return 0;
}
+/*
+ * Replace the relative DN component of dn with newrdn.
+ */
+krb5_error_code
+replace_rdn(krb5_context context, const char *dn, const char *newrdn,
+ char **newdn_out)
+{
+ krb5_error_code ret;
+ LDAPDN ldn = NULL;
+ LDAPRDN lrdn = NULL;
+ char *next;
+
+ *newdn_out = NULL;
+
+ ret = ldap_str2dn(dn, &ldn, LDAP_DN_FORMAT_LDAPV3);
+ if (ret != LDAP_SUCCESS || ldn[0] == NULL) {
+ ret = EINVAL;
+ goto cleanup;
+ }
+
+ ret = ldap_str2rdn(newrdn, &lrdn, &next, LDAP_DN_FORMAT_LDAPV3);
+ if (ret != LDAP_SUCCESS) {
+ ret = EINVAL;
+ goto cleanup;
+ }
+
+ ldap_rdnfree(ldn[0]);
+ ldn[0] = lrdn;
+ lrdn = NULL;
+
+ ret = ldap_dn2str(ldn, newdn_out, LDAP_DN_FORMAT_LDAPV3);
+ if (ret != LDAP_SUCCESS)
+ ret = KRB5_KDB_SERVER_INTERNAL_ERR;
+
+cleanup:
+ if (ldn != NULL)
+ ldap_dnfree(ldn);
+ if (lrdn != NULL)
+ ldap_rdnfree(lrdn);
+ return ret;
+}
+
krb5_error_code
krb5_get_userdn(krb5_context context, krb5_db_entry *entry, char **userdn)
{
return 0;
}
+krb5_error_code
+krb5_ldap_modify_ext(krb5_context context, LDAP *ld, const char *dn,
+ LDAPMod **mods, int op)
+{
+ int ret;
+
+ ret = ldap_modify_ext_s(ld, dn, mods, NULL, NULL);
+ return (ret == LDAP_SUCCESS) ? 0 : set_ldap_error(context, ret, op);
+}
+
krb5_error_code
krb5_ldap_lock(krb5_context kcontext, int mode)
{
return st;
}
+/*
+ * Set *res will to 1 if entry is a standalone principal entry, 0 if not. On
+ * error, the value of *res is not defined.
+ */
+static inline krb5_error_code
+is_standalone_principal(krb5_context kcontext, krb5_db_entry *entry, int *res)
+{
+ krb5_error_code code;
+
+ code = krb5_get_princ_type(kcontext, entry, res);
+ if (!code)
+ *res = (*res == KDB_STANDALONE_PRINCIPAL_OBJECT) ? 1 : 0;
+ return code;
+}
+
+/*
+ * Unparse princ in the format used for LDAP attributes, and set *user to the
+ * result.
+ */
+static krb5_error_code
+unparse_principal_name(krb5_context context, krb5_const_principal princ,
+ char **user_out)
+{
+ krb5_error_code st;
+ char *luser = NULL;
+
+ *user_out = NULL;
+
+ st = krb5_unparse_name(context, princ, &luser);
+ if (st)
+ goto cleanup;
+
+ st = krb5_ldap_unparse_principal_name(luser);
+ if (st)
+ goto cleanup;
+
+ *user_out = luser;
+ luser = NULL;
+
+cleanup:
+ free(luser);
+ return st;
+}
+
+/*
+ * Rename a principal's rdn.
+ *
+ * NOTE: Not every LDAP ds supports deleting the old rdn. If that is desired,
+ * it will have to be deleted afterwards.
+ */
+static krb5_error_code
+rename_principal_rdn(krb5_context context, LDAP *ld, const char *dn,
+ const char *newprinc, char **newdn_out)
+{
+ int ret;
+ char *newrdn = NULL;
+
+ *newdn_out = NULL;
+
+ ret = asprintf(&newrdn, "krbprincipalname=%s", newprinc);
+ if (ret < 0)
+ return ENOMEM;
+
+ /*
+ * ldap_rename_s takes a deleteoldrdn parameter, but setting it to 1 fails
+ * on 389 Directory Server (as of version 1.3.5.4) if the old RDN value
+ * contains uppercase letters. Instead, change the RDN without deleting
+ * the old value and delete it later.
+ */
+ ret = ldap_rename_s(ld, dn, newrdn, NULL, 0, NULL, NULL);
+ if (ret == -1) {
+ ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ret);
+ ret = set_ldap_error(context, ret, OP_MOD);
+ goto cleanup;
+ }
+
+ ret = replace_rdn(context, dn, newrdn, newdn_out);
+
+cleanup:
+ free(newrdn);
+ return ret;
+}
+
+/*
+ * Rename a principal.
+ */
+krb5_error_code
+krb5_ldap_rename_principal(krb5_context context, krb5_const_principal source,
+ krb5_const_principal target)
+{
+ int is_standalone;
+ krb5_error_code st;
+ char *suser = NULL, *tuser = NULL, *strval[2], *dn = NULL, *newdn = NULL;
+ krb5_db_entry *entry = NULL;
+ krb5_kvno mkvno;
+ struct berval **bersecretkey = NULL;
+ kdb5_dal_handle *dal_handle = NULL;
+ krb5_ldap_context *ldap_context = NULL;
+ krb5_ldap_server_handle *ldap_server_handle = NULL;
+ LDAP *ld = NULL;
+ LDAPMod **mods = NULL;
+
+ /* Clear the global error string */
+ krb5_clear_error_message(context);
+
+ SETUP_CONTEXT();
+ if (ldap_context->lrparams == NULL || ldap_context->container_dn == NULL)
+ return EINVAL;
+
+ /* get ldap handle */
+ GET_HANDLE();
+
+ /* Pass no flags. Principal aliases won't be returned, which is a good
+ * thing since we don't support renaming aliases. */
+ st = krb5_ldap_get_principal(context, source, 0, &entry);
+ if (st)
+ goto cleanup;
+
+ st = is_standalone_principal(context, entry, &is_standalone);
+ if (st)
+ goto cleanup;
+
+ st = krb5_get_userdn(context, entry, &dn);
+ if (st)
+ goto cleanup;
+ if (dn == NULL) {
+ st = EINVAL;
+ k5_setmsg(context, st, _("dn information missing"));
+ goto cleanup;
+ }
+
+ st = unparse_principal_name(context, source, &suser);
+ if (st)
+ goto cleanup;
+ st = unparse_principal_name(context, target, &tuser);
+ if (st)
+ goto cleanup;
+
+ /* Specialize the salt and store it first so that in case of an error the
+ * correct salt will still be used. */
+ st = krb5_dbe_specialize_salt(context, entry);
+ if (st)
+ goto cleanup;
+
+ st = krb5_dbe_lookup_mkvno(context, entry, &mkvno);
+ if (st)
+ goto cleanup;
+
+ bersecretkey = krb5_encode_krbsecretkey(entry->key_data, entry->n_key_data,
+ mkvno);
+ if (bersecretkey == NULL) {
+ st = ENOMEM;
+ goto cleanup;
+ }
+
+ st = krb5_add_ber_mem_ldap_mod(&mods, "krbPrincipalKey",
+ LDAP_MOD_REPLACE | LDAP_MOD_BVALUES,
+ bersecretkey);
+ if (st != 0)
+ goto cleanup;
+
+ /* Update the principal. */
+ st = krb5_ldap_modify_ext(context, ld, dn, mods, OP_MOD);
+ if (st)
+ goto cleanup;
+ ldap_mods_free(mods, 1);
+ mods = NULL;
+
+ /* If this is a standalone principal, we want to rename the DN of the LDAP
+ * entry. If not, we will modify the entry without changing its DN. */
+ if (is_standalone) {
+ st = rename_principal_rdn(context, ld, dn, tuser, &newdn);
+ if (st)
+ goto cleanup;
+ free(dn);
+ dn = newdn;
+ newdn = NULL;
+ }
+
+ /* There can be more than one krbPrincipalName, so we have to delete
+ * the old one and add the new one. */
+ strval[0] = suser;
+ strval[1] = NULL;
+ st = krb5_add_str_mem_ldap_mod(&mods, "krbPrincipalName", LDAP_MOD_DELETE,
+ strval);
+ if (st)
+ goto cleanup;
+
+ strval[0] = tuser;
+ strval[1] = NULL;
+ if (!is_standalone) {
+ st = krb5_add_str_mem_ldap_mod(&mods, "krbPrincipalName", LDAP_MOD_ADD,
+ strval);
+ if (st)
+ goto cleanup;
+ }
+
+ st = krb5_add_str_mem_ldap_mod(&mods, "krbCanonicalName", LDAP_MOD_REPLACE,
+ strval);
+ if (st)
+ goto cleanup;
+
+ /* Update the principal. */
+ st = krb5_ldap_modify_ext(context, ld, dn, mods, OP_MOD);
+ if (st)
+ goto cleanup;
+
+cleanup:
+ free(dn);
+ free(suser);
+ free(tuser);
+ krb5_ldap_free_principal(context, entry);
+ ldap_mods_free(mods, 1);
+ krb5_ldap_put_handle_to_pool(ldap_context, ldap_server_handle);
+ return st;
+}
/*
* Function: krb5_ldap_unparse_principal_name
for n in (1, 2, 3, 4, 5):
test_pwhist(n)
+# Test principal renaming and make sure last modified is changed
+def get_princ(princ):
+ out = realm.run([kadminl, 'getprinc', princ])
+ return dict(map(str.strip, x.split(":", 1)) for x in out.splitlines())
+
+realm.addprinc("rename", password('rename'))
+renameprinc = get_princ("rename")
+realm.run([kadminl, '-p', 'fake@KRBTEST.COM', 'renprinc', 'rename', 'renamed'])
+renamedprinc = get_princ("renamed")
+if renameprinc['Last modified'] == renamedprinc['Last modified']:
+ fail('Last modified data not updated when principal was renamed')
+
# Regression test for #7980 (fencepost when dividing keys up by kvno).
realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts,aes128-cts',
'kvnoprinc'])
projects / thirdparty / krb5.git / commitdiff
