1 /*	$NetBSD: admin.h,v 1.1.1.2 2011/04/14 14:09:16 elric Exp $	*/
2 
3 /*
4  * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan
5  * (Royal Institute of Technology, Stockholm, Sweden).
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * 3. Neither the name of the Institute nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35 /* Id */
36 
37 #ifndef __KADM5_ADMIN_H__
38 #define __KADM5_ADMIN_H__
39 
40 #define KADM5_API_VERSION_1 1
41 #define KADM5_API_VERSION_2 2
42 
43 #ifndef USE_KADM5_API_VERSION
44 #define USE_KADM5_API_VERSION KADM5_API_VERSION_2
45 #endif
46 
47 #if USE_KADM5_API_VERSION != KADM5_API_VERSION_2
48 #error No support for API versions other than 2
49 #endif
50 
51 #define KADM5_STRUCT_VERSION 0
52 
53 #include <krb5/krb5.h>
54 
55 #define KRB5_KDB_DISALLOW_POSTDATED	0x00000001
56 #define KRB5_KDB_DISALLOW_FORWARDABLE	0x00000002
57 #define KRB5_KDB_DISALLOW_TGT_BASED	0x00000004
58 #define KRB5_KDB_DISALLOW_RENEWABLE	0x00000008
59 #define KRB5_KDB_DISALLOW_PROXIABLE	0x00000010
60 #define KRB5_KDB_DISALLOW_DUP_SKEY	0x00000020
61 #define KRB5_KDB_DISALLOW_ALL_TIX	0x00000040
62 #define KRB5_KDB_REQUIRES_PRE_AUTH	0x00000080
63 #define KRB5_KDB_REQUIRES_HW_AUTH	0x00000100
64 #define KRB5_KDB_REQUIRES_PWCHANGE	0x00000200
65 #define KRB5_KDB_DISALLOW_SVR		0x00001000
66 #define KRB5_KDB_PWCHANGE_SERVICE	0x00002000
67 #define KRB5_KDB_SUPPORT_DESMD5		0x00004000
68 #define KRB5_KDB_NEW_PRINC		0x00008000
69 #define KRB5_KDB_OK_AS_DELEGATE		0x00010000
70 #define KRB5_KDB_TRUSTED_FOR_DELEGATION	0x00020000
71 #define KRB5_KDB_ALLOW_KERBEROS4	0x00040000
72 #define KRB5_KDB_ALLOW_DIGEST		0x00080000
73 
74 #define KADM5_PRINCIPAL		0x000001
75 #define KADM5_PRINC_EXPIRE_TIME	0x000002
76 #define KADM5_PW_EXPIRATION	0x000004
77 #define KADM5_LAST_PWD_CHANGE	0x000008
78 #define KADM5_ATTRIBUTES	0x000010
79 #define KADM5_MAX_LIFE		0x000020
80 #define KADM5_MOD_TIME		0x000040
81 #define KADM5_MOD_NAME		0x000080
82 #define KADM5_KVNO		0x000100
83 #define KADM5_MKVNO		0x000200
84 #define KADM5_AUX_ATTRIBUTES	0x000400
85 #define KADM5_POLICY		0x000800
86 #define KADM5_POLICY_CLR	0x001000
87 #define KADM5_MAX_RLIFE		0x002000
88 #define KADM5_LAST_SUCCESS	0x004000
89 #define KADM5_LAST_FAILED	0x008000
90 #define KADM5_FAIL_AUTH_COUNT	0x010000
91 #define KADM5_KEY_DATA		0x020000
92 #define KADM5_TL_DATA		0x040000
93 
94 #define KADM5_PRINCIPAL_NORMAL_MASK (~(KADM5_KEY_DATA | KADM5_TL_DATA))
95 
96 #define KADM5_PW_MAX_LIFE 	0x004000
97 #define KADM5_PW_MIN_LIFE	0x008000
98 #define KADM5_PW_MIN_LENGTH 	0x010000
99 #define KADM5_PW_MIN_CLASSES	0x020000
100 #define KADM5_PW_HISTORY_NUM	0x040000
101 #define KADM5_REF_COUNT		0x080000
102 
103 #define KADM5_POLICY_NORMAL_MASK (~0)
104 
105 #define KADM5_ADMIN_SERVICE	"kadmin/admin"
106 #define KADM5_HIST_PRINCIPAL	"kadmin/history"
107 #define KADM5_CHANGEPW_SERVICE	"kadmin/changepw"
108 
109 typedef struct {
110     int16_t key_data_ver;	/* Version */
111     int16_t key_data_kvno;	/* Key Version */
112     int16_t key_data_type[2];	/* Array of types */
113     int16_t key_data_length[2];	/* Array of lengths */
114     void*   key_data_contents[2];/* Array of pointers */
115 } krb5_key_data;
116 
117 typedef struct _krb5_tl_data {
118     struct _krb5_tl_data* tl_data_next;
119     int16_t tl_data_type;
120     int16_t tl_data_length;
121     void*   tl_data_contents;
122 } krb5_tl_data;
123 
124 #define KRB5_TL_LAST_PWD_CHANGE		0x0001
125 #define KRB5_TL_MOD_PRINC		0x0002
126 #define KRB5_TL_KADM_DATA		0x0003
127 #define KRB5_TL_KADM5_E_DATA		0x0004
128 #define KRB5_TL_RB1_CHALLENGE		0x0005
129 #define KRB5_TL_SECURID_STATE           0x0006
130 #define KRB5_TL_PASSWORD           	0x0007
131 #define KRB5_TL_EXTENSION           	0x0008
132 #define KRB5_TL_PKINIT_ACL           	0x0009
133 #define KRB5_TL_ALIASES           	0x000a
134 
135 typedef struct _kadm5_principal_ent_t {
136     krb5_principal principal;
137 
138     krb5_timestamp princ_expire_time;
139     krb5_timestamp last_pwd_change;
140     krb5_timestamp pw_expiration;
141     krb5_deltat max_life;
142     krb5_principal mod_name;
143     krb5_timestamp mod_date;
144     krb5_flags attributes;
145     krb5_kvno kvno;
146     krb5_kvno mkvno;
147 
148     char * policy;
149     uint32_t aux_attributes;
150 
151     krb5_deltat max_renewable_life;
152     krb5_timestamp last_success;
153     krb5_timestamp last_failed;
154     krb5_kvno fail_auth_count;
155     int16_t n_key_data;
156     int16_t n_tl_data;
157     krb5_tl_data *tl_data;
158     krb5_key_data *key_data;
159 } kadm5_principal_ent_rec, *kadm5_principal_ent_t;
160 
161 typedef struct _kadm5_policy_ent_t {
162     char *policy;
163 
164     uint32_t pw_min_life;
165     uint32_t pw_max_life;
166     uint32_t pw_min_length;
167     uint32_t pw_min_classes;
168     uint32_t pw_history_num;
169     uint32_t policy_refcnt;
170 } kadm5_policy_ent_rec, *kadm5_policy_ent_t;
171 
172 #define KADM5_CONFIG_REALM			(1 << 0)
173 #define KADM5_CONFIG_PROFILE			(1 << 1)
174 #define KADM5_CONFIG_KADMIND_PORT		(1 << 2)
175 #define KADM5_CONFIG_ADMIN_SERVER		(1 << 3)
176 #define KADM5_CONFIG_DBNAME			(1 << 4)
177 #define KADM5_CONFIG_ADBNAME			(1 << 5)
178 #define KADM5_CONFIG_ADB_LOCKFILE		(1 << 6)
179 #define KADM5_CONFIG_ACL_FILE			(1 << 7)
180 #define KADM5_CONFIG_DICT_FILE			(1 << 8)
181 #define KADM5_CONFIG_ADMIN_KEYTAB		(1 << 9)
182 #define KADM5_CONFIG_MKEY_FROM_KEYBOARD		(1 << 10)
183 #define KADM5_CONFIG_STASH_FILE			(1 << 11)
184 #define KADM5_CONFIG_MKEY_NAME			(1 << 12)
185 #define KADM5_CONFIG_ENCTYPE			(1 << 13)
186 #define KADM5_CONFIG_MAX_LIFE			(1 << 14)
187 #define KADM5_CONFIG_MAX_RLIFE			(1 << 15)
188 #define KADM5_CONFIG_EXPIRATION			(1 << 16)
189 #define KADM5_CONFIG_FLAGS			(1 << 17)
190 #define KADM5_CONFIG_ENCTYPES			(1 << 18)
191 
192 #define KADM5_PRIV_GET		(1 << 0)
193 #define KADM5_PRIV_ADD 		(1 << 1)
194 #define KADM5_PRIV_MODIFY	(1 << 2)
195 #define KADM5_PRIV_DELETE	(1 << 3)
196 #define KADM5_PRIV_LIST		(1 << 4)
197 #define KADM5_PRIV_CPW		(1 << 5)
198 #define KADM5_PRIV_ALL		(KADM5_PRIV_GET | KADM5_PRIV_ADD | KADM5_PRIV_MODIFY | KADM5_PRIV_DELETE | KADM5_PRIV_LIST | KADM5_PRIV_CPW)
199 
200 typedef struct {
201     int XXX;
202 }krb5_key_salt_tuple;
203 
204 typedef struct _kadm5_config_params {
205     uint32_t mask;
206 
207     /* Client and server fields */
208     char *realm;
209     int kadmind_port;
210 
211     /* client fields */
212     char *admin_server;
213 
214     /* server fields */
215     char *dbname;
216     char *acl_file;
217 
218     /* server library (database) fields */
219     char *stash_file;
220 } kadm5_config_params;
221 
222 typedef krb5_error_code kadm5_ret_t;
223 
224 #include "kadm5-protos.h"
225 
226 #if 0
227 /* unimplemented functions */
228 kadm5_ret_t
229 kadm5_decrypt_key(void *server_handle,
230 		  kadm5_principal_ent_t entry, int32_t
231 		  ktype, int32_t stype, int32_t
232 		  kvno, krb5_keyblock *keyblock,
233 		  krb5_keysalt *keysalt, int *kvnop);
234 
235 kadm5_ret_t
236 kadm5_create_policy(void *server_handle,
237 		    kadm5_policy_ent_t policy, uint32_t mask);
238 
239 kadm5_ret_t
240 kadm5_delete_policy(void *server_handle, char *policy);
241 
242 
243 kadm5_ret_t
244 kadm5_modify_policy(void *server_handle,
245 		    kadm5_policy_ent_t policy,
246 		    uint32_t mask);
247 
248 kadm5_ret_t
249 kadm5_get_policy(void *server_handle, char *policy, kadm5_policy_ent_t ent);
250 
251 kadm5_ret_t
252 kadm5_get_policies(void *server_handle, char *exp,
253 		   char ***pols, int *count);
254 
255 void
256 kadm5_free_policy_ent(kadm5_policy_ent_t policy);
257 
258 #endif
259 
260 #endif /* __KADM5_ADMIN_H__ */
261