crypto/dist/heimdal/lib/kadm5/ad.c

   1 /*
   2  * Copyright (c) 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #define HAVE_TSASL 1
  35
  36 #include "kadm5_locl.h"
  37 #if 1
  38 #undef OPENLDAP
  39 #undef HAVE_TSASL
  40 #endif
  41 #ifdef OPENLDAP
  42 #include <ldap.h>
  43 #ifdef HAVE_TSASL
  44 #include <tsasl.h>
  45 #endif
  46 #include <resolve.h>
  47 #include <base64.h>
  48 #endif
  49
  50 __RCSID("$Heimdal: ad.c 17445 2006-05-05 10:37:46Z lha $"
  51         "$NetBSD$");
  52
  53 #ifdef OPENLDAP
  54
  55 #define CTX2LP(context) ((LDAP *)((context)->ldap_conn))
  56 #define CTX2BASE(context) ((context)->base_dn)
  57
  58 /*
  59  * userAccountControl
  60  */
  61
  62 #define UF_SCRIPT                               0x00000001
  63 #define UF_ACCOUNTDISABLE                       0x00000002
  64 #define UF_UNUSED_0                             0x00000004
  65 #define UF_HOMEDIR_REQUIRED                     0x00000008
  66 #define UF_LOCKOUT                              0x00000010
  67 #define UF_PASSWD_NOTREQD                       0x00000020
  68 #define UF_PASSWD_CANT_CHANGE                   0x00000040
  69 #define UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED      0x00000080
  70 #define UF_TEMP_DUPLICATE_ACCOUNT               0x00000100
  71 #define UF_NORMAL_ACCOUNT                       0x00000200
  72 #define UF_UNUSED_1                             0x00000400
  73 #define UF_INTERDOMAIN_TRUST_ACCOUNT            0x00000800
  74 #define UF_WORKSTATION_TRUST_ACCOUNT            0x00001000
  75 #define UF_SERVER_TRUST_ACCOUNT                 0x00002000
  76 #define UF_UNUSED_2                             0x00004000
  77 #define UF_UNUSED_3                             0x00008000
  78 #define UF_PASSWD_NOT_EXPIRE                    0x00010000
  79 #define UF_MNS_LOGON_ACCOUNT                    0x00020000
  80 #define UF_SMARTCARD_REQUIRED                   0x00040000
  81 #define UF_TRUSTED_FOR_DELEGATION               0x00080000
  82 #define UF_NOT_DELEGATED                        0x00100000
  83 #define UF_USE_DES_KEY_ONLY                     0x00200000
  84 #define UF_DONT_REQUIRE_PREAUTH                 0x00400000
  85 #define UF_UNUSED_4                             0x00800000
  86 #define UF_UNUSED_5                             0x01000000
  87 #define UF_UNUSED_6                             0x02000000
  88 #define UF_UNUSED_7                             0x04000000
  89 #define UF_UNUSED_8                             0x08000000
  90 #define UF_UNUSED_9                             0x10000000
  91 #define UF_UNUSED_10                            0x20000000
  92 #define UF_UNUSED_11                            0x40000000
  93 #define UF_UNUSED_12                            0x80000000
  94
  95 /*
  96  *
  97  */
  98
  99 #ifndef HAVE_TSASL
 100 static int
 101 sasl_interact(LDAP *ld, unsigned flags, void *defaults, void *interact)
 102 {
 103     return LDAP_SUCCESS;
 104 }
 105 #endif
 106
 107 #if 0
 108 static Sockbuf_IO ldap_tsasl_io = {
 109     NULL,                       /* sbi_setup */
 110     NULL,                       /* sbi_remove */
 111     NULL,                       /* sbi_ctrl */
 112     NULL,                       /* sbi_read */
 113     NULL,                       /* sbi_write */
 114     NULL                        /* sbi_close */
 115 };
 116 #endif
 117
 118 #ifdef HAVE_TSASL
 119 static int
 120 ldap_tsasl_bind_s(LDAP *ld,
 121                   LDAP_CONST char *dn,
 122                   LDAPControl **serverControls,
 123                   LDAPControl **clientControls,
 124                   const char *host)
 125 {
 126     char *attrs[] = { "supportedSASLMechanisms", NULL };
 127     struct tsasl_peer *peer = NULL;
 128     struct tsasl_buffer in, out;
 129     struct berval ccred, *scred;
 130     LDAPMessage *m, *m0;
 131     const char *mech;
 132     char **vals;
 133     int ret, rc;
 134
 135     ret = tsasl_peer_init(TSASL_FLAGS_INITIATOR | TSASL_FLAGS_CLEAR,
 136                           "ldap", host, &peer);
 137     if (ret != TSASL_DONE) {
 138         rc = LDAP_LOCAL_ERROR;
 139         goto out;
 140     }
 141
 142     rc = ldap_search_s(ld, "", LDAP_SCOPE_BASE, NULL, attrs, 0, &m0);
 143     if (rc != LDAP_SUCCESS)
 144         goto out;
 145
 146     m = ldap_first_entry(ld, m0);
 147     if (m == NULL) {
 148         ldap_msgfree(m0);
 149         goto out;
 150     }
 151
 152     vals = ldap_get_values(ld, m, "supportedSASLMechanisms");
 153     if (vals == NULL) {
 154         ldap_msgfree(m0);
 155         goto out;
 156     }
 157
 158     ret = tsasl_find_best_mech(peer, vals, &mech);
 159     if (ret) {
 160         ldap_msgfree(m0);
 161         goto out;
 162     }
 163
 164     ldap_msgfree(m0);
 165
 166     ret = tsasl_select_mech(peer, mech);
 167     if (ret != TSASL_DONE) {
 168         rc = LDAP_LOCAL_ERROR;
 169         goto out;
 170     }
 171
 172     in.tb_data = NULL;
 173     in.tb_size = 0;
 174
 175     do {
 176         ret = tsasl_request(peer, &in, &out);
 177         if (in.tb_size != 0) {
 178             free(in.tb_data);
 179             in.tb_data = NULL;
 180             in.tb_size = 0;
 181         }
 182         if (ret != TSASL_DONE && ret != TSASL_CONTINUE) {
 183             rc = LDAP_AUTH_UNKNOWN;
 184             goto out;
 185         }
 186
 187         ccred.bv_val = out.tb_data;
 188         ccred.bv_len = out.tb_size;
 189
 190         rc = ldap_sasl_bind_s(ld, dn, mech, &ccred,
 191                               serverControls, clientControls, &scred);
 192         tsasl_buffer_free(&out);
 193
 194         if (rc != LDAP_SUCCESS && rc != LDAP_SASL_BIND_IN_PROGRESS) {
 195             if(scred && scred->bv_len)
 196                 ber_bvfree(scred);
 197             goto out;
 198         }
 199
 200         in.tb_data = malloc(scred->bv_len);
 201         if (in.tb_data == NULL) {
 202             rc = LDAP_LOCAL_ERROR;
 203             goto out;
 204         }
 205         memcpy(in.tb_data, scred->bv_val, scred->bv_len);
 206         in.tb_size = scred->bv_len;
 207         ber_bvfree(scred);
 208
 209     } while (rc == LDAP_SASL_BIND_IN_PROGRESS);
 210
 211  out:
 212     if (rc == LDAP_SUCCESS) {
 213 #if 0
 214         ber_sockbuf_add_io(ld->ld_conns->lconn_sb, &ldap_tsasl_io,
 215                            LBER_SBIOD_LEVEL_APPLICATION, peer);
 216
 217 #endif
 218     } else if (peer != NULL)
 219         tsasl_peer_free(peer);
 220
 221     return rc;
 222 }
 223 #endif /* HAVE_TSASL */
 224
 225
 226 static int
 227 check_ldap(kadm5_ad_context *context, int ret)
 228 {
 229     switch (ret) {
 230     case LDAP_SUCCESS:
 231         return 0;
 232     case LDAP_SERVER_DOWN: {
 233         LDAP *lp = CTX2LP(context);
 234         ldap_unbind(lp);
 235         context->ldap_conn = NULL;
 236         free(context->base_dn);
 237         context->base_dn = NULL;
 238         return 1;
 239     }
 240     default:
 241         return 1;
 242     }
 243 }
 244
 245 /*
 246  *
 247  */
 248
 249 static void
 250 laddattr(char ***al, int *attrlen, char *attr)
 251 {
 252     char **a;
 253     a = realloc(*al, (*attrlen + 2) * sizeof(**al));
 254     if (a == NULL)
 255         return;
 256     a[*attrlen] = attr;
 257     a[*attrlen + 1] = NULL;
 258     (*attrlen)++;
 259     *al = a;
 260 }
 261
 262 static kadm5_ret_t
 263 _kadm5_ad_connect(void *server_handle)
 264 {
 265     kadm5_ad_context *context = server_handle;
 266     struct {
 267         char *server;
 268         int port;
 269     } *s, *servers = NULL;
 270     int i, num_servers = 0;
 271
 272     if (context->ldap_conn)
 273         return 0;
 274
 275     {
 276         struct dns_reply *r;
 277         struct resource_record *rr;
 278         char *domain;
 279
 280         asprintf(&domain, "_ldap._tcp.%s", context->realm);
 281         if (domain == NULL) {
 282             krb5_set_error_string(context->context, "malloc");
 283             return KADM5_NO_SRV;
 284         }
 285
 286         r = dns_lookup(domain, "SRV");
 287         free(domain);
 288         if (r == NULL) {
 289             krb5_set_error_string(context->context, "Didn't find ldap dns");
 290             return KADM5_NO_SRV;
 291         }
 292
 293         for (rr = r->head ; rr != NULL; rr = rr->next) {
 294             if (rr->type != T_SRV)
 295                 continue;
 296             s = realloc(servers, sizeof(*servers) * (num_servers + 1));
 297             if (s == NULL) {
 298                 krb5_set_error_string(context->context, "malloc");
 299                 dns_free_data(r);
 300                 goto fail;
 301             }
 302             servers = s;
 303             num_servers++;
 304             servers[num_servers - 1].port =  rr->u.srv->port;
 305             servers[num_servers - 1].server =  strdup(rr->u.srv->target);
 306         }
 307         dns_free_data(r);
 308     }
 309
 310     if (num_servers == 0) {
 311         krb5_set_error_string(context->context, "No AD server found in DNS");
 312         return KADM5_NO_SRV;
 313     }
 314
 315     for (i = 0; i < num_servers; i++) {
 316         int lret, version = LDAP_VERSION3;
 317         LDAP *lp;
 318
 319         lp = ldap_init(servers[i].server, servers[i].port);
 320         if (lp == NULL)
 321             continue;
 322
 323         if (ldap_set_option(lp, LDAP_OPT_PROTOCOL_VERSION, &version)) {
 324             ldap_unbind(lp);
 325             continue;
 326         }
 327
 328         if (ldap_set_option(lp, LDAP_OPT_REFERRALS, LDAP_OPT_OFF)) {
 329             ldap_unbind(lp);
 330             continue;
 331         }
 332
 333 #ifdef HAVE_TSASL
 334         lret = ldap_tsasl_bind_s(lp, NULL, NULL, NULL, servers[i].server);
 335
 336 #else
 337         lret = ldap_sasl_interactive_bind_s(lp, NULL, NULL, NULL, NULL,
 338                                             LDAP_SASL_QUIET,
 339                                             sasl_interact, NULL);
 340 #endif
 341         if (lret != LDAP_SUCCESS) {
 342             krb5_set_error_string(context->context,
 343                                   "Couldn't contact any AD servers: %s",
 344                                   ldap_err2string(lret));
 345             ldap_unbind(lp);
 346             continue;
 347         }
 348
 349         context->ldap_conn = lp;
 350         break;
 351     }
 352     if (i >= num_servers) {
 353         goto fail;
 354     }
 355
 356     {
 357         LDAPMessage *m, *m0;
 358         char **attr = NULL;
 359         int attrlen = 0;
 360         char **vals;
 361         int ret;
 362
 363         laddattr(&attr, &attrlen, "defaultNamingContext");
 364
 365         ret = ldap_search_s(CTX2LP(context), "", LDAP_SCOPE_BASE,
 366                             "objectclass=*", attr, 0, &m);
 367         free(attr);
 368         if (check_ldap(context, ret))
 369             goto fail;
 370
 371         if (ldap_count_entries(CTX2LP(context), m) > 0) {
 372             m0 = ldap_first_entry(CTX2LP(context), m);
 373             if (m0 == NULL) {
 374                 krb5_set_error_string(context->context,
 375                                       "Error in AD ldap responce");
 376                 ldap_msgfree(m);
 377                 goto fail;
 378             }
 379             vals = ldap_get_values(CTX2LP(context),
 380                                    m0, "defaultNamingContext");
 381             if (vals == NULL) {
 382                 krb5_set_error_string(context->context,
 383                                       "No naming context found");
 384                 goto fail;
 385             }
 386             context->base_dn = strdup(vals[0]);
 387         } else
 388             goto fail;
 389         ldap_msgfree(m);
 390     }
 391
 392     for (i = 0; i < num_servers; i++)
 393         free(servers[i].server);
 394     free(servers);
 395
 396     return 0;
 397
 398  fail:
 399     for (i = 0; i < num_servers; i++)
 400         free(servers[i].server);
 401     free(servers);
 402
 403     if (context->ldap_conn) {
 404         ldap_unbind(CTX2LP(context));
 405         context->ldap_conn = NULL;
 406     }
 407     return KADM5_RPC_ERROR;
 408 }
 409
 410 #define NTTIME_EPOCH 0x019DB1DED53E8000LL
 411
 412 static time_t
 413 nt2unixtime(const char *str)
 414 {
 415     unsigned long long t;
 416     t = strtoll(str, NULL, 10);
 417     t = ((t - NTTIME_EPOCH) / (long long)10000000);
 418     if (t > (((time_t)(~(long long)0)) >> 1))
 419         return 0;
 420     return (time_t)t;
 421 }
 422
 423 static long long
 424 unix2nttime(time_t unix_time)
 425 {
 426     long long wt;
 427     wt = unix_time * (long long)10000000 + (long long)NTTIME_EPOCH;
 428     return wt;
 429 }
 430
 431 /* XXX create filter in a better way */
 432
 433 static int
 434 ad_find_entry(kadm5_ad_context *context,
 435               const char *fqdn,
 436               const char *pn,
 437               char **name)
 438 {
 439     LDAPMessage *m, *m0;
 440     char *attr[] = { "distinguishedName", NULL };
 441     char *filter;
 442     int ret;
 443
 444     if (name)
 445         *name = NULL;
 446
 447     if (fqdn)
 448         asprintf(&filter,
 449                  "(&(objectClass=computer)(|(dNSHostName=%s)(servicePrincipalName=%s)))",
 450                  fqdn, pn);
 451     else if(pn)
 452         asprintf(&filter, "(&(objectClass=account)(userPrincipalName=%s))", pn);
 453     else
 454         return KADM5_RPC_ERROR;
 455
 456     ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
 457                         LDAP_SCOPE_SUBTREE,
 458                         filter, attr, 0, &m);
 459     free(filter);
 460     if (check_ldap(context, ret))
 461         return KADM5_RPC_ERROR;
 462
 463     if (ldap_count_entries(CTX2LP(context), m) > 0) {
 464         char **vals;
 465         m0 = ldap_first_entry(CTX2LP(context), m);
 466         vals = ldap_get_values(CTX2LP(context), m0, "distinguishedName");
 467         if (vals == NULL || vals[0] == NULL) {
 468             ldap_msgfree(m);
 469             return KADM5_RPC_ERROR;
 470         }
 471         if (name)
 472             *name = strdup(vals[0]);
 473         ldap_msgfree(m);
 474     } else
 475         return KADM5_UNK_PRINC;
 476
 477     return 0;
 478 }
 479
 480 #endif /* OPENLDAP */
 481
 482 static kadm5_ret_t
 483 ad_get_cred(kadm5_ad_context *context, const char *password)
 484 {
 485     kadm5_ret_t ret;
 486     krb5_ccache cc;
 487     char *service;
 488
 489     if (context->ccache)
 490         return 0;
 491
 492     asprintf(&service, "%s/%s@%s", KRB5_TGS_NAME,
 493              context->realm, context->realm);
 494     if (service == NULL)
 495         return ENOMEM;
 496
 497     ret = _kadm5_c_get_cred_cache(context->context,
 498                                   context->client_name,
 499                                   service,
 500                                   password, krb5_prompter_posix,
 501                                   NULL, NULL, &cc);
 502     free(service);
 503     if(ret)
 504         return ret; /* XXX */
 505     context->ccache = cc;
 506     return 0;
 507 }
 508
 509 static kadm5_ret_t
 510 kadm5_ad_chpass_principal(void *server_handle,
 511                           krb5_principal principal,
 512                           const char *password)
 513 {
 514     kadm5_ad_context *context = server_handle;
 515     krb5_data result_code_string, result_string;
 516     int result_code;
 517     kadm5_ret_t ret;
 518
 519     ret = ad_get_cred(context, NULL);
 520     if (ret)
 521         return ret;
 522
 523     krb5_data_zero (&result_code_string);
 524     krb5_data_zero (&result_string);
 525
 526     ret = krb5_set_password_using_ccache (context->context,
 527                                           context->ccache,
 528                                           password,
 529                                           principal,
 530                                           &result_code,
 531                                           &result_code_string,
 532                                           &result_string);
 533
 534     krb5_data_free (&result_code_string);
 535     krb5_data_free (&result_string);
 536
 537     /* XXX do mapping here on error codes */
 538
 539     return ret;
 540 }
 541
 542 #ifdef OPENLDAP
 543 static const char *
 544 get_fqdn(krb5_context context, const krb5_principal p)
 545 {
 546     const char *s, *hosttypes[] = { "host", "ldap", "gc", "cifs", "dns" };
 547     int i;
 548
 549     s = krb5_principal_get_comp_string(context, p, 0);
 550     if (p == NULL)
 551         return NULL;
 552
 553     for (i = 0; i < sizeof(hosttypes)/sizeof(hosttypes[0]); i++) {
 554         if (strcasecmp(s, hosttypes[i]) == 0)
 555             return krb5_principal_get_comp_string(context, p, 1);
 556     }
 557     return 0;
 558 }
 559 #endif
 560
 561
 562 static kadm5_ret_t
 563 kadm5_ad_create_principal(void *server_handle,
 564                           kadm5_principal_ent_t entry,
 565                           uint32_t mask,
 566                           const char *password)
 567 {
 568     kadm5_ad_context *context = server_handle;
 569
 570     /*
 571      * KADM5_PRINC_EXPIRE_TIME
 572      *
 573      * return 0 || KADM5_DUP;
 574      */
 575
 576 #ifdef OPENLDAP
 577     LDAPMod *attrs[8], rattrs[7], *a;
 578     char *useraccvals[2] = { NULL, NULL },
 579         *samvals[2], *dnsvals[2], *spnvals[5], *upnvals[2], *tv[2];
 580     char *ocvals_spn[] = { "top", "person", "organizationalPerson",
 581                            "user", "computer", NULL};
 582     char *p, *realmless_p, *p_msrealm = NULL, *dn = NULL;
 583     const char *fqdn;
 584     char *s, *samname = NULL, *short_spn = NULL;
 585     int ret, i;
 586     int32_t uf_flags = 0;
 587
 588     if ((mask & KADM5_PRINCIPAL) == 0)
 589         return KADM5_BAD_MASK;
 590
 591     for (i = 0; i < sizeof(rattrs)/sizeof(rattrs[0]); i++)
 592         attrs[i] = &rattrs[i];
 593     attrs[i] = NULL;
 594
 595     ret = ad_get_cred(context, NULL);
 596     if (ret)
 597         return ret;
 598
 599     ret = _kadm5_ad_connect(server_handle);
 600     if (ret)
 601         return ret;
 602
 603     fqdn = get_fqdn(context->context, entry->principal);
 604
 605     ret = krb5_unparse_name(context->context, entry->principal, &p);
 606     if (ret)
 607         return ret;
 608
 609     if (ad_find_entry(context, fqdn, p, NULL) == 0) {
 610         free(p);
 611         return KADM5_DUP;
 612     }
 613
 614     if (mask & KADM5_ATTRIBUTES) {
 615         if (entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)
 616             uf_flags |= UF_ACCOUNTDISABLE|UF_LOCKOUT;
 617         if ((entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH) == 0)
 618             uf_flags |= UF_DONT_REQUIRE_PREAUTH;
 619         if (entry->attributes & KRB5_KDB_REQUIRES_HW_AUTH)
 620             uf_flags |= UF_SMARTCARD_REQUIRED;
 621     }
 622
 623     realmless_p = strdup(p);
 624     if (realmless_p == NULL) {
 625         ret = ENOMEM;
 626         goto out;
 627     }
 628     s = strrchr(realmless_p, '@');
 629     if (s)
 630         *s = '\0';
 631
 632     if (fqdn) {
 633         /* create computer account */
 634         asprintf(&samname, "%s$", fqdn);
 635         if (samname == NULL) {
 636             ret = ENOMEM;
 637             goto out;
 638         }
 639         s = strchr(samname, '.');
 640         if (s) {
 641             s[0] = '$';
 642             s[1] = '\0';
 643         }
 644
 645         short_spn = strdup(p);
 646         if (short_spn == NULL) {
 647             errno = ENOMEM;
 648             goto out;
 649         }
 650         s = strchr(short_spn, '.');
 651         if (s) {
 652             *s = '\0';
 653         } else {
 654             free(short_spn);
 655             short_spn = NULL;
 656         }
 657
 658         p_msrealm = strdup(p);
 659         if (p_msrealm == NULL) {
 660             errno = ENOMEM;
 661             goto out;
 662         }
 663         s = strrchr(p_msrealm, '@');
 664         if (s) {
 665             *s = '/';
 666         } else {
 667             free(p_msrealm);
 668             p_msrealm = NULL;
 669         }
 670
 671         asprintf(&dn, "cn=%s, cn=Computers, %s", fqdn, CTX2BASE(context));
 672         if (dn == NULL) {
 673             ret = ENOMEM;
 674             goto out;
 675         }
 676
 677         a = &rattrs[0];
 678         a->mod_op = LDAP_MOD_ADD;
 679         a->mod_type = "objectClass";
 680         a->mod_values = ocvals_spn;
 681         a++;
 682
 683         a->mod_op = LDAP_MOD_ADD;
 684         a->mod_type = "userAccountControl";
 685         a->mod_values = useraccvals;
 686         asprintf(&useraccvals[0], "%d",
 687                  uf_flags |
 688                  UF_PASSWD_NOT_EXPIRE |
 689                  UF_WORKSTATION_TRUST_ACCOUNT);
 690         useraccvals[1] = NULL;
 691         a++;
 692
 693         a->mod_op = LDAP_MOD_ADD;
 694         a->mod_type = "sAMAccountName";
 695         a->mod_values = samvals;
 696         samvals[0] = samname;
 697         samvals[1] = NULL;
 698         a++;
 699
 700         a->mod_op = LDAP_MOD_ADD;
 701         a->mod_type = "dNSHostName";
 702         a->mod_values = dnsvals;
 703         dnsvals[0] = (char *)fqdn;
 704         dnsvals[1] = NULL;
 705         a++;
 706
 707         /* XXX  add even more spn's */
 708         a->mod_op = LDAP_MOD_ADD;
 709         a->mod_type = "servicePrincipalName";
 710         a->mod_values = spnvals;
 711         i = 0;
 712         spnvals[i++] = p;
 713         spnvals[i++] = realmless_p;
 714         if (short_spn)
 715             spnvals[i++] = short_spn;
 716         if (p_msrealm)
 717             spnvals[i++] = p_msrealm;
 718         spnvals[i++] = NULL;
 719         a++;
 720
 721         a->mod_op = LDAP_MOD_ADD;
 722         a->mod_type = "userPrincipalName";
 723         a->mod_values = upnvals;
 724         upnvals[0] = p;
 725         upnvals[1] = NULL;
 726         a++;
 727
 728         a->mod_op = LDAP_MOD_ADD;
 729         a->mod_type = "accountExpires";
 730         a->mod_values = tv;
 731         tv[0] = "9223372036854775807"; /* "never" */
 732         tv[1] = NULL;
 733         a++;
 734
 735     } else {
 736         /* create user account */
 737
 738         a = &rattrs[0];
 739         a->mod_op = LDAP_MOD_ADD;
 740         a->mod_type = "userAccountControl";
 741         a->mod_values = useraccvals;
 742         asprintf(&useraccvals[0], "%d",
 743                  uf_flags |
 744                  UF_PASSWD_NOT_EXPIRE);
 745         useraccvals[1] = NULL;
 746         a++;
 747
 748         a->mod_op = LDAP_MOD_ADD;
 749         a->mod_type = "sAMAccountName";
 750         a->mod_values = samvals;
 751         samvals[0] = realmless_p;
 752         samvals[1] = NULL;
 753         a++;
 754
 755         a->mod_op = LDAP_MOD_ADD;
 756         a->mod_type = "userPrincipalName";
 757         a->mod_values = upnvals;
 758         upnvals[0] = p;
 759         upnvals[1] = NULL;
 760         a++;
 761
 762         a->mod_op = LDAP_MOD_ADD;
 763         a->mod_type = "accountExpires";
 764         a->mod_values = tv;
 765         tv[0] = "9223372036854775807"; /* "never" */
 766         tv[1] = NULL;
 767         a++;
 768     }
 769
 770     attrs[a - &rattrs[0]] = NULL;
 771
 772     ret = ldap_add_s(CTX2LP(context), dn, attrs);
 773
 774  out:
 775     if (useraccvals[0])
 776         free(useraccvals[0]);
 777     if (realmless_p)
 778         free(realmless_p);
 779     if (samname)
 780         free(samname);
 781     if (short_spn)
 782         free(short_spn);
 783     if (p_msrealm)
 784         free(p_msrealm);
 785     free(p);
 786
 787     if (check_ldap(context, ret))
 788         return KADM5_RPC_ERROR;
 789
 790     return 0;
 791 #else
 792     krb5_set_error_string(context->context, "Function not implemented");
 793     return KADM5_RPC_ERROR;
 794 #endif
 795 }
 796
 797 static kadm5_ret_t
 798 kadm5_ad_delete_principal(void *server_handle, krb5_principal principal)
 799 {
 800     kadm5_ad_context *context = server_handle;
 801 #ifdef OPENLDAP
 802     char *p, *dn = NULL;
 803     const char *fqdn;
 804     int ret;
 805
 806     ret = ad_get_cred(context, NULL);
 807     if (ret)
 808         return ret;
 809
 810     ret = _kadm5_ad_connect(server_handle);
 811     if (ret)
 812         return ret;
 813
 814     fqdn = get_fqdn(context->context, principal);
 815
 816     ret = krb5_unparse_name(context->context, principal, &p);
 817     if (ret)
 818         return ret;
 819
 820     if (ad_find_entry(context, fqdn, p, &dn) != 0) {
 821         free(p);
 822         return KADM5_UNK_PRINC;
 823     }
 824
 825     ret = ldap_delete_s(CTX2LP(context), dn);
 826
 827     free(dn);
 828     free(p);
 829
 830     if (check_ldap(context, ret))
 831         return KADM5_RPC_ERROR;
 832     return 0;
 833 #else
 834     krb5_set_error_string(context->context, "Function not implemented");
 835     return KADM5_RPC_ERROR;
 836 #endif
 837 }
 838
 839 static kadm5_ret_t
 840 kadm5_ad_destroy(void *server_handle)
 841 {
 842     kadm5_ad_context *context = server_handle;
 843
 844     if (context->ccache)
 845         krb5_cc_destroy(context->context, context->ccache);
 846
 847 #ifdef OPENLDAP
 848     {
 849         LDAP *lp = CTX2LP(context);
 850         if (lp)
 851             ldap_unbind(lp);
 852         if (context->base_dn)
 853             free(context->base_dn);
 854     }
 855 #endif
 856     free(context->realm);
 857     free(context->client_name);
 858     krb5_free_principal(context->context, context->caller);
 859     if(context->my_context)
 860         krb5_free_context(context->context);
 861     return 0;
 862 }
 863
 864 static kadm5_ret_t
 865 kadm5_ad_flush(void *server_handle)
 866 {
 867     kadm5_ad_context *context = server_handle;
 868 #ifdef OPENLDAP
 869     krb5_set_error_string(context->context, "Function not implemented");
 870     return KADM5_RPC_ERROR;
 871 #else
 872     krb5_set_error_string(context->context, "Function not implemented");
 873     return KADM5_RPC_ERROR;
 874 #endif
 875 }
 876
 877 static kadm5_ret_t
 878 kadm5_ad_get_principal(void *server_handle,
 879                        krb5_principal principal,
 880                        kadm5_principal_ent_t entry,
 881                        uint32_t mask)
 882 {
 883     kadm5_ad_context *context = server_handle;
 884 #ifdef OPENLDAP
 885     LDAPMessage *m, *m0;
 886     char **attr = NULL;
 887     int attrlen = 0;
 888     char *filter, *p, *q, *u;
 889     int ret;
 890
 891     /*
 892      * principal
 893      * KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES
 894      */
 895
 896     /*
 897      * return 0 || KADM5_DUP;
 898      */
 899
 900     memset(entry, 0, sizeof(*entry));
 901
 902     if (mask & KADM5_KVNO)
 903         laddattr(&attr, &attrlen, "msDS-KeyVersionNumber");
 904
 905     if (mask & KADM5_PRINCIPAL) {
 906         laddattr(&attr, &attrlen, "userPrincipalName");
 907         laddattr(&attr, &attrlen, "servicePrincipalName");
 908     }
 909     laddattr(&attr, &attrlen, "objectClass");
 910     laddattr(&attr, &attrlen, "lastLogon");
 911     laddattr(&attr, &attrlen, "badPwdCount");
 912     laddattr(&attr, &attrlen, "badPasswordTime");
 913     laddattr(&attr, &attrlen, "pwdLastSet");
 914     laddattr(&attr, &attrlen, "accountExpires");
 915     laddattr(&attr, &attrlen, "userAccountControl");
 916
 917     krb5_unparse_name_short(context->context, principal, &p);
 918     krb5_unparse_name(context->context, principal, &u);
 919
 920     /* replace @ in domain part with a / */
 921     q = strrchr(p, '@');
 922     if (q && (p != q && *(q - 1) != '\\'))
 923         *q = '/';
 924
 925     asprintf(&filter,
 926              "(|(userPrincipalName=%s)(servicePrincipalName=%s)(servicePrincipalName=%s))",
 927              u, p, u);
 928     free(p);
 929     free(u);
 930
 931     ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
 932                         LDAP_SCOPE_SUBTREE,
 933                         filter, attr, 0, &m);
 934     free(attr);
 935     if (check_ldap(context, ret))
 936         return KADM5_RPC_ERROR;
 937
 938     if (ldap_count_entries(CTX2LP(context), m) > 0) {
 939         char **vals;
 940         m0 = ldap_first_entry(CTX2LP(context), m);
 941         if (m0 == NULL) {
 942             ldap_msgfree(m);
 943             goto fail;
 944         }
 945 #if 0
 946         vals = ldap_get_values(CTX2LP(context), m0, "servicePrincipalName");
 947         if (vals)
 948             printf("servicePrincipalName %s\n", vals[0]);
 949         vals = ldap_get_values(CTX2LP(context), m0, "userPrincipalName");
 950         if (vals)
 951             printf("userPrincipalName %s\n", vals[0]);
 952         vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
 953         if (vals)
 954             printf("userAccountControl %s\n", vals[0]);
 955 #endif
 956         entry->princ_expire_time = 0;
 957         if (mask & KADM5_PRINC_EXPIRE_TIME) {
 958             vals = ldap_get_values(CTX2LP(context), m0, "accountExpires");
 959             if (vals)
 960                 entry->princ_expire_time = nt2unixtime(vals[0]);
 961         }
 962         entry->last_success = 0;
 963         if (mask & KADM5_LAST_SUCCESS) {
 964             vals = ldap_get_values(CTX2LP(context), m0, "lastLogon");
 965             if (vals)
 966                 entry->last_success = nt2unixtime(vals[0]);
 967         }
 968         if (mask & KADM5_LAST_FAILED) {
 969             vals = ldap_get_values(CTX2LP(context), m0, "badPasswordTime");
 970             if (vals)
 971                 entry->last_failed = nt2unixtime(vals[0]);
 972         }
 973         if (mask & KADM5_LAST_PWD_CHANGE) {
 974             vals = ldap_get_values(CTX2LP(context), m0, "pwdLastSet");
 975             if (vals)
 976                 entry->last_pwd_change = nt2unixtime(vals[0]);
 977         }
 978         if (mask & KADM5_FAIL_AUTH_COUNT) {
 979             vals = ldap_get_values(CTX2LP(context), m0, "badPwdCount");
 980             if (vals)
 981                 entry->fail_auth_count = atoi(vals[0]);
 982         }
 983         if (mask & KADM5_ATTRIBUTES) {
 984             vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
 985             if (vals) {
 986                 uint32_t i;
 987                 i = atoi(vals[0]);
 988                 if (i & (UF_ACCOUNTDISABLE|UF_LOCKOUT))
 989                     entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
 990                 if ((i & UF_DONT_REQUIRE_PREAUTH) == 0)
 991                     entry->attributes |= KRB5_KDB_REQUIRES_PRE_AUTH;
 992                 if (i & UF_SMARTCARD_REQUIRED)
 993                     entry->attributes |= KRB5_KDB_REQUIRES_HW_AUTH;
 994                 if ((i & UF_WORKSTATION_TRUST_ACCOUNT) == 0)
 995                     entry->attributes |= KRB5_KDB_DISALLOW_SVR;
 996             }
 997         }
 998         if (mask & KADM5_KVNO) {
 999             vals = ldap_get_values(CTX2LP(context), m0,
1000                                    "msDS-KeyVersionNumber");
1001             if (vals)
1002                 entry->kvno = atoi(vals[0]);
1003             else
1004                 entry->kvno = 0;
1005         }
1006         ldap_msgfree(m);
1007     } else {
1008         return KADM5_UNK_PRINC;
1009     }
1010
1011     if (mask & KADM5_PRINCIPAL)
1012         krb5_copy_principal(context->context, principal, &entry->principal);
1013
1014     return 0;
1015  fail:
1016     return KADM5_RPC_ERROR;
1017 #else
1018     krb5_set_error_string(context->context, "Function not implemented");
1019     return KADM5_RPC_ERROR;
1020 #endif
1021 }
1022
1023 static kadm5_ret_t
1024 kadm5_ad_get_principals(void *server_handle,
1025                         const char *expression,
1026                         char ***principals,
1027                         int *count)
1028 {
1029     kadm5_ad_context *context = server_handle;
1030
1031     /*
1032      * KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES
1033      */
1034
1035 #ifdef OPENLDAP
1036     kadm5_ret_t ret;
1037
1038     ret = ad_get_cred(context, NULL);
1039     if (ret)
1040         return ret;
1041
1042     ret = _kadm5_ad_connect(server_handle);
1043     if (ret)
1044         return ret;
1045
1046     krb5_set_error_string(context->context, "Function not implemented");
1047     return KADM5_RPC_ERROR;
1048 #else
1049     krb5_set_error_string(context->context, "Function not implemented");
1050     return KADM5_RPC_ERROR;
1051 #endif
1052 }
1053
1054 static kadm5_ret_t
1055 kadm5_ad_get_privs(void *server_handle, uint32_t*privs)
1056 {
1057     kadm5_ad_context *context = server_handle;
1058     krb5_set_error_string(context->context, "Function not implemented");
1059     return KADM5_RPC_ERROR;
1060 }
1061
1062 static kadm5_ret_t
1063 kadm5_ad_modify_principal(void *server_handle,
1064                           kadm5_principal_ent_t entry,
1065                           uint32_t mask)
1066 {
1067     kadm5_ad_context *context = server_handle;
1068
1069     /*
1070      * KADM5_ATTRIBUTES
1071      * KRB5_KDB_DISALLOW_ALL_TIX (| KADM5_KVNO)
1072      */
1073
1074 #ifdef OPENLDAP
1075     LDAPMessage *m = NULL, *m0;
1076     kadm5_ret_t ret;
1077     char **attr = NULL;
1078     int attrlen = 0;
1079     char *p = NULL, *s = NULL, *q;
1080     char **vals;
1081     LDAPMod *attrs[4], rattrs[3], *a;
1082     char *uaf[2] = { NULL, NULL };
1083     char *kvno[2] = { NULL, NULL };
1084     char *tv[2] = { NULL, NULL };
1085     char *filter, *dn;
1086     int i;
1087
1088     for (i = 0; i < sizeof(rattrs)/sizeof(rattrs[0]); i++)
1089         attrs[i] = &rattrs[i];
1090     attrs[i] = NULL;
1091     a = &rattrs[0];
1092
1093     ret = _kadm5_ad_connect(server_handle);
1094     if (ret)
1095         return ret;
1096
1097     if (mask & KADM5_KVNO)
1098         laddattr(&attr, &attrlen, "msDS-KeyVersionNumber");
1099     if (mask & KADM5_PRINC_EXPIRE_TIME)
1100         laddattr(&attr, &attrlen, "accountExpires");
1101     if (mask & KADM5_ATTRIBUTES)
1102         laddattr(&attr, &attrlen, "userAccountControl");
1103     laddattr(&attr, &attrlen, "distinguishedName");
1104
1105     krb5_unparse_name(context->context, entry->principal, &p);
1106
1107     s = strdup(p);
1108
1109     q = strrchr(s, '@');
1110     if (q && (p != q && *(q - 1) != '\\'))
1111         *q = '\0';
1112
1113     asprintf(&filter,
1114              "(|(userPrincipalName=%s)(servicePrincipalName=%s))",
1115              s, s);
1116     free(p);
1117     free(s);
1118
1119     ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
1120                         LDAP_SCOPE_SUBTREE,
1121                         filter, attr, 0, &m);
1122     free(attr);
1123     free(filter);
1124     if (check_ldap(context, ret))
1125         return KADM5_RPC_ERROR;
1126
1127     if (ldap_count_entries(CTX2LP(context), m) <= 0) {
1128         ret = KADM5_RPC_ERROR;
1129         goto out;
1130     }
1131
1132     m0 = ldap_first_entry(CTX2LP(context), m);
1133
1134     if (mask & KADM5_ATTRIBUTES) {
1135         int32_t i;
1136
1137         vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
1138         if (vals == NULL) {
1139             ret = KADM5_RPC_ERROR;
1140             goto out;
1141         }
1142
1143         i = atoi(vals[0]);
1144         if (i == 0)
1145             return KADM5_RPC_ERROR;
1146
1147         if (entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)
1148             i |= (UF_ACCOUNTDISABLE|UF_LOCKOUT);
1149         else
1150             i &= ~(UF_ACCOUNTDISABLE|UF_LOCKOUT);
1151         if (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)
1152             i &= ~UF_DONT_REQUIRE_PREAUTH;
1153         else
1154             i |= UF_DONT_REQUIRE_PREAUTH;
1155         if (entry->attributes & KRB5_KDB_REQUIRES_HW_AUTH)
1156             i |= UF_SMARTCARD_REQUIRED;
1157         else
1158             i &= UF_SMARTCARD_REQUIRED;
1159         if (entry->attributes & KRB5_KDB_DISALLOW_SVR)
1160             i &= ~UF_WORKSTATION_TRUST_ACCOUNT;
1161         else
1162             i |= UF_WORKSTATION_TRUST_ACCOUNT;
1163
1164         asprintf(&uaf[0], "%d", i);
1165
1166         a->mod_op = LDAP_MOD_REPLACE;
1167         a->mod_type = "userAccountControl";
1168         a->mod_values = uaf;
1169         a++;
1170     }
1171
1172     if (mask & KADM5_KVNO) {
1173         vals = ldap_get_values(CTX2LP(context), m0, "msDS-KeyVersionNumber");
1174         if (vals == NULL) {
1175             entry->kvno = 0;
1176         } else {
1177             asprintf(&kvno[0], "%d", entry->kvno);
1178
1179             a->mod_op = LDAP_MOD_REPLACE;
1180             a->mod_type = "msDS-KeyVersionNumber";
1181             a->mod_values = kvno;
1182             a++;
1183         }
1184     }
1185
1186     if (mask & KADM5_PRINC_EXPIRE_TIME) {
1187         long long wt;
1188         vals = ldap_get_values(CTX2LP(context), m0, "accountExpires");
1189         if (vals == NULL) {
1190             ret = KADM5_RPC_ERROR;
1191             goto out;
1192         }
1193
1194         wt = unix2nttime(entry->princ_expire_time);
1195
1196         asprintf(&tv[0], "%llu", wt);
1197
1198         a->mod_op = LDAP_MOD_REPLACE;
1199         a->mod_type = "accountExpires";
1200         a->mod_values = tv;
1201         a++;
1202     }
1203
1204     vals = ldap_get_values(CTX2LP(context), m0, "distinguishedName");
1205     if (vals == NULL) {
1206         ret = KADM5_RPC_ERROR;
1207         goto out;
1208     }
1209     dn = vals[0];
1210
1211     attrs[a - &rattrs[0]] = NULL;
1212
1213     ret = ldap_modify_s(CTX2LP(context), dn, attrs);
1214     if (check_ldap(context, ret))
1215         return KADM5_RPC_ERROR;
1216
1217  out:
1218     if (m)
1219         ldap_msgfree(m);
1220     if (uaf[0])
1221         free(uaf[0]);
1222     if (kvno[0])
1223         free(kvno[0]);
1224     if (tv[0])
1225         free(tv[0]);
1226     return ret;
1227 #else
1228     krb5_set_error_string(context->context, "Function not implemented");
1229     return KADM5_RPC_ERROR;
1230 #endif
1231 }
1232
1233 static kadm5_ret_t
1234 kadm5_ad_randkey_principal(void *server_handle,
1235                            krb5_principal principal,
1236                            krb5_keyblock **keys,
1237                            int *n_keys)
1238 {
1239     kadm5_ad_context *context = server_handle;
1240
1241     /*
1242      * random key
1243      */
1244
1245 #ifdef OPENLDAP
1246     krb5_data result_code_string, result_string;
1247     int result_code, plen;
1248     kadm5_ret_t ret;
1249     char *password;
1250
1251     *keys = NULL;
1252     *n_keys = 0;
1253
1254     {
1255         char p[64];
1256         krb5_generate_random_block(p, sizeof(p));
1257         plen = base64_encode(p, sizeof(p), &password);
1258         if (plen < 0)
1259             return ENOMEM;
1260     }
1261
1262     ret = ad_get_cred(context, NULL);
1263     if (ret) {
1264         free(password);
1265         return ret;
1266     }
1267
1268     krb5_data_zero (&result_code_string);
1269     krb5_data_zero (&result_string);
1270
1271     ret = krb5_set_password_using_ccache (context->context,
1272                                           context->ccache,
1273                                           password,
1274                                           principal,
1275                                           &result_code,
1276                                           &result_code_string,
1277                                           &result_string);
1278
1279     krb5_data_free (&result_code_string);
1280     krb5_data_free (&result_string);
1281
1282     if (ret == 0) {
1283
1284         *keys = malloc(sizeof(**keys) * 1);
1285         if (*keys == NULL) {
1286             ret = ENOMEM;
1287             goto out;
1288         }
1289         *n_keys = 1;
1290
1291         ret = krb5_string_to_key(context->context,
1292                                  ENCTYPE_ARCFOUR_HMAC_MD5,
1293                                  password,
1294                                  principal,
1295                                  &(*keys)[0]);
1296         memset(password, 0, sizeof(password));
1297         if (ret) {
1298             free(*keys);
1299             *keys = NULL;
1300             *n_keys = 0;
1301             goto out;
1302         }
1303     }
1304     memset(password, 0, plen);
1305     free(password);
1306  out:
1307     return ret;
1308 #else
1309     *keys = NULL;
1310     *n_keys = 0;
1311
1312     krb5_set_error_string(context->context, "Function not implemented");
1313     return KADM5_RPC_ERROR;
1314 #endif
1315 }
1316
1317 static kadm5_ret_t
1318 kadm5_ad_rename_principal(void *server_handle,
1319                           krb5_principal from,
1320                           krb5_principal to)
1321 {
1322     kadm5_ad_context *context = server_handle;
1323     krb5_set_error_string(context->context, "Function not implemented");
1324     return KADM5_RPC_ERROR;
1325 }
1326
1327 static kadm5_ret_t
1328 kadm5_ad_chpass_principal_with_key(void *server_handle,
1329                                    krb5_principal princ,
1330                                    int n_key_data,
1331                                    krb5_key_data *key_data)
1332 {
1333     kadm5_ad_context *context = server_handle;
1334     krb5_set_error_string(context->context, "Function not implemented");
1335     return KADM5_RPC_ERROR;
1336 }
1337
1338 static void
1339 set_funcs(kadm5_ad_context *c)
1340 {
1341 #define SET(C, F) (C)->funcs.F = kadm5_ad_ ## F
1342     SET(c, chpass_principal);
1343     SET(c, chpass_principal_with_key);
1344     SET(c, create_principal);
1345     SET(c, delete_principal);
1346     SET(c, destroy);
1347     SET(c, flush);
1348     SET(c, get_principal);
1349     SET(c, get_principals);
1350     SET(c, get_privs);
1351     SET(c, modify_principal);
1352     SET(c, randkey_principal);
1353     SET(c, rename_principal);
1354 }
1355
1356 kadm5_ret_t
1357 kadm5_ad_init_with_password_ctx(krb5_context context,
1358                                 const char *client_name,
1359                                 const char *password,
1360                                 const char *service_name,
1361                                 kadm5_config_params *realm_params,
1362                                 unsigned long struct_version,
1363                                 unsigned long api_version,
1364                                 void **server_handle)
1365 {
1366     kadm5_ret_t ret;
1367     kadm5_ad_context *ctx;
1368
1369     ctx = malloc(sizeof(*ctx));
1370     if(ctx == NULL)
1371         return ENOMEM;
1372     memset(ctx, 0, sizeof(*ctx));
1373     set_funcs(ctx);
1374
1375     ctx->context = context;
1376     krb5_add_et_list (context, initialize_kadm5_error_table_r);
1377
1378     ret = krb5_parse_name(ctx->context, client_name, &ctx->caller);
1379     if(ret) {
1380         free(ctx);
1381         return ret;
1382     }
1383
1384     if(realm_params->mask & KADM5_CONFIG_REALM) {
1385         ret = 0;
1386         ctx->realm = strdup(realm_params->realm);
1387         if (ctx->realm == NULL)
1388             ret = ENOMEM;
1389     } else
1390         ret = krb5_get_default_realm(ctx->context, &ctx->realm);
1391     if (ret) {
1392         free(ctx);
1393         return ret;
1394     }
1395
1396     ctx->client_name = strdup(client_name);
1397
1398     if(password != NULL && *password != '\0')
1399         ret = ad_get_cred(ctx, password);
1400     else
1401         ret = ad_get_cred(ctx, NULL);
1402     if(ret) {
1403         kadm5_ad_destroy(ctx);
1404         return ret;
1405     }
1406
1407 #ifdef OPENLDAP
1408     ret = _kadm5_ad_connect(ctx);
1409     if (ret) {
1410         kadm5_ad_destroy(ctx);
1411         return ret;
1412     }
1413 #endif
1414
1415     *server_handle = ctx;
1416     return 0;
1417 }
1418
1419 kadm5_ret_t
1420 kadm5_ad_init_with_password(const char *client_name,
1421                             const char *password,
1422                             const char *service_name,
1423                             kadm5_config_params *realm_params,
1424                             unsigned long struct_version,
1425                             unsigned long api_version,
1426                             void **server_handle)
1427 {
1428     krb5_context context;
1429     kadm5_ret_t ret;
1430     kadm5_ad_context *ctx;
1431
1432     ret = krb5_init_context(&context);
1433     if (ret)
1434         return ret;
1435     ret = kadm5_ad_init_with_password_ctx(context,
1436                                           client_name,
1437                                           password,
1438                                           service_name,
1439                                           realm_params,
1440                                           struct_version,
1441                                           api_version,
1442                                           server_handle);
1443     if(ret) {
1444         krb5_free_context(context);
1445         return ret;
1446     }
1447     ctx = *server_handle;
1448     ctx->my_context = 1;
1449     return 0;
1450 }