1*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 2*0Sstevel@tonic-gate 3*0Sstevel@tonic-gate /* 4*0Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 5*0Sstevel@tonic-gate * 6*0Sstevel@tonic-gate * Openvision retains the copyright to derivative works of 7*0Sstevel@tonic-gate * this source code. Do *NOT* create a derivative of this 8*0Sstevel@tonic-gate * source code before consulting with your legal department. 9*0Sstevel@tonic-gate * Do *NOT* integrate *ANY* of this source code into another 10*0Sstevel@tonic-gate * product before consulting with your legal department. 11*0Sstevel@tonic-gate * 12*0Sstevel@tonic-gate * For further information, read the top-level Openvision 13*0Sstevel@tonic-gate * copyright which is contained in the top-level MIT Kerberos 14*0Sstevel@tonic-gate * copyright. 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 17*0Sstevel@tonic-gate * 18*0Sstevel@tonic-gate */ 19*0Sstevel@tonic-gate 20*0Sstevel@tonic-gate 21*0Sstevel@tonic-gate /* 22*0Sstevel@tonic-gate * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved 23*0Sstevel@tonic-gate * 24*0Sstevel@tonic-gate * $Header: /afs/athena.mit.edu/astaff/project/krbdev/.cvsroot/src/kadmin/\ 25*0Sstevel@tonic-gate * server/misc.c,v 1.10 1996/07/22 20:28:55 marc Exp $ 26*0Sstevel@tonic-gate */ 27*0Sstevel@tonic-gate 28*0Sstevel@tonic-gate #if !defined(lint) && !defined(__CODECENTER__) 29*0Sstevel@tonic-gate static char *rcsid = "$Header: /afs/athena.mit.edu/astaff/project/krbdev" 30*0Sstevel@tonic-gate "/.cvsroot/src/kadmin/server/misc.c,v 1.10 1996/07/22 20:28:55 " 31*0Sstevel@tonic-gate "marc Exp $"; 32*0Sstevel@tonic-gate 33*0Sstevel@tonic-gate #endif 34*0Sstevel@tonic-gate 35*0Sstevel@tonic-gate #include <kadm5/adb.h> 36*0Sstevel@tonic-gate #include <kadm5/server_internal.h> 37*0Sstevel@tonic-gate #include <krb5/kdb.h> 38*0Sstevel@tonic-gate #include "misc.h" 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gate /* 41*0Sstevel@tonic-gate * Function: chpass_principal_wrapper 42*0Sstevel@tonic-gate * 43*0Sstevel@tonic-gate * Purpose: wrapper to kadm5_chpass_principal that checks to see if 44*0Sstevel@tonic-gate * pw_min_life has been reached. if not it returns an error. 45*0Sstevel@tonic-gate * otherwise it calls kadm5_chpass_principal 46*0Sstevel@tonic-gate * 47*0Sstevel@tonic-gate * Arguments: 48*0Sstevel@tonic-gate * principal (input) krb5_principals whose password we are 49*0Sstevel@tonic-gate * changing 50*0Sstevel@tonic-gate * passoword (input) passowrd we are going to change to. 51*0Sstevel@tonic-gate * <return value> 0 on sucsess error code on failure. 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * Requires: 54*0Sstevel@tonic-gate * kadm5_init to have been run. 55*0Sstevel@tonic-gate * 56*0Sstevel@tonic-gate * Effects: 57*0Sstevel@tonic-gate * calls kadm5_chpass_principal which changes the kdb and the 58*0Sstevel@tonic-gate * the admin db. 59*0Sstevel@tonic-gate * 60*0Sstevel@tonic-gate */ 61*0Sstevel@tonic-gate kadm5_ret_t 62*0Sstevel@tonic-gate chpass_principal_wrapper(void *server_handle, 63*0Sstevel@tonic-gate krb5_principal principal, char *password) 64*0Sstevel@tonic-gate { 65*0Sstevel@tonic-gate krb5_int32 now; 66*0Sstevel@tonic-gate kadm5_ret_t ret; 67*0Sstevel@tonic-gate kadm5_policy_ent_rec pol; 68*0Sstevel@tonic-gate kadm5_principal_ent_rec princ; 69*0Sstevel@tonic-gate kadm5_server_handle_t handle = server_handle; 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gate if (ret = krb5_timeofday(handle->context, &now)) 72*0Sstevel@tonic-gate return (ret); 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gate if ((ret = kadm5_get_principal(handle->lhandle, principal, 75*0Sstevel@tonic-gate &princ, 76*0Sstevel@tonic-gate KADM5_PRINCIPAL_NORMAL_MASK)) != 77*0Sstevel@tonic-gate KADM5_OK) 78*0Sstevel@tonic-gate return (ret); 79*0Sstevel@tonic-gate if (princ.aux_attributes & KADM5_POLICY) { 80*0Sstevel@tonic-gate if ((ret = kadm5_get_policy(handle->lhandle, 81*0Sstevel@tonic-gate princ.policy, &pol)) != KADM5_OK) { 82*0Sstevel@tonic-gate (void) kadm5_free_principal_ent(handle->lhandle, 83*0Sstevel@tonic-gate &princ); 84*0Sstevel@tonic-gate return (ret); 85*0Sstevel@tonic-gate } 86*0Sstevel@tonic-gate if ((now - princ.last_pwd_change) < pol.pw_min_life && 87*0Sstevel@tonic-gate !(princ.attributes & KRB5_KDB_REQUIRES_PWCHANGE)) { 88*0Sstevel@tonic-gate (void) kadm5_free_policy_ent(handle->lhandle, &pol); 89*0Sstevel@tonic-gate (void) kadm5_free_principal_ent(handle->lhandle, 90*0Sstevel@tonic-gate &princ); 91*0Sstevel@tonic-gate return (KADM5_PASS_TOOSOON); 92*0Sstevel@tonic-gate } 93*0Sstevel@tonic-gate if (ret = kadm5_free_policy_ent(handle->lhandle, &pol)) { 94*0Sstevel@tonic-gate (void) kadm5_free_principal_ent(handle->lhandle, 95*0Sstevel@tonic-gate &princ); 96*0Sstevel@tonic-gate return (ret); 97*0Sstevel@tonic-gate } 98*0Sstevel@tonic-gate } 99*0Sstevel@tonic-gate if (ret = kadm5_free_principal_ent(handle->lhandle, &princ)) 100*0Sstevel@tonic-gate return (ret); 101*0Sstevel@tonic-gate 102*0Sstevel@tonic-gate return (kadm5_chpass_principal(server_handle, principal, password)); 103*0Sstevel@tonic-gate } 104*0Sstevel@tonic-gate 105*0Sstevel@tonic-gate 106*0Sstevel@tonic-gate /* 107*0Sstevel@tonic-gate * Function: randkey_principal_wrapper 108*0Sstevel@tonic-gate * 109*0Sstevel@tonic-gate * Purpose: wrapper to kadm5_randkey_principal which checks the 110*0Sstevel@tonic-gate * passwords min. life. 111*0Sstevel@tonic-gate * 112*0Sstevel@tonic-gate * Arguments: 113*0Sstevel@tonic-gate * principal (input) krb5_principal whose password we are 114*0Sstevel@tonic-gate * changing 115*0Sstevel@tonic-gate * key (output) new random key 116*0Sstevel@tonic-gate * < return value > 0, error code on error. 117*0Sstevel@tonic-gate * 118*0Sstevel@tonic-gate * Requires: 119*0Sstevel@tonic-gate * kadm5_init needs to be run 120*0Sstevel@tonic-gate * 121*0Sstevel@tonic-gate * Effects: 122*0Sstevel@tonic-gate * calls kadm5_randkey_principal 123*0Sstevel@tonic-gate * 124*0Sstevel@tonic-gate */ 125*0Sstevel@tonic-gate kadm5_ret_t 126*0Sstevel@tonic-gate randkey_principal_wrapper(void *server_handle, 127*0Sstevel@tonic-gate krb5_principal principal, 128*0Sstevel@tonic-gate krb5_keyblock ** keys, int *n_keys) 129*0Sstevel@tonic-gate { 130*0Sstevel@tonic-gate 131*0Sstevel@tonic-gate krb5_int32 now; 132*0Sstevel@tonic-gate kadm5_ret_t ret; 133*0Sstevel@tonic-gate kadm5_policy_ent_rec pol; 134*0Sstevel@tonic-gate kadm5_principal_ent_rec princ; 135*0Sstevel@tonic-gate kadm5_server_handle_t handle = server_handle; 136*0Sstevel@tonic-gate 137*0Sstevel@tonic-gate if (ret = krb5_timeofday(handle->context, &now)) 138*0Sstevel@tonic-gate return (ret); 139*0Sstevel@tonic-gate 140*0Sstevel@tonic-gate if ((ret = kadm5_get_principal(handle->lhandle, 141*0Sstevel@tonic-gate principal, &princ, 142*0Sstevel@tonic-gate KADM5_PRINCIPAL_NORMAL_MASK)) != 143*0Sstevel@tonic-gate OSA_ADB_OK) 144*0Sstevel@tonic-gate return (ret); 145*0Sstevel@tonic-gate if (princ.aux_attributes & KADM5_POLICY) { 146*0Sstevel@tonic-gate if ((ret = kadm5_get_policy(handle->lhandle, 147*0Sstevel@tonic-gate princ.policy, &pol)) != KADM5_OK) { 148*0Sstevel@tonic-gate (void) kadm5_free_principal_ent(handle->lhandle, 149*0Sstevel@tonic-gate &princ); 150*0Sstevel@tonic-gate return (ret); 151*0Sstevel@tonic-gate } 152*0Sstevel@tonic-gate if ((now - princ.last_pwd_change) < pol.pw_min_life && 153*0Sstevel@tonic-gate !(princ.attributes & KRB5_KDB_REQUIRES_PWCHANGE)) { 154*0Sstevel@tonic-gate (void) kadm5_free_policy_ent(handle->lhandle, &pol); 155*0Sstevel@tonic-gate (void) kadm5_free_principal_ent(handle->lhandle, 156*0Sstevel@tonic-gate &princ); 157*0Sstevel@tonic-gate return (KADM5_PASS_TOOSOON); 158*0Sstevel@tonic-gate } 159*0Sstevel@tonic-gate if (ret = kadm5_free_policy_ent(handle->lhandle, &pol)) { 160*0Sstevel@tonic-gate (void) kadm5_free_principal_ent(handle->lhandle, 161*0Sstevel@tonic-gate &princ); 162*0Sstevel@tonic-gate return (ret); 163*0Sstevel@tonic-gate } 164*0Sstevel@tonic-gate } 165*0Sstevel@tonic-gate if (ret = kadm5_free_principal_ent(handle->lhandle, &princ)) 166*0Sstevel@tonic-gate return (ret); 167*0Sstevel@tonic-gate return (kadm5_randkey_principal(server_handle, 168*0Sstevel@tonic-gate principal, keys, n_keys)); 169*0Sstevel@tonic-gate } 170