diff options
author | Simo Sorce <ssorce@redhat.com> | 2011-06-20 19:35:50 -0400 |
---|---|---|
committer | Simo Sorce <ssorce@redhat.com> | 2011-08-26 08:24:49 -0400 |
commit | 452fcdccdccb4340f20c85dd9d4f45ee2b02bf37 (patch) | |
tree | 65e61bd20f90aad8b56ffe92b8083c3091a4703a /daemons/ipa-kdb/ipa_kdb_passwords.c | |
parent | 49c25dbdf5b51a6cc157135a0d2f89c7eb408dd9 (diff) | |
download | freeipa-452fcdccdccb4340f20c85dd9d4f45ee2b02bf37.tar.gz freeipa-452fcdccdccb4340f20c85dd9d4f45ee2b02bf37.tar.xz freeipa-452fcdccdccb4340f20c85dd9d4f45ee2b02bf37.zip |
ipa-kdb: implement change_pwd function
Diffstat (limited to 'daemons/ipa-kdb/ipa_kdb_passwords.c')
-rw-r--r-- | daemons/ipa-kdb/ipa_kdb_passwords.c | 102 |
1 files changed, 102 insertions, 0 deletions
diff --git a/daemons/ipa-kdb/ipa_kdb_passwords.c b/daemons/ipa-kdb/ipa_kdb_passwords.c new file mode 100644 index 000000000..9c927c265 --- /dev/null +++ b/daemons/ipa-kdb/ipa_kdb_passwords.c @@ -0,0 +1,102 @@ +/* + * MIT Kerberos KDC database backend for FreeIPA + * + * Authors: Simo Sorce <ssorce@redhat.com> + * + * Copyright (C) 2011 Simo Sorce, Red Hat + * see file 'COPYING' for use and warranty information + * + * This program is free software you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include "ipa_kdb.h" + +krb5_error_code ipadb_change_pwd(krb5_context context, + krb5_keyblock *master_key, + krb5_key_salt_tuple *ks_tuple, + int ks_tuple_count, char *passwd, + int new_kvno, krb5_boolean keepold, + krb5_db_entry *db_entry) +{ + krb5_error_code kerr; + krb5_data pwd; + struct ipadb_context *ipactx; + krb5_key_salt_tuple *fks = NULL; + int n_fks; + krb5_key_data *keys = NULL; + int n_keys; + krb5_key_data *tdata; + int t_keys; + int old_kvno; + int i; + + ipactx = ipadb_get_context(context); + if (!ipactx) { + return KRB5_KDB_DBNOTINITED; + } + + old_kvno = krb5_db_get_key_data_kvno(context, db_entry->n_key_data, + db_entry->key_data); + if (old_kvno >= new_kvno) { + new_kvno = old_kvno + 1; + } + + pwd.data = passwd; + pwd.length = strlen(passwd); + + /* We further filter supported enctypes to restrict to the list + * we have in ldap */ + kerr = filter_key_salt_tuples(context, ks_tuple, ks_tuple_count, + ipactx->supp_encs, ipactx->n_supp_encs, + &fks, &n_fks); + if (kerr) { + return kerr; + } + + kerr = ipa_krb5_generate_key_data(context, db_entry->princ, + pwd, new_kvno, master_key, + n_fks, fks, &n_keys, &keys); + free(fks); + if (kerr) { + return kerr; + } + + if (keepold) { + /* need to add the new keys to the old list */ + t_keys = db_entry->n_key_data; + + tdata = realloc(db_entry->key_data, + sizeof(krb5_key_data) * (t_keys + n_keys)); + if (!tdata) { + ipa_krb5_free_key_data(keys, n_keys); + return ENOMEM; + } + db_entry->key_data = tdata; + db_entry->n_key_data = t_keys + n_keys; + + for (i = 0; i < n_keys; i++) { + db_entry->key_data[t_keys + i] = keys[i]; + } + free(keys); + + } else { + + ipa_krb5_free_key_data(db_entry->key_data, db_entry->n_key_data); + db_entry->key_data = keys; + db_entry->n_key_data = n_keys; + } + + return 0; +} + |