1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * CDDL HEADER START
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*0Sstevel@tonic-gate * with the License.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate * and limitations under the License.
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * CDDL HEADER END
21*0Sstevel@tonic-gate */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate * Copyright 1997-2002 Sun Microsystems, Inc. All rights reserved.
24*0Sstevel@tonic-gate * Use is subject to license terms.
25*0Sstevel@tonic-gate */
26*0Sstevel@tonic-gate
27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
28*0Sstevel@tonic-gate
29*0Sstevel@tonic-gate /*
30*0Sstevel@tonic-gate * gsscred utility
31*0Sstevel@tonic-gate * Manages mapping between a security principal name and unix uid
32*0Sstevel@tonic-gate */
33*0Sstevel@tonic-gate
34*0Sstevel@tonic-gate #include <stdio.h>
35*0Sstevel@tonic-gate #include <stdlib.h>
36*0Sstevel@tonic-gate #include <pwd.h>
37*0Sstevel@tonic-gate #include <unistd.h>
38*0Sstevel@tonic-gate #include <string.h>
39*0Sstevel@tonic-gate #include <gssapi/gssapi_ext.h>
40*0Sstevel@tonic-gate #include "gsscred.h"
41*0Sstevel@tonic-gate
42*0Sstevel@tonic-gate #define MAX_STR_LEN 1024
43*0Sstevel@tonic-gate
44*0Sstevel@tonic-gate
45*0Sstevel@tonic-gate /*
46*0Sstevel@tonic-gate * Internal Functions
47*0Sstevel@tonic-gate */
48*0Sstevel@tonic-gate static void usage(void);
49*0Sstevel@tonic-gate static void addUser(const char *name, const char *oid, const char *userUid,
50*0Sstevel@tonic-gate const char *userComment, const char *userMech);
51*0Sstevel@tonic-gate static int file_listUsers(const gss_OID mechOid, const char *userUid,
52*0Sstevel@tonic-gate char **errDetails);
53*0Sstevel@tonic-gate static int listUsers(const char *name, const char *nameTypeOid,
54*0Sstevel@tonic-gate const char *uid, const char *mechOid);
55*0Sstevel@tonic-gate static int file_removeUsers(const gss_OID mechOid, const char *userUid,
56*0Sstevel@tonic-gate char **errDetails);
57*0Sstevel@tonic-gate static int removeUsers(const char *name, const char *nameTypeOid,
58*0Sstevel@tonic-gate const char *uid, const char *mechOid);
59*0Sstevel@tonic-gate
60*0Sstevel@tonic-gate /*
61*0Sstevel@tonic-gate * Global variables
62*0Sstevel@tonic-gate */
63*0Sstevel@tonic-gate static int tableSource;
64*0Sstevel@tonic-gate static char *PROG_NAME = NULL;
65*0Sstevel@tonic-gate
66*0Sstevel@tonic-gate int
main(int argc,char * args[])67*0Sstevel@tonic-gate main(int argc, char *args[])
68*0Sstevel@tonic-gate {
69*0Sstevel@tonic-gate char *userName = NULL, *nameTypeOID = NULL,
70*0Sstevel@tonic-gate *uid = NULL, *comment = NULL, *mech = NULL,
71*0Sstevel@tonic-gate operation = '0';
72*0Sstevel@tonic-gate int c, errflag = 0;
73*0Sstevel@tonic-gate extern char *optarg;
74*0Sstevel@tonic-gate
75*0Sstevel@tonic-gate PROG_NAME = *args;
76*0Sstevel@tonic-gate
77*0Sstevel@tonic-gate /* set locale and domain for internationalization */
78*0Sstevel@tonic-gate setlocale(LC_ALL, "");
79*0Sstevel@tonic-gate textdomain(TEXT_DOMAIN);
80*0Sstevel@tonic-gate
81*0Sstevel@tonic-gate if (argc < 2)
82*0Sstevel@tonic-gate usage();
83*0Sstevel@tonic-gate
84*0Sstevel@tonic-gate /* Process the input arguments */
85*0Sstevel@tonic-gate while ((c = getopt(argc, args, "arln:o:u:m:c:")) != EOF) {
86*0Sstevel@tonic-gate
87*0Sstevel@tonic-gate switch (c) {
88*0Sstevel@tonic-gate case 'n':
89*0Sstevel@tonic-gate userName = optarg;
90*0Sstevel@tonic-gate break;
91*0Sstevel@tonic-gate
92*0Sstevel@tonic-gate case 'o':
93*0Sstevel@tonic-gate nameTypeOID = optarg;
94*0Sstevel@tonic-gate break;
95*0Sstevel@tonic-gate
96*0Sstevel@tonic-gate case 'u':
97*0Sstevel@tonic-gate uid = optarg;
98*0Sstevel@tonic-gate break;
99*0Sstevel@tonic-gate
100*0Sstevel@tonic-gate case 'm':
101*0Sstevel@tonic-gate mech = optarg;
102*0Sstevel@tonic-gate break;
103*0Sstevel@tonic-gate
104*0Sstevel@tonic-gate case 'c':
105*0Sstevel@tonic-gate comment = optarg;
106*0Sstevel@tonic-gate break;
107*0Sstevel@tonic-gate
108*0Sstevel@tonic-gate case 'a':
109*0Sstevel@tonic-gate case 'r':
110*0Sstevel@tonic-gate case 'l':
111*0Sstevel@tonic-gate operation = c;
112*0Sstevel@tonic-gate errflag++;
113*0Sstevel@tonic-gate if (errflag > 1)
114*0Sstevel@tonic-gate usage();
115*0Sstevel@tonic-gate break;
116*0Sstevel@tonic-gate
117*0Sstevel@tonic-gate default:
118*0Sstevel@tonic-gate usage();
119*0Sstevel@tonic-gate }
120*0Sstevel@tonic-gate }
121*0Sstevel@tonic-gate
122*0Sstevel@tonic-gate /* determine which back-end to use as the gsscred store */
123*0Sstevel@tonic-gate tableSource = gsscred_read_config_file();
124*0Sstevel@tonic-gate
125*0Sstevel@tonic-gate /* perform the requested operation */
126*0Sstevel@tonic-gate switch (operation) {
127*0Sstevel@tonic-gate case 'a':
128*0Sstevel@tonic-gate addUser(userName, nameTypeOID, uid, comment, mech);
129*0Sstevel@tonic-gate break;
130*0Sstevel@tonic-gate
131*0Sstevel@tonic-gate case 'r':
132*0Sstevel@tonic-gate removeUsers(userName, nameTypeOID, uid, mech);
133*0Sstevel@tonic-gate break;
134*0Sstevel@tonic-gate
135*0Sstevel@tonic-gate case 'l':
136*0Sstevel@tonic-gate listUsers(userName, nameTypeOID, uid, mech);
137*0Sstevel@tonic-gate break;
138*0Sstevel@tonic-gate
139*0Sstevel@tonic-gate default:
140*0Sstevel@tonic-gate usage();
141*0Sstevel@tonic-gate }
142*0Sstevel@tonic-gate fprintf(stdout, "\n");
143*0Sstevel@tonic-gate return (0);
144*0Sstevel@tonic-gate } /* main */
145*0Sstevel@tonic-gate
146*0Sstevel@tonic-gate /*
147*0Sstevel@tonic-gate * Handles the addition of users to the gsscred table.
148*0Sstevel@tonic-gate */
149*0Sstevel@tonic-gate static void
addUser(const char * name,const char * nameOidStr,const char * userUid,const char * userComment,const char * mechOidStr)150*0Sstevel@tonic-gate addUser(const char *name, const char *nameOidStr,
151*0Sstevel@tonic-gate const char *userUid, const char *userComment,
152*0Sstevel@tonic-gate const char *mechOidStr)
153*0Sstevel@tonic-gate {
154*0Sstevel@tonic-gate gss_OID mechOid;
155*0Sstevel@tonic-gate gss_buffer_desc fullName = GSS_C_EMPTY_BUFFER,
156*0Sstevel@tonic-gate hexBufDesc = GSS_C_EMPTY_BUFFER,
157*0Sstevel@tonic-gate hexMechOid = GSS_C_EMPTY_BUFFER;
158*0Sstevel@tonic-gate char comment[MAX_STR_LEN+1], hexBuf[MAX_STR_LEN+MAX_STR_LEN+1],
159*0Sstevel@tonic-gate hexMechOidBuf[MAX_STR_LEN+1], *commentPtr = NULL,
160*0Sstevel@tonic-gate *errDetail = NULL, uidStr[256], *uidPtr;
161*0Sstevel@tonic-gate struct passwd *aUser;
162*0Sstevel@tonic-gate OM_uint32 minor;
163*0Sstevel@tonic-gate int count = 0, retCode;
164*0Sstevel@tonic-gate
165*0Sstevel@tonic-gate hexMechOid.length = MAX_STR_LEN;
166*0Sstevel@tonic-gate hexMechOid.value = (void*)hexMechOidBuf;
167*0Sstevel@tonic-gate
168*0Sstevel@tonic-gate /* addition of users can only be performed by super users */
169*0Sstevel@tonic-gate if (getuid()) {
170*0Sstevel@tonic-gate fprintf(stderr,
171*0Sstevel@tonic-gate gettext("\nUser addition requires"
172*0Sstevel@tonic-gate " root privileges."));
173*0Sstevel@tonic-gate return;
174*0Sstevel@tonic-gate }
175*0Sstevel@tonic-gate
176*0Sstevel@tonic-gate /* the mechanism OID is required */
177*0Sstevel@tonic-gate if (mechOidStr == NULL) {
178*0Sstevel@tonic-gate fprintf(stderr, gettext("\nUnspecified mechanism."));
179*0Sstevel@tonic-gate usage();
180*0Sstevel@tonic-gate }
181*0Sstevel@tonic-gate
182*0Sstevel@tonic-gate /* Convert from string mechanism Oid to ASN.1 oid and then hex */
183*0Sstevel@tonic-gate if (__gss_mech_to_oid(mechOidStr, &mechOid) != GSS_S_COMPLETE) {
184*0Sstevel@tonic-gate fprintf(stderr,
185*0Sstevel@tonic-gate gettext("\nInvalid mechanism specified [%s]."),
186*0Sstevel@tonic-gate mechOidStr);
187*0Sstevel@tonic-gate return;
188*0Sstevel@tonic-gate }
189*0Sstevel@tonic-gate
190*0Sstevel@tonic-gate hexBufDesc.length = mechOid->length;
191*0Sstevel@tonic-gate hexBufDesc.value = mechOid->elements;
192*0Sstevel@tonic-gate
193*0Sstevel@tonic-gate if (!gsscred_AsHex(&hexBufDesc, &hexMechOid)) {
194*0Sstevel@tonic-gate fprintf(stderr,
195*0Sstevel@tonic-gate gettext("\nInternal error. "
196*0Sstevel@tonic-gate "Conversion to hex failed."));
197*0Sstevel@tonic-gate return;
198*0Sstevel@tonic-gate }
199*0Sstevel@tonic-gate
200*0Sstevel@tonic-gate /*
201*0Sstevel@tonic-gate * if the name is specified, then do single addition.
202*0Sstevel@tonic-gate * Might have to look up the uid.
203*0Sstevel@tonic-gate */
204*0Sstevel@tonic-gate if (name != NULL) {
205*0Sstevel@tonic-gate hexBufDesc.length = sizeof (hexBuf);
206*0Sstevel@tonic-gate hexBufDesc.value = hexBuf;
207*0Sstevel@tonic-gate
208*0Sstevel@tonic-gate /* build the name as needed */
209*0Sstevel@tonic-gate if (!gsscred_MakeName(mechOid, name, nameOidStr, &fullName)) {
210*0Sstevel@tonic-gate fprintf(stderr,
211*0Sstevel@tonic-gate gettext("\nError adding user [%s]."), name);
212*0Sstevel@tonic-gate return;
213*0Sstevel@tonic-gate }
214*0Sstevel@tonic-gate
215*0Sstevel@tonic-gate /* convert it to hex */
216*0Sstevel@tonic-gate if (!gsscred_AsHex(&fullName, &hexBufDesc)) {
217*0Sstevel@tonic-gate gss_release_buffer(&minor, &fullName);
218*0Sstevel@tonic-gate fprintf(stderr,
219*0Sstevel@tonic-gate gettext("\nInternal error. "
220*0Sstevel@tonic-gate "Conversion to hex failed."));
221*0Sstevel@tonic-gate return;
222*0Sstevel@tonic-gate }
223*0Sstevel@tonic-gate
224*0Sstevel@tonic-gate /* might require the lookup of the uid if one not specified */
225*0Sstevel@tonic-gate if (userUid == NULL) {
226*0Sstevel@tonic-gate
227*0Sstevel@tonic-gate if ((aUser = getpwnam(name)) == NULL) {
228*0Sstevel@tonic-gate fprintf(stderr,
229*0Sstevel@tonic-gate gettext("\nUnable to obtain password"
230*0Sstevel@tonic-gate " information for [%s]."),
231*0Sstevel@tonic-gate name);
232*0Sstevel@tonic-gate gss_release_buffer(&minor, &fullName);
233*0Sstevel@tonic-gate return;
234*0Sstevel@tonic-gate }
235*0Sstevel@tonic-gate sprintf(uidStr, "%ld", aUser->pw_uid);
236*0Sstevel@tonic-gate uidPtr = uidStr;
237*0Sstevel@tonic-gate }
238*0Sstevel@tonic-gate else
239*0Sstevel@tonic-gate uidPtr = (char *)userUid;
240*0Sstevel@tonic-gate
241*0Sstevel@tonic-gate if (userComment == NULL) {
242*0Sstevel@tonic-gate sprintf(comment, "%s, %s", name, mechOidStr);
243*0Sstevel@tonic-gate commentPtr = comment;
244*0Sstevel@tonic-gate } else
245*0Sstevel@tonic-gate commentPtr = (char *)userComment;
246*0Sstevel@tonic-gate
247*0Sstevel@tonic-gate if (tableSource == GSSCRED_FLAT_FILE)
248*0Sstevel@tonic-gate retCode = file_addGssCredEntry(&hexBufDesc,
249*0Sstevel@tonic-gate uidPtr, commentPtr, &errDetail);
250*0Sstevel@tonic-gate else
251*0Sstevel@tonic-gate /* other backends (ldap, dss) coming soon */
252*0Sstevel@tonic-gate retCode = 0;
253*0Sstevel@tonic-gate
254*0Sstevel@tonic-gate if (!retCode) {
255*0Sstevel@tonic-gate fprintf(stderr, gettext("\nError adding user [%s]."),
256*0Sstevel@tonic-gate commentPtr);
257*0Sstevel@tonic-gate
258*0Sstevel@tonic-gate if (errDetail) {
259*0Sstevel@tonic-gate fprintf(stderr, "\n%s\n", errDetail);
260*0Sstevel@tonic-gate free(errDetail);
261*0Sstevel@tonic-gate errDetail = NULL;
262*0Sstevel@tonic-gate }
263*0Sstevel@tonic-gate }
264*0Sstevel@tonic-gate
265*0Sstevel@tonic-gate gss_release_buffer(&minor, &fullName);
266*0Sstevel@tonic-gate return;
267*0Sstevel@tonic-gate }
268*0Sstevel@tonic-gate
269*0Sstevel@tonic-gate /*
270*0Sstevel@tonic-gate * since no name specified, then we will load everyone from
271*0Sstevel@tonic-gate * password table. This means that -u and -o options are invalid.
272*0Sstevel@tonic-gate * We just ignore it, but we could flag it as error.
273*0Sstevel@tonic-gate */
274*0Sstevel@tonic-gate setpwent();
275*0Sstevel@tonic-gate
276*0Sstevel@tonic-gate while ((aUser = getpwent()) != NULL) {
277*0Sstevel@tonic-gate hexBufDesc.length = sizeof (hexBuf);
278*0Sstevel@tonic-gate hexBufDesc.value = hexBuf;
279*0Sstevel@tonic-gate
280*0Sstevel@tonic-gate if (!gsscred_MakeName(mechOid, aUser->pw_name,
281*0Sstevel@tonic-gate nameOidStr, &fullName)) {
282*0Sstevel@tonic-gate fprintf(stderr,
283*0Sstevel@tonic-gate gettext("\nError adding user [%s]."),
284*0Sstevel@tonic-gate aUser->pw_name);
285*0Sstevel@tonic-gate continue;
286*0Sstevel@tonic-gate }
287*0Sstevel@tonic-gate
288*0Sstevel@tonic-gate if (!gsscred_AsHex(&fullName, &hexBufDesc)) {
289*0Sstevel@tonic-gate gss_release_buffer(&minor, &fullName);
290*0Sstevel@tonic-gate fprintf(stderr,
291*0Sstevel@tonic-gate gettext("\nInternal error. "
292*0Sstevel@tonic-gate "Conversion to hex failed."));
293*0Sstevel@tonic-gate continue;
294*0Sstevel@tonic-gate }
295*0Sstevel@tonic-gate
296*0Sstevel@tonic-gate sprintf(uidStr, "%ld", aUser->pw_uid);
297*0Sstevel@tonic-gate sprintf(comment, "%s, %s", aUser->pw_name, mechOidStr);
298*0Sstevel@tonic-gate if (tableSource == GSSCRED_FLAT_FILE)
299*0Sstevel@tonic-gate retCode = file_addGssCredEntry(&hexBufDesc,
300*0Sstevel@tonic-gate uidStr, comment, &errDetail);
301*0Sstevel@tonic-gate else
302*0Sstevel@tonic-gate retCode = 0;
303*0Sstevel@tonic-gate
304*0Sstevel@tonic-gate if (!retCode) {
305*0Sstevel@tonic-gate fprintf(stderr,
306*0Sstevel@tonic-gate gettext("\nError adding user [%s]."),
307*0Sstevel@tonic-gate comment);
308*0Sstevel@tonic-gate
309*0Sstevel@tonic-gate if (errDetail) {
310*0Sstevel@tonic-gate fprintf(stderr, "\n%s\n", errDetail);
311*0Sstevel@tonic-gate free(errDetail);
312*0Sstevel@tonic-gate errDetail = NULL;
313*0Sstevel@tonic-gate }
314*0Sstevel@tonic-gate } else {
315*0Sstevel@tonic-gate count++;
316*0Sstevel@tonic-gate if ((count % 50) == 0)
317*0Sstevel@tonic-gate fprintf(stdout,
318*0Sstevel@tonic-gate gettext("\n[%d] users added..."),
319*0Sstevel@tonic-gate count);
320*0Sstevel@tonic-gate }
321*0Sstevel@tonic-gate gss_release_buffer(&minor, &fullName);
322*0Sstevel@tonic-gate }
323*0Sstevel@tonic-gate endpwent();
324*0Sstevel@tonic-gate } /* addUser */
325*0Sstevel@tonic-gate
326*0Sstevel@tonic-gate
327*0Sstevel@tonic-gate /*
328*0Sstevel@tonic-gate * Handles the searching of the gsscred table.
329*0Sstevel@tonic-gate */
listUsers(const char * name,const char * nameOidStr,const char * uidStr,const char * mechOidStr)330*0Sstevel@tonic-gate static int listUsers(const char *name, const char *nameOidStr,
331*0Sstevel@tonic-gate const char *uidStr, const char *mechOidStr)
332*0Sstevel@tonic-gate {
333*0Sstevel@tonic-gate GssCredEntry *entryPtr, *entryTmpPtr;
334*0Sstevel@tonic-gate char hexMech[256],
335*0Sstevel@tonic-gate hexName[(MAX_STR_LEN *2) + 1];
336*0Sstevel@tonic-gate gss_OID anOid = NULL, userMechOid = NULL;
337*0Sstevel@tonic-gate gss_OID_set mechSet = NULL;
338*0Sstevel@tonic-gate gss_buffer_desc inBufDesc = GSS_C_EMPTY_BUFFER,
339*0Sstevel@tonic-gate outBufDesc = GSS_C_EMPTY_BUFFER,
340*0Sstevel@tonic-gate searchName = GSS_C_EMPTY_BUFFER;
341*0Sstevel@tonic-gate int status = 1, numOfMechs, i;
342*0Sstevel@tonic-gate OM_uint32 minor;
343*0Sstevel@tonic-gate char *errDetails = NULL;
344*0Sstevel@tonic-gate
345*0Sstevel@tonic-gate /* Do we need to convert the mechanism oid? */
346*0Sstevel@tonic-gate if (mechOidStr != NULL) {
347*0Sstevel@tonic-gate
348*0Sstevel@tonic-gate if (__gss_mech_to_oid(mechOidStr, &userMechOid) !=
349*0Sstevel@tonic-gate GSS_S_COMPLETE) {
350*0Sstevel@tonic-gate fprintf(stderr,
351*0Sstevel@tonic-gate gettext("\nInvalid mechanism specified [%s]."),
352*0Sstevel@tonic-gate mechOidStr);
353*0Sstevel@tonic-gate return (0);
354*0Sstevel@tonic-gate }
355*0Sstevel@tonic-gate inBufDesc.length = userMechOid->length;
356*0Sstevel@tonic-gate inBufDesc.value = userMechOid->elements;
357*0Sstevel@tonic-gate outBufDesc.length = sizeof (hexMech);
358*0Sstevel@tonic-gate outBufDesc.value = hexMech;
359*0Sstevel@tonic-gate
360*0Sstevel@tonic-gate if (!gsscred_AsHex(&inBufDesc, &outBufDesc)) {
361*0Sstevel@tonic-gate fprintf(stderr,
362*0Sstevel@tonic-gate gettext("\nInternal error. "
363*0Sstevel@tonic-gate "Conversion to hex failed."));
364*0Sstevel@tonic-gate status = 0;
365*0Sstevel@tonic-gate goto cleanup;
366*0Sstevel@tonic-gate }
367*0Sstevel@tonic-gate
368*0Sstevel@tonic-gate } /* mechOidStr != NULL */
369*0Sstevel@tonic-gate
370*0Sstevel@tonic-gate /* are we retrieving everyone ? or searching by mech ? */
371*0Sstevel@tonic-gate if ((name == NULL && uidStr == NULL && mechOidStr == NULL) ||
372*0Sstevel@tonic-gate (name == NULL && uidStr == NULL)) {
373*0Sstevel@tonic-gate
374*0Sstevel@tonic-gate if (tableSource == GSSCRED_FLAT_FILE) {
375*0Sstevel@tonic-gate file_listUsers(userMechOid, NULL, &errDetails);
376*0Sstevel@tonic-gate
377*0Sstevel@tonic-gate if (errDetails) {
378*0Sstevel@tonic-gate fprintf(stderr,
379*0Sstevel@tonic-gate gettext("\nError searching gsscred"
380*0Sstevel@tonic-gate " table [%s]."),
381*0Sstevel@tonic-gate errDetails);
382*0Sstevel@tonic-gate free(errDetails);
383*0Sstevel@tonic-gate errDetails = NULL;
384*0Sstevel@tonic-gate return (0);
385*0Sstevel@tonic-gate }
386*0Sstevel@tonic-gate return (1);
387*0Sstevel@tonic-gate }
388*0Sstevel@tonic-gate
389*0Sstevel@tonic-gate }
390*0Sstevel@tonic-gate
391*0Sstevel@tonic-gate /* Are we searching by uid or uid and mech? */
392*0Sstevel@tonic-gate if (name == NULL && uidStr != NULL) {
393*0Sstevel@tonic-gate
394*0Sstevel@tonic-gate if (tableSource == GSSCRED_FLAT_FILE)
395*0Sstevel@tonic-gate file_listUsers(userMechOid, uidStr, &errDetails);
396*0Sstevel@tonic-gate else {
397*0Sstevel@tonic-gate entryPtr = NULL;
398*0Sstevel@tonic-gate while (entryPtr != NULL) {
399*0Sstevel@tonic-gate fprintf(stdout, "\n%s\t%d\t%s",
400*0Sstevel@tonic-gate entryPtr->principal_name,
401*0Sstevel@tonic-gate entryPtr->unix_uid, entryPtr->comment);
402*0Sstevel@tonic-gate free(entryPtr->principal_name);
403*0Sstevel@tonic-gate free(entryPtr->comment);
404*0Sstevel@tonic-gate entryTmpPtr = entryPtr->next;
405*0Sstevel@tonic-gate free(entryPtr);
406*0Sstevel@tonic-gate entryPtr = entryTmpPtr;
407*0Sstevel@tonic-gate }
408*0Sstevel@tonic-gate }
409*0Sstevel@tonic-gate
410*0Sstevel@tonic-gate /* check for any errors */
411*0Sstevel@tonic-gate if (errDetails) {
412*0Sstevel@tonic-gate fprintf(stderr,
413*0Sstevel@tonic-gate gettext("\nError searching gsscred table "
414*0Sstevel@tonic-gate "[%s]."),
415*0Sstevel@tonic-gate errDetails);
416*0Sstevel@tonic-gate free(errDetails);
417*0Sstevel@tonic-gate errDetails = NULL;
418*0Sstevel@tonic-gate status = 0;
419*0Sstevel@tonic-gate }
420*0Sstevel@tonic-gate
421*0Sstevel@tonic-gate goto cleanup;
422*0Sstevel@tonic-gate }
423*0Sstevel@tonic-gate
424*0Sstevel@tonic-gate /*
425*0Sstevel@tonic-gate * We are searching by name;
426*0Sstevel@tonic-gate * how many mechs must we check?
427*0Sstevel@tonic-gate */
428*0Sstevel@tonic-gate if (mechOidStr == NULL) {
429*0Sstevel@tonic-gate
430*0Sstevel@tonic-gate if (gss_indicate_mechs(&minor, &mechSet) != GSS_S_COMPLETE) {
431*0Sstevel@tonic-gate fprintf(stderr,
432*0Sstevel@tonic-gate gettext("\nInternal error. "
433*0Sstevel@tonic-gate "GSS-API call failed."));
434*0Sstevel@tonic-gate return (0);
435*0Sstevel@tonic-gate }
436*0Sstevel@tonic-gate numOfMechs = mechSet->count;
437*0Sstevel@tonic-gate }
438*0Sstevel@tonic-gate else
439*0Sstevel@tonic-gate numOfMechs = 1;
440*0Sstevel@tonic-gate
441*0Sstevel@tonic-gate /* now look through all the mechs searching */
442*0Sstevel@tonic-gate for (i = 0; i < numOfMechs; i++) {
443*0Sstevel@tonic-gate
444*0Sstevel@tonic-gate if (mechOidStr == NULL) {
445*0Sstevel@tonic-gate anOid = &mechSet->elements[i];
446*0Sstevel@tonic-gate inBufDesc.length = anOid->length;
447*0Sstevel@tonic-gate inBufDesc.value = anOid->elements;
448*0Sstevel@tonic-gate outBufDesc.length = sizeof (hexMech);
449*0Sstevel@tonic-gate outBufDesc.value = hexMech;
450*0Sstevel@tonic-gate
451*0Sstevel@tonic-gate if (!gsscred_AsHex(&inBufDesc, &outBufDesc))
452*0Sstevel@tonic-gate continue;
453*0Sstevel@tonic-gate } else
454*0Sstevel@tonic-gate anOid = userMechOid;
455*0Sstevel@tonic-gate
456*0Sstevel@tonic-gate /* create a gss name */
457*0Sstevel@tonic-gate if (!gsscred_MakeName(anOid, name, nameOidStr, &outBufDesc))
458*0Sstevel@tonic-gate continue;
459*0Sstevel@tonic-gate
460*0Sstevel@tonic-gate /* now convert it to hex, and find it */
461*0Sstevel@tonic-gate searchName.value = hexName;
462*0Sstevel@tonic-gate searchName.length = sizeof (hexName);
463*0Sstevel@tonic-gate status = gsscred_AsHex(&outBufDesc, &searchName);
464*0Sstevel@tonic-gate free(outBufDesc.value);
465*0Sstevel@tonic-gate
466*0Sstevel@tonic-gate if (!status)
467*0Sstevel@tonic-gate continue;
468*0Sstevel@tonic-gate
469*0Sstevel@tonic-gate if (tableSource == GSSCRED_FLAT_FILE)
470*0Sstevel@tonic-gate file_getGssCredEntry(&searchName, uidStr, &errDetails);
471*0Sstevel@tonic-gate else {
472*0Sstevel@tonic-gate entryPtr = NULL; /* other backends coming soon */
473*0Sstevel@tonic-gate while (entryPtr != NULL) {
474*0Sstevel@tonic-gate fprintf(stdout, "\n%s\t%d\t%s",
475*0Sstevel@tonic-gate entryPtr->principal_name,
476*0Sstevel@tonic-gate entryPtr->unix_uid, entryPtr->comment);
477*0Sstevel@tonic-gate free(entryPtr->principal_name);
478*0Sstevel@tonic-gate free(entryPtr->comment);
479*0Sstevel@tonic-gate entryTmpPtr = entryPtr->next;
480*0Sstevel@tonic-gate free(entryPtr);
481*0Sstevel@tonic-gate entryPtr = entryTmpPtr;
482*0Sstevel@tonic-gate }
483*0Sstevel@tonic-gate }
484*0Sstevel@tonic-gate
485*0Sstevel@tonic-gate /* any errors to display */
486*0Sstevel@tonic-gate if (errDetails) {
487*0Sstevel@tonic-gate fprintf(stderr,
488*0Sstevel@tonic-gate gettext("\nError searching gsscred table "
489*0Sstevel@tonic-gate "[%s]."),
490*0Sstevel@tonic-gate errDetails);
491*0Sstevel@tonic-gate free(errDetails);
492*0Sstevel@tonic-gate errDetails = NULL;
493*0Sstevel@tonic-gate status = 0;
494*0Sstevel@tonic-gate }
495*0Sstevel@tonic-gate } /* for */
496*0Sstevel@tonic-gate
497*0Sstevel@tonic-gate cleanup:
498*0Sstevel@tonic-gate if (mechSet != NULL)
499*0Sstevel@tonic-gate gss_release_oid_set(&minor, &mechSet);
500*0Sstevel@tonic-gate
501*0Sstevel@tonic-gate return (status);
502*0Sstevel@tonic-gate } /* listUsers */
503*0Sstevel@tonic-gate
504*0Sstevel@tonic-gate /*
505*0Sstevel@tonic-gate * Performs additional handling while searching for users
506*0Sstevel@tonic-gate * stored in the flat file table.
507*0Sstevel@tonic-gate */
508*0Sstevel@tonic-gate int
file_listUsers(const gss_OID mechOid,const char * unixUid,char ** errDetails)509*0Sstevel@tonic-gate file_listUsers(const gss_OID mechOid, const char *unixUid,
510*0Sstevel@tonic-gate char **errDetails)
511*0Sstevel@tonic-gate {
512*0Sstevel@tonic-gate gss_buffer_desc mechBufDesc = GSS_C_EMPTY_BUFFER,
513*0Sstevel@tonic-gate mechHexBufDesc = GSS_C_EMPTY_BUFFER;
514*0Sstevel@tonic-gate char mechBuf[128], mechHexBuf[256];
515*0Sstevel@tonic-gate
516*0Sstevel@tonic-gate if (mechOid != NULL) {
517*0Sstevel@tonic-gate /* must make the name header whic contains mech oid */
518*0Sstevel@tonic-gate mechBufDesc.value = (void *) mechBuf;
519*0Sstevel@tonic-gate mechBufDesc.length = sizeof (mechBuf);
520*0Sstevel@tonic-gate mechHexBufDesc.value = (void*) mechHexBuf;
521*0Sstevel@tonic-gate mechHexBufDesc.length = sizeof (mechHexBuf);
522*0Sstevel@tonic-gate
523*0Sstevel@tonic-gate if ((!gsscred_MakeNameHeader(mechOid, &mechBufDesc)) ||
524*0Sstevel@tonic-gate (!gsscred_AsHex(&mechBufDesc, &mechHexBufDesc))) {
525*0Sstevel@tonic-gate (*errDetails) = strdup(
526*0Sstevel@tonic-gate gettext("\nInternal error. "
527*0Sstevel@tonic-gate " Conversion to hex failed."));
528*0Sstevel@tonic-gate return (0);
529*0Sstevel@tonic-gate }
530*0Sstevel@tonic-gate
531*0Sstevel@tonic-gate return (file_getGssCredEntry(&mechHexBufDesc,
532*0Sstevel@tonic-gate unixUid, errDetails));
533*0Sstevel@tonic-gate }
534*0Sstevel@tonic-gate
535*0Sstevel@tonic-gate return (file_getGssCredEntry(NULL, unixUid, errDetails));
536*0Sstevel@tonic-gate } /* file_listUsers */
537*0Sstevel@tonic-gate
538*0Sstevel@tonic-gate
539*0Sstevel@tonic-gate /*
540*0Sstevel@tonic-gate * Handles the deletion of users.
541*0Sstevel@tonic-gate */
removeUsers(const char * name,const char * nameOidStr,const char * uidStr,const char * mechOidStr)542*0Sstevel@tonic-gate static int removeUsers(const char *name, const char *nameOidStr,
543*0Sstevel@tonic-gate const char *uidStr, const char *mechOidStr)
544*0Sstevel@tonic-gate {
545*0Sstevel@tonic-gate char hexMech[256],
546*0Sstevel@tonic-gate hexName[(MAX_STR_LEN *2) + 1],
547*0Sstevel@tonic-gate *errDetails = NULL;
548*0Sstevel@tonic-gate gss_OID anOid = NULL, userMechOid = NULL;
549*0Sstevel@tonic-gate gss_OID_set mechSet = NULL;
550*0Sstevel@tonic-gate gss_buffer_desc inBufDesc = GSS_C_EMPTY_BUFFER,
551*0Sstevel@tonic-gate outBufDesc = GSS_C_EMPTY_BUFFER,
552*0Sstevel@tonic-gate searchName = GSS_C_EMPTY_BUFFER;
553*0Sstevel@tonic-gate int status = 0, numOfMechs, i;
554*0Sstevel@tonic-gate OM_uint32 minor;
555*0Sstevel@tonic-gate
556*0Sstevel@tonic-gate
557*0Sstevel@tonic-gate /* user deletion can only be performed by super user */
558*0Sstevel@tonic-gate if (getuid()) {
559*0Sstevel@tonic-gate
560*0Sstevel@tonic-gate fprintf(stderr,
561*0Sstevel@tonic-gate gettext("\nUser deletion requires"
562*0Sstevel@tonic-gate " root privileges."));
563*0Sstevel@tonic-gate return (0);
564*0Sstevel@tonic-gate }
565*0Sstevel@tonic-gate
566*0Sstevel@tonic-gate /* do we need to convert the mechanism oid? */
567*0Sstevel@tonic-gate if (mechOidStr != NULL) {
568*0Sstevel@tonic-gate if (__gss_mech_to_oid(mechOidStr, &userMechOid) !=
569*0Sstevel@tonic-gate GSS_S_COMPLETE) {
570*0Sstevel@tonic-gate fprintf(stderr,
571*0Sstevel@tonic-gate gettext("\nInvalid mechanism specified [%s]."),
572*0Sstevel@tonic-gate mechOidStr);
573*0Sstevel@tonic-gate return (0);
574*0Sstevel@tonic-gate }
575*0Sstevel@tonic-gate
576*0Sstevel@tonic-gate inBufDesc.length = userMechOid->length;
577*0Sstevel@tonic-gate inBufDesc.value = userMechOid->elements;
578*0Sstevel@tonic-gate outBufDesc.length = sizeof (hexMech);
579*0Sstevel@tonic-gate outBufDesc.value = hexMech;
580*0Sstevel@tonic-gate
581*0Sstevel@tonic-gate if (!gsscred_AsHex(&inBufDesc, &outBufDesc)) {
582*0Sstevel@tonic-gate fprintf(stderr,
583*0Sstevel@tonic-gate gettext("\nInternal error."
584*0Sstevel@tonic-gate " Conversion to hex failed."));
585*0Sstevel@tonic-gate status = 0;
586*0Sstevel@tonic-gate goto cleanup;
587*0Sstevel@tonic-gate }
588*0Sstevel@tonic-gate
589*0Sstevel@tonic-gate } /* mechOidStr != NULL */
590*0Sstevel@tonic-gate
591*0Sstevel@tonic-gate /* are we deleting the entire table or an entire mech ? */
592*0Sstevel@tonic-gate if (name == NULL && uidStr == NULL) {
593*0Sstevel@tonic-gate
594*0Sstevel@tonic-gate if (tableSource == GSSCRED_FLAT_FILE)
595*0Sstevel@tonic-gate status = file_removeUsers(userMechOid,
596*0Sstevel@tonic-gate NULL, &errDetails);
597*0Sstevel@tonic-gate else
598*0Sstevel@tonic-gate status = 0;
599*0Sstevel@tonic-gate
600*0Sstevel@tonic-gate /* display any errors */
601*0Sstevel@tonic-gate if (errDetails) {
602*0Sstevel@tonic-gate fprintf(stderr,
603*0Sstevel@tonic-gate gettext("\nError deleting gsscred entry "
604*0Sstevel@tonic-gate "[%s]."),
605*0Sstevel@tonic-gate errDetails);
606*0Sstevel@tonic-gate free(errDetails);
607*0Sstevel@tonic-gate errDetails = NULL;
608*0Sstevel@tonic-gate }
609*0Sstevel@tonic-gate goto cleanup;
610*0Sstevel@tonic-gate }
611*0Sstevel@tonic-gate
612*0Sstevel@tonic-gate /* are we deleting by uid or uid and mech? */
613*0Sstevel@tonic-gate if (name == NULL && uidStr != NULL) {
614*0Sstevel@tonic-gate
615*0Sstevel@tonic-gate if (tableSource == GSSCRED_FLAT_FILE)
616*0Sstevel@tonic-gate status = file_removeUsers(userMechOid, uidStr,
617*0Sstevel@tonic-gate &errDetails);
618*0Sstevel@tonic-gate else
619*0Sstevel@tonic-gate status = 0;
620*0Sstevel@tonic-gate
621*0Sstevel@tonic-gate /* check for any errors */
622*0Sstevel@tonic-gate if (errDetails) {
623*0Sstevel@tonic-gate fprintf(stderr,
624*0Sstevel@tonic-gate gettext("\nError deleting gsscred entry "
625*0Sstevel@tonic-gate "[%s]."),
626*0Sstevel@tonic-gate errDetails);
627*0Sstevel@tonic-gate free(errDetails);
628*0Sstevel@tonic-gate errDetails = NULL;
629*0Sstevel@tonic-gate }
630*0Sstevel@tonic-gate goto cleanup;
631*0Sstevel@tonic-gate }
632*0Sstevel@tonic-gate
633*0Sstevel@tonic-gate /*
634*0Sstevel@tonic-gate * We are deleting by name;
635*0Sstevel@tonic-gate * how many mechs must we check?
636*0Sstevel@tonic-gate */
637*0Sstevel@tonic-gate if (mechOidStr == NULL) {
638*0Sstevel@tonic-gate
639*0Sstevel@tonic-gate if (gss_indicate_mechs(&minor, &mechSet) != GSS_S_COMPLETE) {
640*0Sstevel@tonic-gate fprintf(stderr,
641*0Sstevel@tonic-gate gettext("\nInternal error. "
642*0Sstevel@tonic-gate "GSS-API call failed."));
643*0Sstevel@tonic-gate status = 0;
644*0Sstevel@tonic-gate goto cleanup;
645*0Sstevel@tonic-gate }
646*0Sstevel@tonic-gate numOfMechs = mechSet->count;
647*0Sstevel@tonic-gate }
648*0Sstevel@tonic-gate else
649*0Sstevel@tonic-gate numOfMechs = 1;
650*0Sstevel@tonic-gate
651*0Sstevel@tonic-gate /* now look through all the mechs, deleting */
652*0Sstevel@tonic-gate for (i = 0; i < numOfMechs; i++) {
653*0Sstevel@tonic-gate
654*0Sstevel@tonic-gate if (mechOidStr == NULL) {
655*0Sstevel@tonic-gate anOid = &mechSet->elements[i];
656*0Sstevel@tonic-gate inBufDesc.length = anOid->length;
657*0Sstevel@tonic-gate inBufDesc.value = anOid->elements;
658*0Sstevel@tonic-gate outBufDesc.length = sizeof (hexMech);
659*0Sstevel@tonic-gate outBufDesc.value = hexMech;
660*0Sstevel@tonic-gate if (!gsscred_AsHex(&inBufDesc, &outBufDesc))
661*0Sstevel@tonic-gate continue;
662*0Sstevel@tonic-gate } else
663*0Sstevel@tonic-gate anOid = userMechOid;
664*0Sstevel@tonic-gate
665*0Sstevel@tonic-gate /* create a gss name */
666*0Sstevel@tonic-gate if (!gsscred_MakeName(anOid, name, nameOidStr, &outBufDesc))
667*0Sstevel@tonic-gate continue;
668*0Sstevel@tonic-gate
669*0Sstevel@tonic-gate /* now convert it to hex, and delete it */
670*0Sstevel@tonic-gate searchName.value = hexName;
671*0Sstevel@tonic-gate searchName.length = sizeof (hexName);
672*0Sstevel@tonic-gate status = gsscred_AsHex(&outBufDesc, &searchName);
673*0Sstevel@tonic-gate free(outBufDesc.value);
674*0Sstevel@tonic-gate
675*0Sstevel@tonic-gate if (!status)
676*0Sstevel@tonic-gate continue;
677*0Sstevel@tonic-gate
678*0Sstevel@tonic-gate if (tableSource == GSSCRED_FLAT_FILE)
679*0Sstevel@tonic-gate status = file_deleteGssCredEntry(&searchName,
680*0Sstevel@tonic-gate uidStr, &errDetails);
681*0Sstevel@tonic-gate else
682*0Sstevel@tonic-gate status = 0;
683*0Sstevel@tonic-gate
684*0Sstevel@tonic-gate /* check for any errors */
685*0Sstevel@tonic-gate if (errDetails) {
686*0Sstevel@tonic-gate fprintf(stderr,
687*0Sstevel@tonic-gate gettext("\nError deleting gsscred entry"
688*0Sstevel@tonic-gate " [%s]."),
689*0Sstevel@tonic-gate errDetails);
690*0Sstevel@tonic-gate free(errDetails);
691*0Sstevel@tonic-gate errDetails = NULL;
692*0Sstevel@tonic-gate }
693*0Sstevel@tonic-gate } /* for */
694*0Sstevel@tonic-gate
695*0Sstevel@tonic-gate cleanup:
696*0Sstevel@tonic-gate if (mechSet != NULL)
697*0Sstevel@tonic-gate gss_release_oid_set(&minor, &mechSet);
698*0Sstevel@tonic-gate
699*0Sstevel@tonic-gate return (status);
700*0Sstevel@tonic-gate } /* removeUsers */
701*0Sstevel@tonic-gate
702*0Sstevel@tonic-gate
703*0Sstevel@tonic-gate /*
704*0Sstevel@tonic-gate * Performs additional handling while deleting users
705*0Sstevel@tonic-gate * stored in the flat file table.
706*0Sstevel@tonic-gate */
file_removeUsers(const gss_OID mechOid,const char * unixUid,char ** errDetails)707*0Sstevel@tonic-gate int file_removeUsers(const gss_OID mechOid, const char *unixUid,
708*0Sstevel@tonic-gate char **errDetails)
709*0Sstevel@tonic-gate {
710*0Sstevel@tonic-gate gss_buffer_desc mechBufDesc = GSS_C_EMPTY_BUFFER,
711*0Sstevel@tonic-gate mechHexBufDesc = GSS_C_EMPTY_BUFFER;
712*0Sstevel@tonic-gate char mechBuf[128], mechHexBuf[256];
713*0Sstevel@tonic-gate
714*0Sstevel@tonic-gate if (mechOid != NULL) {
715*0Sstevel@tonic-gate /*
716*0Sstevel@tonic-gate * need to create the buffer header which contains
717*0Sstevel@tonic-gate * the mechanism oid.
718*0Sstevel@tonic-gate */
719*0Sstevel@tonic-gate mechBufDesc.value = (void*) mechBuf;
720*0Sstevel@tonic-gate mechBufDesc.length = sizeof (mechBuf);
721*0Sstevel@tonic-gate mechHexBufDesc.value = (void *) mechHexBuf;
722*0Sstevel@tonic-gate mechHexBufDesc.length = sizeof (mechHexBuf);
723*0Sstevel@tonic-gate
724*0Sstevel@tonic-gate if ((!gsscred_MakeNameHeader(mechOid, &mechBufDesc)) ||
725*0Sstevel@tonic-gate (!gsscred_AsHex(&mechBufDesc, &mechHexBufDesc))) {
726*0Sstevel@tonic-gate (*errDetails) = strdup(
727*0Sstevel@tonic-gate gettext("\nInternal error."
728*0Sstevel@tonic-gate " Conversion to hex failed."));
729*0Sstevel@tonic-gate return (0);
730*0Sstevel@tonic-gate }
731*0Sstevel@tonic-gate
732*0Sstevel@tonic-gate return (file_deleteGssCredEntry(&mechHexBufDesc, unixUid,
733*0Sstevel@tonic-gate errDetails));
734*0Sstevel@tonic-gate }
735*0Sstevel@tonic-gate
736*0Sstevel@tonic-gate return (file_deleteGssCredEntry(NULL, unixUid, errDetails));
737*0Sstevel@tonic-gate } /* file_removeUsers */
738*0Sstevel@tonic-gate
739*0Sstevel@tonic-gate
740*0Sstevel@tonic-gate /*
741*0Sstevel@tonic-gate * Prints the usage string, and terminates.
742*0Sstevel@tonic-gate */
usage(void)743*0Sstevel@tonic-gate static void usage(void)
744*0Sstevel@tonic-gate {
745*0Sstevel@tonic-gate
746*0Sstevel@tonic-gate fprintf(stderr,
747*0Sstevel@tonic-gate gettext("\nUsage:\t %s [-n user [-o oid] [-u uid]]"
748*0Sstevel@tonic-gate " [-c comment] -m mech -a"
749*0Sstevel@tonic-gate "\n\t %s [-n user [-o oid]] [-u uid] [-m mech] -r"
750*0Sstevel@tonic-gate "\n\t %s [-n user [-o oid]] [-u uid] [-m mech] -l\n"),
751*0Sstevel@tonic-gate PROG_NAME, PROG_NAME, PROG_NAME);
752*0Sstevel@tonic-gate exit(1);
753*0Sstevel@tonic-gate } /* usage */
754