source4/auth/kerberos/kerberos_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos utility functions for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/kerberos.h"
  25 #include "auth/kerberos/kerberos.h"
  26 #include "auth/credentials/credentials.h"
  27 #include "auth/credentials/credentials_krb5.h"
  28 #include "auth/kerberos/kerberos_credentials.h"
  29 #include "auth/kerberos/kerberos_util.h"
  30
  31 struct principal_container {
  32         struct smb_krb5_context *smb_krb5_context;
  33         krb5_principal principal;
  34         const char *string_form; /* Optional */
  35 };
  36
  37 static krb5_error_code free_principal(struct principal_container *pc)
  38 {
  39         /* current heimdal - 0.6.3, which we need anyway, fixes segfaults here */
  40         krb5_free_principal(pc->smb_krb5_context->krb5_context, pc->principal);
  41
  42         return 0;
  43 }
  44
  45
  46 static krb5_error_code parse_principal(TALLOC_CTX *parent_ctx,
  47                                        const char *princ_string,
  48                                        struct smb_krb5_context *smb_krb5_context,
  49                                        krb5_principal *princ,
  50                                        const char **error_string)
  51 {
  52         int ret;
  53         struct principal_container *mem_ctx;
  54         if (princ_string == NULL) {
  55                  *princ = NULL;
  56                  return 0;
  57         }
  58
  59         /*
  60          * Start with talloc(), talloc_reference() and only then call
  61          * krb5_parse_name(). If any of them fails, the cleanup code is simpler.
  62          */
  63         mem_ctx = talloc(parent_ctx, struct principal_container);
  64         if (!mem_ctx) {
  65                 (*error_string) = error_message(ENOMEM);
  66                 return ENOMEM;
  67         }
  68
  69         mem_ctx->smb_krb5_context = talloc_reference(mem_ctx,
  70                                                      smb_krb5_context);
  71         if (mem_ctx->smb_krb5_context == NULL) {
  72                 (*error_string) = error_message(ENOMEM);
  73                 talloc_free(mem_ctx);
  74                 return ENOMEM;
  75         }
  76
  77         ret = krb5_parse_name(smb_krb5_context->krb5_context,
  78                               princ_string, princ);
  79
  80         if (ret) {
  81                 (*error_string) = smb_get_krb5_error_message(
  82                                                 smb_krb5_context->krb5_context,
  83                                                 ret, parent_ctx);
  84                 talloc_free(mem_ctx);
  85                 return ret;
  86         }
  87
  88         /* This song-and-dance effectivly puts the principal
  89          * into talloc, so we can't loose it. */
  90         mem_ctx->principal = *princ;
  91         talloc_set_destructor(mem_ctx, free_principal);
  92         return 0;
  93 }
  94
  95 /* Obtain the principal set on this context.  Requires a
  96  * smb_krb5_context because we are doing krb5 principal parsing with
  97  * the library routines.  The returned princ is placed in the talloc
  98  * system by means of a destructor (do *not* free). */
  99
 100 krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
 101                                 struct cli_credentials *credentials,
 102                                 struct smb_krb5_context *smb_krb5_context,
 103                                 krb5_principal *princ,
 104                                 enum credentials_obtained *obtained,
 105                                 const char **error_string)
 106 {
 107         krb5_error_code ret;
 108         const char *princ_string;
 109         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 110         *obtained = CRED_UNINITIALISED;
 111
 112         if (!mem_ctx) {
 113                 (*error_string) = error_message(ENOMEM);
 114                 return ENOMEM;
 115         }
 116         princ_string = cli_credentials_get_principal_and_obtained(credentials,
 117                                                                   mem_ctx,
 118                                                                   obtained);
 119         if (!princ_string) {
 120                 *princ = NULL;
 121                 return 0;
 122         }
 123
 124         ret = parse_principal(parent_ctx, princ_string,
 125                               smb_krb5_context, princ, error_string);
 126         talloc_free(mem_ctx);
 127         return ret;
 128 }
 129
 130 /* Obtain the principal set on this context.  Requires a
 131  * smb_krb5_context because we are doing krb5 principal parsing with
 132  * the library routines.  The returned princ is placed in the talloc
 133  * system by means of a destructor (do *not* free). */
 134
 135 static krb5_error_code impersonate_principal_from_credentials(
 136                                 TALLOC_CTX *parent_ctx,
 137                                 struct cli_credentials *credentials,
 138                                 struct smb_krb5_context *smb_krb5_context,
 139                                 krb5_principal *princ,
 140                                 const char **error_string)
 141 {
 142         return parse_principal(parent_ctx,
 143                         cli_credentials_get_impersonate_principal(credentials),
 144                         smb_krb5_context, princ, error_string);
 145 }
 146
 147 krb5_error_code smb_krb5_create_principals_array(TALLOC_CTX *mem_ctx,
 148                                                  krb5_context context,
 149                                                  const char *account_name,
 150                                                  const char *realm,
 151                                                  uint32_t num_spns,
 152                                                  const char *spns[],
 153                                                  uint32_t *pnum_principals,
 154                                                  krb5_principal **pprincipals,
 155                                                  const char **error_string)
 156 {
 157         krb5_error_code code;
 158         TALLOC_CTX *tmp_ctx;
 159         uint32_t num_principals = 0;
 160         krb5_principal *principals;
 161         uint32_t i;
 162
 163         tmp_ctx = talloc_new(mem_ctx);
 164         if (tmp_ctx == NULL) {
 165                 *error_string = "Cannot allocate tmp_ctx";
 166                 return ENOMEM;
 167         }
 168
 169         if (realm == NULL) {
 170                 *error_string = "Cannot create principal without a realm";
 171                 code = EINVAL;
 172                 goto done;
 173         }
 174
 175         if (account_name == NULL && (num_spns == 0 || spns == NULL)) {
 176                 *error_string = "Cannot create principal without an account or SPN";
 177                 code = EINVAL;
 178                 goto done;
 179         }
 180
 181         if (account_name != NULL && account_name[0] != '\0') {
 182                 num_principals++;
 183         }
 184         num_principals += num_spns;
 185
 186         principals = talloc_zero_array(tmp_ctx,
 187                                        krb5_principal,
 188                                        num_principals);
 189         if (principals == NULL) {
 190                 *error_string = "Cannot allocate principals";
 191                 code = ENOMEM;
 192                 goto done;
 193         }
 194
 195         for (i = 0; i < num_spns; i++) {
 196                 code = krb5_parse_name(context, spns[i], &(principals[i]));
 197                 if (code != 0) {
 198                         *error_string = smb_get_krb5_error_message(context,
 199                                                                    code,
 200                                                                    mem_ctx);
 201                         goto done;
 202                 }
 203         }
 204
 205         if (account_name != NULL && account_name[0] != '\0') {
 206                 code = smb_krb5_make_principal(context,
 207                                                &(principals[i]),
 208                                                realm,
 209                                                account_name,
 210                                                NULL);
 211                 if (code != 0) {
 212                         *error_string = smb_get_krb5_error_message(context,
 213                                                                    code,
 214                                                                    mem_ctx);
 215                         goto done;
 216                 }
 217         }
 218
 219         if (pnum_principals != NULL) {
 220                 *pnum_principals = num_principals;
 221
 222                 if (pprincipals != NULL) {
 223                         *pprincipals = talloc_steal(mem_ctx, principals);
 224                 }
 225         }
 226
 227         code = 0;
 228 done:
 229         talloc_free(tmp_ctx);
 230         return code;
 231 }
 232
 233 /**
 234  * Return a freshly allocated ccache (destroyed by destructor on child
 235  * of parent_ctx), for a given set of client credentials
 236  */
 237
 238  krb5_error_code kinit_to_ccache(TALLOC_CTX *parent_ctx,
 239                                  struct cli_credentials *credentials,
 240                                  struct smb_krb5_context *smb_krb5_context,
 241                                  struct tevent_context *event_ctx,
 242                                  krb5_ccache ccache,
 243                                  enum credentials_obtained *obtained,
 244                                  const char **error_string)
 245 {
 246         krb5_error_code ret;
 247         const char *password;
 248         const char *self_service;
 249         const char *target_service;
 250         time_t kdc_time = 0;
 251         krb5_principal princ;
 252         krb5_principal impersonate_principal;
 253         int tries;
 254         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 255         krb5_get_init_creds_opt *krb_options;
 256
 257         if (!mem_ctx) {
 258                 (*error_string) = strerror(ENOMEM);
 259                 return ENOMEM;
 260         }
 261
 262         ret = principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &princ, obtained, error_string);
 263         if (ret) {
 264                 talloc_free(mem_ctx);
 265                 return ret;
 266         }
 267
 268         if (princ == NULL) {
 269                 (*error_string) = talloc_asprintf(credentials, "principal, username or realm was not specified in the credentials");
 270                 talloc_free(mem_ctx);
 271                 return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
 272         }
 273
 274         ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string);
 275         if (ret) {
 276                 talloc_free(mem_ctx);
 277                 return ret;
 278         }
 279
 280         self_service = cli_credentials_get_self_service(credentials);
 281         target_service = cli_credentials_get_target_service(credentials);
 282
 283         password = cli_credentials_get_password(credentials);
 284
 285         /* setup the krb5 options we want */
 286         if ((ret = krb5_get_init_creds_opt_alloc(smb_krb5_context->krb5_context, &krb_options))) {
 287                 (*error_string) = talloc_asprintf(credentials, "krb5_get_init_creds_opt_alloc failed (%s)\n",
 288                                                   smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 289                                                                              ret, mem_ctx));
 290                 talloc_free(mem_ctx);
 291                 return ret;
 292         }
 293
 294 #ifdef SAMBA4_USES_HEIMDAL /* Disable for now MIT reads defaults when needed */
 295         /* get the defaults */
 296         krb5_get_init_creds_opt_set_default_flags(smb_krb5_context->krb5_context, NULL, NULL, krb_options);
 297 #endif
 298         /* set if we want a forwardable ticket */
 299         switch (cli_credentials_get_krb_forwardable(credentials)) {
 300         case CRED_AUTO_KRB_FORWARDABLE:
 301                 break;
 302         case CRED_NO_KRB_FORWARDABLE:
 303                 krb5_get_init_creds_opt_set_forwardable(krb_options, FALSE);
 304                 break;
 305         case CRED_FORCE_KRB_FORWARDABLE:
 306                 krb5_get_init_creds_opt_set_forwardable(krb_options, TRUE);
 307                 break;
 308         }
 309
 310 #ifdef SAMBA4_USES_HEIMDAL /* FIXME: MIT does not have this yet */
 311         /*
 312          * In order to work against windows KDCs even if we use
 313          * the netbios domain name as realm, we need to add the following
 314          * flags:
 315          * KRB5_INIT_CREDS_NO_C_CANON_CHECK;
 316          * KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
 317          *
 318          * On MIT: Set pkinit_eku_checking to none
 319          */
 320         krb5_get_init_creds_opt_set_win2k(smb_krb5_context->krb5_context,
 321                                           krb_options, true);
 322         krb5_get_init_creds_opt_set_canonicalize(smb_krb5_context->krb5_context,
 323                                                  krb_options, true);
 324 #else /* MIT */
 325         krb5_get_init_creds_opt_set_canonicalize(krb_options, true);
 326 #endif
 327
 328         tries = 2;
 329         while (tries--) {
 330 #ifdef SAMBA4_USES_HEIMDAL
 331                 struct tevent_context *previous_ev;
 332                 /* Do this every time, in case we have weird recursive issues here */
 333                 ret = smb_krb5_context_set_event_ctx(smb_krb5_context, event_ctx, &previous_ev);
 334                 if (ret) {
 335                         talloc_free(mem_ctx);
 336                         return ret;
 337                 }
 338 #endif
 339                 if (password) {
 340                         if (impersonate_principal) {
 341                                 ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context,
 342                                                                  ccache,
 343                                                                  princ,
 344                                                                  password,
 345                                                                  impersonate_principal,
 346                                                                  self_service,
 347                                                                  target_service,
 348                                                                  krb_options,
 349                                                                  NULL,
 350                                                                  &kdc_time);
 351                         } else {
 352                                 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,
 353                                                                      ccache,
 354                                                                      princ,
 355                                                                      password,
 356                                                                      target_service,
 357                                                                      krb_options,
 358                                                                      NULL,
 359                                                                      &kdc_time);
 360                         }
 361                 } else if (impersonate_principal) {
 362                         talloc_free(mem_ctx);
 363                         (*error_string) = "INTERNAL error: Cannot impersonate principal with just a keyblock.  A password must be specified in the credentials";
 364                         return EINVAL;
 365                 } else {
 366                         /* No password available, try to use a keyblock instead */
 367
 368                         krb5_keyblock keyblock;
 369                         const struct samr_Password *mach_pwd;
 370                         mach_pwd = cli_credentials_get_nt_hash(credentials, mem_ctx);
 371                         if (!mach_pwd) {
 372                                 talloc_free(mem_ctx);
 373                                 (*error_string) = "kinit_to_ccache: No password available for kinit\n";
 374                                 krb5_get_init_creds_opt_free(smb_krb5_context->krb5_context, krb_options);
 375 #ifdef SAMBA4_USES_HEIMDAL
 376                                 smb_krb5_context_remove_event_ctx(smb_krb5_context, previous_ev, event_ctx);
 377 #endif
 378                                 return EINVAL;
 379                         }
 380                         ret = smb_krb5_keyblock_init_contents(smb_krb5_context->krb5_context,
 381                                                  ENCTYPE_ARCFOUR_HMAC,
 382                                                  mach_pwd->hash, sizeof(mach_pwd->hash),
 383                                                  &keyblock);
 384
 385                         if (ret == 0) {
 386                                 ret = smb_krb5_kinit_keyblock_ccache(smb_krb5_context->krb5_context,
 387                                                                      ccache,
 388                                                                      princ,
 389                                                                      &keyblock,
 390                                                                      target_service,
 391                                                                      krb_options,
 392                                                                      NULL,
 393                                                                      &kdc_time);
 394                                 krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &keyblock);
 395                         }
 396                 }
 397
 398 #ifdef SAMBA4_USES_HEIMDAL
 399                 smb_krb5_context_remove_event_ctx(smb_krb5_context, previous_ev, event_ctx);
 400 #endif
 401
 402                 if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
 403                         /* Perhaps we have been given an invalid skew, so try again without it */
 404                         time_t t = time(NULL);
 405                         krb5_set_real_time(smb_krb5_context->krb5_context, t, 0);
 406                 } else {
 407                         /* not a skew problem */
 408                         break;
 409                 }
 410         }
 411
 412         krb5_get_init_creds_opt_free(smb_krb5_context->krb5_context, krb_options);
 413
 414         if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
 415                 (*error_string) = talloc_asprintf(credentials, "kinit for %s failed (%s)\n",
 416                                                   cli_credentials_get_principal(credentials, mem_ctx),
 417                                                   smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 418                                                                              ret, mem_ctx));
 419                 talloc_free(mem_ctx);
 420                 return ret;
 421         }
 422
 423         /* cope with ticket being in the future due to clock skew */
 424         if ((unsigned)kdc_time > time(NULL)) {
 425                 time_t t = time(NULL);
 426                 int time_offset =(unsigned)kdc_time-t;
 427                 DEBUG(4,("Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 428                 krb5_set_real_time(smb_krb5_context->krb5_context, t + time_offset + 1, 0);
 429         }
 430
 431         if (ret == KRB5KDC_ERR_PREAUTH_FAILED && cli_credentials_wrong_password(credentials)) {
 432                 ret = kinit_to_ccache(parent_ctx,
 433                                       credentials,
 434                                       smb_krb5_context,
 435                                       event_ctx,
 436                                       ccache, obtained,
 437                                       error_string);
 438         }
 439
 440         if (ret) {
 441                 (*error_string) = talloc_asprintf(credentials, "kinit for %s failed (%s)\n",
 442                                                   cli_credentials_get_principal(credentials, mem_ctx),
 443                                                   smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 444                                                                              ret, mem_ctx));
 445                 talloc_free(mem_ctx);
 446                 return ret;
 447         }
 448
 449         DEBUG(10,("kinit for %s succeeded\n",
 450                 cli_credentials_get_principal(credentials, mem_ctx)));
 451
 452
 453         talloc_free(mem_ctx);
 454         return 0;
 455 }
 456
 457 static krb5_error_code free_keytab_container(struct keytab_container *ktc)
 458 {
 459         return krb5_kt_close(ktc->smb_krb5_context->krb5_context, ktc->keytab);
 460 }
 461
 462 krb5_error_code smb_krb5_get_keytab_container(TALLOC_CTX *mem_ctx,
 463                                 struct smb_krb5_context *smb_krb5_context,
 464                                 krb5_keytab opt_keytab,
 465                                 const char *keytab_name,
 466                                 struct keytab_container **ktc)
 467 {
 468         krb5_keytab keytab;
 469         krb5_error_code ret;
 470
 471         if (opt_keytab) {
 472                 keytab = opt_keytab;
 473         } else {
 474                 ret = krb5_kt_resolve(smb_krb5_context->krb5_context,
 475                                                 keytab_name, &keytab);
 476                 if (ret) {
 477                         DEBUG(1,("failed to open krb5 keytab: %s\n",
 478                                  smb_get_krb5_error_message(
 479                                         smb_krb5_context->krb5_context,
 480                                         ret, mem_ctx)));
 481                         return ret;
 482                 }
 483         }
 484
 485         *ktc = talloc(mem_ctx, struct keytab_container);
 486         if (!*ktc) {
 487                 return ENOMEM;
 488         }
 489
 490         (*ktc)->smb_krb5_context = talloc_reference(*ktc, smb_krb5_context);
 491         (*ktc)->keytab = keytab;
 492         (*ktc)->password_based = false;
 493         talloc_set_destructor(*ktc, free_keytab_container);
 494
 495         return 0;
 496 }
 497
 498 /*
 499  * Walk the keytab, looking for entries of this principal name,
 500  * with KVNO other than current kvno -1.
 501  *
 502  * These entries are now stale,
 503  * we only keep the current and previous entries around.
 504  *
 505  * Inspired by the code in Samba3 for 'use kerberos keytab'.
 506  */
 507 krb5_error_code smb_krb5_remove_obsolete_keytab_entries(TALLOC_CTX *mem_ctx,
 508                                                         krb5_context context,
 509                                                         krb5_keytab keytab,
 510                                                         uint32_t num_principals,
 511                                                         krb5_principal *principals,
 512                                                         krb5_kvno kvno,
 513                                                         bool *found_previous,
 514                                                         const char **error_string)
 515 {
 516         TALLOC_CTX *tmp_ctx;
 517         krb5_error_code code;
 518         krb5_kt_cursor cursor;
 519
 520         tmp_ctx = talloc_new(mem_ctx);
 521         if (tmp_ctx == NULL) {
 522                 *error_string = "Cannot allocate tmp_ctx";
 523                 return ENOMEM;
 524         }
 525
 526         *found_previous = true;
 527
 528         code = krb5_kt_start_seq_get(context, keytab, &cursor);
 529         switch (code) {
 530         case 0:
 531                 break;
 532 #ifdef HEIM_ERR_OPNOTSUPP
 533         case HEIM_ERR_OPNOTSUPP:
 534 #endif
 535         case ENOENT:
 536         case KRB5_KT_END:
 537                 /* no point enumerating if there isn't anything here */
 538                 code = 0;
 539                 goto done;
 540         default:
 541                 *error_string = talloc_asprintf(mem_ctx,
 542                                                 "failed to open keytab for read of old entries: %s\n",
 543                                                 smb_get_krb5_error_message(context, code, mem_ctx));
 544                 goto done;
 545         }
 546
 547         do {
 548                 krb5_kvno old_kvno = kvno - 1;
 549                 krb5_keytab_entry entry;
 550                 bool matched = false;
 551                 uint32_t i;
 552
 553                 code = krb5_kt_next_entry(context, keytab, &entry, &cursor);
 554                 if (code) {
 555                         break;
 556                 }
 557
 558                 for (i = 0; i < num_principals; i++) {
 559                         krb5_boolean ok;
 560
 561                         ok = smb_krb5_kt_compare(context,
 562                                                 &entry,
 563                                                 principals[i],
 564                                                 0,
 565                                                 0);
 566                         if (ok) {
 567                                 matched = true;
 568                                 break;
 569                         }
 570                 }
 571
 572                 if (!matched) {
 573                         /*
 574                          * Free the entry, it wasn't the one we were looking
 575                          * for anyway
 576                          */
 577                         krb5_kt_free_entry(context, &entry);
 578                         /* Make sure we do not double free */
 579                         ZERO_STRUCT(entry);
 580                         continue;
 581                 }
 582
 583                 /*
 584                  * Delete it, if it is not kvno - 1.
 585                  *
 586                  * Some keytab files store the kvno only in 8bits. Limit the
 587                  * compare to 8bits, so that we don't miss old keys and delete
 588                  * them.
 589                  */
 590                 if ((entry.vno & 0xff) != (old_kvno & 0xff)) {
 591                         krb5_error_code rc;
 592
 593                         /* Release the enumeration.  We are going to
 594                          * have to start this from the top again,
 595                          * because deletes during enumeration may not
 596                          * always be consistent.
 597                          *
 598                          * Also, the enumeration locks a FILE: keytab
 599                          */
 600                         krb5_kt_end_seq_get(context, keytab, &cursor);
 601
 602                         code = krb5_kt_remove_entry(context, keytab, &entry);
 603                         krb5_kt_free_entry(context, &entry);
 604
 605                         /* Make sure we do not double free */
 606                         ZERO_STRUCT(entry);
 607
 608                         /* Deleted: Restart from the top */
 609                         rc = krb5_kt_start_seq_get(context, keytab, &cursor);
 610                         if (rc != 0) {
 611                                 krb5_kt_free_entry(context, &entry);
 612
 613                                 /* Make sure we do not double free */
 614                                 ZERO_STRUCT(entry);
 615
 616                                 DEBUG(1, ("failed to restart enumeration of keytab: %s\n",
 617                                           smb_get_krb5_error_message(context,
 618                                                                      code,
 619                                                                      tmp_ctx)));
 620
 621                                 talloc_free(tmp_ctx);
 622                                 return rc;
 623                         }
 624
 625                         if (code != 0) {
 626                                 break;
 627                         }
 628
 629                 } else {
 630                         *found_previous = true;
 631                 }
 632
 633                 /* Free the entry, we don't need it any more */
 634                 krb5_kt_free_entry(context, &entry);
 635                 /* Make sure we do not double free */
 636                 ZERO_STRUCT(entry);
 637         } while (code == 0);
 638
 639         krb5_kt_end_seq_get(context, keytab, &cursor);
 640
 641         switch (code) {
 642         case 0:
 643                 break;
 644         case ENOENT:
 645         case KRB5_KT_END:
 646                 break;
 647         default:
 648                 *error_string = talloc_asprintf(mem_ctx,
 649                                                 "failed in deleting old entries for principal: %s\n",
 650                                                 smb_get_krb5_error_message(context,
 651                                                                            code,
 652                                                                            mem_ctx));
 653         }
 654
 655         code = 0;
 656 done:
 657         talloc_free(tmp_ctx);
 658         return code;
 659 }