envvar arguments with a flag indicating whether KDC config data should
be used. Prototype and all callers changed.
(krb5_read_realm_params): Delete config file and env var arguments.
Prototype and all callers changed.
* lib/kadm5/admin.h (KADM5_CONFIG_PROFILE): Commented out.
(struct _kadm5_config_params): Delete field PROFILE.
* lib/kadm5/alt_prof.c (kadm5_get_config_params): Don't look at it.
(kadm5_free_config_params): Don't free it.
* kadmin/testing/tcl/util.t: Remove profile data from config params.
* kadmin/testing/util/tcl_kadm5.c (config_mask_flags): Deleted
KADM5_CONFIG_PROFILE entry.
(parse_config_params): Changed to require 20 parameters instead of 21.
* lib/kadm5/unit-test/api.2/init-v2.exp (test100): Deleted.
* lib/kadm5/alt_prof.c (krb5_aprof_init): Fetch the list of config files from
the library and add the caller-indicated config file to the front of the list.
* lib/kadm5/clnt/client_init.c (kadm5_init_krb5_context): New function.
* lib/kadm5/clnt/libkadm5clnt.exports: Export it.
* lib/kadm5/srv/server_init.c: Include k5-int.h, osconf.h, gssapiP_krb5.h.
(kadm5_init_krb5_context): New function.
* lib/kadm5/srv/libkadm5srv.exports: Export it.
* lib/kadm5/srv/Makefile.in (LOCAL_INCLUDES): Add gssapi directories.
* lib/kadm5/admin.h (kadm5_init_krb5_context): Declare it.
* kadmin/dbutil/kdb5_destroy.c (kdb5_destroy): Call kadm5_init_krb5_context
instead of krb5_init_context.
* kadmin/dbutil/dump.c (load_db): Likewise.
* kadmin/dbutil/kdb5_util.c (main): Likewise.
* kadmin/dbutil/kadm5_create.c (kadm5_create): Likewise.
* kadmin/dbutil/kdb5_stash.c (kdb5_stash): Likewise.
* kadmin/dbutil/loadv4.c (load_v4db): Likewise.
* kadmin/server/ovsec_kadmd.c (main): Likewise.
* kadmin/cli/kadmin.c (kadmin_startup): Likewise.
* kadmin/testing/util/tcl_ovsec_kadm.c (tcl_ovsec_kadm_init): Likewise.
* lib/kadm5/unit-test/lock-test.c (main): Likewise.
* lib/kadm5/unit-test/handle-test.c (main): Likewise.
* lib/kadm5/unit-test/randkey-test.c (main): Likewise.
* lib/kadm5/unit-test/setkey-test.c (main): Likewise.
* lib/kadm5/chpass_util.c (_kadm5_chpass_principal_util): Likewise.
* lib/kadm5/kadm_rpc_xdr.c (xdr_krb5_principal): Likewise.
* lib/krb5/os/init_os_ctx.c (add_kdc_config_file): New function.
(os_init_paths): Add new argument KDC; call add_kdc_config_file if true.
* lib/krb5/krb/init_ctx.c (krb5int_init_context_kdc): New function.
(init_common): Add new argument KDC, passed to krb5_os_init_context.
* lib/krb5/libkrb5.exports: Export krb5int_init_context_kdc.
* k5-int.h (krb5_os_init_context): Update decl.
* lib/kadm5/srv/server_init.c (kadm5_init): Call krb5int_init_context_kdc.
* krb524/krb524d.c (main): Likewise.
* lib/kadm5/unit-test/api.2/init-v2.exp: Don't run test 154 for error for
$KRB5_KDC_PROFILE file not present.
* lib/krb5/os/init_os_ctx.c (os_get_default_config_files): Rewrite KLL test so
as not to confuse Emacs indentation support.
* lib/gssapi/krb5/init_sec_context.c (kg_kdc_flag_mutex, kdc_flag): New
variables.
(krb5_gss_init_context, krb5_gss_use_kdc_context): New functions.
* lib/gssapi/krb5/gssapiP_krb5.h (kg_kdc_flag_mutex): Declare.
(krb5_gss_init_context, krb5_gss_use_kdc_context): Declare.
(krb5_init_context): Define as macro to invoke krb5_gss_init_context for now.
* lib/gssapi/gss_libinit.c (gssint_lib_init): Initialize the mutex.
(gssint_lib_fini): Destroy it.
* lib/gssapi/libgssapi_krb5.exports: Export krb5_gss_use_kdc_context.
* lib/kadm5/srv/server_init.c (kadm5_init): Don't complain if the config files
specify an admin server, since we now look at krb5.conf as well.
* lib/kadm5/unit-test/api.2/init-v2.exp: Delete test test114 for bad server
params.
* plugins/kdb/db2/adb_openclose.c (osa_adb_init_db): Use
krb5int_init_context_kdc instead of krb5_init_context.
* kdc/rtest.c (main): Likewise.
* kdc/fakeka.c (main): Likewise.
* kdc/main.c (main, init_realm): Likewise.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@18009
dc483132-0cff-0310-8789-
dd5450dbe970
krb5_error_code krb5_aprof_finish (krb5_pointer);
krb5_error_code krb5_read_realm_params (krb5_context,
- char *,
- char *,
char *,
krb5_realm_params **);
krb5_error_code krb5_free_realm_params (krb5_context,
krb5_error_code krb5int_get_fq_local_hostname (char *, size_t);
-krb5_error_code krb5_os_init_context (krb5_context);
+krb5_error_code krb5_os_init_context (krb5_context, krb5_boolean);
void krb5_os_free_context (krb5_context);
memset((char *) ¶ms, 0, sizeof(params));
- retval = krb5_init_context(&context);
-
if (strcmp (whoami, "kadmin.local") == 0)
set_com_err_hook(extended_com_err_fn);
+ retval = kadm5_init_krb5_context(&context);
if (retval) {
com_err(whoami, retval, "while initializing krb5 library");
exit(1);
}
-
+
while ((optchar = getopt(argc, argv, "x:r:p:kq:w:d:s:mc:t:e:ON")) != EOF) {
switch (optchar) {
case 'x':
/*
* Initialize the Kerberos context and error tables.
*/
- if ((kret = krb5_init_context(&kcontext))) {
+ if ((kret = kadm5_init_krb5_context(&kcontext))) {
fprintf(stderr, ctx_err_fmt, programname);
free(dbname_tmp);
exit_status++;
newparams.mask |= KADM5_CONFIG_DBNAME;
newparams.dbname = dbname_tmp;
- if ((kret = kadm5_get_config_params(kcontext, NULL, NULL,
+ if ((kret = kadm5_get_config_params(kcontext, 1,
&newparams, &newparams))) {
com_err(argv[0], kret,
"while retreiving new configuration parameters");
kadm5_config_params lparams;
- if ((retval = krb5_init_context(&context)))
+ if ((retval = kadm5_init_krb5_context(&context)))
exit(ERR);
/*
* The lock file has to exist before calling kadm5_init, but
* params->admin_lockfile may not be set yet...
*/
- if ((retval = kadm5_get_config_params(context, NULL, NULL,
+ if ((retval = kadm5_get_config_params(context, 1,
params, &lparams))) {
com_err(progname, retval, "while looking up the Kerberos configuration");
return 1;
krb5_context context;
int force = 0;
- retval1 = krb5_init_context(&context);
+ retval1 = kadm5_init_krb5_context(&context);
if( retval1 )
{
com_err(argv[0], retval1, "while initializing krb5_context");
if (strrchr(argv[0], '/'))
argv[0] = strrchr(argv[0], '/')+1;
- retval = krb5_init_context(&context);
+ retval = kadm5_init_krb5_context(&context);
if( retval )
{
com_err(argv[0], retval, "while initializing krb5_context");
int cmd_argc;
krb5_error_code retval;
- retval = krb5_init_context(&util_context);
set_com_err_hook(extended_com_err_fn);
+
+ retval = kadm5_init_krb5_context(&util_context);
if (retval) {
com_err (progname, retval, "while initializing Kerberos code");
exit(1);
util_context->default_realm = temp;
}
- retval = kadm5_get_config_params(util_context, NULL, NULL,
+ retval = kadm5_get_config_params(util_context, 1,
&global_params, &global_params);
if (retval) {
com_err(argv[0], retval, "while retreiving configuration parameters");
krb5_int32 crflags = KRB5_KDB_CREATE_BTREE;
krb5_data seed;
- retval = krb5_init_context(&context);
+ retval = kadm5_init_krb5_context(&context);
if (retval) {
fprintf(stderr, "%s: Could not initialize krb5 context.\n", PROGNAME);
return;
display_status("str_to_oid", major_status, minor_status);
exit(1);
}
-
+
names[0].name = names[1].name = names[2].name = names[3].name = NULL;
names[0].type = names[1].type = names[2].type = names[3].type =
nt_krb5_name_oid;
if (argc != 0)
usage();
- if ((ret = krb5_init_context(&context))) {
+ if ((ret = kadm5_init_krb5_context(&context))) {
fprintf(stderr, "%s: %s while initializing context, aborting\n",
whoami, error_message(ret));
exit(1);
krb5_klog_init(context, "admin_server", whoami, 1);
-
krb5_klog_syslog(LOG_INFO, "Seeding random number generator");
ret = krb5_c_random_os_entropy(context, 1, NULL);
if(ret) {
- krb5_klog_syslog(LOG_ERR, "Error getting random seed: %s, aborting",
+ krb5_klog_syslog(LOG_ERR,
+ "Error getting random seed: %s, aborting",
krb5_get_error_message (context, ret));
exit(1);
}
free(db_args), db_args=NULL;
}
- if ((ret = kadm5_get_config_params(context, NULL, NULL, ¶ms,
+ if ((ret = kadm5_get_config_params(context, 1, ¶ms,
¶ms))) {
const char *e_txt = krb5_get_error_message (context, ret);
krb5_klog_syslog(LOG_ERR, "%s: %s while initializing, aborting",
__REALM__ = {
kdc = __KDCHOST__:1750
admin_server = __KDCHOST__:1751
-# THIS SHOULD BE IN KDC.CONF INSTEAD!
database_module = foobar_db2_module_blah
}
error "config_params: length of mask and values differ"
}
- set params [list $masks 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 {}]
+ set params [list $masks 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 {}]
for {set i 0} {$i < [llength $masks]} {incr i} {
set mask [lindex $masks $i]
set value [lindex $values $i]
switch -glob -- $mask {
"KADM5_CONFIG_REALM" {set params [lreplace $params 1 1 $value]}
- "KADM5_CONFIG_PROFILE" {set params [lreplace $params 2 2 $value]}
"KADM5_CONFIG_KADMIND_PORT" {
- set params [lreplace $params 3 3 $value]}
+ set params [lreplace $params 2 2 $value]}
"KADM5_CONFIG_ADMIN_SERVER" {
- set params [lreplace $params 4 4 $value]}
- "KADM5_CONFIG_DBNAME" {set params [lreplace $params 5 5 $value]}
- "KADM5_CONFIG_ADBNAME" {set params [lreplace $params 6 6 $value]}
+ set params [lreplace $params 3 3 $value]}
+ "KADM5_CONFIG_DBNAME" {set params [lreplace $params 4 4 $value]}
+ "KADM5_CONFIG_ADBNAME" {set params [lreplace $params 5 5 $value]}
"KADM5_CONFIG_ADB_LOCKFILE" {
- set params [lreplace $params 7 7 $value]}
+ set params [lreplace $params 6 6 $value]}
"KADM5_CONFIG_ADMIN_KEYTAB" {
- set params [lreplace $params 8 8 $value]}
- "KADM5_CONFIG_ACL_FILE" {set params [lreplace $params 9 9 $value]}
+ set params [lreplace $params 7 7 $value]}
+ "KADM5_CONFIG_ACL_FILE" {set params [lreplace $params 8 8 $value]}
"KADM5_CONFIG_DICT_FILE" {
- set params [lreplace $params 10 10 $value]}
+ set params [lreplace $params 9 9 $value]}
"KADM5_CONFIG_MKEY_FROM_KBD" {
- set params [lreplace $params 11 11 $value]}
+ set params [lreplace $params 10 10 $value]}
"KADM5_CONFIG_STASH_FILE" {
- set params [lreplace $params 12 12 $value]}
+ set params [lreplace $params 11 11 $value]}
"KADM5_CONFIG_MKEY_NAME" {
- set params [lreplace $params 13 13 $value]}
- "KADM5_CONFIG_ENCTYPE" {set params [lreplace $params 14 14 $value]}
+ set params [lreplace $params 12 12 $value]}
+ "KADM5_CONFIG_ENCTYPE" {set params [lreplace $params 13 13 $value]}
"KADM5_CONFIG_MAX_LIFE" {
- set params [lreplace $params 15 15 $value]}
+ set params [lreplace $params 14 14 $value]}
"KADM5_CONFIG_MAX_RLIFE" {
- set params [lreplace $params 16 16 $value]}
+ set params [lreplace $params 15 15 $value]}
"KADM5_CONFIG_EXPIRATION" {
- set params [lreplace $params 17 17 $value]}
- "KADM5_CONFIG_FLAGS" {set params [lreplace $params 18 18 $value]}
+ set params [lreplace $params 16 16 $value]}
+ "KADM5_CONFIG_FLAGS" {set params [lreplace $params 17 17 $value]}
"KADM5_CONFIG_ENCTYPES" {
- set params [lreplace $params 19 20 [llength $value] $value]}
+ set params [lreplace $params 18 19 [llength $value] $value]}
"*" {error "config_params: unknown mask $mask"}
}
}
{"KADM5_CONFIG_ENCTYPE", KADM5_CONFIG_ENCTYPE},
{"KADM5_CONFIG_ADBNAME", KADM5_CONFIG_ADBNAME},
{"KADM5_CONFIG_ADB_LOCKFILE", KADM5_CONFIG_ADB_LOCKFILE},
- {"KADM5_CONFIG_PROFILE", KADM5_CONFIG_PROFILE},
{"KADM5_CONFIG_ACL_FILE", KADM5_CONFIG_ACL_FILE},
{"KADM5_CONFIG_KADMIND_PORT", KADM5_CONFIG_KADMIND_PORT},
{"KADM5_CONFIG_ENCTYPES", KADM5_CONFIG_ENCTYPES},
return retcode;
}
- if (argc != 21) {
+ if (argc != 20) {
sprintf(interp->result,
- "wrong # args in config params structure (%d should be 21)",
+ "wrong # args in config params structure (%d should be 20)",
argc);
retcode = TCL_ERROR;
goto finished;
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = parse_str(interp, argv[2], ¶ms->profile)) != TCL_OK) {
- Tcl_AppendElement(interp, "while parsing profile name");
- retcode = TCL_ERROR;
- goto finished;
- }
- if ((retcode = Tcl_GetInt(interp, argv[3], &tmp))
+ if ((retcode = Tcl_GetInt(interp, argv[2], &tmp))
!= TCL_OK) {
Tcl_AppendElement(interp, "while parsing kadmind_port");
retcode = TCL_ERROR;
goto finished;
}
params->kadmind_port = tmp;
- if ((retcode = parse_str(interp, argv[4], ¶ms->admin_server))
+ if ((retcode = parse_str(interp, argv[3], ¶ms->admin_server))
!= TCL_OK) {
Tcl_AppendElement(interp, "while parsing profile name");
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = parse_str(interp, argv[5], ¶ms->dbname)) != TCL_OK) {
+ if ((retcode = parse_str(interp, argv[4], ¶ms->dbname)) != TCL_OK) {
Tcl_AppendElement(interp, "while parsing profile name");
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = parse_str(interp, argv[6], ¶ms->admin_dbname)) != TCL_OK) {
+ if ((retcode = parse_str(interp, argv[5], ¶ms->admin_dbname)) != TCL_OK) {
Tcl_AppendElement(interp, "while parsing admin_dbname name");
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = parse_str(interp, argv[7], ¶ms->admin_lockfile)) != TCL_OK) {
+ if ((retcode = parse_str(interp, argv[6], ¶ms->admin_lockfile)) != TCL_OK) {
Tcl_AppendElement(interp, "while parsing admin_lockfile name");
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = parse_str(interp, argv[8], ¶ms->admin_keytab)) != TCL_OK) {
+ if ((retcode = parse_str(interp, argv[7], ¶ms->admin_keytab)) != TCL_OK) {
Tcl_AppendElement(interp, "while parsing admin_keytab name");
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = parse_str(interp, argv[9], ¶ms->acl_file)) != TCL_OK) {
+ if ((retcode = parse_str(interp, argv[8], ¶ms->acl_file)) != TCL_OK) {
Tcl_AppendElement(interp, "while parsing acl_file name");
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = parse_str(interp, argv[10], ¶ms->dict_file)) != TCL_OK) {
+ if ((retcode = parse_str(interp, argv[9], ¶ms->dict_file)) != TCL_OK) {
Tcl_AppendElement(interp, "while parsing dict_file name");
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = Tcl_GetInt(interp, argv[11], &tmp))
+ if ((retcode = Tcl_GetInt(interp, argv[10], &tmp))
!= TCL_OK) {
Tcl_AppendElement(interp, "while parsing mkey_from_kbd");
retcode = TCL_ERROR;
goto finished;
}
params->mkey_from_kbd = tmp;
- if ((retcode = parse_str(interp, argv[12], ¶ms->stash_file)) != TCL_OK) {
+ if ((retcode = parse_str(interp, argv[11], ¶ms->stash_file)) != TCL_OK) {
Tcl_AppendElement(interp, "while parsing stash_file name");
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = parse_str(interp, argv[13], ¶ms->mkey_name)) != TCL_OK) {
+ if ((retcode = parse_str(interp, argv[12], ¶ms->mkey_name)) != TCL_OK) {
Tcl_AppendElement(interp, "while parsing mkey_name name");
retcode = TCL_ERROR;
goto finished;
}
- if ((retcode = Tcl_GetInt(interp, argv[14], &tmp))
+ if ((retcode = Tcl_GetInt(interp, argv[13], &tmp))
!= TCL_OK) {
Tcl_AppendElement(interp, "while parsing enctype");
retcode = TCL_ERROR;
goto finished;
}
params->enctype = tmp;
- if ((retcode = Tcl_GetInt(interp, argv[15], &tmp))
+ if ((retcode = Tcl_GetInt(interp, argv[14], &tmp))
!= TCL_OK) {
Tcl_AppendElement(interp, "while parsing max_life");
retcode = TCL_ERROR;
goto finished;
}
params->max_life = tmp;
- if ((retcode = Tcl_GetInt(interp, argv[16], &tmp))
+ if ((retcode = Tcl_GetInt(interp, argv[15], &tmp))
!= TCL_OK) {
Tcl_AppendElement(interp, "while parsing max_rlife");
retcode = TCL_ERROR;
goto finished;
}
params->max_rlife = tmp;
- if ((retcode = Tcl_GetInt(interp, argv[17], &tmp))
+ if ((retcode = Tcl_GetInt(interp, argv[16], &tmp))
!= TCL_OK) {
Tcl_AppendElement(interp, "while parsing expiration");
retcode = TCL_ERROR;
goto finished;
}
params->expiration = tmp;
- if ((retcode = parse_krb5_flags(interp, argv[18], &tmp))
+ if ((retcode = parse_krb5_flags(interp, argv[17], &tmp))
!= TCL_OK) {
Tcl_AppendElement(interp, "while parsing flags");
retcode = TCL_ERROR;
goto finished;
}
params->flags = tmp;
- if ((retcode = Tcl_GetInt(interp, argv[19], &tmp))
+ if ((retcode = Tcl_GetInt(interp, argv[18], &tmp))
!= TCL_OK) {
Tcl_AppendElement(interp, "while parsing num_keysalts");
retcode = TCL_ERROR;
goto finished;
}
params->num_keysalts = tmp;
- if ((retcode = parse_keysalts(interp, argv[20], ¶ms->keysalts,
+ if ((retcode = parse_keysalts(interp, argv[19], ¶ms->keysalts,
params->num_keysalts)) != TCL_OK) {
Tcl_AppendElement(interp, "while parsing keysalts");
retcode = TCL_ERROR;
argv++, argc--;
- krb5_init_context(&context);
+ kadm5_init_krb5_context(&context);
if (argc != 7) {
Tcl_AppendResult(interp, whoami, ": ", arg_error, 0);
argv++, argc--;
- krb5_init_context(&context);
+ kadm5_init_krb5_context(&context);
if (argc != 7) {
Tcl_AppendResult(interp, whoami, ": ", arg_error, 0);
* Initialize kerberos stuff and kadm5 stuff.
*/
- if ((code = krb5_init_context(&context))) {
+ if ((code = krb5int_init_context_kdc(&context))) {
com_err(argv[0], code, "while initializing Kerberos");
exit(1);
}
exit(1);
}
- if ((code = kadm5_get_config_params(context, NULL, NULL, NULL,
+ if ((code = kadm5_get_config_params(context, 1, NULL,
&realm_params))) {
com_err(argv[0], code, "while getting realm parameters");
exit(1);
}
rdp->realm_name = realm;
- kret = krb5_init_context(&rdp->realm_context);
+ kret = krb5int_init_context_kdc(&rdp->realm_context);
if (kret) {
com_err(progname, kret, "while getting context for realm %s",
realm);
}
kret = krb5_read_realm_params(rdp->realm_context, rdp->realm_name,
- (char *) NULL, (char *) NULL, &rparams);
+ &rparams);
if (kret) {
com_err(progname, kret, "while reading realm parameters");
goto whoops;
* reporting. The per-realm operations use the "realm_context"
* associated with each realm.
*/
- retval = krb5_init_context(&kcontext);
+ retval = krb5int_init_context_kdc(&kcontext);
if (retval) {
com_err(argv[0], retval, "while initializing krb5");
exit(1);
/* Get a context */
- kret = krb5_init_context(&kdc_realm.realm_context);
+ kret = krb5int_init_context_kdc(&kdc_realm.realm_context);
if (kret) {
com_err(argv[0], kret, "while getting krb5 context");
exit(2);
whoami = ((whoami = strrchr(argv[0], '/')) ? whoami + 1 : argv[0]);
- retval = krb5_init_context(&context);
+ retval = krb5int_init_context_kdc(&context);
if (retval) {
com_err(whoami, retval, "while initializing krb5");
exit(1);
if (err)
return err;
err = k5_key_register(K5_KEY_GSS_KRB5_CCACHE_NAME, free);
+ if (err)
+ return err;
+ err = k5_mutex_finish_init(&kg_kdc_flag_mutex);
if (err)
return err;
return k5_mutex_finish_init(&kg_vdb.mutex);
k5_key_delete(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME);
k5_key_delete(K5_KEY_GSS_KRB5_CCACHE_NAME);
k5_mutex_destroy(&kg_vdb.mutex);
+ k5_mutex_destroy(&kg_kdc_flag_mutex);
k5_mutex_destroy(&gssint_krb5_keytab_lock);
}
int *conf_state, int *qop_state,
int toktype);
+extern k5_mutex_t kg_kdc_flag_mutex;
+krb5_error_code krb5_gss_init_context (krb5_context *ctxp);
+#define krb5_init_context(C) krb5_gss_init_context(C)
+
+krb5_error_code krb5_gss_use_kdc_context(void);
+
#endif /* _GSSAPIP_KRB5_H_ */
return(major_status);
}
+
+k5_mutex_t kg_kdc_flag_mutex = K5_MUTEX_PARTIAL_INITIALIZER;
+static int kdc_flag = 0;
+
+krb5_error_code
+krb5_gss_init_context (krb5_context *ctxp)
+{
+ krb5_error_code err;
+ int is_kdc;
+
+ err = gssint_initialize_library();
+ if (err)
+ return err;
+ err = k5_mutex_lock(&kg_kdc_flag_mutex);
+ if (err)
+ return err;
+ is_kdc = kdc_flag;
+ k5_mutex_unlock(&kg_kdc_flag_mutex);
+ if (is_kdc)
+ return krb5int_init_context_kdc(ctxp);
+ else
+#undef krb5_init_context
+ return krb5_init_context(ctxp);
+}
+
+krb5_error_code
+krb5_gss_use_kdc_context()
+{
+ krb5_error_code err;
+
+ err = gssint_initialize_library();
+ if (err)
+ return err;
+ err = k5_mutex_lock(&kg_kdc_flag_mutex);
+ if (err)
+ return err;
+ kdc_flag = 1;
+ k5_mutex_unlock(&kg_kdc_flag_mutex);
+ return 0;
+}
krb5_gss_verify_mic
krb5_gss_wrap
krb5_gss_wrap_size_limit
+krb5_gss_use_kdc_context
#define KADM5_CONFIG_ENCTYPE 0x000200
#define KADM5_CONFIG_ADBNAME 0x000400
#define KADM5_CONFIG_ADB_LOCKFILE 0x000800
-#define KADM5_CONFIG_PROFILE 0x001000
+/*#define KADM5_CONFIG_PROFILE 0x001000*/
#define KADM5_CONFIG_ACL_FILE 0x002000
#define KADM5_CONFIG_KADMIND_PORT 0x004000
#define KADM5_CONFIG_ENCTYPES 0x008000
typedef struct _kadm5_config_params {
long mask;
char * realm;
- char * profile;
int kadmind_port;
int kpasswd_port;
#if USE_KADM5_API_VERSION > 1
krb5_error_code kadm5_get_config_params(krb5_context context,
- char *kdcprofile, char *kdcenv,
+ int use_kdc_config,
kadm5_config_params *params_in,
kadm5_config_params *params_out);
kadm5_ret_t kadm5_free_name_list(void *server_handle, char **names,
int count);
+krb5_error_code kadm5_init_krb5_context (krb5_context *);
+
#if USE_KADM5_API_VERSION == 1
/*
* OVSEC_KADM_API_VERSION_1 should be, if possible, compile-time
krb5_pointer *acontextp;
{
krb5_error_code kret;
- const_profile_filespec_t namelist[2];
profile_t profile;
-
- namelist[1] = (profile_filespec_t) NULL;
- profile = (profile_t) NULL;
- if (envname) {
- if ((namelist[0] = getenv(envname))) {
- kret = profile_init(namelist, &profile);
- if (kret)
- return kret;
- *acontextp = (krb5_pointer) profile;
- return 0;
- }
+ const char *kdc_config;
+ size_t krb5_config_len, kdc_config_len;
+ char *profile_path;
+ char **filenames;
+ int i;
+
+ kret = krb5_get_default_config_files (&filenames);
+ if (kret)
+ return kret;
+ krb5_config_len = 0;
+ for (i = 0; filenames[i] != NULL; i++)
+ krb5_config_len += strlen(filenames[i]) + 1;
+ if (i > 0)
+ krb5_config_len--;
+ if (envname == NULL
+ || (kdc_config = getenv(envname)) == NULL)
+ kdc_config = fname;
+ if (kdc_config == NULL)
+ kdc_config_len = 0;
+ else
+ kdc_config_len = strlen(kdc_config);
+ profile_path = malloc(2 + krb5_config_len + kdc_config_len);
+ if (profile_path == NULL) {
+ krb5_free_config_files(filenames);
+ return errno;
}
+ if (kdc_config_len)
+ strcpy(profile_path, kdc_config);
+ else
+ profile_path[0] = 0;
+ if (krb5_config_len)
+ for (i = 0; filenames[i] != NULL; i++) {
+ if (kdc_config_len || i)
+ strcat(profile_path, ":");
+ strcat(profile_path, filenames[i]);
+ }
+ krb5_free_config_files(filenames);
profile = (profile_t) NULL;
- if (fname) {
- kret = profile_init_path(fname, &profile);
- if (kret == ENOENT) {
- profile = 0;
- } else if (kret)
- return kret;
- *acontextp = (krb5_pointer) profile;
- return 0;
- }
+ kret = profile_init_path(profile_path, &profile);
+ free(profile_path);
+ if (kret)
+ return kret;
+ *acontextp = profile;
return 0;
}
* in params_in for which the mask is set will be re-assigned to newly copied
* versions, overwriting the old pointer value.
*/
-krb5_error_code kadm5_get_config_params(context, kdcprofile, kdcenv,
+krb5_error_code kadm5_get_config_params(context, use_kdc_config,
params_in, params_out)
krb5_context context;
- char *kdcprofile;
- char *kdcenv;
+ int use_kdc_config;
kadm5_config_params *params_in, *params_out;
{
char *filename;
params.realm = lrealm;
params.mask |= KADM5_CONFIG_REALM;
}
- if (params_in->mask & KADM5_CONFIG_PROFILE) {
- filename = params.profile = strdup(params_in->profile);
- if (params.profile)
- params.mask |= KADM5_CONFIG_PROFILE;
- envname = NULL;
+ /*
+ * XXX These defaults should to work on both client and
+ * server. kadm5_get_config_params can be implemented as a
+ * wrapper function in each library that provides correct
+ * defaults for NULL values.
+ */
+ if (use_kdc_config) {
+ filename = DEFAULT_KDC_PROFILE;
+ envname = KDC_PROFILE_ENV;
} else {
- /*
- * XXX These defaults should to work on both client and
- * server. kadm5_get_config_params can be implemented as a
- * wrapper function in each library that provides correct
- * defaults for NULL values.
- */
- filename = (kdcprofile) ? kdcprofile : DEFAULT_KDC_PROFILE;
- envname = (kdcenv) ? kdcenv : KDC_PROFILE_ENV;
- if (context->profile_secure == TRUE) envname = 0;
+ filename = DEFAULT_PROFILE_PATH;
+ envname = "KRB5_CONFIG";
}
+ if (context->profile_secure == TRUE) envname = 0;
kret = krb5_aprof_init(filename, envname, &aprofile);
if (kret)
params.mask |= KADM5_CONFIG_STASH_FILE;
params.stash_file = svalue;
}
-
+
/* Get the value for maximum ticket lifetime. */
hierarchy[2] = "max_life";
if (params_in->mask & KADM5_CONFIG_MAX_LIFE) {
kadm5_config_params *params;
{
if (params) {
- if (params->profile)
- krb5_xfree(params->profile);
if (params->dbname)
krb5_xfree(params->dbname);
if (params->mkey_name)
params_in.mask |= KADM5_CONFIG_REALM;
params_in.realm = realm_in;
- ret = kadm5_get_config_params(ctx, DEFAULT_PROFILE_PATH,
- "KRB5_CONFIG", ¶ms_in, ¶ms_out);
+ ret = kadm5_get_config_params(ctx, 0, ¶ms_in, ¶ms_out);
if (ret)
return ret;
* alternate profile.
*/
krb5_error_code
-krb5_read_realm_params(kcontext, realm, kdcprofile, kdcenv, rparamp)
+krb5_read_realm_params(kcontext, realm, rparamp)
krb5_context kcontext;
char *realm;
- char *kdcprofile;
- char *kdcenv;
krb5_realm_params **rparamp;
{
char *filename;
krb5_boolean bvalue;
krb5_deltat dtvalue;
+ char *kdcprofile = 0;
+ char *kdcenv = 0;
+
krb5_error_code kret;
filename = (kdcprofile) ? kdcprofile : DEFAULT_KDC_PROFILE;
} else { /* read the password */
krb5_context context;
- if ((code = (int) krb5_init_context(&context)) == 0) {
+ if ((code = (int) kadm5_init_krb5_context(&context)) == 0) {
pwsize = sizeof(buffer);
code = krb5_read_password(context, KADM5_PW_FIRST_PROMPT,
KADM5_PW_SECOND_PROMPT,
return KADM5_BAD_CLIENT_PARAMS;
}
- if ((code = kadm5_get_config_params(handle->context,
- DEFAULT_PROFILE_PATH,
- "KRB5_CONFIG",
- params_in,
- &handle->params))) {
+ if ((code = kadm5_get_config_params(handle->context, 0,
+ params_in, &handle->params))) {
krb5_free_context(handle->context);
free(handle);
return(code);
CHECK_HANDLE(handle);
return 0;
}
+
+krb5_error_code kadm5_init_krb5_context (krb5_context *ctx)
+{
+ return krb5_init_context(ctx);
+}
kadm5_get_principals
kadm5_get_privs
kadm5_init
+kadm5_init_krb5_context
kadm5_init_with_creds
kadm5_init_with_password
kadm5_init_with_skey
ok, and the other solutions are even uglier */
if (!context &&
- krb5_init_context(&context))
+ kadm5_init_krb5_context(&context))
return(FALSE);
switch(xdrs->x_op) {
myfulldir=lib/kadm5/srv
mydir=srv
BUILDTOP=$(REL)..$(S)..$(S)..
-LOCALINCLUDES = -I$(BUILDTOP)/include/kadm5
+LOCALINCLUDES = -I$(BUILDTOP)/include/kadm5 \
+ -I$(SRCTOP)/lib/gssapi/krb5 -I$(SRCTOP)/lib/gssapi/generic \
+ -I$(BUILDTOP)/lib/gssapi/krb5 -I$(BUILDTOP)/lib/gssapi/generic
DEFINES = @HESIOD_DEFS@
DEFS=
kadm5_get_principals
kadm5_get_privs
kadm5_init
+kadm5_init_krb5_context
kadm5_init_with_creds
kadm5_init_with_password
kadm5_init_with_skey
#include <stdlib.h>
#include <errno.h>
#include <com_err.h>
+#include "k5-int.h" /* needed for gssapiP_krb5.h */
#include <kadm5/admin.h>
#include <krb5.h>
#include "server_internal.h"
+#include "osconf.h"
/*
* Function check_handle
return ret;
}
- ret = (int) krb5_init_context(&(handle->context));
+ ret = (int) krb5int_init_context_kdc(&(handle->context));
if (ret) {
free_db_args(handle);
free(handle);
params_in = ¶ms_local;
}
+#if 0 /* Now that we look at krb5.conf as well as kdc.conf, we can
+ expect to see admin_server being set sometimes. */
#define ILLEGAL_PARAMS (KADM5_CONFIG_ADMIN_SERVER)
if (params_in && (params_in->mask & ILLEGAL_PARAMS)) {
krb5_free_context(handle->context);
free(handle);
return KADM5_BAD_SERVER_PARAMS;
}
+#endif
- ret = kadm5_get_config_params(handle->context, (char *) NULL,
- (char *) NULL, params_in,
+ ret = kadm5_get_config_params(handle->context, 1, params_in,
&handle->params);
if (ret) {
krb5_free_context(handle->context);
CHECK_HANDLE(handle);
return 0;
}
+
+#include "gssapiP_krb5.h"
+krb5_error_code kadm5_init_krb5_context (krb5_context *ctx)
+{
+ static int first_time = 1;
+ if (first_time) {
+ krb5_error_code err;
+ err = krb5_gss_use_kdc_context();
+ if (err)
+ return err;
+ first_time = 0;
+ }
+ return krb5int_init_context_kdc(ctx);
+}
api_exit
api_start
-test "init 100"
-proc test100 {} {
- global test
-
- # We used to check for ENOENT, but kadm5_get_config_params no
- # longer fails if it cannot find the file---it just provides
- # defaults instead.... XXX will fail on srv test!
- one_line_fail_test {
- kadm5_init admin admin $KADM5_ADMIN_SERVICE \
- [config_params {KADM5_CONFIG_PROFILE} /does-not-exist] \
- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
- server_handle
- } "MISSING_KRB5_CONF_PARAMS"
-}
-if {$RPC} test100
-
if ![info exists RESOLVE] {
set RESOLVE [findfile $objdir/../../../tests/resolve/resolve]
}
}
if {! $RPC} test109
-test "init 114"
-proc test114 {} {
- global test
-
- one_line_fail_test {
- kadm5_init admin admin $KADM5_ADMIN_SERVICE \
- [config_params {KADM5_CONFIG_ADMIN_SERVER} does.not.exist] \
- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
- server_handle
- } "BAD_SERVER_PARAMS"
-}
-if {! $RPC} test114
-
test "init 115"
proc test115 {} {
global test
api_exit; lib_start_api
}
-if {! $RPC} test154
+if {0 && ! $RPC} test154
return ""
krb5_context context;
- krb5_init_context(&context);
+ kadm5_init_krb5_context(&context);
ret = ovsec_kadm_init("admin/none", "admin", "ovsec_adm/admin", 0,
OVSEC_KADM_STRUCT_VERSION, OVSEC_KADM_API_VERSION_1, NULL,
whoami = argv[0];
- kret = krb5_init_context(&context);
+ kret = kadm5_init_krb5_context(&context);
if (kret) {
com_err(whoami, kret, "while initializing krb5");
exit(1);
}
params.mask = 0;
- ret = kadm5_get_config_params(context, NULL, NULL, ¶ms,
- ¶ms);
+ ret = kadm5_get_config_params(context, 1, ¶ms, ¶ms);
if (ret) {
com_err(whoami, ret, "while retrieving configuration parameters");
exit(1);
int x, i;
- krb5_init_context(&context);
+ kadm5_init_krb5_context(&context);
krb5_parse_name(context, "testuser", &tprinc);
ret = ovsec_kadm_init("admin", "admin", "ovsec_adm/admin", 0,
*/
memset((char *) &context, 0, sizeof(context));
- krb5_init_context(&context);
+ kadm5_init_krb5_context(&context);
ret = krb5_parse_name(context, principal, &princ);
if (ret) {
if (!(kf = fopen(keyfile, "w")))
#endif
{
+ int e = errno;
#if HAVE_UMASK
(void) umask(oumask);
#endif
- return errno;
+ return e;
}
enctype = key->enctype;
if ((fwrite((krb5_pointer) &enctype,
extern void krb5_win_ccdll_load(krb5_context context);
#endif
-static krb5_error_code init_common (krb5_context *, krb5_boolean);
+static krb5_error_code init_common (krb5_context *, krb5_boolean, krb5_boolean);
krb5_error_code KRB5_CALLCONV
krb5_init_context(krb5_context *context)
{
- return init_common (context, FALSE);
+ return init_common (context, FALSE, FALSE);
}
krb5_error_code KRB5_CALLCONV
/* This is to make gcc -Wall happy */
if(0) krb5_brand[0] = krb5_brand[0];
- return init_common (context, TRUE);
+ return init_common (context, TRUE, FALSE);
+}
+
+krb5_error_code KRB5_CALLCONV
+krb5int_init_context_kdc(krb5_context *context)
+{
+ return init_common (context, FALSE, TRUE);
}
static krb5_error_code
-init_common (krb5_context *context, krb5_boolean secure)
+init_common (krb5_context *context, krb5_boolean secure, krb5_boolean kdc)
{
krb5_context ctx = 0;
krb5_error_code retval;
sizeof(krb5_enctype) * ctx->tgs_ktype_count);
ctx->conf_tgs_ktypes_count = ctx->tgs_ktype_count;
- if ((retval = krb5_os_init_context(ctx)))
+ if ((retval = krb5_os_init_context(ctx, kdc)))
goto cleanup;
/* initialize the prng (not well, but passable) */
krb5_get_error_message
krb5_free_error_message
krb5_clear_error_message
+krb5int_init_context_kdc
#ifdef USE_LOGIN_LIBRARY
/* If __KLAllowHomeDirectoryAccess() == FALSE, we are probably
trying to authenticate to a fileserver for the user's homedir. */
- if (secure || !__KLAllowHomeDirectoryAccess ()) {
-#else
- if (secure) {
+ if (!__KLAllowHomeDirectoryAccess ())
+ secure = 1;
#endif
- filepath = DEFAULT_SECURE_PROFILE_PATH;
+ if (secure) {
+ filepath = DEFAULT_SECURE_PROFILE_PATH;
} else {
filepath = getenv("KRB5_CONFIG");
if (!filepath) filepath = DEFAULT_PROFILE_PATH;
return 0;
}
+static krb5_error_code
+add_kdc_config_file(profile_filespec_t **pfiles)
+{
+ char *file;
+ size_t count;
+ profile_filespec_t *newfiles;
+
+ file = getenv(KDC_PROFILE_ENV);
+ if (file == NULL)
+ file = DEFAULT_KDC_PROFILE;
+
+ for (count = 0; (*pfiles)[count]; count++)
+ ;
+ count += 2;
+ newfiles = malloc(count * sizeof(*newfiles));
+ if (newfiles == NULL)
+ return errno;
+ memcpy(newfiles + 1, *pfiles, (count-1) * sizeof(*newfiles));
+ newfiles[0] = strdup(file);
+ if (newfiles[0] == NULL) {
+ int e = errno;
+ free(newfiles);
+ return e;
+ }
+ free(*pfiles);
+ *pfiles = newfiles;
+ return 0;
+}
-/* Set the profile paths in the context. If secure is set to TRUE then
- do not include user paths (from environment variables, etc.)
-*/
+
+/* Set the profile paths in the context. If secure is set to TRUE
+ then do not include user paths (from environment variables, etc).
+ If kdc is TRUE, include kdc.conf from whereever we expect to find
+ it. */
static krb5_error_code
-os_init_paths(krb5_context ctx)
+os_init_paths(krb5_context ctx, krb5_boolean kdc)
{
krb5_error_code retval = 0;
profile_filespec_t *files = 0;
retval = os_get_default_config_files(&files, secure);
+ if (retval == 0)
+ retval = add_kdc_config_file(&files);
+
if (!retval) {
retval = profile_init((const_profile_filespec_t *) files,
&ctx->profile);
}
krb5_error_code
-krb5_os_init_context(krb5_context ctx)
+krb5_os_init_context(krb5_context ctx, krb5_boolean kdc)
{
krb5_os_context os_ctx;
krb5_error_code retval = 0;
ctx->vtbl = 0;
PLUGIN_DIR_INIT(&ctx->libkrb5_plugins);
- retval = os_init_paths(ctx);
+ retval = os_init_paths(ctx, kdc);
/*
* If there's an error in the profile, return an error. Just
* ignoring the error is a Bad Thing (tm).
}
ctx->profile_secure = TRUE;
- retval = os_init_paths(ctx);
+ retval = os_init_paths(ctx, FALSE);
if (retval)
return retval;
/* now initialize lockp->lockinfo if necessary */
if (lockp->lockinfo.lockfile == NULL) {
- if ((code = krb5_init_context(&lockp->lockinfo.context))) {
+ if ((code = krb5int_init_context_kdc(&lockp->lockinfo.context))) {
free(db);
return((krb5_error_code) code);
}
projects / thirdparty / krb5.git / commitdiff
