1 /*
2 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
4 */
5
6 /*
7 * kadmin/ldap_util/kdb5_ldap_realm.c
8 *
9 * Copyright 1990,1991,2001, 2002 by the Massachusetts Institute of Technology.
10 * All Rights Reserved.
11 *
12 * Export of this software from the United States of America may
13 * require a specific license from the United States Government.
14 * It is the responsibility of any person or organization contemplating
15 * export to obtain such a license before exporting.
16 *
17 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
18 * distribute this software and its documentation for any purpose and
19 * without fee is hereby granted, provided that the above copyright
20 * notice appear in all copies and that both that copyright notice and
21 * this permission notice appear in supporting documentation, and that
139
140
141 static char *strdur(time_t duration);
142 static int get_ticket_policy(krb5_ldap_realm_params *rparams, int *i, char *argv[],int argc);
143 static krb5_error_code krb5_dbe_update_mod_princ_data_new (krb5_context context, krb5_db_entry *entry, krb5_timestamp mod_date, krb5_const_principal mod_princ);
144 static krb5_error_code krb5_dbe_update_tl_data_new ( krb5_context context, krb5_db_entry *entry, krb5_tl_data *new_tl_data);
145
146 #define ADMIN_LIFETIME 60*60*3 /* 3 hours */
147 #define CHANGEPW_LIFETIME 60*5 /* 5 minutes */
148
149 static int get_ticket_policy(rparams,i,argv,argc)
150 krb5_ldap_realm_params *rparams;
151 int *i;
152 char *argv[];
153 int argc;
154 {
155 time_t date;
156 time_t now;
157 int mask = 0;
158 krb5_error_code retval = 0;
159 krb5_boolean no_msg = FALSE;
160
161 krb5_boolean print_usage = FALSE;
162 /* Solaris Kerberos */
163 char *me = progname;
164
165 time(&now);
166 if (!strcmp(argv[*i], "-maxtktlife")) {
167 if (++(*i) > argc-1)
168 goto err_usage;
169 date = get_date(argv[*i]);
170 if (date == (time_t)(-1)) {
171 retval = EINVAL;
172 com_err (me, retval, gettext("while providing time specification"));
173 goto err_nomsg;
174 }
175 rparams->max_life = date-now;
176 mask |= LDAP_REALM_MAXTICKETLIFE;
177 }
178
179
180 else if (!strcmp(argv[*i], "-maxrenewlife")) {
181 if (++(*i) > argc-1)
285 } else if (!strcmp((argv[*i] + 1), "needchange")) {
286 if (*(argv[*i]) == '+')
287 rparams->tktflags |= KRB5_KDB_REQUIRES_PWCHANGE;
288 else if (*(argv[*i]) == '-')
289 rparams->tktflags &= (int)(~KRB5_KDB_REQUIRES_PWCHANGE);
290 else
291 goto err_usage;
292
293 mask |= LDAP_REALM_KRBTICKETFLAGS;
294 } else if (!strcmp((argv[*i] + 1), "password_changing_service")) {
295 if (*(argv[*i]) == '+')
296 rparams->tktflags |= KRB5_KDB_PWCHANGE_SERVICE;
297 else if (*(argv[*i]) == '-')
298 rparams->tktflags &= (int)(~KRB5_KDB_PWCHANGE_SERVICE);
299 else
300 goto err_usage;
301
302 mask |=LDAP_REALM_KRBTICKETFLAGS;
303 }
304 err_usage:
305 print_usage = TRUE;
306
307 err_nomsg:
308 no_msg = TRUE;
309
310 return mask;
311 }
312
313 /*
314 * This function will create a realm on the LDAP Server, with
315 * the specified attributes.
316 */
317 void kdb5_ldap_create(argc, argv)
318 int argc;
319 char *argv[];
320 {
321 krb5_error_code retval = 0;
322 krb5_keyblock master_keyblock;
323 krb5_ldap_realm_params *rparams = NULL;
324 krb5_principal master_princ = NULL;
325 kdb5_dal_handle *dal_handle = NULL;
326 krb5_ldap_context *ldap_context=NULL;
327 krb5_boolean realm_obj_created = FALSE;
328 krb5_boolean create_complete = FALSE;
|
1 /*
2 * Copyright 2017 Gary Mills
3 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
4 * Use is subject to license terms.
5 */
6
7 /*
8 * kadmin/ldap_util/kdb5_ldap_realm.c
9 *
10 * Copyright 1990,1991,2001, 2002 by the Massachusetts Institute of Technology.
11 * All Rights Reserved.
12 *
13 * Export of this software from the United States of America may
14 * require a specific license from the United States Government.
15 * It is the responsibility of any person or organization contemplating
16 * export to obtain such a license before exporting.
17 *
18 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
19 * distribute this software and its documentation for any purpose and
20 * without fee is hereby granted, provided that the above copyright
21 * notice appear in all copies and that both that copyright notice and
22 * this permission notice appear in supporting documentation, and that
140
141
142 static char *strdur(time_t duration);
143 static int get_ticket_policy(krb5_ldap_realm_params *rparams, int *i, char *argv[],int argc);
144 static krb5_error_code krb5_dbe_update_mod_princ_data_new (krb5_context context, krb5_db_entry *entry, krb5_timestamp mod_date, krb5_const_principal mod_princ);
145 static krb5_error_code krb5_dbe_update_tl_data_new ( krb5_context context, krb5_db_entry *entry, krb5_tl_data *new_tl_data);
146
147 #define ADMIN_LIFETIME 60*60*3 /* 3 hours */
148 #define CHANGEPW_LIFETIME 60*5 /* 5 minutes */
149
150 static int get_ticket_policy(rparams,i,argv,argc)
151 krb5_ldap_realm_params *rparams;
152 int *i;
153 char *argv[];
154 int argc;
155 {
156 time_t date;
157 time_t now;
158 int mask = 0;
159 krb5_error_code retval = 0;
160
161 /* Solaris Kerberos */
162 char *me = progname;
163
164 time(&now);
165 if (!strcmp(argv[*i], "-maxtktlife")) {
166 if (++(*i) > argc-1)
167 goto err_usage;
168 date = get_date(argv[*i]);
169 if (date == (time_t)(-1)) {
170 retval = EINVAL;
171 com_err (me, retval, gettext("while providing time specification"));
172 goto err_nomsg;
173 }
174 rparams->max_life = date-now;
175 mask |= LDAP_REALM_MAXTICKETLIFE;
176 }
177
178
179 else if (!strcmp(argv[*i], "-maxrenewlife")) {
180 if (++(*i) > argc-1)
284 } else if (!strcmp((argv[*i] + 1), "needchange")) {
285 if (*(argv[*i]) == '+')
286 rparams->tktflags |= KRB5_KDB_REQUIRES_PWCHANGE;
287 else if (*(argv[*i]) == '-')
288 rparams->tktflags &= (int)(~KRB5_KDB_REQUIRES_PWCHANGE);
289 else
290 goto err_usage;
291
292 mask |= LDAP_REALM_KRBTICKETFLAGS;
293 } else if (!strcmp((argv[*i] + 1), "password_changing_service")) {
294 if (*(argv[*i]) == '+')
295 rparams->tktflags |= KRB5_KDB_PWCHANGE_SERVICE;
296 else if (*(argv[*i]) == '-')
297 rparams->tktflags &= (int)(~KRB5_KDB_PWCHANGE_SERVICE);
298 else
299 goto err_usage;
300
301 mask |=LDAP_REALM_KRBTICKETFLAGS;
302 }
303 err_usage:
304
305 err_nomsg:
306
307 return mask;
308 }
309
310 /*
311 * This function will create a realm on the LDAP Server, with
312 * the specified attributes.
313 */
314 void kdb5_ldap_create(argc, argv)
315 int argc;
316 char *argv[];
317 {
318 krb5_error_code retval = 0;
319 krb5_keyblock master_keyblock;
320 krb5_ldap_realm_params *rparams = NULL;
321 krb5_principal master_princ = NULL;
322 kdb5_dal_handle *dal_handle = NULL;
323 krb5_ldap_context *ldap_context=NULL;
324 krb5_boolean realm_obj_created = FALSE;
325 krb5_boolean create_complete = FALSE;
|