(argv[i], "-addrealm")) {
	    if (++i > argc - 1)
		goto err_usage;

	    if (!realmdn_flag) {
		/* Allocate list for processing */
		list = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*));
		if (list == NULL) {
		    retval = ENOMEM;
		    goto cleanup;
		}

		if ((retval = krb5_parse_list(argv[i], LIST_DELIMITER, list)))
		    goto cleanup;

		/* Convert realm names to realm DNs */
		if ((retval = convert_realm_name2dn_list(list,
							 ldap_context->krbcontainer->DN))) {
		    goto cleanup;
		}

		if ((in_mask & LDAP_SERVICE_REALMREFERENCE) && (srvparams->krbrealmreferences) && (!oldrealmrefs)) {
		    /* Store the old realm list for removing rights */
		    oldrealmrefs = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*));
		    if (oldrealmrefs == NULL) {
			retval = ENOMEM;
			goto cleanup;
		    }

		    for (j = 0; srvparams->krbrealmreferences[j] != NULL; j++) {
			oldrealmrefs[j] = strdup(srvparams->krbrealmreferences[j]);
			if (oldrealmrefs[j] == NULL) {
			    retval = ENOMEM;
			    goto cleanup;
			}
		    }
		    oldrealmrefs[j] = NULL;
		}

		/* Call list_modify_str_array() only if realm DN attribute
		 * exists already -- Actually, it's better to handle this
		 * within list_modify_str_array() */
		if (in_mask & LDAP_SERVICE_REALMREFERENCE) {
		    /* Re-size existing list */
		    existing_entries = list_count_str_array(
			srvparams->krbrealmreferences);
		    new_entries = list_count_str_array(list);
		    temp_ptr = (char **) realloc(srvparams->krbrealmreferences,
						 sizeof(char *) * (existing_entries + new_entries + 1));
		    if (temp_ptr == NULL) {
			retval = ENOMEM;
			goto cleanup;
		    }
		    srvparams->krbrealmreferences = temp_ptr;

		    list_modify_str_array(&(srvparams->krbrealmreferences),
					  (const char**)list, LIST_MODE_ADD);

		    /* Clean up */
		    free (list);
		    list = NULL;
		} else
		    srvparams->krbrealmreferences = list;

		out_mask |= LDAP_SERVICE_REALMREFERENCE;
	    }
	} else {
	    /* Any other argument must be service DN
	       -- skip it */
	}
    }

    /* Modify attributes of object */
    if ((retval = krb5_ldap_modify_service(util_context, srvparams, out_mask)))
	goto cleanup;

    /* Service rights modification code */
    if (out_mask & LDAP_SERVICE_REALMREFERENCE) {

	printf("%s", gettext("Changing rights for the service object. Please wait ... "));
	fflush(stdout);

	newrealmrefs = (char**) calloc(MAX_LIST_ENTRIES, sizeof(char*));
	if (newrealmrefs == NULL) {
	    retval = ENOMEM;
	    goto cleanup;
	}

	if ((srvparams != NULL) && (srvparams->krbrealmreferences != NULL)) {
	    for (j = 0; srvparams->krbrealmreferences[j] != NULL; j++) {
		newrealmrefs[j] = strdup(srvparams->krbrealmreferences[j]);
		if (newrealmrefs[j] == NULL) {
		    retval = ENOMEM;
		    goto cleanup;
		}
	    }
	    newrealmrefs[j] = NULL;
	}
	disjoint_members(oldrealmrefs, newrealmrefs);

	/* Delete the rights for the given service, on each of the realm
	 * container & subtree in the old realm reference list.
	 */
	if (oldrealmrefs) {
	    rightsmask = 0;
	    rightsmask |= LDAP_REALM_RIGHTS;
	    rightsmask |= LDAP_SUBTREE_RIGHTS;

	    for (i = 0; (oldrealmrefs[i] != NULL); i++) {
		/* Get the realm name, not the dn */
		temprdns = ldap_explode_dn(oldrealmrefs[i], 1);

		if (temprdns[0] == NULL) {
		    retval = EINVAL;
		    goto cleanup;
		}

		realmName = strdup(temprdns[0]);
		if (realmName == NULL) {
		    retval = ENOMEM;
		    goto cleanup;
		}

		if ((retval = krb5_ldap_read_realm_params(util_context,
							  realmName, &rparams, &rmask))) {
		    com_err(me, retval, gettext("while reading information of realm '%s'"),
			    realmName);
		    goto err_nomsg;
		}

		if ((retval = krb5_ldap_delete_service_rights(util_context,
							      srvparams->servicetype, srvparams->servicedn,
							      realmName, rparams->subtree, rightsmask))) {
		    printf(gettext("failed\n"));
		    com_err(me, retval, gettext("while assigning rights '%s'"),
			    srvparams->servicedn);
		    goto err_nomsg;
		}

		if (rparams)
		    krb5_ldap_free_realm_params(rparams);
	    }
	}

	/* Add the rights for the given service, on each of the realm
	 * container & subtree in the new realm reference list.
	 */
	if (newrealmrefs) {
	    rightsmask = 0;
	    rightsmask |= LDAP_REALM_RIGHTS;
	    rightsmask |= LDAP_SUBTREE_RIGHTS;

	    for (i = 0; (newrealmrefs[i] != NULL); i++) {
		/* Get the realm name, not the dn */
		temprdns = ldap_explode_dn(newrealmrefs[i], 1);

		if (temprdns[0] == NULL) {
		    retval = EINVAL;
		    goto cleanup;
		}

		realmName = strdup(temprdns[0]);
		if (realmName == NULL) {
		    retval = ENOMEM;
		    goto cleanup;
		}

		if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
								 &(ldap_context->krbcontainer)))) {
		    com_err(me, retval,
			    gettext("while reading Kerberos container information"));
		    goto cleanup;
		}

		if ((retval = krb5_ldap_read_realm_params(util_context,
							  realmName, &rparams, &rmask))) {
		    com_err(me, retval, gettext("while reading information of realm '%s'"),
			    realmName);
		    goto err_nomsg;
		}

		if ((retval = krb5_ldap_add_service_rights(util_context,
							   srvparams->servicetype, srvparams->servicedn,
							   realmName, rparams->subtree, rightsmask))) {
		    printf(gettext("failed\n"));
		    com_err(me, retval, gettext("while assigning rights '%s'"),
			    srvparams->servicedn);
		    goto err_nomsg;
		}

		if (rparams) {
		    krb5_ldap_free_realm_params(rparams);
		    rparams = NULL;
		}
	    }
	    printf(gettext("done\n"));
	}
    }
    goto cleanup;

err_usage:
    print_usage = TRUE;

err_nomsg:
    no_msg = TRUE;

cleanup:
    /* Clean-up structure */
    krb5_ldap_free_service(util_context, srvparams);

    if (servicedn)
	free(servicedn);

    if (list) {
	free(list);
	list = NULL;
    }

    if (oldrealmrefs) {
	for (i = 0; oldrealmrefs[i] != NULL; i++)
	    free(oldrealmrefs[i]);
	free(oldrealmrefs);
    }

    if (newrealmrefs) {
	for (i = 0; newrealmrefs[i] != NULL; i++)
	    free(newrealmrefs[i]);
	free(newrealmrefs);
    }
    if (realmName) {
	free(realmName);
	realmName = NULL;
    }

    if (print_usage)
	db_usage(MODIFY_SERVICE);

    if (retval) {
	if (!no_msg)
	    com_err(me, retval, gettext("while modifying service object"));
	exit_status++;
    }

    return;
}


/*
 * This function will delete the entry corresponding to the service object
 * from the service password file.
 */
static krb5_error_code
rem_service_entry_from_file(argc, argv, file_name, service_object)
    int argc;
    char *argv[];
    char *file_name;
    char *service_object;
{
    int     st        = EINVAL;
    /* Solaris Kerberos */
    char    *me       = progname;
    char    *tmp_file = NULL;
    int     tmpfd     = -1;
    FILE    *pfile    = NULL;
    unsigned int len  = 0;
    char    line[MAX_LEN]={0};
    mode_t  omask     = umask(077);

    /* Check for permissions on the password file */
    if (access(file_name, W_OK) == -1) {
	/* If the specified file itself is not there, no need to show error */
	if (errno == ENOENT) {
	    st=0;
	    goto cleanup;
	} else {
	    com_err(me, errno, gettext("while deleting entry from file %s", file_name));
	    goto cleanup;
	}
    }

    /* Create a temporary file which contains all the entries except the
       entry for the given service dn */
    pfile = fopen(file_name, "r+F");
    if (pfile == NULL) {
	com_err(me, errno, gettext("while deleting entry from file %s"), file_name);
	goto cleanup;
    }

    /* Create a new file with the extension .tmp */
    tmp_file = (char *)malloc(strlen(file_name) + 4 + 1);
    if (tmp_file == NULL) {
	com_err(me, ENOMEM, gettext("while deleting entry from file"));
	fclose(pfile);
	goto cleanup;
    }
    snprintf (tmp_file, strlen(file_name) + 4 + 1, "%s%s", file_name, ".tmp");


    tmpfd = creat(tmp_file, S_IRUSR|S_IWUSR);
    umask(omask);
    if (tmpfd == -1) {
	com_err(me, errno, gettext("while deleting entry from file\n"));
	fclose(pfile);
	goto cleanup;
    }

    /* Copy only those lines which donot have the specified service dn */
    while (fgets(line, MAX_LEN, pfile) != NULL) {
	if ((strstr(line, service_object) != NULL) &&
	    (line[strlen(service_object)] == '#')) {
	    continue;
	} else {
	    len = strlen(line);
	    if (write(tmpfd, line, len) != len) {
		com_err(me, errno, gettext("while deleting entry from file\n"));
		close(tmpfd);
		unlink(tmp_file);
		fclose(pfile);
		goto cleanup;
	    }
	}
    }

    fclose(pfile);
    if (unlink(file_name) == 0) {
	link(tmp_file, file_name);
    } else {
	com_err(me, errno, gettext("while deleting entry from file\n"));
    }
    unlink(tmp_file);

    st=0;

cleanup:

    if (tmp_file)
	free(tmp_file);

    return st;
}


/*
 * This function will delete the service object from the LDAP Server
 * and unlink the references to the Realm objects (if any)
 */
void
kdb5_ldap_destroy_service(argc, argv)
    int argc;
    char *argv[];
{
    int i = 0;
    char buf[5] = {0};
    krb5_error_code retval = EINVAL;
    int force = 0;
    char *servicedn = NULL;
    char *stashfilename = NULL;
    int mask = 0;
    krb5_ldap_service_params *lserparams = NULL;
    krb5_boolean print_usage = FALSE;

    if ((argc < 2) || (argc > 5)) {
	exit_status++;
	goto err_usage;
    }

    for (i=1; i < argc; i++) {

	if (strcmp(argv[i],"-force")==0) {
	    force++;
	} else if (strcmp(argv[i],"-f")==0) {
	    if (argv[i+1]) {
		stashfilename=strdup(argv[i+1]);
		if (stashfilename == NULL) {
		    /* Solaris Kerberos */
		    com_err(progname, ENOMEM, gettext("while destroying service"));
		    exit_status++;
		    goto cleanup;
		}
		i++;
	    } else {
		exit_status++;
		goto err_usage;
	    }
	} else {
	    if ((argv[i]) && (servicedn == NULL)) {
		servicedn=strdup(argv[i]);
		if (servicedn == NULL) {
		    /* Solaris Kerberos */
		    com_err(progname, ENOMEM, gettext("while destroying service"));
		    exit_status++;
		    goto cleanup;
		}
	    } else {
		exit_status++;
		goto err_usage;
	    }
	}
    }

    if (!servicedn) {
	exit_status++;
	goto err_usage;
    }

    if (!force) {
	printf(gettext("This will delete the service object '%s', are you sure?\n"), servicedn);
	printf(gettext("(type 'yes' to confirm)? "));
	if (fgets(buf, sizeof(buf), stdin) == NULL) {
	    exit_status++;
	    goto cleanup;;
	}
	if (strcmp(buf, yes)) {
	    exit_status++;
	    goto cleanup;
	}
    }

    if ((retval = krb5_ldap_read_service(util_context, servicedn,
					 &lserparams, &mask))) {
	/* Solaris Kerberos */
	com_err(progname, retval, gettext("while destroying service '%s'"), servicedn);
	exit_status++;
	goto cleanup;
    }

    retval = krb5_ldap_delete_service(util_context, lserparams, servicedn);

    if (retval) {
	/* Solaris Kerberos */
	com_err(progname, retval, gettext("while destroying service '%s'"), servicedn);
	exit_status++;
	goto cleanup;
    }

    if (stashfilename == NULL) {
	stashfilename = strdup(DEF_SERVICE_PASSWD_FILE);
	if (stashfilename == NULL) {
	    /* Solaris Kerberos */
	    com_err(progname, ENOMEM, gettext("while destroying service"));
	    exit_status++;
	    goto cleanup;
	}
    }
    printf(gettext("** service object '%s' deleted.\n"), servicedn);
    retval = rem_service_entry_from_file(argc, argv, stashfilename, servicedn);

    if (retval)
	printf(gettext("** error removing service object entry '%s' from password file.\n"),
	       servicedn);

    goto cleanup;


err_usage:
    print_usage = TRUE;

cleanup:

    if (lserparams) {
	krb5_ldap_free_service(util_context, lserparams);
    }

    if (servicedn) {
	free(servicedn);
    }

    if (stashfilename) {
	free(stashfilename);
    }

    if (print_usage) {
	db_usage(DESTROY_SERVICE);
    }

    return;
}


/*
 * This function will display information about the given service object
 */
void kdb5_ldap_view_service(argc, argv)
    int argc;
    char *argv[];
{
    krb5_ldap_service_params *lserparams = NULL;
    krb5_error_code retval = 0;
    char *servicedn = NULL;
    int mask = 0;
    krb5_boolean print_usage = FALSE;

    if (!(argc == 2)) {
	exit_status++;
	goto err_usage;
    }

    servicedn=strdup(argv[1]);
    if (servicedn == NULL) {
	/* Solaris Kerberos */
	com_err(progname, ENOMEM, gettext("while viewing service"));
	exit_status++;
	goto cleanup;
    }

    if ((retval = krb5_ldap_read_service(util_context, servicedn, &lserparams, &mask))) {
	/* Solaris Kerberos */
	com_err(progname, retval, gettext("while viewing service '%s'"), servicedn);
	exit_status++;
	goto cleanup;
    }

    print_service_params(lserparams, mask);

    goto cleanup;

err_usage:
    print_usage = TRUE;

cleanup:

    if (lserparams) {
	krb5_ldap_free_service(util_context, lserparams);
    }

    if (servicedn)
	free(servicedn);

    if (print_usage) {
	db_usage(VIEW_SERVICE);
    }

    return;
}


/*
 * This function will list the DNs of kerberos services present on
 * the LDAP Server under a specific sub-tree (entire tree by default)
 */
void kdb5_ldap_list_services(argc, argv)
    int argc;
    char *argv[];
{
    /* Solaris Kerberos */
    char *me = progname;
    krb5_error_code retval = 0;
    char *basedn = NULL;
    char **list = NULL;
    char **plist = NULL;
    krb5_boolean print_usage = FALSE;

    /* Check for number of arguments */
    if ((argc != 1) && (argc != 3)) {
	exit_status++;
	goto err_usage;
    }

    /* Parse base DN argument if present */
    if (argc == 3) {
	if (strcmp(argv[1], "-basedn")) {
	    retval = EINVAL;
	    goto err_usage;
	}

	basedn = strdup(argv[2]);
	if (basedn == NULL) {
	    com_err(me, ENOMEM, gettext("while listing services"));
	    exit_status++;
	    goto cleanup;
	}
    }

    retval = krb5_ldap_list_services(util_context, basedn, &list);
    if ((retval != 0) || (list == NULL)) {
	exit_status++;
	goto cleanup;
    }

    for (plist = list; *plist != NULL; plist++) {
	printf("%s\n", *plist);
    }

    goto cleanup;

err_usage:
    print_usage = TRUE;

cleanup:
    if (list != NULL) {
	krb5_free_list_entries (list);
	free (list);
    }

    if (basedn)
	free (basedn);

    if (print_usage) {
	db_usage(LIST_SERVICE);
    }

    if (retval) {
	com_err(me, retval, gettext("while listing policy objects"));
	exit_status++;
    }

    return;
}


/*
 * This function will print the service object information
 * to the standard output
 */
static void
print_service_params(lserparams, mask)
    krb5_ldap_service_params *lserparams;
    int mask;
{
    int            i=0;

    /* Print the service dn */
    printf("%20s%-20s\n", gettext("Service dn: "), lserparams->servicedn);

    /* Print the service type of the object to be read */
    if (lserparams->servicetype == LDAP_KDC_SERVICE) {
	printf("%20s%-20s\n", gettext("Service type: "), "kdc");
    } else if (lserparams->servicetype == LDAP_ADMIN_SERVICE) {
	printf("%20s%-20s\n", gettext("Service type: "), "admin");
    } else if (lserparams->servicetype == LDAP_PASSWD_SERVICE) {
	printf("%20s%-20s\n", gettext("Service type: "), "pwd");
    }

    /* Print the host server values */
    printf("%20s\n", gettext("Service host list: "));
    if (mask & LDAP_SERVICE_HOSTSERVER) {
	for (i=0; lserparams->krbhostservers[i] != NULL; ++i) {
	    printf("%20s%-50s\n","",lserparams->krbhostservers[i]);
	}
    }

    /* Print the realm reference dn values */
    printf("%20s\n", gettext("Realm DN list: "));
    if (mask & LDAP_SERVICE_REALMREFERENCE) {
	for (i=0; lserparams && lserparams->krbrealmreferences && lserparams->krbrealmreferences[i] != NULL; ++i) {
	    printf("%20s%-50s\n","",lserparams->krbrealmreferences[i]);
	}
    }

    return;
}


/*
 * This function will generate random  password of length(RANDOM_PASSWD_LEN)
 *
 *
 * INPUT:
 *      ctxt - context
 *
 * OUTPUT:
 *     RANDOM_PASSWD_LEN length random password
 */
static int generate_random_password(krb5_context ctxt, char **randpwd, unsigned int *passlen)
{
    char *random_pwd = NULL;
    int ret = 0;
    krb5_data data;
    int i=0;
    /*int len = 0;*/

    /* setting random password length in the range 16-32 */
    srand((unsigned int)(time(0) ^ getpid()));

    data.length = RANDOM_PASSWD_LEN;
    random_pwd = (char *)malloc(data.length + 1);
    if (random_pwd == NULL) {
	com_err("setsrvpw", ENOMEM, gettext("while generating random password"));
	return ENOMEM;
    }
    memset(random_pwd, 0, data.length + 1);
    data.data = random_pwd;

    ret = krb5_c_random_make_octets(ctxt, &data);
    if (ret) {
	com_err("setsrvpw", ret, gettext("Error generating random password"));
	free(random_pwd);
	return ret;
    }

    for (i=0; i<data.length; i++) {
	/* restricting to ascii chars. Need to change this when 8.8 supports */
	if ((unsigned char)random_pwd[i] > 127) {
	    random_pwd[i] = (unsigned char)random_pwd[i] % 128;
	} else if (random_pwd[i] == 0) {
	    random_pwd[i] = (rand()/(RAND_MAX/127 + 1))+1;
	}
    }

    *randpwd = random_pwd;
    *passlen = data.length;

    return 0;
}


/*
 * This function will set the password of the service object in the directory
 * and/or the specified service password file.
 *
 *
 * INPUT:
 *      argc - contains the number of arguments for this sub-command
 *      argv - array of arguments for this sub-command
 *
 * OUTPUT:
 *      void
 */
int
kdb5_ldap_set_service_password(argc, argv)
    int argc;
    char **argv;
{
    krb5_ldap_context *lparams = NULL;
    char *file_name = NULL;
    char *tmp_file = NULL;
    /* Solaris Kerberos */
    char *me = progname;
    int filelen = 0;
    int random_passwd = 0;
    int set_dir_pwd = 1;
    krb5_boolean db_init_local = FALSE;
    char *service_object = NULL;
    char *passwd = NULL;
    char *prompt1 = NULL;
    char *prompt2 = NULL;
    unsigned int passwd_len = 0;
    krb5_error_code errcode = -1;
    int retval = 0, i = 0;
    unsigned int len = 0;
    krb5_boolean print_usage = FALSE;
    FILE *pfile = NULL;
    char *str = NULL;
    char line[MAX_LEN];
    kdb5_dal_handle *dal_handle = NULL;
    struct data encrypted_passwd = {0, NULL};

    /* The arguments for setsrv password should contain the service object DN
     * and options to specify whether the password should be updated in file only
     * or both file and directory. So the possible combination of arguments are:
     * setsrvpw servicedn				wherein argc is 2
     * setsrvpw	-fileonly servicedn 			wherein argc is 3
     * setsrvpw -randpw servicedn			wherein argc is 3
     * setsrvpw -f filename servicedn			wherein argc is 4
     * setsrvpw -fileonly -f filename servicedn 	wherein argc is 5
     * setsrvpw -randpw -f filename servicedn 		wherein argc is 5
     */
    if ((argc < 2) || (argc > 5)) {
	print_usage = TRUE;
	goto cleanup;
    }

    dal_handle = (kdb5_dal_handle *)util_context->db_context;
    lparams = (krb5_ldap_context *) dal_handle->db_context;

    if (lparams == NULL) {
	printf(gettext("%s: Invalid LDAP handle\n"), me);
	goto cleanup;
    }

    /* Parse the arguments */
    for (i = 1; i < argc -1 ; i++) {
	if (strcmp(argv[i], "-randpw") == 0) {
	    random_passwd = 1;
	} else if (strcmp(argv[i], "-fileonly") == 0) {
	    set_dir_pwd = 0;
	} else if (strcmp(argv[i], "-f") == 0) {
	    if (argv[++i] == NULL) {
		print_usage = TRUE;
		goto cleanup;
	    }

	    file_name = strdup(argv[i]);
	    if (file_name == NULL) {
		com_err(me, ENOMEM, gettext("while setting service object password"));
		goto cleanup;
	    }
	    /* Verify if the file location has the proper file name
	     * for eg, if the file location is a directory like /home/temp/,
	     * we reject it.
	     */
	    filelen = strlen(file_name);
	    if ((filelen == 0) || (file_name[filelen-1] == '/')) {
		printf(gettext("%s: Filename not specified for setting service object password\n"), me);
		print_usage = TRUE;
		goto cleanup;
	    }
	} else {
	    printf(gettext("%s: Invalid option specified for \"setsrvpw\" command\n"), me);
	    print_usage = TRUE;
	    goto cleanup;
	}
    }

    if (i != argc-1) {
	print_usage = TRUE;
	goto cleanup;
    }

    service_object = strdup(argv[i]);
    if (service_object == NULL) {
	com_err(me, ENOMEM, gettext("while setting service object password"));
	goto cleanup;
    }

    if (strlen(service_object) == 0) {
	printf(gettext("%s: Service object not specified for \"setsrvpw\" command\n"), me);
	print_usage = TRUE;
	goto cleanup;
    }

    if (service_object[0] == '-') {
	print_usage = TRUE;
	goto cleanup;
    }

    if (file_name == NULL) {
	file_name = strdup(DEF_SERVICE_PASSWD_FILE);
	if (file_name == NULL) {
	    com_err(me, ENOMEM, gettext("while setting service object password"));
	    goto cleanup;
	}
    }

    if (set_dir_pwd) {
	if (db_inited == FALSE) {
	    if ((errcode = krb5_ldap_db_init(util_context, lparams))) {
		com_err(me, errcode, gettext("while initializing database"));
		goto cleanup;
	    }
	    db_init_local = TRUE;
	}
    }

    if (random_passwd) {
	if (!set_dir_pwd) {
	    printf(gettext("%s: Invalid option specified for \"setsrvpw\" command\n"), me);
	    print_usage = TRUE;
	    goto cleanup;
	} else {
	    /* Generate random password */

	    if ((errcode = generate_random_password(util_context, &passwd, &passwd_len))) {
		printf(gettext("%s: Failed to set service object password\n"), me);
		goto cleanup;
	    }
	    passwd_len = strlen(passwd);
	}
    } else {
	/* Get the service object password from the terminal */
	passwd = (char *)malloc(MAX_SERVICE_PASSWD_LEN + 1);
	if (passwd == NULL) {
	    com_err(me, ENOMEM, gettext("while setting service object password"));
	    goto cleanup;
	}
	memset(passwd, 0, MAX_SERVICE_PASSWD_LEN + 1);
	passwd_len = MAX_SERVICE_PASSWD_LEN;

	len = strlen(service_object);
	/* size of allocation=strlen of servicedn + strlen("Password for \" \"")=20 */
	prompt1 = (char *)malloc(len + 20);
	if (prompt1 == NULL) {
	    com_err(me, ENOMEM, gettext("while setting service object password"));
	    goto cleanup;
	}
	sprintf(prompt1, gettext("Password for \"%s\""), service_object);

	/* size of allocation=strlen of servicedn + strlen("Re-enter Password for \" \"")=30 */
	prompt2 = (char *)malloc(len + 30);
	if (prompt2 == NULL) {
	    com_err(me, ENOMEM, gettext("while setting service object password"));
	    free(prompt1);
	    goto cleanup;
	}
	sprintf(prompt2, gettext("Re-enter password for \"%s\""), service_object);

	retval = krb5_read_password(util_context, prompt1, prompt2, passwd, &passwd_len);
	free(prompt1);
	free(prompt2);
	if (retval) {
	    com_err(me, retval, gettext("while setting service object password"));
	    memset(passwd, 0, MAX_SERVICE_PASSWD_LEN);
	    goto cleanup;
	}
	if (passwd_len == 0) {
	    printf(gettext("%s: Invalid password\n"), me);
	    memset(passwd, 0, MAX_SERVICE_PASSWD_LEN);
	    goto cleanup;
	}
	passwd_len = strlen(passwd);
    }

    /* Hex the password */
    {
	krb5_data pwd, hex;
	pwd.length = passwd_len;
	pwd.data = passwd;

	errcode = tohex(pwd, &hex);
	if (errcode != 0) {
	    if (hex.length != 0) {
		memset(hex.data, 0, hex.length);
		free(hex.data);
	    }
	    com_err(me, errcode, gettext("Failed to convert the password to hex"));
	    memset(passwd, 0, passwd_len);
	    goto cleanup;
	}
	/* Password = {CRYPT}<encrypted password>:<encrypted key> */
	encrypted_passwd.value = (unsigned char *)malloc(strlen(service_object) +
							 1 + 5 + hex.length + 2);
	if (encrypted_passwd.value == NULL) {
	    com_err(me, ENOMEM, gettext("while setting service object password"));
	    memset(passwd, 0, passwd_len);
	    memset(hex.data, 0, hex.length);
	    free(hex.data);
	    goto cleanup;
	}
	encrypted_passwd.value[strlen(service_object) +
			       1 + 5 + hex.length + 1] = '\0';
	sprintf((char *)encrypted_passwd.value, "%s#{HEX}%s\n", service_object, hex.data);
	encrypted_passwd.len = strlen((char *)encrypted_passwd.value);
	memset(hex.data, 0, hex.length);
	free(hex.data);
    }

    /* We should check if the file exists and we have permission to write into that file */
    if (access(file_name, W_OK) == -1) {
	if (errno == ENOENT) {
	    mode_t omask;
	    int fd = -1;

	    printf(gettext("File does not exist. Creating the file %s...\n"), file_name);
	    omask = umask(077);
	    fd = creat(file_name, S_IRUSR|S_IWUSR);
	    umask(omask);
	    if (fd == -1) {
		com_err(me, errno, gettext("Error creating file %s"), file_name);
		memset(passwd, 0, passwd_len);
		goto cleanup;
	    }
	    close(fd);
	} else {
	    com_err(me, errno, gettext("Unable to access the file %s"), file_name);
	    memset(passwd, 0, passwd_len);
	    goto cleanup;
	}
    }

    if (set_dir_pwd) {
	if ((errcode = krb5_ldap_set_service_passwd(util_context, service_object, passwd)) != 0) {
	    com_err(me, errcode, gettext("Failed to set password for service object %s"), service_object);
	    memset(passwd, 0, passwd_len);
	    goto cleanup;
	}
    }

    memset(passwd, 0, passwd_len);


    /* TODO: file lock for the service password file */
    /* set password in the file */
    pfile = fopen(file_name, "r+F");
    if (pfile == NULL) {
	com_err(me, errno, gettext("Failed to open file %s"), file_name);
	goto cleanup;
    }

    while (fgets(line, MAX_LEN, pfile) != NULL) {
	if ((str = strstr(line, service_object)) != NULL) {
	    if (line[strlen(service_object)] == '#') {
		break;
	    }
	    str = NULL;
	}
    }
    if (str == NULL) {
	if (feof(pfile)) {
	    /* If the service object dn is not present in the service password file */
	    if (fwrite(encrypted_passwd.value, (unsigned int)encrypted_passwd.len, 1, pfile) != 1) {
		com_err(me, errno, gettext("Failed to write service object password to file"));
		goto cleanup;
	    }
	} else {
	    com_err(me, errno, gettext("Error reading service object password file"));
	    goto cleanup;
	}
	fclose(pfile);
	pfile = NULL;
    } else {
	/* Password entry for the service object is already present in the file */
	/* Delete the existing entry and add the new entry */
	FILE *newfile = NULL;
	mode_t omask;

	/* Create a new file with the extension .tmp */
	tmp_file = (char *) malloc(sizeof(char) * (strlen(file_name) + 4 + 1));
	if (tmp_file == NULL) {
	    com_err(me, ENOMEM, gettext("while setting service object password"));
	    goto cleanup;
	}
	sprintf(tmp_file,"%s.%s",file_name,"tmp");

	omask = umask(077);
	newfile = fopen(tmp_file, "w+F");
	umask(omask);
	if (newfile == NULL) {
	    com_err(me, errno, gettext("Error creating file %s"), tmp_file);
	    goto cleanup;
	}


	fseek(pfile, 0, SEEK_SET);
	while (fgets(line, MAX_LEN, pfile) != NULL) {
	    if (((str = strstr(line, service_object)) != NULL) && (line[strlen(service_object)] == '#')) {
		if (fprintf(newfile, "%s", encrypted_passwd.value) < 0) {
		    com_err(me, errno, gettext("Failed to write service object password to file"));
		    fclose(newfile);
		    unlink(tmp_file);
		    goto cleanup;
		}
	    } else {
		len = strlen(line);
		if (fprintf(newfile, "%s", line) < 0) {
		    com_err(me, errno, gettext("Failed to write service object password to file"));
		    fclose(newfile);
		    unlink(tmp_file);
		    goto cleanup;
		}
	    }
	}

	if (!feof(pfile)) {
	    com_err(me, errno, gettext("Error reading service object password file"));
	    fclose(newfile);
	    unlink(tmp_file);
	    goto cleanup;
	}

	/* TODO: file lock for the service password file */
	fclose(pfile);
	pfile = NULL;

	fclose(newfile);
	newfile = NULL;

	if (unlink(file_name) == 0) {
	    link(tmp_file, file_name);
	} else {
	    com_err(me, errno, gettext("Failed to write service object password to file"));
	    unlink(tmp_file);
	    goto cleanup;
	}
	unlink(tmp_file);
    }
    errcode = 0;

cleanup:
    if (db_init_local)
	krb5_ldap_close(util_context);

    if (service_object)
	free(service_object);

    if (file_name)
	free(file_name);

    if (passwd)
	free(passwd);

    if (encrypted_passwd.value) {
	memset(encrypted_passwd.value, 0, encrypted_passwd.len);
	free(encrypted_passwd.value);
    }

    if (pfile)
	fclose(pfile);

    if (tmp_file)
	free(tmp_file);

    if (print_usage)
	db_usage(SET_SRV_PW);

    return errcode;
}

#else /* #ifdef HAVE_EDIRECTORY */

/*
 * Convert the user supplied password into hexadecimal and stash it. Only a
 * little more secure than storing plain password in the file ...
 */
void
kdb5_ldap_stash_service_password(argc, argv)
    int argc;
    char **argv;
{
    int ret = 0;
    unsigned int passwd_len = 0;
    /* Solaris Kerberos */
    char *me = progname;
    char *service_object = NULL;
    char *file_name = NULL, *tmp_file = NULL;
    char passwd[MAX_SERVICE_PASSWD_LEN];
    char *str = NULL;
    char line[MAX_LEN];
    int fd;
    FILE *pfile = NULL;
    krb5_boolean print_usage = FALSE;
    krb5_data hexpasswd = {0, 0, NULL};
    mode_t old_mode = 0;

    /*
     * Format:
     *   stashsrvpw [-f filename] service_dn
     * where
     *   'service_dn' is the DN of the service object
     *   'filename' is the path of the stash file
     */
    if (argc != 2 && argc != 4) {
	print_usage = TRUE;
	goto cleanup;
    }

    if (argc == 4) {
	/* Find the stash file name */
	if (strcmp (argv[1], "-f") == 0) {
	    if (((file_name = strdup (argv[2])) == NULL) ||
	        ((service_object = strdup (argv[3])) == NULL)) {
	        com_err(me, ENOMEM, gettext("while setting service object password"));
	        goto cleanup;
	    }
	} else if (strcmp (argv[2], "-f") == 0) {
	    if (((file_name = strdup (argv[3])) == NULL) ||
	        ((service_object = strdup (argv[1])) == NULL)) {
	        com_err(me, ENOMEM, gettext("while setting service object password"));
	        goto cleanup;
	    }
	} else {
	    print_usage = TRUE;
	    goto cleanup;
	}
	if (file_name == NULL) {
	    com_err(me, ENOMEM, gettext("while setting service object password"));
	    goto cleanup;
	}
    } else { /* argc == 2 */
	char *section;

	service_object = strdup (argv[1]);
	if (service_object == NULL) {
	    com_err(me, ENOMEM, gettext("while setting service object password"));
	    goto cleanup;
	}

	/* Pick up the stash-file name from krb5.conf */
	profile_get_string(util_context->profile, KDB_REALM_SECTION,
			   util_context->default_realm, KDB_MODULE_POINTER, NULL, &section);

	if (section == NULL) {
	    profile_get_string(util_context->profile, KDB_MODULE_DEF_SECTION,
			       KDB_MODULE_POINTER, NULL, NULL, &section);
	    if (section == NULL) {
		/* Stash file path neither in krb5.conf nor on command line */
		file_name = strdup(DEF_SERVICE_PASSWD_FILE);
	        if (file_name == NULL) {
	            com_err(me, ENOMEM, gettext("while setting service object password"));
	            goto cleanup;
	        }
		goto done;
	    }
	}

	profile_get_string (util_context->profile, KDB_MODULE_SECTION, section,
			    "ldap_service_password_file", NULL, &file_name);

	/*
	 * Solaris Kerberos: use default if ldap_service_password_file not set
	 */
	if (file_name == NULL) {
	    file_name = strdup(DEF_SERVICE_PASSWD_FILE);
	    if (file_name == NULL) {
		com_err(me, ENOMEM, gettext("while setting service object password"));
		goto cleanup;
	    }
	}
    }
done:

    /* Get password from user */
    {
	char prompt1[256], prompt2[256];

	/* Get the service object password from the terminal */
	memset(passwd, 0, sizeof (passwd));
	passwd_len = sizeof (passwd);

	/* size of prompt = strlen of servicedn + strlen("Password for \" \"") */
	assert (sizeof (prompt1) > (strlen (service_object)
				    + sizeof ("Password for \" \"")));
	sprintf(prompt1, gettext("Password for \"%s\""), service_object);

	/* size of prompt = strlen of servicedn + strlen("Re-enter Password for \" \"") */
	assert (sizeof (prompt2) > (strlen (service_object)
				    + sizeof ("Re-enter Password for \" \"")));
	sprintf(prompt2, gettext("Re-enter password for \"%s\""), service_object);

	ret = krb5_read_password(util_context, prompt1, prompt2, passwd, &passwd_len);
	if (ret != 0) {
	    com_err(me, ret, gettext("while setting service object password"));
	    memset(passwd, 0, sizeof (passwd));
	    goto cleanup;
	}

	if (passwd_len == 0) {
	    printf(gettext("%s: Invalid password\n"), me);
	    memset(passwd, 0, MAX_SERVICE_PASSWD_LEN);
	    goto cleanup;
	}
    }

    /* Convert the password to hexadecimal */
    {
	krb5_data pwd;

	pwd.length = passwd_len;
	pwd.data = passwd;

	ret = tohex(pwd, &hexpasswd);
	if (ret != 0) {
	    com_err(me, ret, gettext("Failed to convert the password to hexadecimal"));
	    memset(passwd, 0, passwd_len);
	    goto cleanup;
	}
    }
    memset(passwd, 0, passwd_len);

    /* TODO: file lock for the service passowrd file */

    /* set password in the file */
#if 0 /* ************ Begin IFDEF'ed OUT ***************************** */
    old_mode = umask(0177);
    pfile = fopen(file_name, "a+");
    if (pfile == NULL) {
	com_err(me, errno, gettext("Failed to open file %s: %s"), file_name,
		strerror (errno));
	goto cleanup;
    }
    rewind (pfile);
    umask(old_mode);
#else
    /* Solaris Kerberos: safer than the above */
    fd = open(file_name, O_CREAT|O_RDWR|O_APPEND, 0600);
    if (fd < 0) {
	com_err(me, errno, gettext("Failed to open file %s: %s"), file_name,
		strerror (errno));
	goto cleanup;
    }
    pfile = fdopen(fd, "a+F");
    if (pfile == NULL) {
	com_err(me, errno, gettext("Failed to open file %s: %s"), file_name,
		strerror (errno));
	goto cleanup;
    }
    rewind (pfile);
#endif

    while (fgets (line, MAX_LEN, pfile) != NULL) {
	if ((str = strstr (line, service_object)) != NULL) {
	    /*
	     * White spaces not allowed, # delimits the service dn from the
	     * password
	     */
	    if (line [strlen (service_object)] == '#')
		break;
	    str = NULL;
	}
    }

    if (str == NULL) {
	if (feof(pfile)) {
	    /* If the service object dn is not present in the service password file */
	    if (fprintf(pfile, "%s#{HEX}%s\n", service_object, hexpasswd.data) < 0) {
		com_err(me, errno, gettext("Failed to write service object password to file"));
		fclose(pfile);
		goto cleanup;
	    }
	} else {
	    com_err(me, errno, gettext("Error reading service object password file"));
	    fclose(pfile);
	    goto cleanup;
	}
	fclose(pfile);
    } else {
	/*
	 * Password entry for the service object is already present in the file
	 * Delete the existing entry and add the new entry
	 */
	FILE *newfile;

	mode_t omask;

	/* Create a new file with the extension .tmp */
	tmp_file = (char *) malloc(sizeof(char) * (strlen(file_name) + 4 + 1));
	if (tmp_file == NULL) {
	    com_err(me, ENOMEM, gettext("while setting service object password"));
	    fclose(pfile);
	    goto cleanup;
	}
	sprintf(tmp_file,"%s.%s",file_name,"tmp");

	omask = umask(077);
	newfile = fopen(tmp_file, "wF");
	umask (omask);
	if (newfile == NULL) {
	    com_err(me, errno, gettext("Error creating file %s"), tmp_file);
	    fclose(pfile);
	    goto cleanup;
	}

	fseek(pfile, 0, SEEK_SET);
	while (fgets(line, MAX_LEN, pfile) != NULL) {
	    if (((str = strstr(line, service_object)) != NULL) &&
		(line[strlen(service_object)] == '#')) {
		if (fprintf(newfile, "%s#{HEX}%s\n", service_object, hexpasswd.data) < 0) {
		    com_err(me, errno, gettext("Failed to write service object password to file"));
		    fclose(newfile);
		    unlink(tmp_file);
		    fclose(pfile);
		    goto cleanup;
		}
	    } else {
		if (fprintf (newfile, "%s", line) < 0) {
		    com_err(me, errno, gettext("Failed to write service object password to file"));
		    fclose(newfile);
		    unlink(tmp_file);
		    fclose(pfile);
		    goto cleanup;
		}
	    }
	}

	if (!feof(pfile)) {
	    com_err(me, errno, gettext("Error reading service object password file"));
	    fclose(newfile);
	    unlink(tmp_file);
	    fclose(pfile);
	    goto cleanup;
	}

	/* TODO: file lock for the service passowrd file */

	fclose(pfile);
	fclose(newfile);

	ret = rename(tmp_file, file_name);
	if (ret != 0) {
	    com_err(me, errno, gettext("Failed to write service object password to "
		    "file"));
	    goto cleanup;
	}
    }
    ret = 0;

cleanup:

    if (hexpasswd.length != 0) {
	memset(hexpasswd.data, 0, hexpasswd.length);
	free(hexpasswd.data);
    }

    if (service_object)
	free(service_object);

    if (file_name)
	free(file_name);

    if (tmp_file)
	free(tmp_file);

    if (print_usage)
	usage();
/*	db_usage(STASH_SRV_PW); */

    if (ret)
	exit_status++;
}

#endif /* #ifdef HAVE_EDIRECTORY */