1/* 2 * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "kadmin_locl.h" 35#include "kadmin-commands.h" 36 37/* 38 * fetch the default principal corresponding to `princ' 39 */ 40 41static krb5_error_code 42get_default (kadm5_server_context *contextp, 43 krb5_principal princ, 44 kadm5_principal_ent_t default_ent) 45{ 46 krb5_error_code ret; 47 krb5_principal def_principal; 48 krb5_const_realm realm = krb5_principal_get_realm(contextp->context, princ); 49 50 ret = krb5_make_principal (contextp->context, &def_principal, 51 realm, "default", NULL); 52 if (ret) 53 return ret; 54 ret = kadm5_get_principal (contextp, def_principal, default_ent, 55 KADM5_PRINCIPAL_NORMAL_MASK); 56 krb5_free_principal (contextp->context, def_principal); 57 return ret; 58} 59 60/* 61 * Add the principal `name' to the database. 62 * Prompt for all data not given by the input parameters. 63 */ 64 65static krb5_error_code 66add_one_principal (const char *name, 67 int rand_key, 68 int rand_password, 69 int use_defaults, 70 int verbose_flag, 71 char *password, 72 char *policy, 73 krb5_key_data *key_data, 74 const char *max_ticket_life, 75 const char *max_renewable_life, 76 const char *attributes, 77 const char *expiration, 78 const char *pw_expiration) 79{ 80 krb5_error_code ret; 81 kadm5_principal_ent_rec princ, defrec; 82 kadm5_principal_ent_rec *default_ent = NULL; 83 krb5_principal princ_ent = NULL; 84 int mask = 0; 85 int default_mask = 0; 86 char pwbuf[1024]; 87 88 memset(&princ, 0, sizeof(princ)); 89 ret = krb5_parse_name(context, name, &princ_ent); 90 if (ret) { 91 krb5_warn(context, ret, "krb5_parse_name"); 92 return ret; 93 } 94 princ.principal = princ_ent; 95 mask |= KADM5_PRINCIPAL; 96 97 ret = set_entry(context, &princ, &mask, 98 max_ticket_life, max_renewable_life, 99 expiration, pw_expiration, attributes, policy); 100 if (ret) 101 goto out; 102 103 default_ent = &defrec; 104 ret = get_default (kadm_handle, princ_ent, default_ent); 105 if (ret) { 106 default_ent = NULL; 107 default_mask = 0; 108 } else { 109 default_mask = KADM5_ATTRIBUTES | KADM5_MAX_LIFE | KADM5_MAX_RLIFE | 110 KADM5_PRINC_EXPIRE_TIME | KADM5_PW_EXPIRATION; 111 } 112 113 if(use_defaults) 114 set_defaults(&princ, &mask, default_ent, default_mask); 115 else 116 if(edit_entry(&princ, &mask, default_ent, default_mask)) 117 goto out; 118 if(rand_key || key_data) { 119 princ.attributes |= KRB5_KDB_DISALLOW_ALL_TIX; 120 mask |= KADM5_ATTRIBUTES; 121 random_password (pwbuf, sizeof(pwbuf)); 122 password = pwbuf; 123 } else if (rand_password) { 124 random_password (pwbuf, sizeof(pwbuf)); 125 password = pwbuf; 126 } else if(password == NULL) { 127 char *princ_name; 128 char *prompt; 129 130 krb5_unparse_name(context, princ_ent, &princ_name); 131 asprintf (&prompt, "%s's Password: ", princ_name); 132 free (princ_name); 133 ret = UI_UTIL_read_pw_string_stdio(pwbuf, sizeof(pwbuf), prompt, 1); 134 free (prompt); 135 if (ret) { 136 ret = KRB5_LIBOS_BADPWDMATCH; 137 krb5_set_error_message(context, ret, "failed to verify password"); 138 goto out; 139 } 140 password = pwbuf; 141 } 142 143 ret = kadm5_create_principal(kadm_handle, &princ, mask, password); 144 princ.principal = NULL; 145 kadm5_free_principal_ent(kadm_handle, &princ); 146 if(ret) { 147 krb5_warn(context, ret, "kadm5_create_principal"); 148 goto out; 149 } 150 if(rand_key) { 151 krb5_keyblock *new_keys; 152 int n_keys, i; 153 ret = kadm5_randkey_principal(kadm_handle, princ_ent, 154 &new_keys, &n_keys); 155 if(ret){ 156 krb5_warn(context, ret, "kadm5_randkey_principal"); 157 n_keys = 0; 158 } 159 for(i = 0; i < n_keys; i++) 160 krb5_free_keyblock_contents(context, &new_keys[i]); 161 if (n_keys > 0) 162 free(new_keys); 163 ret = kadm5_get_principal(kadm_handle, princ_ent, &princ, 164 KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES); 165 if(ret){ 166 krb5_warn(context, ret, "kadm5_get_principal"); 167 goto out; 168 } 169 princ.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX); 170 /* 171 * Updating kvno w/o key data and vice-versa gives _kadm5_setup_entry() 172 * and _kadm5_set_keys2() headaches. But we used to, so we handle 173 * this in in those two functions. Might as well leave this code as 174 * it was then. 175 */ 176 princ.kvno = 1; 177 kadm5_modify_principal(kadm_handle, &princ, 178 KADM5_ATTRIBUTES | KADM5_KVNO); 179 } else if (key_data) { 180 ret = kadm5_chpass_principal_with_key (kadm_handle, princ_ent, 181 3, key_data); 182 if (ret) { 183 krb5_warn(context, ret, "kadm5_chpass_principal_with_key"); 184 } 185 kadm5_get_principal(kadm_handle, princ_ent, &princ, 186 KADM5_PRINCIPAL | KADM5_ATTRIBUTES); 187 princ.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX); 188 kadm5_modify_principal(kadm_handle, &princ, KADM5_ATTRIBUTES); 189 } else if (rand_password) { 190 char *princ_name; 191 192 krb5_unparse_name(context, princ_ent, &princ_name); 193 printf ("added %s with password \"%s\"\n", princ_name, password); 194 free (princ_name); 195 } 196 197 if (verbose_flag && !rand_password) { 198 char *princ_name; 199 krb5_unparse_name(context, princ_ent, &princ_name); 200 printf ("Principal \"%s\" created.\n", princ_name); 201 free (princ_name); 202 } 203 204out: 205 kadm5_free_principal_ent(kadm_handle, &princ); /* frees princ_ent */ 206 if(default_ent) 207 kadm5_free_principal_ent (kadm_handle, default_ent); 208 if (password != NULL) 209 memset (password, 0, strlen(password)); 210 return ret; 211} 212 213/* 214 * parse the string `key_string' into `key', returning 0 iff succesful. 215 */ 216 217/* 218 * the ank command 219 */ 220 221/* 222 * Parse arguments and add all the principals. 223 */ 224 225int 226add_new_key(struct add_options *opt, int argc, char **argv) 227{ 228 krb5_error_code ret = 0; 229 int i; 230 int num; 231 krb5_key_data key_data[3]; 232 krb5_key_data *kdp = NULL; 233 234 num = 0; 235 if (opt->random_key_flag) 236 ++num; 237 if (opt->random_password_flag) 238 ++num; 239 if (opt->password_string) 240 ++num; 241 if (opt->key_string) 242 ++num; 243 244 if (num > 1) { 245 fprintf (stderr, "give only one of " 246 "--random-key, --random-password, --password, --key\n"); 247 return 1; 248 } 249 250 if (opt->key_string) { 251 const char *error; 252 253 if (parse_des_key (opt->key_string, key_data, &error)) { 254 fprintf (stderr, "failed parsing key \"%s\": %s\n", 255 opt->key_string, error); 256 return 1; 257 } 258 kdp = key_data; 259 } 260 261 for(i = 0; i < argc; i++) { 262 ret = add_one_principal (argv[i], 263 opt->random_key_flag, 264 opt->random_password_flag, 265 opt->use_defaults_flag, 266 opt->verbose_flag, 267 opt->password_string, 268 opt->policy_string, 269 kdp, 270 opt->max_ticket_life_string, 271 opt->max_renewable_life_string, 272 opt->attributes_string, 273 opt->expiration_time_string, 274 opt->pw_expiration_time_string); 275 if (ret) { 276 krb5_warn (context, ret, "adding %s", argv[i]); 277 break; 278 } 279 } 280 if (kdp) { 281 int16_t dummy = 3; 282 kadm5_free_key_data (kadm_handle, &dummy, key_data); 283 } 284 return ret != 0; 285} 286