1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 3*0Sstevel@tonic-gate * Use is subject to license terms. 4*0Sstevel@tonic-gate */ 5*0Sstevel@tonic-gate 6*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 7*0Sstevel@tonic-gate 8*0Sstevel@tonic-gate /* 9*0Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 10*0Sstevel@tonic-gate * 11*0Sstevel@tonic-gate * Openvision retains the copyright to derivative works of 12*0Sstevel@tonic-gate * this source code. Do *NOT* create a derivative of this 13*0Sstevel@tonic-gate * source code before consulting with your legal department. 14*0Sstevel@tonic-gate * Do *NOT* integrate *ANY* of this source code into another 15*0Sstevel@tonic-gate * product before consulting with your legal department. 16*0Sstevel@tonic-gate * 17*0Sstevel@tonic-gate * For further information, read the top-level Openvision 18*0Sstevel@tonic-gate * copyright which is contained in the top-level MIT Kerberos 19*0Sstevel@tonic-gate * copyright. 20*0Sstevel@tonic-gate * 21*0Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate */ 24*0Sstevel@tonic-gate 25*0Sstevel@tonic-gate 26*0Sstevel@tonic-gate /* 27*0Sstevel@tonic-gate * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved. 28*0Sstevel@tonic-gate * 29*0Sstevel@tonic-gate * $Id: server_init.c,v 1.5 1997/10/13 15:03:13 epeisach Exp $ 30*0Sstevel@tonic-gate * $Source: /cvs/krbdev/krb5/src/lib/kadm5/srv/server_init.c,v $ 31*0Sstevel@tonic-gate */ 32*0Sstevel@tonic-gate 33*0Sstevel@tonic-gate #if !defined(lint) && !defined(__CODECENTER__) 34*0Sstevel@tonic-gate static char *rcsid = "$Header: /cvs/krbdev/krb5/src/lib/kadm5/srv/server_init.c,v 1.5 1997/10/13 15:03:13 epeisach Exp $"; 35*0Sstevel@tonic-gate #endif 36*0Sstevel@tonic-gate 37*0Sstevel@tonic-gate #include <stdio.h> 38*0Sstevel@tonic-gate #include <stdlib.h> 39*0Sstevel@tonic-gate #include <com_err.h> 40*0Sstevel@tonic-gate #include <kadm5/admin.h> 41*0Sstevel@tonic-gate #include <krb5.h> 42*0Sstevel@tonic-gate #include "server_internal.h" 43*0Sstevel@tonic-gate #include <kdb/kdb_log.h> 44*0Sstevel@tonic-gate 45*0Sstevel@tonic-gate /* 46*0Sstevel@tonic-gate * Function check_handle 47*0Sstevel@tonic-gate * 48*0Sstevel@tonic-gate * Purpose: Check a server handle and return a com_err code if it is 49*0Sstevel@tonic-gate * invalid or 0 if it is valid. 50*0Sstevel@tonic-gate * 51*0Sstevel@tonic-gate * Arguments: 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * handle The server handle. 54*0Sstevel@tonic-gate */ 55*0Sstevel@tonic-gate 56*0Sstevel@tonic-gate static int check_handle(void *handle) 57*0Sstevel@tonic-gate { 58*0Sstevel@tonic-gate CHECK_HANDLE(handle); 59*0Sstevel@tonic-gate return 0; 60*0Sstevel@tonic-gate } 61*0Sstevel@tonic-gate 62*0Sstevel@tonic-gate kadm5_ret_t kadm5_init_with_password(char *client_name, char *pass, 63*0Sstevel@tonic-gate char *service_name, 64*0Sstevel@tonic-gate kadm5_config_params *params, 65*0Sstevel@tonic-gate krb5_ui_4 struct_version, 66*0Sstevel@tonic-gate krb5_ui_4 api_version, 67*0Sstevel@tonic-gate void **server_handle) 68*0Sstevel@tonic-gate { 69*0Sstevel@tonic-gate return kadm5_init(client_name, pass, service_name, params, 70*0Sstevel@tonic-gate struct_version, api_version, 71*0Sstevel@tonic-gate server_handle); 72*0Sstevel@tonic-gate } 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gate kadm5_ret_t kadm5_init_with_creds(char *client_name, 75*0Sstevel@tonic-gate krb5_ccache ccache, 76*0Sstevel@tonic-gate char *service_name, 77*0Sstevel@tonic-gate kadm5_config_params *params, 78*0Sstevel@tonic-gate krb5_ui_4 struct_version, 79*0Sstevel@tonic-gate krb5_ui_4 api_version, 80*0Sstevel@tonic-gate void **server_handle) 81*0Sstevel@tonic-gate { 82*0Sstevel@tonic-gate /* 83*0Sstevel@tonic-gate * A program calling init_with_creds *never* expects to prompt the 84*0Sstevel@tonic-gate * user. Therefore, always pass a dummy password in case this is 85*0Sstevel@tonic-gate * KADM5_API_VERSION_1. If this is KADM5_API_VERSION_2 and 86*0Sstevel@tonic-gate * MKEY_FROM_KBD is non-zero, return an error. 87*0Sstevel@tonic-gate */ 88*0Sstevel@tonic-gate if (api_version == KADM5_API_VERSION_2 && params && 89*0Sstevel@tonic-gate (params->mask & KADM5_CONFIG_MKEY_FROM_KBD) && 90*0Sstevel@tonic-gate params->mkey_from_kbd) 91*0Sstevel@tonic-gate return KADM5_BAD_SERVER_PARAMS; 92*0Sstevel@tonic-gate return kadm5_init(client_name, NULL, service_name, params, 93*0Sstevel@tonic-gate struct_version, api_version, 94*0Sstevel@tonic-gate server_handle); 95*0Sstevel@tonic-gate } 96*0Sstevel@tonic-gate 97*0Sstevel@tonic-gate 98*0Sstevel@tonic-gate kadm5_ret_t kadm5_init_with_skey(char *client_name, char *keytab, 99*0Sstevel@tonic-gate char *service_name, 100*0Sstevel@tonic-gate kadm5_config_params *params, 101*0Sstevel@tonic-gate krb5_ui_4 struct_version, 102*0Sstevel@tonic-gate krb5_ui_4 api_version, 103*0Sstevel@tonic-gate void **server_handle) 104*0Sstevel@tonic-gate { 105*0Sstevel@tonic-gate /* 106*0Sstevel@tonic-gate * A program calling init_with_skey *never* expects to prompt the 107*0Sstevel@tonic-gate * user. Therefore, always pass a dummy password in case this is 108*0Sstevel@tonic-gate * KADM5_API_VERSION_1. If this is KADM5_API_VERSION_2 and 109*0Sstevel@tonic-gate * MKEY_FROM_KBD is non-zero, return an error. 110*0Sstevel@tonic-gate */ 111*0Sstevel@tonic-gate if (api_version == KADM5_API_VERSION_2 && params && 112*0Sstevel@tonic-gate (params->mask & KADM5_CONFIG_MKEY_FROM_KBD) && 113*0Sstevel@tonic-gate params->mkey_from_kbd) 114*0Sstevel@tonic-gate return KADM5_BAD_SERVER_PARAMS; 115*0Sstevel@tonic-gate return kadm5_init(client_name, NULL, service_name, params, 116*0Sstevel@tonic-gate struct_version, api_version, 117*0Sstevel@tonic-gate server_handle); 118*0Sstevel@tonic-gate } 119*0Sstevel@tonic-gate 120*0Sstevel@tonic-gate kadm5_ret_t kadm5_init(char *client_name, char *pass, 121*0Sstevel@tonic-gate char *service_name, 122*0Sstevel@tonic-gate kadm5_config_params *params_in, 123*0Sstevel@tonic-gate krb5_ui_4 struct_version, 124*0Sstevel@tonic-gate krb5_ui_4 api_version, 125*0Sstevel@tonic-gate void **server_handle) 126*0Sstevel@tonic-gate { 127*0Sstevel@tonic-gate int ret; 128*0Sstevel@tonic-gate kadm5_server_handle_t handle; 129*0Sstevel@tonic-gate kadm5_config_params params_local; /* for v1 compat */ 130*0Sstevel@tonic-gate 131*0Sstevel@tonic-gate if (! server_handle) 132*0Sstevel@tonic-gate return EINVAL; 133*0Sstevel@tonic-gate 134*0Sstevel@tonic-gate if (! client_name) 135*0Sstevel@tonic-gate return EINVAL; 136*0Sstevel@tonic-gate 137*0Sstevel@tonic-gate if (! (handle = (kadm5_server_handle_t) malloc(sizeof *handle))) 138*0Sstevel@tonic-gate return ENOMEM; 139*0Sstevel@tonic-gate memset(handle, 0, sizeof(*handle)); 140*0Sstevel@tonic-gate 141*0Sstevel@tonic-gate if (ret = (int) krb5_init_context(&(handle->context))) { 142*0Sstevel@tonic-gate free(handle); 143*0Sstevel@tonic-gate return(ret); 144*0Sstevel@tonic-gate } 145*0Sstevel@tonic-gate 146*0Sstevel@tonic-gate handle->magic_number = KADM5_SERVER_HANDLE_MAGIC; 147*0Sstevel@tonic-gate handle->struct_version = struct_version; 148*0Sstevel@tonic-gate handle->api_version = api_version; 149*0Sstevel@tonic-gate 150*0Sstevel@tonic-gate /* 151*0Sstevel@tonic-gate * Verify the version numbers before proceeding; we can't use 152*0Sstevel@tonic-gate * CHECK_HANDLE because not all fields are set yet. 153*0Sstevel@tonic-gate */ 154*0Sstevel@tonic-gate GENERIC_CHECK_HANDLE(handle, KADM5_OLD_SERVER_API_VERSION, 155*0Sstevel@tonic-gate KADM5_NEW_SERVER_API_VERSION); 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate /* 158*0Sstevel@tonic-gate * Acquire relevant profile entries. In version 2, merge values 159*0Sstevel@tonic-gate * in params_in with values from profile, based on 160*0Sstevel@tonic-gate * params_in->mask. 161*0Sstevel@tonic-gate * 162*0Sstevel@tonic-gate * In version 1, we've given a realm (which may be NULL) instead 163*0Sstevel@tonic-gate * of params_in. So use that realm, make params_in contain an 164*0Sstevel@tonic-gate * empty mask, and behave like version 2. 165*0Sstevel@tonic-gate */ 166*0Sstevel@tonic-gate memset((char *) ¶ms_local, 0, sizeof(params_local)); 167*0Sstevel@tonic-gate if (api_version == KADM5_API_VERSION_1) { 168*0Sstevel@tonic-gate params_local.realm = (char *) params_in; 169*0Sstevel@tonic-gate if (params_in) 170*0Sstevel@tonic-gate params_local.mask = KADM5_CONFIG_REALM; 171*0Sstevel@tonic-gate params_in = ¶ms_local; 172*0Sstevel@tonic-gate } 173*0Sstevel@tonic-gate 174*0Sstevel@tonic-gate #define ILLEGAL_PARAMS (KADM5_CONFIG_ADMIN_SERVER) 175*0Sstevel@tonic-gate if (params_in && (params_in->mask & ILLEGAL_PARAMS)) { 176*0Sstevel@tonic-gate krb5_free_context(handle->context); 177*0Sstevel@tonic-gate free(handle); 178*0Sstevel@tonic-gate return KADM5_BAD_SERVER_PARAMS; 179*0Sstevel@tonic-gate } 180*0Sstevel@tonic-gate 181*0Sstevel@tonic-gate if (ret = kadm5_get_config_params(handle->context, 182*0Sstevel@tonic-gate (char *) NULL, 183*0Sstevel@tonic-gate (char *) NULL, 184*0Sstevel@tonic-gate params_in, 185*0Sstevel@tonic-gate &handle->params)) { 186*0Sstevel@tonic-gate krb5_free_context(handle->context); 187*0Sstevel@tonic-gate free(handle); 188*0Sstevel@tonic-gate return(ret); 189*0Sstevel@tonic-gate } 190*0Sstevel@tonic-gate 191*0Sstevel@tonic-gate #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | KADM5_CONFIG_DBNAME | \ 192*0Sstevel@tonic-gate KADM5_CONFIG_ADBNAME | \ 193*0Sstevel@tonic-gate KADM5_CONFIG_ADB_LOCKFILE | \ 194*0Sstevel@tonic-gate KADM5_CONFIG_ENCTYPE | \ 195*0Sstevel@tonic-gate KADM5_CONFIG_FLAGS | \ 196*0Sstevel@tonic-gate KADM5_CONFIG_MAX_LIFE | KADM5_CONFIG_MAX_RLIFE | \ 197*0Sstevel@tonic-gate KADM5_CONFIG_EXPIRATION | KADM5_CONFIG_ENCTYPES) 198*0Sstevel@tonic-gate if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) { 199*0Sstevel@tonic-gate krb5_free_context(handle->context); 200*0Sstevel@tonic-gate free(handle); 201*0Sstevel@tonic-gate return KADM5_MISSING_CONF_PARAMS; 202*0Sstevel@tonic-gate } 203*0Sstevel@tonic-gate 204*0Sstevel@tonic-gate /* 205*0Sstevel@tonic-gate * Set the db_name based on configuration before calling 206*0Sstevel@tonic-gate * krb5_db_init, so it will get used. 207*0Sstevel@tonic-gate */ 208*0Sstevel@tonic-gate if (ret = krb5_db_set_name(handle->context, 209*0Sstevel@tonic-gate handle->params.dbname)) { 210*0Sstevel@tonic-gate free(handle); 211*0Sstevel@tonic-gate return(ret); 212*0Sstevel@tonic-gate } 213*0Sstevel@tonic-gate 214*0Sstevel@tonic-gate if (ret = krb5_db_init(handle->context)) { 215*0Sstevel@tonic-gate krb5_free_context(handle->context); 216*0Sstevel@tonic-gate free(handle); 217*0Sstevel@tonic-gate return(ret); 218*0Sstevel@tonic-gate } 219*0Sstevel@tonic-gate 220*0Sstevel@tonic-gate if ((ret = krb5_parse_name(handle->context, client_name, 221*0Sstevel@tonic-gate &handle->current_caller))) { 222*0Sstevel@tonic-gate krb5_db_fini(handle->context); 223*0Sstevel@tonic-gate krb5_free_context(handle->context); 224*0Sstevel@tonic-gate free(handle); 225*0Sstevel@tonic-gate return ret; 226*0Sstevel@tonic-gate } 227*0Sstevel@tonic-gate 228*0Sstevel@tonic-gate if (! (handle->lhandle = malloc(sizeof(*handle)))) { 229*0Sstevel@tonic-gate krb5_db_fini(handle->context); 230*0Sstevel@tonic-gate krb5_free_context(handle->context); 231*0Sstevel@tonic-gate free(handle); 232*0Sstevel@tonic-gate return ENOMEM; 233*0Sstevel@tonic-gate } 234*0Sstevel@tonic-gate *handle->lhandle = *handle; 235*0Sstevel@tonic-gate handle->lhandle->api_version = KADM5_API_VERSION_2; 236*0Sstevel@tonic-gate handle->lhandle->struct_version = KADM5_STRUCT_VERSION; 237*0Sstevel@tonic-gate handle->lhandle->lhandle = handle->lhandle; 238*0Sstevel@tonic-gate 239*0Sstevel@tonic-gate /* can't check the handle until current_caller is set */ 240*0Sstevel@tonic-gate if (ret = check_handle((void *) handle)) { 241*0Sstevel@tonic-gate free(handle); 242*0Sstevel@tonic-gate return ret; 243*0Sstevel@tonic-gate } 244*0Sstevel@tonic-gate 245*0Sstevel@tonic-gate /* 246*0Sstevel@tonic-gate * The KADM5_API_VERSION_1 spec said "If pass (or keytab) is NULL 247*0Sstevel@tonic-gate * or an empty string, reads the master password from [the stash 248*0Sstevel@tonic-gate * file]. Otherwise, the non-NULL password is ignored and the 249*0Sstevel@tonic-gate * user is prompted for it via the tty." However, the code was 250*0Sstevel@tonic-gate * implemented the other way: when a non-NULL password was 251*0Sstevel@tonic-gate * provided, the stash file was used. This is somewhat more 252*0Sstevel@tonic-gate * sensible, as then a local or remote client that provides a 253*0Sstevel@tonic-gate * password does not prompt the user. This code maintains the 254*0Sstevel@tonic-gate * previous actual behavior, and not the old spec behavior, 255*0Sstevel@tonic-gate * because that is how the unit tests are written. 256*0Sstevel@tonic-gate * 257*0Sstevel@tonic-gate * In KADM5_API_VERSION_2, this decision is controlled by 258*0Sstevel@tonic-gate * params. 259*0Sstevel@tonic-gate * 260*0Sstevel@tonic-gate * kdb_init_master's third argument is "from_keyboard". 261*0Sstevel@tonic-gate */ 262*0Sstevel@tonic-gate if (ret = kdb_init_master(handle, handle->params.realm, 263*0Sstevel@tonic-gate (handle->api_version == KADM5_API_VERSION_1 ? 264*0Sstevel@tonic-gate ((pass == NULL) || !(strlen(pass))) : 265*0Sstevel@tonic-gate ((handle->params.mask & 266*0Sstevel@tonic-gate KADM5_CONFIG_MKEY_FROM_KBD) && 267*0Sstevel@tonic-gate handle->params.mkey_from_kbd)) 268*0Sstevel@tonic-gate )) { 269*0Sstevel@tonic-gate krb5_db_fini(handle->context); 270*0Sstevel@tonic-gate krb5_free_context(handle->context); 271*0Sstevel@tonic-gate free(handle); 272*0Sstevel@tonic-gate return ret; 273*0Sstevel@tonic-gate } 274*0Sstevel@tonic-gate 275*0Sstevel@tonic-gate if ((ret = kdb_init_hist(handle, handle->params.realm))) { 276*0Sstevel@tonic-gate krb5_db_fini(handle->context); 277*0Sstevel@tonic-gate krb5_free_context(handle->context); 278*0Sstevel@tonic-gate free(handle); 279*0Sstevel@tonic-gate return ret; 280*0Sstevel@tonic-gate } 281*0Sstevel@tonic-gate 282*0Sstevel@tonic-gate if (ret = init_dict(&handle->params)) { 283*0Sstevel@tonic-gate krb5_db_fini(handle->context); 284*0Sstevel@tonic-gate krb5_free_principal(handle->context, handle->current_caller); 285*0Sstevel@tonic-gate krb5_free_context(handle->context); 286*0Sstevel@tonic-gate free(handle); 287*0Sstevel@tonic-gate return ret; 288*0Sstevel@tonic-gate } 289*0Sstevel@tonic-gate 290*0Sstevel@tonic-gate if (ret = adb_policy_init(handle)) { 291*0Sstevel@tonic-gate krb5_db_fini(handle->context); 292*0Sstevel@tonic-gate krb5_free_principal(handle->context, handle->current_caller); 293*0Sstevel@tonic-gate krb5_free_context(handle->context); 294*0Sstevel@tonic-gate free(handle); 295*0Sstevel@tonic-gate return ret; 296*0Sstevel@tonic-gate } 297*0Sstevel@tonic-gate handle->lhandle->policy_db = handle->policy_db; 298*0Sstevel@tonic-gate 299*0Sstevel@tonic-gate *server_handle = (void *) handle; 300*0Sstevel@tonic-gate 301*0Sstevel@tonic-gate return KADM5_OK; 302*0Sstevel@tonic-gate } 303*0Sstevel@tonic-gate 304*0Sstevel@tonic-gate kadm5_ret_t kadm5_destroy(void *server_handle) 305*0Sstevel@tonic-gate { 306*0Sstevel@tonic-gate kadm5_server_handle_t handle = server_handle; 307*0Sstevel@tonic-gate 308*0Sstevel@tonic-gate CHECK_HANDLE(server_handle); 309*0Sstevel@tonic-gate 310*0Sstevel@tonic-gate destroy_dict(); 311*0Sstevel@tonic-gate 312*0Sstevel@tonic-gate adb_policy_close(handle); 313*0Sstevel@tonic-gate krb5_db_fini(handle->context); 314*0Sstevel@tonic-gate krb5_free_principal(handle->context, handle->current_caller); 315*0Sstevel@tonic-gate kadm5_free_config_params(handle->context, &handle->params); 316*0Sstevel@tonic-gate krb5_free_context(handle->context); 317*0Sstevel@tonic-gate handle->magic_number = 0; 318*0Sstevel@tonic-gate free(handle->lhandle); 319*0Sstevel@tonic-gate free(handle); 320*0Sstevel@tonic-gate 321*0Sstevel@tonic-gate return KADM5_OK; 322*0Sstevel@tonic-gate } 323*0Sstevel@tonic-gate 324*0Sstevel@tonic-gate kadm5_ret_t kadm5_flush(void *server_handle) 325*0Sstevel@tonic-gate { 326*0Sstevel@tonic-gate kadm5_server_handle_t handle = server_handle; 327*0Sstevel@tonic-gate kadm5_ret_t ret; 328*0Sstevel@tonic-gate 329*0Sstevel@tonic-gate CHECK_HANDLE(server_handle); 330*0Sstevel@tonic-gate 331*0Sstevel@tonic-gate if ((ret = krb5_db_fini(handle->context)) || 332*0Sstevel@tonic-gate /* 333*0Sstevel@tonic-gate * Set the db_name based on configuration before calling 334*0Sstevel@tonic-gate * krb5_db_init, so it will get used. 335*0Sstevel@tonic-gate */ 336*0Sstevel@tonic-gate (ret = krb5_db_set_name(handle->context, 337*0Sstevel@tonic-gate handle->params.dbname)) || 338*0Sstevel@tonic-gate (ret = krb5_db_init(handle->context)) || 339*0Sstevel@tonic-gate (ret = adb_policy_close(handle)) || 340*0Sstevel@tonic-gate (ret = adb_policy_init(handle))) { 341*0Sstevel@tonic-gate (void) kadm5_destroy(server_handle); 342*0Sstevel@tonic-gate return ret; 343*0Sstevel@tonic-gate } 344*0Sstevel@tonic-gate return KADM5_OK; 345*0Sstevel@tonic-gate } 346*0Sstevel@tonic-gate 347*0Sstevel@tonic-gate int _kadm5_check_handle(void *handle) 348*0Sstevel@tonic-gate { 349*0Sstevel@tonic-gate CHECK_HANDLE(handle); 350*0Sstevel@tonic-gate return 0; 351*0Sstevel@tonic-gate } 352*0Sstevel@tonic-gate 353*0Sstevel@tonic-gate krb5_error_code 354*0Sstevel@tonic-gate kadm5_init_iprop(void *handle) 355*0Sstevel@tonic-gate { 356*0Sstevel@tonic-gate kadm5_server_handle_t iprop_h; 357*0Sstevel@tonic-gate krb5_error_code retval; 358*0Sstevel@tonic-gate 359*0Sstevel@tonic-gate iprop_h = handle; 360*0Sstevel@tonic-gate if (iprop_h->params.iprop_enabled) { 361*0Sstevel@tonic-gate ulog_set_role(iprop_h->context, IPROP_MASTER); 362*0Sstevel@tonic-gate if ((retval = ulog_map(iprop_h->context, &iprop_h->params, 363*0Sstevel@tonic-gate FKCOMMAND)) != 0) 364*0Sstevel@tonic-gate return (retval); 365*0Sstevel@tonic-gate } 366*0Sstevel@tonic-gate return (0); 367*0Sstevel@tonic-gate } 368