1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 3*0Sstevel@tonic-gate * Use is subject to license terms. 4*0Sstevel@tonic-gate */ 5*0Sstevel@tonic-gate 6*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 7*0Sstevel@tonic-gate 8*0Sstevel@tonic-gate /* 9*0Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 10*0Sstevel@tonic-gate * 11*0Sstevel@tonic-gate * Openvision retains the copyright to derivative works of 12*0Sstevel@tonic-gate * this source code. Do *NOT* create a derivative of this 13*0Sstevel@tonic-gate * source code before consulting with your legal department. 14*0Sstevel@tonic-gate * Do *NOT* integrate *ANY* of this source code into another 15*0Sstevel@tonic-gate * product before consulting with your legal department. 16*0Sstevel@tonic-gate * 17*0Sstevel@tonic-gate * For further information, read the top-level Openvision 18*0Sstevel@tonic-gate * copyright which is contained in the top-level MIT Kerberos 19*0Sstevel@tonic-gate * copyright. 20*0Sstevel@tonic-gate * 21*0Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate */ 24*0Sstevel@tonic-gate 25*0Sstevel@tonic-gate 26*0Sstevel@tonic-gate /* 27*0Sstevel@tonic-gate * lib/kadm/alt_prof.c 28*0Sstevel@tonic-gate * 29*0Sstevel@tonic-gate * Copyright 1995 by the Massachusetts Institute of Technology. 30*0Sstevel@tonic-gate * All Rights Reserved. 31*0Sstevel@tonic-gate * 32*0Sstevel@tonic-gate * Export of this software from the United States of America may 33*0Sstevel@tonic-gate * require a specific license from the United States Government. 34*0Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 35*0Sstevel@tonic-gate * export to obtain such a license before exporting. 36*0Sstevel@tonic-gate * 37*0Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 38*0Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 39*0Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 40*0Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 41*0Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 42*0Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 43*0Sstevel@tonic-gate * to distribution of the software without specific, written prior 44*0Sstevel@tonic-gate * permission. M.I.T. makes no representations about the suitability of 45*0Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 46*0Sstevel@tonic-gate * or implied warranty. 47*0Sstevel@tonic-gate * 48*0Sstevel@tonic-gate */ 49*0Sstevel@tonic-gate 50*0Sstevel@tonic-gate /* 51*0Sstevel@tonic-gate * alt_prof.c - Implement alternate profile file handling. 52*0Sstevel@tonic-gate */ 53*0Sstevel@tonic-gate #include <k5-int.h> 54*0Sstevel@tonic-gate #include <kadm5/admin.h> 55*0Sstevel@tonic-gate #include <adm_proto.h> 56*0Sstevel@tonic-gate #include <stdio.h> 57*0Sstevel@tonic-gate #include <ctype.h> 58*0Sstevel@tonic-gate #include <os-proto.h> 59*0Sstevel@tonic-gate #include <kdb/kdb_log.h> 60*0Sstevel@tonic-gate 61*0Sstevel@tonic-gate krb5_error_code kadm5_free_config_params(); 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate #define DEFAULT_ENCTYPE_LIST \ 64*0Sstevel@tonic-gate "aes256-cts-hmac-sha1-96:normal " \ 65*0Sstevel@tonic-gate "aes128-cts-hmac-sha1-96:normal " \ 66*0Sstevel@tonic-gate "des3-cbc-hmac-sha1-kd:normal " \ 67*0Sstevel@tonic-gate "arcfour-hmac-md5:normal " \ 68*0Sstevel@tonic-gate "des-cbc-md5:normal " \ 69*0Sstevel@tonic-gate "des-cbc-crc:normal" 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gate /* 72*0Sstevel@tonic-gate * krb5_aprof_init() - Initialize alternate profile context. 73*0Sstevel@tonic-gate * 74*0Sstevel@tonic-gate * Parameters: 75*0Sstevel@tonic-gate * fname - default file name of the profile. 76*0Sstevel@tonic-gate * envname - environment variable name which can override fname. 77*0Sstevel@tonic-gate * acontextp - Pointer to opaque context for alternate profile. 78*0Sstevel@tonic-gate * 79*0Sstevel@tonic-gate * Returns: 80*0Sstevel@tonic-gate * error codes from profile_init() 81*0Sstevel@tonic-gate */ 82*0Sstevel@tonic-gate krb5_error_code 83*0Sstevel@tonic-gate krb5_aprof_init(fname, envname, acontextp) 84*0Sstevel@tonic-gate char *fname; 85*0Sstevel@tonic-gate char *envname; 86*0Sstevel@tonic-gate krb5_pointer *acontextp; 87*0Sstevel@tonic-gate { 88*0Sstevel@tonic-gate krb5_error_code kret; 89*0Sstevel@tonic-gate const char *namelist[2]; 90*0Sstevel@tonic-gate profile_t profile; 91*0Sstevel@tonic-gate 92*0Sstevel@tonic-gate namelist[1] = (char *)NULL; 93*0Sstevel@tonic-gate profile = (profile_t)NULL; 94*0Sstevel@tonic-gate if (envname) { 95*0Sstevel@tonic-gate if ((namelist[0] = getenv(envname))) { 96*0Sstevel@tonic-gate kret = profile_init(namelist, &profile); 97*0Sstevel@tonic-gate if (kret) 98*0Sstevel@tonic-gate return (kret); 99*0Sstevel@tonic-gate *acontextp = (krb5_pointer) profile; 100*0Sstevel@tonic-gate return (0); 101*0Sstevel@tonic-gate } 102*0Sstevel@tonic-gate } 103*0Sstevel@tonic-gate profile = (profile_t)NULL; 104*0Sstevel@tonic-gate if (fname) { 105*0Sstevel@tonic-gate kret = profile_init_path(fname, &profile); 106*0Sstevel@tonic-gate if (kret == ENOENT) { 107*0Sstevel@tonic-gate profile = 0; 108*0Sstevel@tonic-gate } else if (kret) 109*0Sstevel@tonic-gate return (kret); 110*0Sstevel@tonic-gate *acontextp = (krb5_pointer) profile; 111*0Sstevel@tonic-gate return (0); 112*0Sstevel@tonic-gate } 113*0Sstevel@tonic-gate return (0); 114*0Sstevel@tonic-gate } 115*0Sstevel@tonic-gate 116*0Sstevel@tonic-gate /* 117*0Sstevel@tonic-gate * krb5_aprof_getvals() - Get values from alternate profile. 118*0Sstevel@tonic-gate * 119*0Sstevel@tonic-gate * Parameters: 120*0Sstevel@tonic-gate * acontext - opaque context for alternate profile. 121*0Sstevel@tonic-gate * hierarchy - hierarchy of value to retrieve. 122*0Sstevel@tonic-gate * retdata - Returned data values. 123*0Sstevel@tonic-gate * 124*0Sstevel@tonic-gate * Returns: 125*0Sstevel@tonic-gate * error codes from profile_get_values() 126*0Sstevel@tonic-gate */ 127*0Sstevel@tonic-gate krb5_error_code 128*0Sstevel@tonic-gate krb5_aprof_getvals(acontext, hierarchy, retdata) 129*0Sstevel@tonic-gate krb5_pointer acontext; 130*0Sstevel@tonic-gate const char **hierarchy; 131*0Sstevel@tonic-gate char ***retdata; 132*0Sstevel@tonic-gate { 133*0Sstevel@tonic-gate return (profile_get_values((profile_t)acontext, 134*0Sstevel@tonic-gate hierarchy, 135*0Sstevel@tonic-gate retdata)); 136*0Sstevel@tonic-gate } 137*0Sstevel@tonic-gate 138*0Sstevel@tonic-gate /* 139*0Sstevel@tonic-gate * krb5_aprof_get_deltat() - Get a delta time value from the alternate 140*0Sstevel@tonic-gate * profile. 141*0Sstevel@tonic-gate * 142*0Sstevel@tonic-gate * Parameters: 143*0Sstevel@tonic-gate * acontext - opaque context for alternate profile. 144*0Sstevel@tonic-gate * hierarchy - hierarchy of value to retrieve. 145*0Sstevel@tonic-gate * uselast - if true, use last value, otherwise use 146*0Sstevel@tonic-gate * first value found. 147*0Sstevel@tonic-gate * deltatp - returned delta time value. 148*0Sstevel@tonic-gate * 149*0Sstevel@tonic-gate * Returns: 150*0Sstevel@tonic-gate * error codes from profile_get_values() 151*0Sstevel@tonic-gate * error codes from krb5_string_to_deltat() 152*0Sstevel@tonic-gate */ 153*0Sstevel@tonic-gate krb5_error_code 154*0Sstevel@tonic-gate krb5_aprof_get_deltat(acontext, hierarchy, uselast, deltatp) 155*0Sstevel@tonic-gate krb5_pointer acontext; 156*0Sstevel@tonic-gate const char **hierarchy; 157*0Sstevel@tonic-gate krb5_boolean uselast; 158*0Sstevel@tonic-gate krb5_deltat *deltatp; 159*0Sstevel@tonic-gate { 160*0Sstevel@tonic-gate krb5_error_code kret; 161*0Sstevel@tonic-gate char **values; 162*0Sstevel@tonic-gate char *valp; 163*0Sstevel@tonic-gate int index; 164*0Sstevel@tonic-gate 165*0Sstevel@tonic-gate if (!(kret = krb5_aprof_getvals(acontext, hierarchy, &values))) { 166*0Sstevel@tonic-gate index = 0; 167*0Sstevel@tonic-gate if (uselast) { 168*0Sstevel@tonic-gate for (index = 0; values[index]; index++); 169*0Sstevel@tonic-gate index--; 170*0Sstevel@tonic-gate } 171*0Sstevel@tonic-gate valp = values[index]; 172*0Sstevel@tonic-gate kret = krb5_string_to_deltat(valp, deltatp); 173*0Sstevel@tonic-gate 174*0Sstevel@tonic-gate /* Free the string storage */ 175*0Sstevel@tonic-gate for (index = 0; values[index]; index++) 176*0Sstevel@tonic-gate krb5_xfree(values[index]); 177*0Sstevel@tonic-gate krb5_xfree(values); 178*0Sstevel@tonic-gate } 179*0Sstevel@tonic-gate return (kret); 180*0Sstevel@tonic-gate } 181*0Sstevel@tonic-gate 182*0Sstevel@tonic-gate /* 183*0Sstevel@tonic-gate * krb5_aprof_get_string() - Get a string value from the alternate 184*0Sstevel@tonic-gate * profile. 185*0Sstevel@tonic-gate * 186*0Sstevel@tonic-gate * Parameters: 187*0Sstevel@tonic-gate * acontext - opaque context for alternate profile. 188*0Sstevel@tonic-gate * hierarchy - hierarchy of value to retrieve. 189*0Sstevel@tonic-gate * uselast - if true, use last value, otherwise use 190*0Sstevel@tonic-gate * first value found. 191*0Sstevel@tonic-gate * stringp - returned string value. 192*0Sstevel@tonic-gate * 193*0Sstevel@tonic-gate * Returns: 194*0Sstevel@tonic-gate * error codes from profile_get_values() 195*0Sstevel@tonic-gate */ 196*0Sstevel@tonic-gate krb5_error_code 197*0Sstevel@tonic-gate krb5_aprof_get_string(acontext, hierarchy, uselast, stringp) 198*0Sstevel@tonic-gate krb5_pointer acontext; 199*0Sstevel@tonic-gate const char **hierarchy; 200*0Sstevel@tonic-gate krb5_boolean uselast; 201*0Sstevel@tonic-gate char **stringp; 202*0Sstevel@tonic-gate { 203*0Sstevel@tonic-gate krb5_error_code kret; 204*0Sstevel@tonic-gate char **values; 205*0Sstevel@tonic-gate int index, i; 206*0Sstevel@tonic-gate 207*0Sstevel@tonic-gate if (!(kret = krb5_aprof_getvals(acontext, hierarchy, &values))) { 208*0Sstevel@tonic-gate index = 0; 209*0Sstevel@tonic-gate if (uselast) { 210*0Sstevel@tonic-gate for (index = 0; values[index]; index++); 211*0Sstevel@tonic-gate index--; 212*0Sstevel@tonic-gate } 213*0Sstevel@tonic-gate 214*0Sstevel@tonic-gate *stringp = values[index]; 215*0Sstevel@tonic-gate 216*0Sstevel@tonic-gate /* Free the string storage */ 217*0Sstevel@tonic-gate for (i = 0; values[i]; i++) 218*0Sstevel@tonic-gate if (i != index) 219*0Sstevel@tonic-gate krb5_xfree(values[i]); 220*0Sstevel@tonic-gate krb5_xfree(values); 221*0Sstevel@tonic-gate } 222*0Sstevel@tonic-gate return (kret); 223*0Sstevel@tonic-gate } 224*0Sstevel@tonic-gate 225*0Sstevel@tonic-gate /* 226*0Sstevel@tonic-gate * krb5_aprof_get_int32() - Get a 32-bit integer value from the alternate 227*0Sstevel@tonic-gate * profile. 228*0Sstevel@tonic-gate * 229*0Sstevel@tonic-gate * Parameters: 230*0Sstevel@tonic-gate * acontext - opaque context for alternate profile. 231*0Sstevel@tonic-gate * hierarchy - hierarchy of value to retrieve. 232*0Sstevel@tonic-gate * uselast - if true, use last value, otherwise use 233*0Sstevel@tonic-gate * first value found. 234*0Sstevel@tonic-gate * intp - returned 32-bit integer value. 235*0Sstevel@tonic-gate * 236*0Sstevel@tonic-gate * Returns: 237*0Sstevel@tonic-gate * error codes from profile_get_values() 238*0Sstevel@tonic-gate * EINVAL - value is not an integer 239*0Sstevel@tonic-gate */ 240*0Sstevel@tonic-gate krb5_error_code 241*0Sstevel@tonic-gate krb5_aprof_get_int32(acontext, hierarchy, uselast, intp) 242*0Sstevel@tonic-gate krb5_pointer acontext; 243*0Sstevel@tonic-gate const char **hierarchy; 244*0Sstevel@tonic-gate krb5_boolean uselast; 245*0Sstevel@tonic-gate krb5_int32 *intp; 246*0Sstevel@tonic-gate { 247*0Sstevel@tonic-gate krb5_error_code kret; 248*0Sstevel@tonic-gate char **values; 249*0Sstevel@tonic-gate int index; 250*0Sstevel@tonic-gate 251*0Sstevel@tonic-gate if (!(kret = krb5_aprof_getvals(acontext, hierarchy, &values))) { 252*0Sstevel@tonic-gate index = 0; 253*0Sstevel@tonic-gate if (uselast) { 254*0Sstevel@tonic-gate for (index = 0; values[index]; index++); 255*0Sstevel@tonic-gate index--; 256*0Sstevel@tonic-gate } 257*0Sstevel@tonic-gate 258*0Sstevel@tonic-gate if (sscanf(values[index], "%d", intp) != 1) 259*0Sstevel@tonic-gate kret = EINVAL; 260*0Sstevel@tonic-gate 261*0Sstevel@tonic-gate /* Free the string storage */ 262*0Sstevel@tonic-gate for (index = 0; values[index]; index++) 263*0Sstevel@tonic-gate krb5_xfree(values[index]); 264*0Sstevel@tonic-gate krb5_xfree(values); 265*0Sstevel@tonic-gate } 266*0Sstevel@tonic-gate return (kret); 267*0Sstevel@tonic-gate } 268*0Sstevel@tonic-gate 269*0Sstevel@tonic-gate /* 270*0Sstevel@tonic-gate * krb5_aprof_finish() - Finish alternate profile context. 271*0Sstevel@tonic-gate * 272*0Sstevel@tonic-gate * Parameter: 273*0Sstevel@tonic-gate * acontext - opaque context for alternate profile. 274*0Sstevel@tonic-gate * 275*0Sstevel@tonic-gate * Returns: 276*0Sstevel@tonic-gate * 0 on success, something else on failure. 277*0Sstevel@tonic-gate */ 278*0Sstevel@tonic-gate krb5_error_code 279*0Sstevel@tonic-gate krb5_aprof_finish(acontext) 280*0Sstevel@tonic-gate krb5_pointer acontext; 281*0Sstevel@tonic-gate { 282*0Sstevel@tonic-gate profile_release(acontext); 283*0Sstevel@tonic-gate return (0); 284*0Sstevel@tonic-gate } 285*0Sstevel@tonic-gate 286*0Sstevel@tonic-gate /* 287*0Sstevel@tonic-gate * Function: kadm5_get_config_params 288*0Sstevel@tonic-gate * 289*0Sstevel@tonic-gate * Purpose: Merge configuration parameters provided by the caller with 290*0Sstevel@tonic-gate * values specified in configuration files and with default values. 291*0Sstevel@tonic-gate * 292*0Sstevel@tonic-gate * Arguments: 293*0Sstevel@tonic-gate * 294*0Sstevel@tonic-gate * context(r) krb5_context to use 295*0Sstevel@tonic-gate * profile(r) profile file to use 296*0Sstevel@tonic-gate * envname(r) envname that contains a profile name to 297*0Sstevel@tonic-gate * override profile 298*0Sstevel@tonic-gate * params_in(r) params structure containing user-supplied 299*0Sstevel@tonic-gate * values, or NULL 300*0Sstevel@tonic-gate * params_out(w) params structure to be filled in 301*0Sstevel@tonic-gate * 302*0Sstevel@tonic-gate * Effects: 303*0Sstevel@tonic-gate * 304*0Sstevel@tonic-gate * The fields and mask of params_out are filled in with values 305*0Sstevel@tonic-gate * obtained from params_in, the specified profile, and default 306*0Sstevel@tonic-gate * values. Only and all fields specified in params_out->mask are 307*0Sstevel@tonic-gate * set. The context of params_out must be freed with 308*0Sstevel@tonic-gate * kadm5_free_config_params. 309*0Sstevel@tonic-gate * 310*0Sstevel@tonic-gate * params_in and params_out may be the same pointer. However, all pointers 311*0Sstevel@tonic-gate * in params_in for which the mask is set will be re-assigned to newly copied 312*0Sstevel@tonic-gate * versions, overwriting the old pointer value. 313*0Sstevel@tonic-gate */ 314*0Sstevel@tonic-gate krb5_error_code kadm5_get_config_params(context, kdcprofile, kdcenv, 315*0Sstevel@tonic-gate params_in, params_out) 316*0Sstevel@tonic-gate krb5_context context; 317*0Sstevel@tonic-gate char *kdcprofile; 318*0Sstevel@tonic-gate char *kdcenv; 319*0Sstevel@tonic-gate kadm5_config_params *params_in, *params_out; 320*0Sstevel@tonic-gate { 321*0Sstevel@tonic-gate char *filename; 322*0Sstevel@tonic-gate char *envname; 323*0Sstevel@tonic-gate char *lrealm; 324*0Sstevel@tonic-gate krb5_pointer aprofile = 0; 325*0Sstevel@tonic-gate const char *hierarchy[4]; 326*0Sstevel@tonic-gate char *svalue; 327*0Sstevel@tonic-gate krb5_int32 ivalue; 328*0Sstevel@tonic-gate kadm5_config_params params, empty_params; 329*0Sstevel@tonic-gate 330*0Sstevel@tonic-gate krb5_error_code kret = 0; 331*0Sstevel@tonic-gate krb5_error_code dnsret = 1; 332*0Sstevel@tonic-gate 333*0Sstevel@tonic-gate #ifdef KRB5_DNS_LOOKUP 334*0Sstevel@tonic-gate char dns_host[MAX_DNS_NAMELEN]; 335*0Sstevel@tonic-gate unsigned short dns_portno; 336*0Sstevel@tonic-gate krb5_data dns_realm; 337*0Sstevel@tonic-gate #endif /* KRB5_DNS_LOOKUP */ 338*0Sstevel@tonic-gate 339*0Sstevel@tonic-gate memset((char *)¶ms, 0, sizeof (params)); 340*0Sstevel@tonic-gate memset((char *)&empty_params, 0, sizeof (empty_params)); 341*0Sstevel@tonic-gate 342*0Sstevel@tonic-gate if (params_in == NULL) params_in = &empty_params; 343*0Sstevel@tonic-gate 344*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_REALM) { 345*0Sstevel@tonic-gate lrealm = params.realm = strdup(params_in->realm); 346*0Sstevel@tonic-gate if (params.realm) 347*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 348*0Sstevel@tonic-gate } else { 349*0Sstevel@tonic-gate kret = krb5_get_default_realm(context, &lrealm); 350*0Sstevel@tonic-gate if (kret) 351*0Sstevel@tonic-gate goto cleanup; 352*0Sstevel@tonic-gate params.realm = lrealm; 353*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 354*0Sstevel@tonic-gate } 355*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_PROFILE) { 356*0Sstevel@tonic-gate filename = params.profile = strdup(params_in->profile); 357*0Sstevel@tonic-gate if (params.profile) 358*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_PROFILE; 359*0Sstevel@tonic-gate envname = NULL; 360*0Sstevel@tonic-gate } else { 361*0Sstevel@tonic-gate /* 362*0Sstevel@tonic-gate * XXX These defaults should to work on both client and 363*0Sstevel@tonic-gate * server. kadm5_get_config_params can be implemented as a 364*0Sstevel@tonic-gate * wrapper function in each library that provides correct 365*0Sstevel@tonic-gate * defaults for NULL values. 366*0Sstevel@tonic-gate */ 367*0Sstevel@tonic-gate filename = (kdcprofile) ? kdcprofile : DEFAULT_KDC_PROFILE; 368*0Sstevel@tonic-gate envname = (kdcenv) ? kdcenv : KDC_PROFILE_ENV; 369*0Sstevel@tonic-gate if (context->profile_secure == TRUE) envname = 0; 370*0Sstevel@tonic-gate } 371*0Sstevel@tonic-gate 372*0Sstevel@tonic-gate kret = krb5_aprof_init(filename, envname, &aprofile); 373*0Sstevel@tonic-gate if (kret) 374*0Sstevel@tonic-gate goto cleanup; 375*0Sstevel@tonic-gate 376*0Sstevel@tonic-gate /* Initialize realm parameters */ 377*0Sstevel@tonic-gate hierarchy[0] = "realms"; 378*0Sstevel@tonic-gate hierarchy[1] = lrealm; 379*0Sstevel@tonic-gate hierarchy[3] = (char *)NULL; 380*0Sstevel@tonic-gate 381*0Sstevel@tonic-gate #ifdef KRB5_DNS_LOOKUP 382*0Sstevel@tonic-gate /* 383*0Sstevel@tonic-gate * Initialize realm info for (possible) DNS lookups. 384*0Sstevel@tonic-gate */ 385*0Sstevel@tonic-gate dns_realm.data = strdup(lrealm); 386*0Sstevel@tonic-gate dns_realm.length = strlen(lrealm); 387*0Sstevel@tonic-gate dns_realm.magic = 0; 388*0Sstevel@tonic-gate #endif /* KRB5_DNS_LOOKUP */ 389*0Sstevel@tonic-gate 390*0Sstevel@tonic-gate /* Get the value for the admin server */ 391*0Sstevel@tonic-gate hierarchy[2] = "admin_server"; 392*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_ADMIN_SERVER) { 393*0Sstevel@tonic-gate params.admin_server = strdup(params_in->admin_server); 394*0Sstevel@tonic-gate if (params.admin_server) 395*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ADMIN_SERVER; 396*0Sstevel@tonic-gate } else if (aprofile && 397*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 398*0Sstevel@tonic-gate params.admin_server = svalue; 399*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ADMIN_SERVER; 400*0Sstevel@tonic-gate } 401*0Sstevel@tonic-gate #ifdef KRB5_DNS_LOOKUP 402*0Sstevel@tonic-gate else if (strcmp(envname, "KRB5_CONFIG") == 0) { 403*0Sstevel@tonic-gate /* 404*0Sstevel@tonic-gate * Solaris Kerberos: only do DNS lookup for admin_server if this 405*0Sstevel@tonic-gate * is a krb5.conf type of config file. Note, the filename may 406*0Sstevel@tonic-gate * not be /etc/krb5/krb5.conf so we assume that the KRB5_CONFIG 407*0Sstevel@tonic-gate * envname string will consistently indicate the type of config 408*0Sstevel@tonic-gate * file. 409*0Sstevel@tonic-gate */ 410*0Sstevel@tonic-gate dnsret = krb5_get_servername(context, &dns_realm, 411*0Sstevel@tonic-gate "_kerberos-adm", "_udp", 412*0Sstevel@tonic-gate dns_host, &dns_portno); 413*0Sstevel@tonic-gate if (dnsret == 0) { 414*0Sstevel@tonic-gate params.admin_server = strdup(dns_host); 415*0Sstevel@tonic-gate if (params.admin_server) 416*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ADMIN_SERVER; 417*0Sstevel@tonic-gate params.kadmind_port = dns_portno; 418*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KADMIND_PORT; 419*0Sstevel@tonic-gate } 420*0Sstevel@tonic-gate } 421*0Sstevel@tonic-gate #endif /* KRB5_DNS_LOOKUP */ 422*0Sstevel@tonic-gate 423*0Sstevel@tonic-gate if ((params.mask & KADM5_CONFIG_ADMIN_SERVER) && dnsret) { 424*0Sstevel@tonic-gate char *p; 425*0Sstevel@tonic-gate if (p = strchr(params.admin_server, ':')) { 426*0Sstevel@tonic-gate params.kadmind_port = atoi(p+1); 427*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KADMIND_PORT; 428*0Sstevel@tonic-gate *p = '\0'; 429*0Sstevel@tonic-gate } 430*0Sstevel@tonic-gate } 431*0Sstevel@tonic-gate 432*0Sstevel@tonic-gate /* Get the value for the database */ 433*0Sstevel@tonic-gate hierarchy[2] = "database_name"; 434*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_DBNAME) { 435*0Sstevel@tonic-gate params.dbname = strdup(params_in->dbname); 436*0Sstevel@tonic-gate if (params.dbname) 437*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_DBNAME; 438*0Sstevel@tonic-gate } else if (aprofile && 439*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 440*0Sstevel@tonic-gate params.dbname = svalue; 441*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_DBNAME; 442*0Sstevel@tonic-gate } else { 443*0Sstevel@tonic-gate params.dbname = strdup(DEFAULT_KDB_FILE); 444*0Sstevel@tonic-gate if (params.dbname) 445*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_DBNAME; 446*0Sstevel@tonic-gate } 447*0Sstevel@tonic-gate 448*0Sstevel@tonic-gate /* 449*0Sstevel@tonic-gate * admin database name and lockfile are now always derived from dbname 450*0Sstevel@tonic-gate */ 451*0Sstevel@tonic-gate if (params.mask & KADM5_CONFIG_DBNAME) { 452*0Sstevel@tonic-gate params.admin_dbname = (char *)malloc(strlen(params.dbname) 453*0Sstevel@tonic-gate + 7); 454*0Sstevel@tonic-gate if (params.admin_dbname) { 455*0Sstevel@tonic-gate sprintf(params.admin_dbname, "%s.kadm5", 456*0Sstevel@tonic-gate params.dbname); 457*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ADBNAME; 458*0Sstevel@tonic-gate } 459*0Sstevel@tonic-gate } 460*0Sstevel@tonic-gate 461*0Sstevel@tonic-gate if (params.mask & KADM5_CONFIG_ADBNAME) { 462*0Sstevel@tonic-gate params.admin_lockfile = 463*0Sstevel@tonic-gate (char *)malloc(strlen(params.admin_dbname)+ 6); 464*0Sstevel@tonic-gate if (params.admin_lockfile) { 465*0Sstevel@tonic-gate sprintf(params.admin_lockfile, "%s.lock", 466*0Sstevel@tonic-gate params.admin_dbname); 467*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ADB_LOCKFILE; 468*0Sstevel@tonic-gate } 469*0Sstevel@tonic-gate } 470*0Sstevel@tonic-gate 471*0Sstevel@tonic-gate /* Get the value for the admin(policy) database lock file */ 472*0Sstevel@tonic-gate hierarchy[2] = "admin_keytab"; 473*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_ADMIN_KEYTAB) { 474*0Sstevel@tonic-gate params.admin_keytab = strdup(params_in->admin_keytab); 475*0Sstevel@tonic-gate if (params.admin_keytab) 476*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ADMIN_KEYTAB; 477*0Sstevel@tonic-gate } else if (aprofile && 478*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 479*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ADMIN_KEYTAB; 480*0Sstevel@tonic-gate params.admin_keytab = svalue; 481*0Sstevel@tonic-gate } else if (params.admin_keytab = (char *)getenv("KRB5_KTNAME")) { 482*0Sstevel@tonic-gate params.admin_keytab = strdup(params.admin_keytab); 483*0Sstevel@tonic-gate if (params.admin_keytab) 484*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ADMIN_KEYTAB; 485*0Sstevel@tonic-gate } else { 486*0Sstevel@tonic-gate params.admin_keytab = strdup(DEFAULT_KADM5_KEYTAB); 487*0Sstevel@tonic-gate if (params.admin_keytab) 488*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ADMIN_KEYTAB; 489*0Sstevel@tonic-gate } 490*0Sstevel@tonic-gate 491*0Sstevel@tonic-gate /* Get the name of the acl file */ 492*0Sstevel@tonic-gate hierarchy[2] = "acl_file"; 493*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_ACL_FILE) { 494*0Sstevel@tonic-gate params.acl_file = strdup(params_in->acl_file); 495*0Sstevel@tonic-gate if (params.acl_file) 496*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ACL_FILE; 497*0Sstevel@tonic-gate } else if (aprofile && 498*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 499*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ACL_FILE; 500*0Sstevel@tonic-gate params.acl_file = svalue; 501*0Sstevel@tonic-gate } else { 502*0Sstevel@tonic-gate params.acl_file = strdup(DEFAULT_KADM5_ACL_FILE); 503*0Sstevel@tonic-gate if (params.acl_file) 504*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ACL_FILE; 505*0Sstevel@tonic-gate } 506*0Sstevel@tonic-gate 507*0Sstevel@tonic-gate /* Get the name of the dict file */ 508*0Sstevel@tonic-gate hierarchy[2] = "dict_file"; 509*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_DICT_FILE) { 510*0Sstevel@tonic-gate params.dict_file = strdup(params_in->dict_file); 511*0Sstevel@tonic-gate if (params.dict_file) 512*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_DICT_FILE; 513*0Sstevel@tonic-gate } else if (aprofile && 514*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 515*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_DICT_FILE; 516*0Sstevel@tonic-gate params.dict_file = svalue; 517*0Sstevel@tonic-gate } 518*0Sstevel@tonic-gate 519*0Sstevel@tonic-gate /* Get the value for the kadmind port */ 520*0Sstevel@tonic-gate if (! (params.mask & KADM5_CONFIG_KADMIND_PORT)) { 521*0Sstevel@tonic-gate hierarchy[2] = "kadmind_port"; 522*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_KADMIND_PORT) { 523*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KADMIND_PORT; 524*0Sstevel@tonic-gate params.kadmind_port = params_in->kadmind_port; 525*0Sstevel@tonic-gate } else if (aprofile && 526*0Sstevel@tonic-gate !krb5_aprof_get_int32(aprofile, hierarchy, TRUE, 527*0Sstevel@tonic-gate &ivalue)) { 528*0Sstevel@tonic-gate params.kadmind_port = ivalue; 529*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KADMIND_PORT; 530*0Sstevel@tonic-gate } else { 531*0Sstevel@tonic-gate params.kadmind_port = DEFAULT_KADM5_PORT; 532*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KADMIND_PORT; 533*0Sstevel@tonic-gate } 534*0Sstevel@tonic-gate } 535*0Sstevel@tonic-gate 536*0Sstevel@tonic-gate /* Get the value for the master key name */ 537*0Sstevel@tonic-gate hierarchy[2] = "master_key_name"; 538*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_MKEY_NAME) { 539*0Sstevel@tonic-gate params.mkey_name = strdup(params_in->mkey_name); 540*0Sstevel@tonic-gate if (params.mkey_name) 541*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_MKEY_NAME; 542*0Sstevel@tonic-gate } else if (aprofile && 543*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 544*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_MKEY_NAME; 545*0Sstevel@tonic-gate params.mkey_name = svalue; 546*0Sstevel@tonic-gate } 547*0Sstevel@tonic-gate 548*0Sstevel@tonic-gate /* Get the value for the master key type */ 549*0Sstevel@tonic-gate hierarchy[2] = "master_key_type"; 550*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_ENCTYPE) { 551*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ENCTYPE; 552*0Sstevel@tonic-gate params.enctype = params_in->enctype; 553*0Sstevel@tonic-gate } else if (aprofile && 554*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 555*0Sstevel@tonic-gate if (!krb5_string_to_enctype(svalue, ¶ms.enctype)) { 556*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ENCTYPE; 557*0Sstevel@tonic-gate krb5_xfree(svalue); 558*0Sstevel@tonic-gate } 559*0Sstevel@tonic-gate } else { 560*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ENCTYPE; 561*0Sstevel@tonic-gate params.enctype = DEFAULT_KDC_ENCTYPE; 562*0Sstevel@tonic-gate } 563*0Sstevel@tonic-gate 564*0Sstevel@tonic-gate /* Get the value for mkey_from_kbd */ 565*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_MKEY_FROM_KBD) { 566*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_MKEY_FROM_KBD; 567*0Sstevel@tonic-gate params.mkey_from_kbd = params_in->mkey_from_kbd; 568*0Sstevel@tonic-gate } 569*0Sstevel@tonic-gate 570*0Sstevel@tonic-gate /* Get the value for the stashfile */ 571*0Sstevel@tonic-gate hierarchy[2] = "key_stash_file"; 572*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_STASH_FILE) { 573*0Sstevel@tonic-gate params.stash_file = strdup(params_in->stash_file); 574*0Sstevel@tonic-gate if (params.stash_file) 575*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_STASH_FILE; 576*0Sstevel@tonic-gate } else if (aprofile && 577*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 578*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_STASH_FILE; 579*0Sstevel@tonic-gate params.stash_file = svalue; 580*0Sstevel@tonic-gate } 581*0Sstevel@tonic-gate 582*0Sstevel@tonic-gate /* 583*0Sstevel@tonic-gate * Get the value for maximum ticket lifetime. 584*0Sstevel@tonic-gate * See SEAM documentation or the Bug ID 4184504 585*0Sstevel@tonic-gate * We have changed the logic so that the entries are 586*0Sstevel@tonic-gate * created in the database with the maximum duration 587*0Sstevel@tonic-gate * for life and renew life KRB5_INT32_MAX 588*0Sstevel@tonic-gate * However this wil get negotiated down when 589*0Sstevel@tonic-gate * as or tgs request is processed by KDC. 590*0Sstevel@tonic-gate */ 591*0Sstevel@tonic-gate hierarchy[2] = "max_life"; 592*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_MAX_LIFE) { 593*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_MAX_LIFE; 594*0Sstevel@tonic-gate params.max_life = params_in->max_life; 595*0Sstevel@tonic-gate } else { 596*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_MAX_LIFE; 597*0Sstevel@tonic-gate params.max_life = KRB5_INT32_MAX; 598*0Sstevel@tonic-gate } 599*0Sstevel@tonic-gate 600*0Sstevel@tonic-gate /* Get the value for maximum renewable ticket lifetime. */ 601*0Sstevel@tonic-gate hierarchy[2] = "max_renewable_life"; 602*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_MAX_RLIFE) { 603*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_MAX_RLIFE; 604*0Sstevel@tonic-gate params.max_rlife = params_in->max_rlife; 605*0Sstevel@tonic-gate } else { 606*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_MAX_RLIFE; 607*0Sstevel@tonic-gate params.max_rlife = KRB5_INT32_MAX; 608*0Sstevel@tonic-gate } 609*0Sstevel@tonic-gate 610*0Sstevel@tonic-gate /* Get the value for the default principal expiration */ 611*0Sstevel@tonic-gate hierarchy[2] = "default_principal_expiration"; 612*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_EXPIRATION) { 613*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_EXPIRATION; 614*0Sstevel@tonic-gate params.expiration = params_in->expiration; 615*0Sstevel@tonic-gate } else if (aprofile && 616*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 617*0Sstevel@tonic-gate if (!krb5_string_to_timestamp(svalue, ¶ms.expiration)) { 618*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_EXPIRATION; 619*0Sstevel@tonic-gate krb5_xfree(svalue); 620*0Sstevel@tonic-gate } 621*0Sstevel@tonic-gate } else { 622*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_EXPIRATION; 623*0Sstevel@tonic-gate params.expiration = 0; 624*0Sstevel@tonic-gate } 625*0Sstevel@tonic-gate 626*0Sstevel@tonic-gate /* Get the value for the default principal flags */ 627*0Sstevel@tonic-gate hierarchy[2] = "default_principal_flags"; 628*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_FLAGS) { 629*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_FLAGS; 630*0Sstevel@tonic-gate params.flags = params_in->flags; 631*0Sstevel@tonic-gate } else if (aprofile && 632*0Sstevel@tonic-gate !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 633*0Sstevel@tonic-gate char *sp, *ep, *tp; 634*0Sstevel@tonic-gate 635*0Sstevel@tonic-gate sp = svalue; 636*0Sstevel@tonic-gate params.flags = 0; 637*0Sstevel@tonic-gate while (sp) { 638*0Sstevel@tonic-gate if ((ep = strchr(sp, (int)',')) || 639*0Sstevel@tonic-gate (ep = strchr(sp, (int)' ')) || 640*0Sstevel@tonic-gate (ep = strchr(sp, (int)'\t'))) { 641*0Sstevel@tonic-gate /* Fill in trailing whitespace of sp */ 642*0Sstevel@tonic-gate tp = ep - 1; 643*0Sstevel@tonic-gate while (isspace(*tp) && (tp < sp)) { 644*0Sstevel@tonic-gate *tp = '\0'; 645*0Sstevel@tonic-gate tp--; 646*0Sstevel@tonic-gate } 647*0Sstevel@tonic-gate *ep = '\0'; 648*0Sstevel@tonic-gate ep++; 649*0Sstevel@tonic-gate /* Skip over trailing whitespace of ep */ 650*0Sstevel@tonic-gate while (isspace(*ep) && (*ep)) ep++; 651*0Sstevel@tonic-gate } 652*0Sstevel@tonic-gate /* Convert this flag */ 653*0Sstevel@tonic-gate if (krb5_string_to_flags(sp, 654*0Sstevel@tonic-gate "+", 655*0Sstevel@tonic-gate "-", 656*0Sstevel@tonic-gate ¶ms.flags)) 657*0Sstevel@tonic-gate break; 658*0Sstevel@tonic-gate sp = ep; 659*0Sstevel@tonic-gate } 660*0Sstevel@tonic-gate if (!sp) 661*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_FLAGS; 662*0Sstevel@tonic-gate krb5_xfree(svalue); 663*0Sstevel@tonic-gate } else { 664*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_FLAGS; 665*0Sstevel@tonic-gate params.flags = KRB5_KDB_DEF_FLAGS; 666*0Sstevel@tonic-gate } 667*0Sstevel@tonic-gate 668*0Sstevel@tonic-gate /* Get the value for the supported enctype/salttype matrix */ 669*0Sstevel@tonic-gate hierarchy[2] = "supported_enctypes"; 670*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_ENCTYPES) { 671*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ENCTYPES; 672*0Sstevel@tonic-gate if (params_in->num_keysalts > 0) { 673*0Sstevel@tonic-gate params.keysalts = malloc(params_in->num_keysalts * 674*0Sstevel@tonic-gate sizeof (*params.keysalts)); 675*0Sstevel@tonic-gate if (params.keysalts == NULL) { 676*0Sstevel@tonic-gate kret = ENOMEM; 677*0Sstevel@tonic-gate goto cleanup; 678*0Sstevel@tonic-gate } 679*0Sstevel@tonic-gate (void) memcpy(params.keysalts, params_in->keysalts, 680*0Sstevel@tonic-gate (params_in->num_keysalts * 681*0Sstevel@tonic-gate sizeof (*params.keysalts))); 682*0Sstevel@tonic-gate params.num_keysalts = params_in->num_keysalts; 683*0Sstevel@tonic-gate } 684*0Sstevel@tonic-gate } else { 685*0Sstevel@tonic-gate svalue = NULL; 686*0Sstevel@tonic-gate if (aprofile) 687*0Sstevel@tonic-gate krb5_aprof_get_string(aprofile, hierarchy, 688*0Sstevel@tonic-gate TRUE, &svalue); 689*0Sstevel@tonic-gate if (svalue == NULL) 690*0Sstevel@tonic-gate svalue = strdup(DEFAULT_ENCTYPE_LIST); 691*0Sstevel@tonic-gate 692*0Sstevel@tonic-gate params.keysalts = NULL; 693*0Sstevel@tonic-gate params.num_keysalts = 0; 694*0Sstevel@tonic-gate krb5_string_to_keysalts(svalue, 695*0Sstevel@tonic-gate ", \t", /* Tuple separators */ 696*0Sstevel@tonic-gate ":.-", /* Key/salt separators */ 697*0Sstevel@tonic-gate 0, /* No duplicates */ 698*0Sstevel@tonic-gate ¶ms.keysalts, 699*0Sstevel@tonic-gate ¶ms.num_keysalts); 700*0Sstevel@tonic-gate if (params.num_keysalts) 701*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ENCTYPES; 702*0Sstevel@tonic-gate 703*0Sstevel@tonic-gate if (svalue) 704*0Sstevel@tonic-gate krb5_xfree(svalue); 705*0Sstevel@tonic-gate } 706*0Sstevel@tonic-gate 707*0Sstevel@tonic-gate hierarchy[2] = "kpasswd_server"; 708*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_KPASSWD_SERVER) { 709*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KPASSWD_SERVER; 710*0Sstevel@tonic-gate params.kpasswd_server = strdup(params_in->kpasswd_server); 711*0Sstevel@tonic-gate } else { 712*0Sstevel@tonic-gate svalue = NULL; 713*0Sstevel@tonic-gate 714*0Sstevel@tonic-gate if (aprofile) 715*0Sstevel@tonic-gate krb5_aprof_get_string(aprofile, hierarchy, 716*0Sstevel@tonic-gate TRUE, &svalue); 717*0Sstevel@tonic-gate if (svalue == NULL) { 718*0Sstevel@tonic-gate #ifdef KRB5_DNS_LOOKUP 719*0Sstevel@tonic-gate if (strcmp(envname, "KRB5_CONFIG") == 0) { 720*0Sstevel@tonic-gate /* 721*0Sstevel@tonic-gate * Solaris Kerberos: only do DNS lookup for 722*0Sstevel@tonic-gate * kpasswd_server if this is a krb5.conf type of 723*0Sstevel@tonic-gate * config file. Note, the filename may not be 724*0Sstevel@tonic-gate * /etc/krb5/krb5.conf so we assume that the 725*0Sstevel@tonic-gate * KRB5_CONFIG envname string will consistently 726*0Sstevel@tonic-gate * indicate the type of config file. 727*0Sstevel@tonic-gate */ 728*0Sstevel@tonic-gate dnsret = krb5_get_servername(context, 729*0Sstevel@tonic-gate &dns_realm, "_kpasswd", "_udp", 730*0Sstevel@tonic-gate dns_host, &dns_portno); 731*0Sstevel@tonic-gate 732*0Sstevel@tonic-gate if (dnsret == 0) { 733*0Sstevel@tonic-gate params.kpasswd_server = 734*0Sstevel@tonic-gate strdup(dns_host); 735*0Sstevel@tonic-gate if (params.kpasswd_server) { 736*0Sstevel@tonic-gate params.mask |= 737*0Sstevel@tonic-gate KADM5_CONFIG_KPASSWD_SERVER; 738*0Sstevel@tonic-gate } 739*0Sstevel@tonic-gate params.kpasswd_port = dns_portno; 740*0Sstevel@tonic-gate params.mask |= 741*0Sstevel@tonic-gate KADM5_CONFIG_KPASSWD_PORT; 742*0Sstevel@tonic-gate } 743*0Sstevel@tonic-gate } 744*0Sstevel@tonic-gate #endif /* KRB5_DNS_LOOKUP */ 745*0Sstevel@tonic-gate 746*0Sstevel@tonic-gate /* 747*0Sstevel@tonic-gate * If a unique 'kpasswd_server' is not specified, 748*0Sstevel@tonic-gate * use the normal 'admin_server'. 749*0Sstevel@tonic-gate */ 750*0Sstevel@tonic-gate if ((params.mask & KADM5_CONFIG_ADMIN_SERVER) && 751*0Sstevel@tonic-gate dnsret) { 752*0Sstevel@tonic-gate params.kpasswd_server = 753*0Sstevel@tonic-gate strdup(params.admin_server); 754*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KPASSWD_SERVER; 755*0Sstevel@tonic-gate } 756*0Sstevel@tonic-gate } else { 757*0Sstevel@tonic-gate char *p; 758*0Sstevel@tonic-gate params.kpasswd_server = svalue; 759*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KPASSWD_SERVER; 760*0Sstevel@tonic-gate 761*0Sstevel@tonic-gate if ((p = strchr(params.kpasswd_server, ':'))) { 762*0Sstevel@tonic-gate params.kpasswd_port = atoi(p+1); 763*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KPASSWD_PORT; 764*0Sstevel@tonic-gate *p = '\0'; 765*0Sstevel@tonic-gate } 766*0Sstevel@tonic-gate } 767*0Sstevel@tonic-gate } 768*0Sstevel@tonic-gate 769*0Sstevel@tonic-gate hierarchy[2] = "kpasswd_protocol"; 770*0Sstevel@tonic-gate 771*0Sstevel@tonic-gate /* default to current RPCSEC_GSS protocol */ 772*0Sstevel@tonic-gate params.kpasswd_protocol = KRB5_CHGPWD_RPCSEC; 773*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KPASSWD_PROTOCOL; 774*0Sstevel@tonic-gate 775*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_KPASSWD_PROTOCOL) { 776*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KPASSWD_PROTOCOL; 777*0Sstevel@tonic-gate params.kpasswd_protocol = params_in->kpasswd_protocol; 778*0Sstevel@tonic-gate } else { 779*0Sstevel@tonic-gate svalue = NULL; 780*0Sstevel@tonic-gate 781*0Sstevel@tonic-gate if (aprofile) 782*0Sstevel@tonic-gate krb5_aprof_get_string(aprofile, hierarchy, 783*0Sstevel@tonic-gate TRUE, &svalue); 784*0Sstevel@tonic-gate if (svalue != NULL) { 785*0Sstevel@tonic-gate if (strcasecmp(svalue, "RPCSEC_GSS") == 0) { 786*0Sstevel@tonic-gate params.kpasswd_protocol = KRB5_CHGPWD_RPCSEC; 787*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KPASSWD_PROTOCOL; 788*0Sstevel@tonic-gate } else if (strcasecmp(svalue, "SET_CHANGE") == 0) { 789*0Sstevel@tonic-gate params.kpasswd_protocol = 790*0Sstevel@tonic-gate KRB5_CHGPWD_CHANGEPW_V2; 791*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KPASSWD_PROTOCOL; 792*0Sstevel@tonic-gate } 793*0Sstevel@tonic-gate } 794*0Sstevel@tonic-gate if (svalue) 795*0Sstevel@tonic-gate krb5_xfree(svalue); 796*0Sstevel@tonic-gate } 797*0Sstevel@tonic-gate 798*0Sstevel@tonic-gate /* 799*0Sstevel@tonic-gate * If the kpasswd_port is not yet defined, define it now. 800*0Sstevel@tonic-gate */ 801*0Sstevel@tonic-gate if (! (params.mask & KADM5_CONFIG_KPASSWD_PORT)) { 802*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_KPASSWD_PORT) 803*0Sstevel@tonic-gate params.kpasswd_port = params_in->kpasswd_port; 804*0Sstevel@tonic-gate /* 805*0Sstevel@tonic-gate * If kpasswd_port is not explicitly defined, 806*0Sstevel@tonic-gate * determine the port to use based on the protocol. 807*0Sstevel@tonic-gate * The alternative protocol uses a different port 808*0Sstevel@tonic-gate * than the standard admind port. 809*0Sstevel@tonic-gate */ 810*0Sstevel@tonic-gate else if (params.kpasswd_protocol == KRB5_CHGPWD_RPCSEC) { 811*0Sstevel@tonic-gate params.kpasswd_port = DEFAULT_KADM5_PORT; 812*0Sstevel@tonic-gate } else { 813*0Sstevel@tonic-gate /* 814*0Sstevel@tonic-gate * When using the Horowitz/IETF protocol for 815*0Sstevel@tonic-gate * password changing, the default port is 464 816*0Sstevel@tonic-gate * (officially recognized by IANA). 817*0Sstevel@tonic-gate */ 818*0Sstevel@tonic-gate params.kpasswd_port = DEFAULT_KPASSWD_PORT; 819*0Sstevel@tonic-gate } 820*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_KPASSWD_PORT; 821*0Sstevel@tonic-gate } 822*0Sstevel@tonic-gate 823*0Sstevel@tonic-gate hierarchy[2] = "sunw_dbprop_enable"; 824*0Sstevel@tonic-gate 825*0Sstevel@tonic-gate params.iprop_enabled = FALSE; 826*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_IPROP_ENABLED; 827*0Sstevel@tonic-gate 828*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_IPROP_ENABLED) { 829*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_IPROP_ENABLED; 830*0Sstevel@tonic-gate params.iprop_enabled = params_in->iprop_enabled; 831*0Sstevel@tonic-gate } else { 832*0Sstevel@tonic-gate if (aprofile && !krb5_aprof_get_string(aprofile, hierarchy, 833*0Sstevel@tonic-gate TRUE, &svalue)) { 834*0Sstevel@tonic-gate if (strncasecmp(svalue, "Y", 1) == 0) 835*0Sstevel@tonic-gate params.iprop_enabled = TRUE; 836*0Sstevel@tonic-gate if (strncasecmp(svalue, "true", 4) == 0) 837*0Sstevel@tonic-gate params.iprop_enabled = TRUE; 838*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_IPROP_ENABLED; 839*0Sstevel@tonic-gate krb5_xfree(svalue); 840*0Sstevel@tonic-gate } 841*0Sstevel@tonic-gate } 842*0Sstevel@tonic-gate 843*0Sstevel@tonic-gate hierarchy[2] = "sunw_dbprop_master_ulogsize"; 844*0Sstevel@tonic-gate 845*0Sstevel@tonic-gate params.iprop_ulogsize = DEF_ULOGENTRIES; 846*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ULOG_SIZE; 847*0Sstevel@tonic-gate 848*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_ULOG_SIZE) { 849*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ULOG_SIZE; 850*0Sstevel@tonic-gate params.iprop_ulogsize = params_in->iprop_ulogsize; 851*0Sstevel@tonic-gate } else { 852*0Sstevel@tonic-gate if (aprofile && !krb5_aprof_get_int32(aprofile, hierarchy, 853*0Sstevel@tonic-gate TRUE, &ivalue)) { 854*0Sstevel@tonic-gate if (ivalue > MAX_ULOGENTRIES) 855*0Sstevel@tonic-gate params.iprop_ulogsize = MAX_ULOGENTRIES; 856*0Sstevel@tonic-gate else if (ivalue <= 0) 857*0Sstevel@tonic-gate params.iprop_ulogsize = DEF_ULOGENTRIES; 858*0Sstevel@tonic-gate else 859*0Sstevel@tonic-gate params.iprop_ulogsize = ivalue; 860*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_ULOG_SIZE; 861*0Sstevel@tonic-gate } 862*0Sstevel@tonic-gate } 863*0Sstevel@tonic-gate 864*0Sstevel@tonic-gate hierarchy[2] = "sunw_dbprop_slave_poll"; 865*0Sstevel@tonic-gate 866*0Sstevel@tonic-gate params.iprop_polltime = "2m"; 867*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_POLL_TIME; 868*0Sstevel@tonic-gate 869*0Sstevel@tonic-gate if (params_in->mask & KADM5_CONFIG_POLL_TIME) { 870*0Sstevel@tonic-gate params.iprop_polltime = strdup(params_in->iprop_polltime); 871*0Sstevel@tonic-gate if (params.iprop_polltime) 872*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_POLL_TIME; 873*0Sstevel@tonic-gate } else { 874*0Sstevel@tonic-gate if (aprofile && !krb5_aprof_get_string(aprofile, hierarchy, 875*0Sstevel@tonic-gate TRUE, &svalue)) { 876*0Sstevel@tonic-gate params.iprop_polltime = strdup(svalue); 877*0Sstevel@tonic-gate params.mask |= KADM5_CONFIG_POLL_TIME; 878*0Sstevel@tonic-gate krb5_xfree(svalue); 879*0Sstevel@tonic-gate } 880*0Sstevel@tonic-gate } 881*0Sstevel@tonic-gate 882*0Sstevel@tonic-gate *params_out = params; 883*0Sstevel@tonic-gate 884*0Sstevel@tonic-gate cleanup: 885*0Sstevel@tonic-gate if (aprofile) 886*0Sstevel@tonic-gate krb5_aprof_finish(aprofile); 887*0Sstevel@tonic-gate if (kret) { 888*0Sstevel@tonic-gate (void) kadm5_free_config_params(context, ¶ms); 889*0Sstevel@tonic-gate params_out->mask = 0; 890*0Sstevel@tonic-gate } 891*0Sstevel@tonic-gate #ifdef KRB5_DNS_LOOKUP 892*0Sstevel@tonic-gate if (dns_realm.data) 893*0Sstevel@tonic-gate free(dns_realm.data); 894*0Sstevel@tonic-gate #endif /* KRB5_DNS_LOOKUP */ 895*0Sstevel@tonic-gate 896*0Sstevel@tonic-gate return (kret); 897*0Sstevel@tonic-gate } 898*0Sstevel@tonic-gate /* 899*0Sstevel@tonic-gate * kadm5_free_config_params() - Free data allocated by above. 900*0Sstevel@tonic-gate */ 901*0Sstevel@tonic-gate /*ARGSUSED*/ 902*0Sstevel@tonic-gate krb5_error_code 903*0Sstevel@tonic-gate kadm5_free_config_params(context, params) 904*0Sstevel@tonic-gate krb5_context context; 905*0Sstevel@tonic-gate kadm5_config_params *params; 906*0Sstevel@tonic-gate { 907*0Sstevel@tonic-gate if (params) { 908*0Sstevel@tonic-gate if (params->profile) { 909*0Sstevel@tonic-gate krb5_xfree(params->profile); 910*0Sstevel@tonic-gate params->profile = NULL; 911*0Sstevel@tonic-gate } 912*0Sstevel@tonic-gate if (params->dbname) { 913*0Sstevel@tonic-gate krb5_xfree(params->dbname); 914*0Sstevel@tonic-gate params->dbname = NULL; 915*0Sstevel@tonic-gate } 916*0Sstevel@tonic-gate if (params->mkey_name) { 917*0Sstevel@tonic-gate krb5_xfree(params->mkey_name); 918*0Sstevel@tonic-gate params->mkey_name = NULL; 919*0Sstevel@tonic-gate } 920*0Sstevel@tonic-gate if (params->stash_file) { 921*0Sstevel@tonic-gate krb5_xfree(params->stash_file); 922*0Sstevel@tonic-gate params->stash_file = NULL; 923*0Sstevel@tonic-gate } 924*0Sstevel@tonic-gate if (params->keysalts) { 925*0Sstevel@tonic-gate krb5_xfree(params->keysalts); 926*0Sstevel@tonic-gate params->keysalts = NULL; 927*0Sstevel@tonic-gate params->num_keysalts = 0; 928*0Sstevel@tonic-gate } 929*0Sstevel@tonic-gate if (params->admin_keytab) { 930*0Sstevel@tonic-gate free(params->admin_keytab); 931*0Sstevel@tonic-gate params->admin_keytab = NULL; 932*0Sstevel@tonic-gate } 933*0Sstevel@tonic-gate if (params->dict_file) { 934*0Sstevel@tonic-gate free(params->dict_file); 935*0Sstevel@tonic-gate params->dict_file = NULL; 936*0Sstevel@tonic-gate } 937*0Sstevel@tonic-gate if (params->acl_file) { 938*0Sstevel@tonic-gate free(params->acl_file); 939*0Sstevel@tonic-gate params->acl_file = NULL; 940*0Sstevel@tonic-gate } 941*0Sstevel@tonic-gate if (params->realm) { 942*0Sstevel@tonic-gate free(params->realm); 943*0Sstevel@tonic-gate params->realm = NULL; 944*0Sstevel@tonic-gate } 945*0Sstevel@tonic-gate if (params->admin_dbname) { 946*0Sstevel@tonic-gate free(params->admin_dbname); 947*0Sstevel@tonic-gate params->admin_dbname = NULL; 948*0Sstevel@tonic-gate } 949*0Sstevel@tonic-gate if (params->admin_lockfile) { 950*0Sstevel@tonic-gate free(params->admin_lockfile); 951*0Sstevel@tonic-gate params->admin_lockfile = NULL; 952*0Sstevel@tonic-gate } 953*0Sstevel@tonic-gate if (params->admin_server) { 954*0Sstevel@tonic-gate free(params->admin_server); 955*0Sstevel@tonic-gate params->admin_server = NULL; 956*0Sstevel@tonic-gate } 957*0Sstevel@tonic-gate if (params->kpasswd_server) { 958*0Sstevel@tonic-gate free(params->kpasswd_server); 959*0Sstevel@tonic-gate params->kpasswd_server = NULL; 960*0Sstevel@tonic-gate } 961*0Sstevel@tonic-gate } 962*0Sstevel@tonic-gate return (0); 963*0Sstevel@tonic-gate } 964*0Sstevel@tonic-gate 965*0Sstevel@tonic-gate /* 966*0Sstevel@tonic-gate * This is the old krb5_realm_read_params, which I mutated into 967*0Sstevel@tonic-gate * kadm5_get_config_params but which old code(kdb5_* and krb5kdc) 968*0Sstevel@tonic-gate * still uses. 969*0Sstevel@tonic-gate */ 970*0Sstevel@tonic-gate 971*0Sstevel@tonic-gate /* 972*0Sstevel@tonic-gate * krb5_read_realm_params() - Read per-realm parameters from KDC 973*0Sstevel@tonic-gate * alternate profile. 974*0Sstevel@tonic-gate */ 975*0Sstevel@tonic-gate krb5_error_code 976*0Sstevel@tonic-gate krb5_read_realm_params(kcontext, realm, kdcprofile, kdcenv, rparamp) 977*0Sstevel@tonic-gate krb5_context kcontext; 978*0Sstevel@tonic-gate char *realm; 979*0Sstevel@tonic-gate char *kdcprofile; 980*0Sstevel@tonic-gate char *kdcenv; 981*0Sstevel@tonic-gate krb5_realm_params **rparamp; 982*0Sstevel@tonic-gate { 983*0Sstevel@tonic-gate char *filename; 984*0Sstevel@tonic-gate char *envname; 985*0Sstevel@tonic-gate char *lrealm; 986*0Sstevel@tonic-gate krb5_pointer aprofile = 0; 987*0Sstevel@tonic-gate krb5_realm_params *rparams; 988*0Sstevel@tonic-gate const char *hierarchy[4]; 989*0Sstevel@tonic-gate char *svalue; 990*0Sstevel@tonic-gate krb5_int32 ivalue; 991*0Sstevel@tonic-gate krb5_deltat dtvalue; 992*0Sstevel@tonic-gate 993*0Sstevel@tonic-gate krb5_error_code kret; 994*0Sstevel@tonic-gate 995*0Sstevel@tonic-gate filename = (kdcprofile) ? kdcprofile : DEFAULT_KDC_PROFILE; 996*0Sstevel@tonic-gate envname = (kdcenv) ? kdcenv : KDC_PROFILE_ENV; 997*0Sstevel@tonic-gate 998*0Sstevel@tonic-gate if (kcontext->profile_secure == TRUE) envname = 0; 999*0Sstevel@tonic-gate 1000*0Sstevel@tonic-gate rparams = (krb5_realm_params *) NULL; 1001*0Sstevel@tonic-gate if (realm) 1002*0Sstevel@tonic-gate lrealm = strdup(realm); 1003*0Sstevel@tonic-gate else { 1004*0Sstevel@tonic-gate kret = krb5_get_default_realm(kcontext, &lrealm); 1005*0Sstevel@tonic-gate if (kret) 1006*0Sstevel@tonic-gate goto cleanup; 1007*0Sstevel@tonic-gate } 1008*0Sstevel@tonic-gate 1009*0Sstevel@tonic-gate kret = krb5_aprof_init(filename, envname, &aprofile); 1010*0Sstevel@tonic-gate if (kret) 1011*0Sstevel@tonic-gate goto cleanup; 1012*0Sstevel@tonic-gate 1013*0Sstevel@tonic-gate rparams = (krb5_realm_params *) malloc(sizeof (krb5_realm_params)); 1014*0Sstevel@tonic-gate if (rparams == 0) { 1015*0Sstevel@tonic-gate kret = ENOMEM; 1016*0Sstevel@tonic-gate goto cleanup; 1017*0Sstevel@tonic-gate } 1018*0Sstevel@tonic-gate 1019*0Sstevel@tonic-gate /* Initialize realm parameters */ 1020*0Sstevel@tonic-gate memset((char *)rparams, 0, sizeof (krb5_realm_params)); 1021*0Sstevel@tonic-gate 1022*0Sstevel@tonic-gate /* Get the value for the database */ 1023*0Sstevel@tonic-gate hierarchy[0] = "realms"; 1024*0Sstevel@tonic-gate hierarchy[1] = lrealm; 1025*0Sstevel@tonic-gate hierarchy[2] = "database_name"; 1026*0Sstevel@tonic-gate hierarchy[3] = (char *)NULL; 1027*0Sstevel@tonic-gate if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) 1028*0Sstevel@tonic-gate rparams->realm_dbname = svalue; 1029*0Sstevel@tonic-gate 1030*0Sstevel@tonic-gate /* Get the value for the KDC port list */ 1031*0Sstevel@tonic-gate hierarchy[2] = "kdc_ports"; 1032*0Sstevel@tonic-gate if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) 1033*0Sstevel@tonic-gate rparams->realm_kdc_ports = svalue; 1034*0Sstevel@tonic-gate hierarchy[2] = "kdc_tcp_ports"; 1035*0Sstevel@tonic-gate if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) 1036*0Sstevel@tonic-gate rparams->realm_kdc_tcp_ports = svalue; 1037*0Sstevel@tonic-gate 1038*0Sstevel@tonic-gate /* Get the name of the acl file */ 1039*0Sstevel@tonic-gate hierarchy[2] = "acl_file"; 1040*0Sstevel@tonic-gate if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) 1041*0Sstevel@tonic-gate rparams->realm_acl_file = svalue; 1042*0Sstevel@tonic-gate 1043*0Sstevel@tonic-gate /* Get the value for the kadmind port */ 1044*0Sstevel@tonic-gate hierarchy[2] = "kadmind_port"; 1045*0Sstevel@tonic-gate if (!krb5_aprof_get_int32(aprofile, hierarchy, TRUE, &ivalue)) { 1046*0Sstevel@tonic-gate rparams->realm_kadmind_port = ivalue; 1047*0Sstevel@tonic-gate rparams->realm_kadmind_port_valid = 1; 1048*0Sstevel@tonic-gate } 1049*0Sstevel@tonic-gate 1050*0Sstevel@tonic-gate /* Get the value for the master key name */ 1051*0Sstevel@tonic-gate hierarchy[2] = "master_key_name"; 1052*0Sstevel@tonic-gate if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) 1053*0Sstevel@tonic-gate rparams->realm_mkey_name = svalue; 1054*0Sstevel@tonic-gate 1055*0Sstevel@tonic-gate /* Get the value for the master key type */ 1056*0Sstevel@tonic-gate hierarchy[2] = "master_key_type"; 1057*0Sstevel@tonic-gate if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 1058*0Sstevel@tonic-gate if (!krb5_string_to_enctype(svalue, &rparams->realm_enctype)) 1059*0Sstevel@tonic-gate rparams->realm_enctype_valid = 1; 1060*0Sstevel@tonic-gate krb5_xfree(svalue); 1061*0Sstevel@tonic-gate } 1062*0Sstevel@tonic-gate 1063*0Sstevel@tonic-gate /* Get the value for the stashfile */ 1064*0Sstevel@tonic-gate hierarchy[2] = "key_stash_file"; 1065*0Sstevel@tonic-gate if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) 1066*0Sstevel@tonic-gate rparams->realm_stash_file = svalue; 1067*0Sstevel@tonic-gate 1068*0Sstevel@tonic-gate /* Get the value for maximum ticket lifetime. */ 1069*0Sstevel@tonic-gate hierarchy[2] = "max_life"; 1070*0Sstevel@tonic-gate if (!krb5_aprof_get_deltat(aprofile, hierarchy, TRUE, &dtvalue)) { 1071*0Sstevel@tonic-gate rparams->realm_max_life = dtvalue; 1072*0Sstevel@tonic-gate rparams->realm_max_life_valid = 1; 1073*0Sstevel@tonic-gate } 1074*0Sstevel@tonic-gate 1075*0Sstevel@tonic-gate /* Get the value for maximum renewable ticket lifetime. */ 1076*0Sstevel@tonic-gate hierarchy[2] = "max_renewable_life"; 1077*0Sstevel@tonic-gate if (!krb5_aprof_get_deltat(aprofile, hierarchy, TRUE, &dtvalue)) { 1078*0Sstevel@tonic-gate rparams->realm_max_rlife = dtvalue; 1079*0Sstevel@tonic-gate rparams->realm_max_rlife_valid = 1; 1080*0Sstevel@tonic-gate } 1081*0Sstevel@tonic-gate 1082*0Sstevel@tonic-gate /* Get the value for the default principal expiration */ 1083*0Sstevel@tonic-gate hierarchy[2] = "default_principal_expiration"; 1084*0Sstevel@tonic-gate if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 1085*0Sstevel@tonic-gate if (!krb5_string_to_timestamp(svalue, 1086*0Sstevel@tonic-gate &rparams->realm_expiration)) 1087*0Sstevel@tonic-gate rparams->realm_expiration_valid = 1; 1088*0Sstevel@tonic-gate krb5_xfree(svalue); 1089*0Sstevel@tonic-gate } 1090*0Sstevel@tonic-gate 1091*0Sstevel@tonic-gate /* Get the value for the default principal flags */ 1092*0Sstevel@tonic-gate hierarchy[2] = "default_principal_flags"; 1093*0Sstevel@tonic-gate if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) { 1094*0Sstevel@tonic-gate char *sp, *ep, *tp; 1095*0Sstevel@tonic-gate 1096*0Sstevel@tonic-gate sp = svalue; 1097*0Sstevel@tonic-gate rparams->realm_flags = 0; 1098*0Sstevel@tonic-gate while (sp) { 1099*0Sstevel@tonic-gate if ((ep = strchr(sp, (int)',')) || 1100*0Sstevel@tonic-gate (ep = strchr(sp, (int)' ')) || 1101*0Sstevel@tonic-gate (ep = strchr(sp, (int)'\t'))) { 1102*0Sstevel@tonic-gate /* Fill in trailing whitespace of sp */ 1103*0Sstevel@tonic-gate tp = ep - 1; 1104*0Sstevel@tonic-gate while (isspace(*tp) && (tp < sp)) { 1105*0Sstevel@tonic-gate *tp = '\0'; 1106*0Sstevel@tonic-gate tp--; 1107*0Sstevel@tonic-gate } 1108*0Sstevel@tonic-gate *ep = '\0'; 1109*0Sstevel@tonic-gate ep++; 1110*0Sstevel@tonic-gate /* Skip over trailing whitespace of ep */ 1111*0Sstevel@tonic-gate while (isspace(*ep) && (*ep)) ep++; 1112*0Sstevel@tonic-gate } 1113*0Sstevel@tonic-gate /* Convert this flag */ 1114*0Sstevel@tonic-gate if (krb5_string_to_flags(sp, 1115*0Sstevel@tonic-gate "+", 1116*0Sstevel@tonic-gate "-", 1117*0Sstevel@tonic-gate &rparams->realm_flags)) 1118*0Sstevel@tonic-gate break; 1119*0Sstevel@tonic-gate sp = ep; 1120*0Sstevel@tonic-gate } 1121*0Sstevel@tonic-gate if (!sp) 1122*0Sstevel@tonic-gate rparams->realm_flags_valid = 1; 1123*0Sstevel@tonic-gate krb5_xfree(svalue); 1124*0Sstevel@tonic-gate } 1125*0Sstevel@tonic-gate 1126*0Sstevel@tonic-gate /* Get the value for the supported enctype/salttype matrix */ 1127*0Sstevel@tonic-gate /* 1128*0Sstevel@tonic-gate * SUNWresync121 1129*0Sstevel@tonic-gate * Solaris kerberos: updated this code to support default values for 1130*0Sstevel@tonic-gate * the supported_enctypes. 1131*0Sstevel@tonic-gate */ 1132*0Sstevel@tonic-gate hierarchy[2] = "supported_enctypes"; 1133*0Sstevel@tonic-gate svalue = NULL; 1134*0Sstevel@tonic-gate krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue); 1135*0Sstevel@tonic-gate 1136*0Sstevel@tonic-gate /* 1137*0Sstevel@tonic-gate * Set the default value if supported_enctypes was not explicitly 1138*0Sstevel@tonic-gate * set in the kdc.conf. 1139*0Sstevel@tonic-gate */ 1140*0Sstevel@tonic-gate if (svalue == NULL) { 1141*0Sstevel@tonic-gate svalue = strdup(DEFAULT_ENCTYPE_LIST); 1142*0Sstevel@tonic-gate } 1143*0Sstevel@tonic-gate if (svalue != NULL) { 1144*0Sstevel@tonic-gate krb5_string_to_keysalts(svalue, 1145*0Sstevel@tonic-gate ", \t", /* Tuple separators */ 1146*0Sstevel@tonic-gate ":.-", /* Key/salt separators */ 1147*0Sstevel@tonic-gate 0, /* No duplicates */ 1148*0Sstevel@tonic-gate &rparams->realm_keysalts, 1149*0Sstevel@tonic-gate &rparams->realm_num_keysalts); 1150*0Sstevel@tonic-gate krb5_xfree(svalue); 1151*0Sstevel@tonic-gate svalue = NULL; 1152*0Sstevel@tonic-gate } 1153*0Sstevel@tonic-gate 1154*0Sstevel@tonic-gate cleanup: 1155*0Sstevel@tonic-gate if (aprofile) 1156*0Sstevel@tonic-gate krb5_aprof_finish(aprofile); 1157*0Sstevel@tonic-gate if (lrealm) 1158*0Sstevel@tonic-gate free(lrealm); 1159*0Sstevel@tonic-gate if (kret) { 1160*0Sstevel@tonic-gate if (rparams) 1161*0Sstevel@tonic-gate krb5_free_realm_params(kcontext, rparams); 1162*0Sstevel@tonic-gate rparams = 0; 1163*0Sstevel@tonic-gate } 1164*0Sstevel@tonic-gate *rparamp = rparams; 1165*0Sstevel@tonic-gate return (kret); 1166*0Sstevel@tonic-gate } 1167*0Sstevel@tonic-gate 1168*0Sstevel@tonic-gate /* 1169*0Sstevel@tonic-gate * krb5_free_realm_params() - Free data allocated by above. 1170*0Sstevel@tonic-gate */ 1171*0Sstevel@tonic-gate /*ARGSUSED*/ 1172*0Sstevel@tonic-gate krb5_error_code 1173*0Sstevel@tonic-gate krb5_free_realm_params(kcontext, rparams) 1174*0Sstevel@tonic-gate krb5_context kcontext; 1175*0Sstevel@tonic-gate krb5_realm_params *rparams; 1176*0Sstevel@tonic-gate { 1177*0Sstevel@tonic-gate if (rparams) { 1178*0Sstevel@tonic-gate if (rparams->realm_profile) 1179*0Sstevel@tonic-gate krb5_xfree(rparams->realm_profile); 1180*0Sstevel@tonic-gate if (rparams->realm_dbname) 1181*0Sstevel@tonic-gate krb5_xfree(rparams->realm_dbname); 1182*0Sstevel@tonic-gate if (rparams->realm_mkey_name) 1183*0Sstevel@tonic-gate krb5_xfree(rparams->realm_mkey_name); 1184*0Sstevel@tonic-gate if (rparams->realm_stash_file) 1185*0Sstevel@tonic-gate krb5_xfree(rparams->realm_stash_file); 1186*0Sstevel@tonic-gate if (rparams->realm_keysalts) 1187*0Sstevel@tonic-gate krb5_xfree(rparams->realm_keysalts); 1188*0Sstevel@tonic-gate if (rparams->realm_kdc_ports) 1189*0Sstevel@tonic-gate krb5_xfree(rparams->realm_kdc_ports); 1190*0Sstevel@tonic-gate krb5_xfree(rparams); 1191*0Sstevel@tonic-gate } 1192*0Sstevel@tonic-gate return (0); 1193*0Sstevel@tonic-gate } 1194