admin.h revision 72445 
1/*
2 * Copyright (c) 1997-2000 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33/* $Id: admin.h,v 1.18 2000/08/04 11:26:21 joda Exp $ */
34
35#ifndef __KADM5_ADMIN_H__
36#define __KADM5_ADMIN_H__
37
38#define KADM5_API_VERSION_1 1
39#define KADM5_API_VERSION_2 2
40
41#ifndef USE_KADM5_API_VERSION
42#define USE_KADM5_API_VERSION KADM5_API_VERSION_2
43#endif
44
45#if USE_KADM5_API_VERSION != KADM5_API_VERSION_2
46#error No support for API versions other than 2
47#endif
48
49#define KADM5_STRUCT_VERSION 0
50
51#include <krb5.h>
52
53#define KRB5_KDB_DISALLOW_POSTDATED	0x00000001
54#define KRB5_KDB_DISALLOW_FORWARDABLE	0x00000002
55#define KRB5_KDB_DISALLOW_TGT_BASED	0x00000004
56#define KRB5_KDB_DISALLOW_RENEWABLE	0x00000008
57#define KRB5_KDB_DISALLOW_PROXIABLE	0x00000010
58#define KRB5_KDB_DISALLOW_DUP_SKEY	0x00000020
59#define KRB5_KDB_DISALLOW_ALL_TIX	0x00000040
60#define KRB5_KDB_REQUIRES_PRE_AUTH	0x00000080
61#define KRB5_KDB_REQUIRES_HW_AUTH	0x00000100
62#define KRB5_KDB_REQUIRES_PWCHANGE	0x00000200
63#define KRB5_KDB_DISALLOW_SVR		0x00001000
64#define KRB5_KDB_PWCHANGE_SERVICE	0x00002000
65#define KRB5_KDB_SUPPORT_DESMD5		0x00004000
66#define KRB5_KDB_NEW_PRINC		0x00008000
67
68#define KADM5_PRINCIPAL		0x000001
69#define KADM5_PRINC_EXPIRE_TIME	0x000002
70#define KADM5_PW_EXPIRATION	0x000004
71#define KADM5_LAST_PWD_CHANGE	0x000008
72#define KADM5_ATTRIBUTES	0x000010
73#define KADM5_MAX_LIFE		0x000020
74#define KADM5_MOD_TIME		0x000040
75#define KADM5_MOD_NAME		0x000080
76#define KADM5_KVNO		0x000100
77#define KADM5_MKVNO		0x000200
78#define KADM5_AUX_ATTRIBUTES	0x000400
79#define KADM5_POLICY		0x000800
80#define KADM5_POLICY_CLR	0x001000
81#define KADM5_MAX_RLIFE		0x002000
82#define KADM5_LAST_SUCCESS	0x004000
83#define KADM5_LAST_FAILED	0x008000
84#define KADM5_FAIL_AUTH_COUNT	0x010000
85#define KADM5_KEY_DATA		0x020000
86#define KADM5_TL_DATA		0x040000
87
88#define KADM5_PRINCIPAL_NORMAL_MASK (~(KADM5_KEY_DATA | KADM5_TL_DATA))
89
90#define KADM5_PW_MAX_LIFE 	0x004000
91#define KADM5_PW_MIN_LIFE	0x008000
92#define KADM5_PW_MIN_LENGTH 	0x010000
93#define KADM5_PW_MIN_CLASSES	0x020000
94#define KADM5_PW_HISTORY_NUM	0x040000
95#define KADM5_REF_COUNT		0x080000
96
97#define KADM5_POLICY_NORMAL_MASK (~0)
98
99#define KADM5_ADMIN_SERVICE	"kadmin/admin"
100#define KADM5_HIST_PRINCIPAL	"kadmin/history"
101#define KADM5_CHANGEPW_SERVICE	"kadmin/changepw"
102
103typedef struct _krb5_key_data {
104    int16_t key_data_ver;	/* Version */
105    int16_t key_data_kvno;	/* Key Version */
106    int16_t key_data_type[2];	/* Array of types */
107    int16_t key_data_length[2];	/* Array of lengths */
108    void*   key_data_contents[2];/* Array of pointers */
109} krb5_key_data;
110
111typedef struct _krb5_tl_data {
112    struct _krb5_tl_data* tl_data_next;
113    int16_t tl_data_type;
114    int16_t tl_data_length;
115    void*   tl_data_contents;
116} krb5_tl_data;
117
118typedef struct _kadm5_principal_ent_t {
119    krb5_principal principal;
120
121    krb5_timestamp princ_expire_time;
122    krb5_timestamp last_pwd_change;
123    krb5_timestamp pw_expiration;
124    krb5_deltat max_life;
125    krb5_principal mod_name;
126    krb5_timestamp mod_date;
127    krb5_flags attributes;
128    krb5_kvno kvno;
129    krb5_kvno mkvno;
130
131    char * policy;
132    u_int32_t aux_attributes;
133
134    krb5_deltat max_renewable_life;
135    krb5_timestamp last_success;
136    krb5_timestamp last_failed;
137    krb5_kvno fail_auth_count;
138    int16_t n_key_data;
139    int16_t n_tl_data;
140    krb5_tl_data *tl_data;
141    krb5_key_data *key_data;
142} kadm5_principal_ent_rec, *kadm5_principal_ent_t;
143
144typedef struct _kadm5_policy_ent_t {
145    char *policy;
146
147    u_int32_t pw_min_life;
148    u_int32_t pw_max_life;
149    u_int32_t pw_min_length;
150    u_int32_t pw_min_classes;
151    u_int32_t pw_history_num;
152    u_int32_t policy_refcnt;
153} kadm5_policy_ent_rec, *kadm5_policy_ent_t;
154
155#define KADM5_CONFIG_REALM			(1 << 0)
156#define KADM5_CONFIG_PROFILE			(1 << 1)
157#define KADM5_CONFIG_KADMIND_PORT		(1 << 2)
158#define KADM5_CONFIG_ADMIN_SERVER		(1 << 3)
159#define KADM5_CONFIG_DBNAME			(1 << 4)
160#define KADM5_CONFIG_ADBNAME			(1 << 5)
161#define KADM5_CONFIG_ADB_LOCKFILE		(1 << 6)
162#define KADM5_CONFIG_ACL_FILE			(1 << 7)
163#define KADM5_CONFIG_DICT_FILE			(1 << 8)
164#define KADM5_CONFIG_ADMIN_KEYTAB		(1 << 9)
165#define KADM5_CONFIG_MKEY_FROM_KEYBOARD		(1 << 10)
166#define KADM5_CONFIG_STASH_FILE			(1 << 11)
167#define KADM5_CONFIG_MKEY_NAME			(1 << 12)
168#define KADM5_CONFIG_ENCTYPE			(1 << 13)
169#define KADM5_CONFIG_MAX_LIFE			(1 << 14)
170#define KADM5_CONFIG_MAX_RLIFE			(1 << 15)
171#define KADM5_CONFIG_EXPIRATION			(1 << 16)
172#define KADM5_CONFIG_FLAGS			(1 << 17)
173#define KADM5_CONFIG_ENCTYPES			(1 << 18)
174
175#define KADM5_PRIV_GET		(1 << 0)
176#define KADM5_PRIV_ADD 		(1 << 1)
177#define KADM5_PRIV_MODIFY	(1 << 2)
178#define KADM5_PRIV_DELETE	(1 << 3)
179#define KADM5_PRIV_LIST		(1 << 4)
180#define KADM5_PRIV_CPW		(1 << 5)
181#define KADM5_PRIV_ALL		(KADM5_PRIV_GET | KADM5_PRIV_ADD | KADM5_PRIV_MODIFY | KADM5_PRIV_DELETE | KADM5_PRIV_LIST | KADM5_PRIV_CPW)
182
183typedef struct {
184    int XXX;
185}krb5_key_salt_tuple;
186
187typedef struct _kadm5_config_params {
188    u_int32_t mask;
189
190    /* Client and server fields */
191    char *realm;
192    int kadmind_port;
193
194    /* client fields */
195    char *admin_server;
196
197    /* server fields */
198    char *dbname;
199    char *acl_file;
200
201    /* server library (database) fields */
202    char *stash_file;
203} kadm5_config_params;
204
205typedef krb5_error_code kadm5_ret_t;
206
207#include "kadm5-protos.h"
208
209#if 0
210/* unimplemented functions */
211kadm5_ret_t
212kadm5_decrypt_key(void *server_handle,
213		  kadm5_principal_ent_t entry, int32_t
214		  ktype, int32_t stype, int32_t
215		  kvno, krb5_keyblock *keyblock,
216		  krb5_keysalt *keysalt, int *kvnop);
217
218kadm5_ret_t
219kadm5_create_policy(void *server_handle,
220		    kadm5_policy_ent_t policy, u_int32_t mask);
221
222kadm5_ret_t
223kadm5_delete_policy(void *server_handle, char *policy);
224
225
226kadm5_ret_t
227kadm5_modify_policy(void *server_handle,
228		    kadm5_policy_ent_t policy,
229		    u_int32_t mask);
230
231kadm5_ret_t
232kadm5_get_policy(void *server_handle, char *policy, kadm5_policy_ent_t ent);
233
234kadm5_ret_t
235kadm5_get_policies(void *server_handle, char *exp,
236		   char ***pols, int *count);
237
238void
239kadm5_free_policy_ent(kadm5_policy_ent_t policy);
240
241#endif
242
243#endif /* __KADM5_ADMIN_H__ */
244