usr/src/lib/krb5/kadm5/admin.h

   1 /*
   2  * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
   3  */
   4
   5 #ifndef __KADM5_ADMIN_H__
   6 #define __KADM5_ADMIN_H__
   7
   8
   9 #ifdef __cplusplus
  10 extern "C" {
  11 #endif
  12
  13 /*
  14  * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
  15  *
  16  *      Openvision retains the copyright to derivative works of
  17  *      this source code.  Do *NOT* create a derivative of this
  18  *      source code before consulting with your legal department.
  19  *      Do *NOT* integrate *ANY* of this source code into another
  20  *      product before consulting with your legal department.
  21  *
  22  *      For further information, read the top-level Openvision
  23  *      copyright which is contained in the top-level MIT Kerberos
  24  *      copyright.
  25  *
  26  * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
  27  *
  28  */
  29 /*
  30  * lib/kadm5/admin.h
  31  *
  32  * Copyright 2001 by the Massachusetts Institute of Technology.
  33  * All Rights Reserved.
  34  *
  35  * Export of this software from the United States of America may
  36  *   require a specific license from the United States Government.
  37  *   It is the responsibility of any person or organization contemplating
  38  *   export to obtain such a license before exporting.
  39  *
  40  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  41  * distribute this software and its documentation for any purpose and
  42  * without fee is hereby granted, provided that the above copyright
  43  * notice appear in all copies and that both that copyright notice and
  44  * this permission notice appear in supporting documentation, and that
  45  * the name of M.I.T. not be used in advertising or publicity pertaining
  46  * to distribution of the software without specific, written prior
  47  * permission.  Furthermore if you modify this software you must label
  48  * your software as modified software and not distribute it in such a
  49  * fashion that it might be confused with the original M.I.T. software.
  50  * M.I.T. makes no representations about the suitability of
  51  * this software for any purpose.  It is provided "as is" without express
  52  * or implied warranty.
  53  *
  54  */
  55 /*
  56  * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved
  57  *
  58  * $Header$
  59  */
  60
  61 #include        <sys/types.h>
  62 #include        <rpc/types.h>
  63 #include        <rpc/rpc.h>
  64 #include        <k5-int.h>
  65 #include        <krb5.h>
  66 #include        <krb5/kdb.h>
  67 #include        <com_err.h>
  68 #include        <kadm5/kadm_err.h>
  69 #include        <kadm5/chpass_util_strings.h>
  70
  71 #define KADM5_ADMIN_SERVICE_P   "kadmin@admin"
  72 /*
  73  * Solaris Kerberos:
  74  * The kadmin/admin principal is unused on Solaris. This principal is used
  75  * in AUTH_GSSAPI but Solaris doesn't support AUTH_GSSAPI. RPCSEC_GSS can only
  76  * be used with host-based principals.
  77  *
  78  */
  79 /* #define KADM5_ADMIN_SERVICE  "kadmin/admin" */
  80 #define KADM5_CHANGEPW_SERVICE_P        "kadmin@changepw"
  81 #define KADM5_CHANGEPW_SERVICE  "kadmin/changepw"
  82 #define KADM5_HIST_PRINCIPAL    "kadmin/history"
  83 #define KADM5_ADMIN_HOST_SERVICE "kadmin"
  84 #define KADM5_CHANGEPW_HOST_SERVICE "changepw"
  85 #define KADM5_KIPROP_HOST_SERVICE "kiprop"
  86
  87 typedef krb5_principal  kadm5_princ_t;
  88 typedef char            *kadm5_policy_t;
  89 typedef long            kadm5_ret_t;
  90 typedef int rpc_int32;
  91 typedef unsigned int rpc_u_int32;
  92
  93 #define KADM5_PW_FIRST_PROMPT \
  94         (error_message(CHPASS_UTIL_NEW_PASSWORD_PROMPT))
  95 #define KADM5_PW_SECOND_PROMPT \
  96         (error_message(CHPASS_UTIL_NEW_PASSWORD_AGAIN_PROMPT))
  97
  98 /*
  99  * Successful return code
 100  */
 101 #define KADM5_OK        0
 102
 103 /*
 104  * Field masks
 105  */
 106
 107 /* kadm5_principal_ent_t */
 108 #define KADM5_PRINCIPAL         0x000001
 109 #define KADM5_PRINC_EXPIRE_TIME 0x000002
 110 #define KADM5_PW_EXPIRATION     0x000004
 111 #define KADM5_LAST_PWD_CHANGE   0x000008
 112 #define KADM5_ATTRIBUTES        0x000010
 113 #define KADM5_MAX_LIFE          0x000020
 114 #define KADM5_MOD_TIME          0x000040
 115 #define KADM5_MOD_NAME          0x000080
 116 #define KADM5_KVNO              0x000100
 117 #define KADM5_MKVNO             0x000200
 118 #define KADM5_AUX_ATTRIBUTES    0x000400
 119 #define KADM5_POLICY            0x000800
 120 #define KADM5_POLICY_CLR        0x001000
 121 /* version 2 masks */
 122 #define KADM5_MAX_RLIFE         0x002000
 123 #define KADM5_LAST_SUCCESS      0x004000
 124 #define KADM5_LAST_FAILED       0x008000
 125 #define KADM5_FAIL_AUTH_COUNT   0x010000
 126 #define KADM5_KEY_DATA          0x020000
 127 #define KADM5_TL_DATA           0x040000
 128 #ifdef notyet /* Novell */
 129 #define KADM5_CPW_FUNCTION      0x080000
 130 #define KADM5_RANDKEY_USED      0x100000
 131 #endif
 132 #define KADM5_LOAD              0x200000
 133 /* Solaris Kerberos: adding support for key history in LDAP KDB */
 134 #define KADM5_KEY_HIST          0x400000
 135
 136 /* all but KEY_DATA and TL_DATA */
 137 #define KADM5_PRINCIPAL_NORMAL_MASK 0x01ffff
 138
 139
 140 /* kadm5_policy_ent_t */
 141 #define KADM5_PW_MAX_LIFE       0x004000
 142 #define KADM5_PW_MIN_LIFE       0x008000
 143 #define KADM5_PW_MIN_LENGTH     0x010000
 144 #define KADM5_PW_MIN_CLASSES    0x020000
 145 #define KADM5_PW_HISTORY_NUM    0x040000
 146 #define KADM5_REF_COUNT         0x080000
 147
 148 /* kadm5_config_params */
 149 #define KADM5_CONFIG_REALM              0x0000001
 150 #define KADM5_CONFIG_DBNAME             0x0000002
 151 #define KADM5_CONFIG_MKEY_NAME          0x0000004
 152 #define KADM5_CONFIG_MAX_LIFE           0x0000008
 153 #define KADM5_CONFIG_MAX_RLIFE          0x0000010
 154 #define KADM5_CONFIG_EXPIRATION         0x0000020
 155 #define KADM5_CONFIG_FLAGS              0x0000040
 156 #define KADM5_CONFIG_ADMIN_KEYTAB       0x0000080
 157 #define KADM5_CONFIG_STASH_FILE         0x0000100
 158 #define KADM5_CONFIG_ENCTYPE            0x0000200
 159 #define KADM5_CONFIG_ADBNAME            0x0000400
 160 #define KADM5_CONFIG_ADB_LOCKFILE       0x0000800
 161 #define KADM5_CONFIG_PROFILE            0x0001000
 162 #define KADM5_CONFIG_ACL_FILE           0x0002000
 163 #define KADM5_CONFIG_KADMIND_PORT       0x0004000
 164 #define KADM5_CONFIG_ENCTYPES           0x0008000
 165 #define KADM5_CONFIG_ADMIN_SERVER       0x0010000
 166 #define KADM5_CONFIG_DICT_FILE          0x0020000
 167 #define KADM5_CONFIG_MKEY_FROM_KBD      0x0040000
 168 #define KADM5_CONFIG_KPASSWD_PORT       0x0080000
 169 #define KADM5_CONFIG_KPASSWD_SERVER     0x0100000
 170 #define KADM5_CONFIG_KPASSWD_PROTOCOL   0x0200000
 171 #define KADM5_CONFIG_IPROP_ENABLED      0x0400000
 172 #define KADM5_CONFIG_ULOG_SIZE          0x0800000
 173 #define KADM5_CONFIG_POLL_TIME          0x1000000
 174
 175 /* password change constants */
 176 #define KRB5_KPASSWD_SUCCESS            0
 177 #define KRB5_KPASSWD_MALFORMED          1
 178 #define KRB5_KPASSWD_HARDERROR          2
 179 #define KRB5_KPASSWD_AUTHERROR          3
 180 #define KRB5_KPASSWD_SOFTERROR          4
 181 #define KRB5_KPASSWD_ACCESSDENIED       5
 182 #define KRB5_KPASSWD_BAD_VERSION        6
 183 #define KRB5_KPASSWD_INITIAL_FLAG_NEEDED        7
 184 #define KRB5_KPASSWD_POLICY_REJECT      8
 185 #define KRB5_KPASSWD_BAD_PRINCIPAL      9
 186 #define KRB5_KPASSWD_ETYPE_NOSUPP       10
 187
 188 /*
 189  * permission bits
 190  */
 191 #define KADM5_PRIV_GET          0x01
 192 #define KADM5_PRIV_ADD          0x02
 193 #define KADM5_PRIV_MODIFY       0x04
 194 #define KADM5_PRIV_DELETE       0x08
 195
 196 /*
 197  * API versioning constants
 198  */
 199 #define KADM5_MASK_BITS         0xffffff00
 200
 201 #define KADM5_STRUCT_VERSION_MASK       0x12345600
 202 #define KADM5_STRUCT_VERSION_1  (KADM5_STRUCT_VERSION_MASK|0x01)
 203 #define KADM5_STRUCT_VERSION    KADM5_STRUCT_VERSION_1
 204
 205 #define KADM5_API_VERSION_MASK  0x12345700
 206 #define KADM5_API_VERSION_1     (KADM5_API_VERSION_MASK|0x01)
 207 #define KADM5_API_VERSION_2     (KADM5_API_VERSION_MASK|0x02)
 208
 209 #ifdef KRB5_DNS_LOOKUP
 210 /*
 211  * Name length constants for DNS lookups
 212  */
 213 #define MAX_HOST_NAMELEN 256
 214 #define MAX_DNS_NAMELEN (15*(MAX_HOST_NAMELEN + 1)+1)
 215 #endif /* KRB5_DNS_LOOKUP */
 216
 217 typedef struct _kadm5_principal_ent_t_v2 {
 218         krb5_principal  principal;
 219         krb5_timestamp  princ_expire_time;
 220         krb5_timestamp  last_pwd_change;
 221         krb5_timestamp  pw_expiration;
 222         krb5_deltat     max_life;
 223         krb5_principal  mod_name;
 224         krb5_timestamp  mod_date;
 225         krb5_flags      attributes;
 226         krb5_kvno       kvno;
 227         krb5_kvno       mkvno;
 228         char            *policy;
 229         long            aux_attributes;
 230
 231         /* version 2 fields */
 232         krb5_deltat max_renewable_life;
 233         krb5_timestamp last_success;
 234         krb5_timestamp last_failed;
 235         krb5_kvno fail_auth_count;
 236         krb5_int16 n_key_data;
 237         krb5_int16 n_tl_data;
 238         krb5_tl_data *tl_data;
 239         krb5_key_data *key_data;
 240 } kadm5_principal_ent_rec_v2, *kadm5_principal_ent_t_v2;
 241
 242 typedef struct _kadm5_principal_ent_t_v1 {
 243         krb5_principal  principal;
 244         krb5_timestamp  princ_expire_time;
 245         krb5_timestamp  last_pwd_change;
 246         krb5_timestamp  pw_expiration;
 247         krb5_deltat     max_life;
 248         krb5_principal  mod_name;
 249         krb5_timestamp  mod_date;
 250         krb5_flags      attributes;
 251         krb5_kvno       kvno;
 252         krb5_kvno       mkvno;
 253         char            *policy;
 254         long            aux_attributes;
 255 } kadm5_principal_ent_rec_v1, *kadm5_principal_ent_t_v1;
 256
 257 #if USE_KADM5_API_VERSION == 1
 258 typedef struct _kadm5_principal_ent_t_v1
 259      kadm5_principal_ent_rec, *kadm5_principal_ent_t;
 260 #else
 261 typedef struct _kadm5_principal_ent_t_v2
 262      kadm5_principal_ent_rec, *kadm5_principal_ent_t;
 263 #endif
 264
 265 typedef struct _kadm5_policy_ent_t {
 266         char            *policy;
 267         long            pw_min_life;
 268         long            pw_max_life;
 269         long            pw_min_length;
 270         long            pw_min_classes;
 271         long            pw_history_num;
 272         long            policy_refcnt;
 273 } kadm5_policy_ent_rec, *kadm5_policy_ent_t;
 274
 275 /*
 276  * New types to indicate which protocol to use when sending
 277  * password change requests
 278  */
 279 typedef enum {
 280         KRB5_CHGPWD_RPCSEC,
 281         KRB5_CHGPWD_CHANGEPW_V2
 282 } krb5_chgpwd_prot;
 283
 284 /*
 285  * Data structure returned by kadm5_get_config_params()
 286  */
 287 typedef struct _kadm5_config_params {
 288      long               mask;
 289      char *             realm;
 290      int                kadmind_port;
 291      int                kpasswd_port;
 292
 293      char *             admin_server;
 294 #ifdef notyet /* Novell */ /* ABI change? */
 295      char *             kpasswd_server;
 296 #endif
 297
 298      char *             dbname;
 299      char *             admin_dbname;
 300      char *             admin_lockfile;
 301      char *             admin_keytab;
 302      char *             acl_file;
 303      char *             dict_file;
 304
 305      int                mkey_from_kbd;
 306      char *             stash_file;
 307      char *             mkey_name;
 308      krb5_enctype       enctype;
 309      krb5_deltat        max_life;
 310      krb5_deltat        max_rlife;
 311      krb5_timestamp     expiration;
 312      krb5_flags         flags;
 313      krb5_key_salt_tuple *keysalts;
 314      krb5_int32         num_keysalts;
 315      char                       *kpasswd_server;
 316
 317      krb5_chgpwd_prot   kpasswd_protocol;
 318      bool_t                     iprop_enabled;
 319      int                        iprop_ulogsize;
 320      char                       *iprop_polltime;
 321 } kadm5_config_params;
 322
 323 /***********************************************************************
 324  * This is the old krb5_realm_read_params, which I mutated into
 325  * kadm5_get_config_params but which old code (kdb5_* and krb5kdc)
 326  * still uses.
 327  ***********************************************************************/
 328
 329 /*
 330  * Data structure returned by krb5_read_realm_params()
 331  */
 332 typedef struct __krb5_realm_params {
 333     char *              realm_profile;
 334     char *              realm_dbname;
 335     char *              realm_mkey_name;
 336     char *              realm_stash_file;
 337     char *              realm_kdc_ports;
 338     char *              realm_kdc_tcp_ports;
 339     char *              realm_acl_file;
 340     krb5_int32          realm_kadmind_port;
 341     krb5_enctype        realm_enctype;
 342     krb5_deltat         realm_max_life;
 343     krb5_deltat         realm_max_rlife;
 344     krb5_timestamp      realm_expiration;
 345     krb5_flags          realm_flags;
 346     krb5_key_salt_tuple *realm_keysalts;
 347     unsigned int        realm_reject_bad_transit:1;
 348     unsigned int        realm_kadmind_port_valid:1;
 349     unsigned int        realm_enctype_valid:1;
 350     unsigned int        realm_max_life_valid:1;
 351     unsigned int        realm_max_rlife_valid:1;
 352     unsigned int        realm_expiration_valid:1;
 353     unsigned int        realm_flags_valid:1;
 354     unsigned int        realm_reject_bad_transit_valid:1;
 355     krb5_int32          realm_num_keysalts;
 356 } krb5_realm_params;
 357
 358 /*
 359  * functions
 360  */
 361
 362 kadm5_ret_t
 363 kadm5_get_adm_host_srv_name(krb5_context context,
 364                            const char *realm, char **host_service_name);
 365
 366 kadm5_ret_t
 367 kadm5_get_cpw_host_srv_name(krb5_context context,
 368                            const char *realm, char **host_service_name);
 369
 370 #if USE_KADM5_API_VERSION > 1
 371 krb5_error_code kadm5_get_config_params(krb5_context context,
 372                                         int use_kdc_config,
 373                                         kadm5_config_params *params_in,
 374                                         kadm5_config_params *params_out);
 375
 376 krb5_error_code kadm5_free_config_params(krb5_context context,
 377                                          kadm5_config_params *params);
 378
 379 krb5_error_code kadm5_free_realm_params(krb5_context kcontext,
 380                                         kadm5_config_params *params);
 381
 382 krb5_error_code kadm5_get_admin_service_name(krb5_context, char *,
 383                                              char *, size_t);
 384 #endif
 385
 386 kadm5_ret_t    kadm5_init(char *client_name, char *pass,
 387                           char *service_name,
 388 #if USE_KADM5_API_VERSION == 1
 389                           char *realm,
 390 #else
 391                           kadm5_config_params *params,
 392 #endif
 393                           krb5_ui_4 struct_version,
 394                           krb5_ui_4 api_version,
 395                           char **db_args,
 396                           void **server_handle);
 397 kadm5_ret_t    kadm5_init_with_password(char *client_name,
 398                                         char *pass,
 399                                         char *service_name,
 400 #if USE_KADM5_API_VERSION == 1
 401                                         char *realm,
 402 #else
 403                                         kadm5_config_params *params,
 404 #endif
 405                                         krb5_ui_4 struct_version,
 406                                         krb5_ui_4 api_version,
 407                                         char **db_args,
 408                                         void **server_handle);
 409 kadm5_ret_t    kadm5_init_with_skey(char *client_name,
 410                                     char *keytab,
 411                                     char *service_name,
 412 #if USE_KADM5_API_VERSION == 1
 413                                     char *realm,
 414 #else
 415                                     kadm5_config_params *params,
 416 #endif
 417                                     krb5_ui_4 struct_version,
 418                                     krb5_ui_4 api_version,
 419                                     char **db_args,
 420                                     void **server_handle);
 421 #if USE_KADM5_API_VERSION > 1
 422 kadm5_ret_t    kadm5_init_with_creds(char *client_name,
 423                                      krb5_ccache cc,
 424                                      char *service_name,
 425                                      kadm5_config_params *params,
 426                                      krb5_ui_4 struct_version,
 427                                      krb5_ui_4 api_version,
 428                                      char **db_args,
 429                                      void **server_handle);
 430 #endif
 431 kadm5_ret_t    kadm5_lock(void *server_handle);
 432 kadm5_ret_t    kadm5_unlock(void *server_handle);
 433 kadm5_ret_t    kadm5_flush(void *server_handle);
 434 kadm5_ret_t    kadm5_destroy(void *server_handle);
 435 kadm5_ret_t    kadm5_check_min_life(void *server_handle,        /* Solaris Kerberos */
 436                               krb5_principal principal,
 437                               char *msg_ret,
 438                               unsigned int msg_len);
 439 kadm5_ret_t    kadm5_create_principal(void *server_handle,
 440                                       kadm5_principal_ent_t ent,
 441                                       long mask, char *pass);
 442 kadm5_ret_t    kadm5_create_principal_3(void *server_handle,
 443                                         kadm5_principal_ent_t ent,
 444                                         long mask,
 445                                         int n_ks_tuple,
 446                                         krb5_key_salt_tuple *ks_tuple,
 447                                         char *pass);
 448 kadm5_ret_t    kadm5_delete_principal(void *server_handle,
 449                                       krb5_principal principal);
 450 kadm5_ret_t    kadm5_modify_principal(void *server_handle,
 451                                       kadm5_principal_ent_t ent,
 452                                       long mask);
 453 kadm5_ret_t    kadm5_rename_principal(void *server_handle,
 454                                       krb5_principal,krb5_principal);
 455 #if USE_KADM5_API_VERSION == 1
 456 kadm5_ret_t    kadm5_get_principal(void *server_handle,
 457                                    krb5_principal principal,
 458                                    kadm5_principal_ent_t *ent);
 459 #else
 460 kadm5_ret_t    kadm5_get_principal(void *server_handle,
 461                                    krb5_principal principal,
 462                                    kadm5_principal_ent_t ent,
 463                                    long mask);
 464 #endif
 465 kadm5_ret_t    kadm5_chpass_principal(void *server_handle,
 466                                       krb5_principal principal,
 467                                       char *pass);
 468 kadm5_ret_t    kadm5_chpass_principal_3(void *server_handle,
 469                                         krb5_principal principal,
 470                                         krb5_boolean keepold,
 471                                         int n_ks_tuple,
 472                                         krb5_key_salt_tuple *ks_tuple,
 473                                         char *pass);
 474 #if USE_KADM5_API_VERSION == 1
 475 kadm5_ret_t    kadm5_randkey_principal(void *server_handle,
 476                                        krb5_principal principal,
 477                                        krb5_keyblock **keyblock);
 478 #else
 479
 480 /*
 481  * Solaris Kerberos:
 482  * this routine is only implemented in the client library.
 483  */
 484 kadm5_ret_t    kadm5_randkey_principal_old(void *server_handle,
 485                                     krb5_principal principal,
 486                                     krb5_keyblock **keyblocks,
 487                                     int *n_keys);
 488
 489 kadm5_ret_t    kadm5_randkey_principal(void *server_handle,
 490                                        krb5_principal principal,
 491                                        krb5_keyblock **keyblocks,
 492                                        int *n_keys);
 493 kadm5_ret_t    kadm5_randkey_principal_3(void *server_handle,
 494                                          krb5_principal principal,
 495                                          krb5_boolean keepold,
 496                                          int n_ks_tuple,
 497                                          krb5_key_salt_tuple *ks_tuple,
 498                                          krb5_keyblock **keyblocks,
 499                                          int *n_keys);
 500 #endif
 501 kadm5_ret_t    kadm5_setv4key_principal(void *server_handle,
 502                                         krb5_principal principal,
 503                                         krb5_keyblock *keyblock);
 504
 505 kadm5_ret_t    kadm5_setkey_principal(void *server_handle,
 506                                       krb5_principal principal,
 507                                       krb5_keyblock *keyblocks,
 508                                       int n_keys);
 509
 510 kadm5_ret_t    kadm5_setkey_principal_3(void *server_handle,
 511                                         krb5_principal principal,
 512                                         krb5_boolean keepold,
 513                                         int n_ks_tuple,
 514                                         krb5_key_salt_tuple *ks_tuple,
 515                                         krb5_keyblock *keyblocks,
 516                                         int n_keys);
 517
 518 kadm5_ret_t    kadm5_decrypt_key(void *server_handle,
 519                                  kadm5_principal_ent_t entry, krb5_int32
 520                                  ktype, krb5_int32 stype, krb5_int32
 521                                  kvno, krb5_keyblock *keyblock,
 522                                  krb5_keysalt *keysalt, int *kvnop);
 523
 524 kadm5_ret_t    kadm5_create_policy(void *server_handle,
 525                                    kadm5_policy_ent_t ent,
 526                                    long mask);
 527 /*
 528  * kadm5_create_policy_internal is not part of the supported,
 529  * exposed API.  It is available only in the server library, and you
 530  * shouldn't use it unless you know why it's there and how it's
 531  * different from kadm5_create_policy.
 532  */
 533 kadm5_ret_t    kadm5_create_policy_internal(void *server_handle,
 534                                             kadm5_policy_ent_t
 535                                             entry, long mask);
 536 kadm5_ret_t    kadm5_delete_policy(void *server_handle,
 537                                    kadm5_policy_t policy);
 538 kadm5_ret_t    kadm5_modify_policy(void *server_handle,
 539                                    kadm5_policy_ent_t ent,
 540                                    long mask);
 541 /*
 542  * kadm5_modify_policy_internal is not part of the supported,
 543  * exposed API.  It is available only in the server library, and you
 544  * shouldn't use it unless you know why it's there and how it's
 545  * different from kadm5_modify_policy.
 546  */
 547 kadm5_ret_t    kadm5_modify_policy_internal(void *server_handle,
 548                                             kadm5_policy_ent_t
 549                                             entry, long mask);
 550 #if USE_KADM5_API_VERSION == 1
 551 kadm5_ret_t    kadm5_get_policy(void *server_handle,
 552                                 kadm5_policy_t policy,
 553                                 kadm5_policy_ent_t *ent);
 554 #else
 555 kadm5_ret_t    kadm5_get_policy(void *server_handle,
 556                                 kadm5_policy_t policy,
 557                                 kadm5_policy_ent_t ent);
 558 #endif
 559 kadm5_ret_t    kadm5_get_privs(void *server_handle,
 560                                long *privs);
 561
 562 kadm5_ret_t    kadm5_chpass_principal_util(void *server_handle,
 563                                            krb5_principal princ,
 564                                            char *new_pw,
 565                                            char **ret_pw,
 566                                            char *msg_ret,
 567                                            unsigned int msg_len);
 568
 569 kadm5_ret_t    kadm5_free_principal_ent(void *server_handle,
 570                                         kadm5_principal_ent_t
 571                                         ent);
 572 kadm5_ret_t    kadm5_free_policy_ent(void *server_handle,
 573                                      kadm5_policy_ent_t ent);
 574
 575 kadm5_ret_t    kadm5_get_principals(void *server_handle,
 576                                     char *exp, char ***princs,
 577                                     int *count);
 578
 579 kadm5_ret_t    kadm5_get_policies(void *server_handle,
 580                                   char *exp, char ***pols,
 581                                   int *count);
 582
 583 #if USE_KADM5_API_VERSION > 1
 584 kadm5_ret_t    kadm5_free_key_data(void *server_handle,
 585                                    krb5_int16 *n_key_data,
 586                                    krb5_key_data *key_data);
 587 #endif
 588
 589 kadm5_ret_t    kadm5_free_name_list(void *server_handle, char **names,
 590                                     int count);
 591
 592 krb5_error_code kadm5_init_krb5_context (krb5_context *);
 593
 594 #if USE_KADM5_API_VERSION == 1
 595 /*
 596  * OVSEC_KADM_API_VERSION_1 should be, if possible, compile-time
 597  * compatible with KADM5_API_VERSION_2.  Basically, this means we have
 598  * to continue to provide all the old ovsec_kadm function and symbol
 599  * names.
 600  */
 601
 602 #define OVSEC_KADM_ACLFILE              "/krb5/ovsec_adm.acl"
 603 #define OVSEC_KADM_WORDFILE             "/krb5/ovsec_adm.dict"
 604
 605 #define OVSEC_KADM_ADMIN_SERVICE        "ovsec_adm/admin"
 606 #define OVSEC_KADM_CHANGEPW_SERVICE     "ovsec_adm/changepw"
 607 #define OVSEC_KADM_HIST_PRINCIPAL       "ovsec_adm/history"
 608
 609 typedef krb5_principal  ovsec_kadm_princ_t;
 610 typedef krb5_keyblock   ovsec_kadm_keyblock;
 611 typedef char            *ovsec_kadm_policy_t;
 612 typedef long            ovsec_kadm_ret_t;
 613
 614 enum    ovsec_kadm_salttype { OVSEC_KADM_SALT_V4, OVSEC_KADM_SALT_NORMAL };
 615 enum    ovsec_kadm_saltmod  { OVSEC_KADM_MOD_KEEP, OVSEC_KADM_MOD_V4, OVSEC_KADM_MOD_NORMAL };
 616
 617 #define OVSEC_KADM_PW_FIRST_PROMPT \
 618         ((char *) error_message(CHPASS_UTIL_NEW_PASSWORD_PROMPT))
 619 #define OVSEC_KADM_PW_SECOND_PROMPT \
 620         ((char *) error_message(CHPASS_UTIL_NEW_PASSWORD_AGAIN_PROMPT))
 621
 622 /*
 623  * Successful return code
 624  */
 625 #define OVSEC_KADM_OK   0
 626
 627 /*
 628  * Create/Modify masks
 629  */
 630 /* principal */
 631 #define OVSEC_KADM_PRINCIPAL            0x000001
 632 #define OVSEC_KADM_PRINC_EXPIRE_TIME    0x000002
 633 #define OVSEC_KADM_PW_EXPIRATION        0x000004
 634 #define OVSEC_KADM_LAST_PWD_CHANGE      0x000008
 635 #define OVSEC_KADM_ATTRIBUTES           0x000010
 636 #define OVSEC_KADM_MAX_LIFE             0x000020
 637 #define OVSEC_KADM_MOD_TIME             0x000040
 638 #define OVSEC_KADM_MOD_NAME             0x000080
 639 #define OVSEC_KADM_KVNO                 0x000100
 640 #define OVSEC_KADM_MKVNO                0x000200
 641 #define OVSEC_KADM_AUX_ATTRIBUTES       0x000400
 642 #define OVSEC_KADM_POLICY               0x000800
 643 #define OVSEC_KADM_POLICY_CLR           0x001000
 644 /* policy */
 645 #define OVSEC_KADM_PW_MAX_LIFE          0x004000
 646 #define OVSEC_KADM_PW_MIN_LIFE          0x008000
 647 #define OVSEC_KADM_PW_MIN_LENGTH        0x010000
 648 #define OVSEC_KADM_PW_MIN_CLASSES       0x020000
 649 #define OVSEC_KADM_PW_HISTORY_NUM       0x040000
 650 #define OVSEC_KADM_REF_COUNT            0x080000
 651
 652 /*
 653  * permission bits
 654  */
 655 #define OVSEC_KADM_PRIV_GET     0x01
 656 #define OVSEC_KADM_PRIV_ADD     0x02
 657 #define OVSEC_KADM_PRIV_MODIFY  0x04
 658 #define OVSEC_KADM_PRIV_DELETE  0x08
 659
 660 /*
 661  * API versioning constants
 662  */
 663 #define OVSEC_KADM_MASK_BITS            0xffffff00
 664
 665 #define OVSEC_KADM_STRUCT_VERSION_MASK  0x12345600
 666 #define OVSEC_KADM_STRUCT_VERSION_1     (OVSEC_KADM_STRUCT_VERSION_MASK|0x01)
 667 #define OVSEC_KADM_STRUCT_VERSION       OVSEC_KADM_STRUCT_VERSION_1
 668
 669 #define OVSEC_KADM_API_VERSION_MASK     0x12345700
 670 #define OVSEC_KADM_API_VERSION_1        (OVSEC_KADM_API_VERSION_MASK|0x01)
 671
 672
 673 typedef struct _ovsec_kadm_principal_ent_t {
 674         krb5_principal  principal;
 675         krb5_timestamp  princ_expire_time;
 676         krb5_timestamp  last_pwd_change;
 677         krb5_timestamp  pw_expiration;
 678         krb5_deltat     max_life;
 679         krb5_principal  mod_name;
 680         krb5_timestamp  mod_date;
 681         krb5_flags      attributes;
 682         krb5_kvno       kvno;
 683         krb5_kvno       mkvno;
 684         char            *policy;
 685         long            aux_attributes;
 686 } ovsec_kadm_principal_ent_rec, *ovsec_kadm_principal_ent_t;
 687
 688 typedef struct _ovsec_kadm_policy_ent_t {
 689         char            *policy;
 690         long            pw_min_life;
 691         long            pw_max_life;
 692         long            pw_min_length;
 693         long            pw_min_classes;
 694         long            pw_history_num;
 695         long            policy_refcnt;
 696 } ovsec_kadm_policy_ent_rec, *ovsec_kadm_policy_ent_t;
 697
 698 /*
 699  * functions
 700  */
 701 ovsec_kadm_ret_t    ovsec_kadm_init(char *client_name, char *pass,
 702                                     char *service_name, char *realm,
 703                                     krb5_ui_4 struct_version,
 704                                     krb5_ui_4 api_version,
 705                                     char **db_args,
 706                                     void **server_handle);
 707 ovsec_kadm_ret_t    ovsec_kadm_init_with_password(char *client_name,
 708                                                   char *pass,
 709                                                   char *service_name,
 710                                                   char *realm,
 711                                                   krb5_ui_4 struct_version,
 712                                                   krb5_ui_4 api_version,
 713                                                   char ** db_args,
 714                                                   void **server_handle);
 715 ovsec_kadm_ret_t    ovsec_kadm_init_with_skey(char *client_name,
 716                                               char *keytab,
 717                                               char *service_name,
 718                                               char *realm,
 719                                               krb5_ui_4 struct_version,
 720                                               krb5_ui_4 api_version,
 721                                               char **db_args,
 722                                               void **server_handle);
 723 ovsec_kadm_ret_t    ovsec_kadm_flush(void *server_handle);
 724 ovsec_kadm_ret_t    ovsec_kadm_destroy(void *server_handle);
 725 ovsec_kadm_ret_t    ovsec_kadm_create_principal(void *server_handle,
 726                                                 ovsec_kadm_principal_ent_t ent,
 727                                                 long mask, char *pass);
 728 ovsec_kadm_ret_t    ovsec_kadm_delete_principal(void *server_handle,
 729                                                 krb5_principal principal);
 730 ovsec_kadm_ret_t    ovsec_kadm_modify_principal(void *server_handle,
 731                                                 ovsec_kadm_principal_ent_t ent,
 732                                                 long mask);
 733 ovsec_kadm_ret_t    ovsec_kadm_rename_principal(void *server_handle,
 734                                                 krb5_principal,krb5_principal);
 735 ovsec_kadm_ret_t    ovsec_kadm_get_principal(void *server_handle,
 736                                              krb5_principal principal,
 737                                              ovsec_kadm_principal_ent_t *ent);
 738 ovsec_kadm_ret_t    ovsec_kadm_chpass_principal(void *server_handle,
 739                                                 krb5_principal principal,
 740                                                 char *pass);
 741 ovsec_kadm_ret_t    ovsec_kadm_randkey_principal(void *server_handle,
 742                                                  krb5_principal principal,
 743                                                  krb5_keyblock **keyblock);
 744 ovsec_kadm_ret_t    ovsec_kadm_create_policy(void *server_handle,
 745                                              ovsec_kadm_policy_ent_t ent,
 746                                              long mask);
 747 /*
 748  * ovsec_kadm_create_policy_internal is not part of the supported,
 749  * exposed API.  It is available only in the server library, and you
 750  * shouldn't use it unless you know why it's there and how it's
 751  * different from ovsec_kadm_create_policy.
 752  */
 753 ovsec_kadm_ret_t    ovsec_kadm_create_policy_internal(void *server_handle,
 754                                                       ovsec_kadm_policy_ent_t
 755                                                       entry, long mask);
 756 ovsec_kadm_ret_t    ovsec_kadm_delete_policy(void *server_handle,
 757                                              ovsec_kadm_policy_t policy);
 758 ovsec_kadm_ret_t    ovsec_kadm_modify_policy(void *server_handle,
 759                                              ovsec_kadm_policy_ent_t ent,
 760                                              long mask);
 761 /*
 762  * ovsec_kadm_modify_policy_internal is not part of the supported,
 763  * exposed API.  It is available only in the server library, and you
 764  * shouldn't use it unless you know why it's there and how it's
 765  * different from ovsec_kadm_modify_policy.
 766  */
 767 ovsec_kadm_ret_t    ovsec_kadm_modify_policy_internal(void *server_handle,
 768                                                       ovsec_kadm_policy_ent_t
 769                                                       entry, long mask);
 770 ovsec_kadm_ret_t    ovsec_kadm_get_policy(void *server_handle,
 771                                           ovsec_kadm_policy_t policy,
 772                                           ovsec_kadm_policy_ent_t *ent);
 773 ovsec_kadm_ret_t    ovsec_kadm_get_privs(void *server_handle,
 774                                          long *privs);
 775
 776 ovsec_kadm_ret_t    ovsec_kadm_chpass_principal_util(void *server_handle,
 777                                                      krb5_principal princ,
 778                                                      char *new_pw,
 779                                                      char **ret_pw,
 780                                                      char *msg_ret);
 781
 782 ovsec_kadm_ret_t    ovsec_kadm_free_principal_ent(void *server_handle,
 783                                                   ovsec_kadm_principal_ent_t
 784                                                   ent);
 785 ovsec_kadm_ret_t    ovsec_kadm_free_policy_ent(void *server_handle,
 786                                                ovsec_kadm_policy_ent_t ent);
 787
 788 ovsec_kadm_ret_t ovsec_kadm_free_name_list(void *server_handle,
 789                                            char **names, int count);
 790
 791 ovsec_kadm_ret_t    ovsec_kadm_get_principals(void *server_handle,
 792                                               char *exp, char ***princs,
 793                                               int *count);
 794
 795 ovsec_kadm_ret_t    ovsec_kadm_get_policies(void *server_handle,
 796                                             char *exp, char ***pols,
 797                                             int *count);
 798
 799 #define OVSEC_KADM_FAILURE KADM5_FAILURE
 800 #define OVSEC_KADM_AUTH_GET KADM5_AUTH_GET
 801 #define OVSEC_KADM_AUTH_ADD KADM5_AUTH_ADD
 802 #define OVSEC_KADM_AUTH_MODIFY KADM5_AUTH_MODIFY
 803 #define OVSEC_KADM_AUTH_DELETE KADM5_AUTH_DELETE
 804 #define OVSEC_KADM_AUTH_INSUFFICIENT KADM5_AUTH_INSUFFICIENT
 805 #define OVSEC_KADM_BAD_DB KADM5_BAD_DB
 806 #define OVSEC_KADM_DUP KADM5_DUP
 807 #define OVSEC_KADM_RPC_ERROR KADM5_RPC_ERROR
 808 #define OVSEC_KADM_NO_SRV KADM5_NO_SRV
 809 #define OVSEC_KADM_BAD_HIST_KEY KADM5_BAD_HIST_KEY
 810 #define OVSEC_KADM_NOT_INIT KADM5_NOT_INIT
 811 #define OVSEC_KADM_UNK_PRINC KADM5_UNK_PRINC
 812 #define OVSEC_KADM_UNK_POLICY KADM5_UNK_POLICY
 813 #define OVSEC_KADM_BAD_MASK KADM5_BAD_MASK
 814 #define OVSEC_KADM_BAD_CLASS KADM5_BAD_CLASS
 815 #define OVSEC_KADM_BAD_LENGTH KADM5_BAD_LENGTH
 816 #define OVSEC_KADM_BAD_POLICY KADM5_BAD_POLICY
 817 #define OVSEC_KADM_BAD_PRINCIPAL KADM5_BAD_PRINCIPAL
 818 #define OVSEC_KADM_BAD_AUX_ATTR KADM5_BAD_AUX_ATTR
 819 #define OVSEC_KADM_BAD_HISTORY KADM5_BAD_HISTORY
 820 #define OVSEC_KADM_BAD_MIN_PASS_LIFE KADM5_BAD_MIN_PASS_LIFE
 821 #define OVSEC_KADM_PASS_Q_TOOSHORT KADM5_PASS_Q_TOOSHORT
 822 #define OVSEC_KADM_PASS_Q_CLASS KADM5_PASS_Q_CLASS
 823 #define OVSEC_KADM_PASS_Q_DICT KADM5_PASS_Q_DICT
 824 #define OVSEC_KADM_PASS_REUSE KADM5_PASS_REUSE
 825 #define OVSEC_KADM_PASS_TOOSOON KADM5_PASS_TOOSOON
 826 #define OVSEC_KADM_POLICY_REF KADM5_POLICY_REF
 827 #define OVSEC_KADM_INIT KADM5_INIT
 828 #define OVSEC_KADM_BAD_PASSWORD KADM5_BAD_PASSWORD
 829 #define OVSEC_KADM_PROTECT_PRINCIPAL KADM5_PROTECT_PRINCIPAL
 830 #define OVSEC_KADM_BAD_SERVER_HANDLE KADM5_BAD_SERVER_HANDLE
 831 #define OVSEC_KADM_BAD_STRUCT_VERSION KADM5_BAD_STRUCT_VERSION
 832 #define OVSEC_KADM_OLD_STRUCT_VERSION KADM5_OLD_STRUCT_VERSION
 833 #define OVSEC_KADM_NEW_STRUCT_VERSION KADM5_NEW_STRUCT_VERSION
 834 #define OVSEC_KADM_BAD_API_VERSION KADM5_BAD_API_VERSION
 835 #define OVSEC_KADM_OLD_LIB_API_VERSION KADM5_OLD_LIB_API_VERSION
 836 #define OVSEC_KADM_OLD_SERVER_API_VERSION KADM5_OLD_SERVER_API_VERSION
 837 #define OVSEC_KADM_NEW_LIB_API_VERSION KADM5_NEW_LIB_API_VERSION
 838 #define OVSEC_KADM_NEW_SERVER_API_VERSION KADM5_NEW_SERVER_API_VERSION
 839 #define OVSEC_KADM_SECURE_PRINC_MISSING KADM5_SECURE_PRINC_MISSING
 840 #define OVSEC_KADM_NO_RENAME_SALT KADM5_NO_RENAME_SALT
 841
 842 #endif /* USE_KADM5_API_VERSION == 1 */
 843
 844 #define MAXPRINCLEN 125
 845
 846 void trunc_name(size_t *len, char **dots);
 847
 848 krb5_chgpwd_prot _kadm5_get_kpasswd_protocol(void *server_handle);
 849 kadm5_ret_t     kadm5_chpass_principal_v2(void *server_handle,
 850                                         krb5_principal princ,
 851                                         char *new_password,
 852                                         kadm5_ret_t *srvr_rsp_code,
 853                                         krb5_data *srvr_msg);
 854
 855 void handle_chpw(krb5_context context, int s, void *serverhandle,
 856                         kadm5_config_params *params);
 857
 858 #ifdef __cplusplus
 859 }
 860 #endif
 861
 862 #endif  /* __KADM5_ADMIN_H__ */