1b528cefcSMark Murray /*
2c19800e8SDoug Rabson * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
3b528cefcSMark Murray * (Royal Institute of Technology, Stockholm, Sweden).
4b528cefcSMark Murray * All rights reserved.
5b528cefcSMark Murray *
6b528cefcSMark Murray * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7b528cefcSMark Murray *
8b528cefcSMark Murray * Redistribution and use in source and binary forms, with or without
9b528cefcSMark Murray * modification, are permitted provided that the following conditions
10b528cefcSMark Murray * are met:
11b528cefcSMark Murray *
12b528cefcSMark Murray * 1. Redistributions of source code must retain the above copyright
13b528cefcSMark Murray * notice, this list of conditions and the following disclaimer.
14b528cefcSMark Murray *
15b528cefcSMark Murray * 2. Redistributions in binary form must reproduce the above copyright
16b528cefcSMark Murray * notice, this list of conditions and the following disclaimer in the
17b528cefcSMark Murray * documentation and/or other materials provided with the distribution.
18b528cefcSMark Murray *
19b528cefcSMark Murray * 3. Neither the name of the Institute nor the names of its contributors
20b528cefcSMark Murray * may be used to endorse or promote products derived from this software
21b528cefcSMark Murray * without specific prior written permission.
22b528cefcSMark Murray *
23b528cefcSMark Murray * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24b528cefcSMark Murray * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25b528cefcSMark Murray * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26b528cefcSMark Murray * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27b528cefcSMark Murray * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28b528cefcSMark Murray * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29b528cefcSMark Murray * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30b528cefcSMark Murray * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31b528cefcSMark Murray * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32b528cefcSMark Murray * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33b528cefcSMark Murray * SUCH DAMAGE.
34b528cefcSMark Murray */
35c19800e8SDoug Rabson
36c19800e8SDoug Rabson #include "kuser_locl.h"
37c19800e8SDoug Rabson
38c19800e8SDoug Rabson #ifdef __APPLE__
39c19800e8SDoug Rabson #include <Security/Security.h>
405e9cd1aeSAssar Westerlund #endif
415e9cd1aeSAssar Westerlund
425e9cd1aeSAssar Westerlund #ifndef NO_NTLM
435e9cd1aeSAssar Westerlund #include "heimntlm.h"
44b528cefcSMark Murray #endif
45c19800e8SDoug Rabson
46b528cefcSMark Murray int forwardable_flag = -1;
47b528cefcSMark Murray int proxiable_flag = -1;
48b528cefcSMark Murray int renewable_flag = -1;
49c19800e8SDoug Rabson int renew_flag = 0;
508373020dSJacques Vidrine int pac_flag = -1;
515e9cd1aeSAssar Westerlund int validate_flag = 0;
52b528cefcSMark Murray int version_flag = 0;
53b528cefcSMark Murray int help_flag = 0;
54c19800e8SDoug Rabson int addrs_flag = -1;
55b528cefcSMark Murray struct getarg_strings extra_addresses;
56b528cefcSMark Murray int anonymous_flag = 0;
57b528cefcSMark Murray char *lifetime = NULL;
58b528cefcSMark Murray char *renew_life = NULL;
59b528cefcSMark Murray char *server_str = NULL;
60bbd80c28SJacques Vidrine char *cred_cache = NULL;
614137ff4cSJacques Vidrine char *start_str = NULL;
62c19800e8SDoug Rabson static int switch_cache_flags = 1;
63b528cefcSMark Murray struct getarg_strings etype_str;
64c19800e8SDoug Rabson int use_keytab = 0;
65c19800e8SDoug Rabson char *keytab_str = NULL;
66c19800e8SDoug Rabson int do_afslog = -1;
67c19800e8SDoug Rabson int fcache_version;
68c19800e8SDoug Rabson char *password_file = NULL;
69c19800e8SDoug Rabson char *pk_user_id = NULL;
70c19800e8SDoug Rabson int pk_enterprise_flag = 0;
71c19800e8SDoug Rabson struct hx509_certs_data *ent_user_id = NULL;
72b528cefcSMark Murray char *pk_x509_anchors = NULL;
735e9cd1aeSAssar Westerlund int pk_use_enckey = 0;
74c19800e8SDoug Rabson static int canonicalize_flag = 0;
75c19800e8SDoug Rabson static int enterprise_flag = 0;
76c19800e8SDoug Rabson static int ok_as_delegate_flag = 0;
77c19800e8SDoug Rabson static int use_referrals_flag = 0;
78c19800e8SDoug Rabson static int windows_flag = 0;
79c19800e8SDoug Rabson #ifndef NO_NTLM
80c19800e8SDoug Rabson static char *ntlm_domain;
81c19800e8SDoug Rabson #endif
82c19800e8SDoug Rabson
83b528cefcSMark Murray
84b528cefcSMark Murray static struct getargs args[] = {
85b528cefcSMark Murray /*
864137ff4cSJacques Vidrine * used by MIT
874137ff4cSJacques Vidrine * a: ~A
88c19800e8SDoug Rabson * V: verbose
89b528cefcSMark Murray * F: ~f
90b528cefcSMark Murray * P: ~p
91bbd80c28SJacques Vidrine * C: v4 cache name?
92b528cefcSMark Murray * 5:
93b528cefcSMark Murray *
94b528cefcSMark Murray * old flags
955e9cd1aeSAssar Westerlund * 4:
96b528cefcSMark Murray * 9:
97b528cefcSMark Murray */
98b528cefcSMark Murray { "afslog", 0 , arg_flag, &do_afslog,
99b528cefcSMark Murray NP_("obtain afs tokens", ""), NULL },
100b528cefcSMark Murray
101b528cefcSMark Murray { "cache", 'c', arg_string, &cred_cache,
1025e9cd1aeSAssar Westerlund NP_("credentials cache", ""), "cachename" },
103b528cefcSMark Murray
1045e9cd1aeSAssar Westerlund { "forwardable", 0, arg_negative_flag, &forwardable_flag,
105b528cefcSMark Murray NP_("get tickets not forwardable", ""), NULL },
106b528cefcSMark Murray
107b528cefcSMark Murray { NULL, 'f', arg_flag, &forwardable_flag,
108b528cefcSMark Murray NP_("get forwardable tickets", ""), NULL },
109b528cefcSMark Murray
1105e9cd1aeSAssar Westerlund { "keytab", 't', arg_string, &keytab_str,
111b528cefcSMark Murray NP_("keytab to use", ""), "keytabname" },
112b528cefcSMark Murray
113b528cefcSMark Murray { "lifetime", 'l', arg_string, &lifetime,
1145e9cd1aeSAssar Westerlund NP_("lifetime of tickets", ""), "time" },
115b528cefcSMark Murray
116c19800e8SDoug Rabson { "proxiable", 'p', arg_flag, &proxiable_flag,
117b528cefcSMark Murray NP_("get proxiable tickets", ""), NULL },
118b528cefcSMark Murray
119b528cefcSMark Murray { "renew", 'R', arg_flag, &renew_flag,
1205e9cd1aeSAssar Westerlund NP_("renew TGT", ""), NULL },
121b528cefcSMark Murray
122b528cefcSMark Murray { "renewable", 0, arg_flag, &renewable_flag,
123b528cefcSMark Murray NP_("get renewable tickets", ""), NULL },
124b528cefcSMark Murray
125b528cefcSMark Murray { "renewable-life", 'r', arg_string, &renew_life,
126b528cefcSMark Murray NP_("renewable lifetime of tickets", ""), "time" },
127b528cefcSMark Murray
128b528cefcSMark Murray { "server", 'S', arg_string, &server_str,
1295e9cd1aeSAssar Westerlund NP_("server to get ticket for", ""), "principal" },
130b528cefcSMark Murray
131b528cefcSMark Murray { "start-time", 's', arg_string, &start_str,
132b528cefcSMark Murray NP_("when ticket gets valid", ""), "time" },
133b528cefcSMark Murray
134c19800e8SDoug Rabson { "use-keytab", 'k', arg_flag, &use_keytab,
135b528cefcSMark Murray NP_("get key from keytab", ""), NULL },
136b528cefcSMark Murray
1378373020dSJacques Vidrine { "validate", 'v', arg_flag, &validate_flag,
1388373020dSJacques Vidrine NP_("validate TGT", ""), NULL },
1398373020dSJacques Vidrine
1405e9cd1aeSAssar Westerlund { "enctypes", 'e', arg_strings, &etype_str,
1415e9cd1aeSAssar Westerlund NP_("encryption types to use", ""), "enctypes" },
1425e9cd1aeSAssar Westerlund
143c19800e8SDoug Rabson { "fcache-version", 0, arg_integer, &fcache_version,
144c19800e8SDoug Rabson NP_("file cache version to create", ""), NULL },
145c19800e8SDoug Rabson
146c19800e8SDoug Rabson { "addresses", 'A', arg_negative_flag, &addrs_flag,
147c19800e8SDoug Rabson NP_("request a ticket with no addresses", ""), NULL },
148c19800e8SDoug Rabson
149c19800e8SDoug Rabson { "extra-addresses",'a', arg_strings, &extra_addresses,
150c19800e8SDoug Rabson NP_("include these extra addresses", ""), "addresses" },
151c19800e8SDoug Rabson
152c19800e8SDoug Rabson { "anonymous", 0, arg_flag, &anonymous_flag,
153c19800e8SDoug Rabson NP_("request an anonymous ticket", ""), NULL },
154c19800e8SDoug Rabson
155c19800e8SDoug Rabson { "request-pac", 0, arg_flag, &pac_flag,
156c19800e8SDoug Rabson NP_("request a Windows PAC", ""), NULL },
157c19800e8SDoug Rabson
158c19800e8SDoug Rabson { "password-file", 0, arg_string, &password_file,
159c19800e8SDoug Rabson NP_("read the password from a file", ""), NULL },
160c19800e8SDoug Rabson
161c19800e8SDoug Rabson { "canonicalize",0, arg_flag, &canonicalize_flag,
162c19800e8SDoug Rabson NP_("canonicalize client principal", ""), NULL },
163c19800e8SDoug Rabson
164b528cefcSMark Murray { "enterprise",0, arg_flag, &enterprise_flag,
165b528cefcSMark Murray NP_("parse principal as a KRB5-NT-ENTERPRISE name", ""), NULL },
166b528cefcSMark Murray #ifdef PKINIT
167b528cefcSMark Murray { "pk-enterprise", 0, arg_flag, &pk_enterprise_flag,
168b528cefcSMark Murray NP_("use enterprise name from certificate", ""), NULL },
169b528cefcSMark Murray
170b528cefcSMark Murray { "pk-user", 'C', arg_string, &pk_user_id,
171b528cefcSMark Murray NP_("principal's public/private/certificate identifier", ""), "id" },
172b528cefcSMark Murray
173b528cefcSMark Murray { "x509-anchors", 'D', arg_string, &pk_x509_anchors,
174adb0ddaeSAssar Westerlund NP_("directory with CA certificates", ""), "directory" },
175b528cefcSMark Murray
176b528cefcSMark Murray { "pk-use-enckey", 0, arg_flag, &pk_use_enckey,
177b528cefcSMark Murray NP_("Use RSA encrypted reply (instead of DH)", ""), NULL },
1784137ff4cSJacques Vidrine #endif
1794137ff4cSJacques Vidrine #ifndef NO_NTLM
1804137ff4cSJacques Vidrine { "ntlm-domain", 0, arg_string, &ntlm_domain,
1814137ff4cSJacques Vidrine NP_("NTLM domain", ""), "domain" },
1824137ff4cSJacques Vidrine #endif
1834137ff4cSJacques Vidrine
1844137ff4cSJacques Vidrine { "change-default", 0, arg_negative_flag, &switch_cache_flags,
1854137ff4cSJacques Vidrine NP_("switch the default cache to the new credentials cache", ""), NULL },
1864137ff4cSJacques Vidrine
1874137ff4cSJacques Vidrine { "ok-as-delegate", 0, arg_flag, &ok_as_delegate_flag,
1884137ff4cSJacques Vidrine NP_("honor ok-as-delegate on tickets", ""), NULL },
1894137ff4cSJacques Vidrine
1904137ff4cSJacques Vidrine { "use-referrals", 0, arg_flag, &use_referrals_flag,
1914137ff4cSJacques Vidrine NP_("only use referrals, no dns canalisation", ""), NULL },
1924137ff4cSJacques Vidrine
1934137ff4cSJacques Vidrine { "windows", 0, arg_flag, &windows_flag,
1944137ff4cSJacques Vidrine NP_("get windows behavior", ""), NULL },
1954137ff4cSJacques Vidrine
1964137ff4cSJacques Vidrine { "version", 0, arg_flag, &version_flag, NULL, NULL },
1974137ff4cSJacques Vidrine { "help", 0, arg_flag, &help_flag, NULL, NULL }
198c19800e8SDoug Rabson };
199c19800e8SDoug Rabson
2004137ff4cSJacques Vidrine static void
usage(int ret)2014137ff4cSJacques Vidrine usage (int ret)
2024137ff4cSJacques Vidrine {
2034137ff4cSJacques Vidrine arg_printusage_i18n (args,
2044137ff4cSJacques Vidrine sizeof(args)/sizeof(*args),
2054137ff4cSJacques Vidrine N_("Usage: ", ""),
2064137ff4cSJacques Vidrine NULL,
2074137ff4cSJacques Vidrine "[principal [command]]",
2084137ff4cSJacques Vidrine getarg_i18n);
2091c43270aSJacques Vidrine exit (ret);
2100cadf2f4SJacques Vidrine }
2114137ff4cSJacques Vidrine
2121c43270aSJacques Vidrine static krb5_error_code
get_server(krb5_context context,krb5_principal client,const char * server,krb5_principal * princ)2131c43270aSJacques Vidrine get_server(krb5_context context,
2144137ff4cSJacques Vidrine krb5_principal client,
2151c43270aSJacques Vidrine const char *server,
2160cadf2f4SJacques Vidrine krb5_principal *princ)
2174137ff4cSJacques Vidrine {
2184137ff4cSJacques Vidrine krb5_const_realm realm;
2194137ff4cSJacques Vidrine if(server)
2204137ff4cSJacques Vidrine return krb5_parse_name(context, server, princ);
2214137ff4cSJacques Vidrine
2224137ff4cSJacques Vidrine realm = krb5_principal_get_realm(context, client);
2234137ff4cSJacques Vidrine return krb5_make_principal(context, princ, realm,
224c19800e8SDoug Rabson KRB5_TGS_NAME, realm, NULL);
2254137ff4cSJacques Vidrine }
226c19800e8SDoug Rabson
2274137ff4cSJacques Vidrine static int
renew_validate(krb5_context context,int renew,int validate,krb5_ccache cache,const char * server,krb5_deltat life)2284137ff4cSJacques Vidrine renew_validate(krb5_context context,
2294137ff4cSJacques Vidrine int renew,
2304137ff4cSJacques Vidrine int validate,
2314137ff4cSJacques Vidrine krb5_ccache cache,
2324137ff4cSJacques Vidrine const char *server,
2334137ff4cSJacques Vidrine krb5_deltat life)
2344137ff4cSJacques Vidrine {
2354137ff4cSJacques Vidrine krb5_error_code ret;
236b528cefcSMark Murray krb5_creds in, *out = NULL;
237b528cefcSMark Murray krb5_kdc_flags flags;
238b528cefcSMark Murray
239b528cefcSMark Murray memset(&in, 0, sizeof(in));
240b528cefcSMark Murray
241b528cefcSMark Murray ret = krb5_cc_get_principal(context, cache, &in.client);
242b528cefcSMark Murray if(ret) {
243b528cefcSMark Murray krb5_warn(context, ret, "krb5_cc_get_principal");
244b528cefcSMark Murray return ret;
245c19800e8SDoug Rabson }
246b528cefcSMark Murray ret = get_server(context, in.client, server, &in.server);
247b528cefcSMark Murray if(ret) {
248b528cefcSMark Murray krb5_warn(context, ret, "get_server");
249b528cefcSMark Murray goto out;
250b528cefcSMark Murray }
251b528cefcSMark Murray
252b528cefcSMark Murray if (renew) {
253b528cefcSMark Murray /*
254b528cefcSMark Murray * no need to check the error here, it's only to be
2554137ff4cSJacques Vidrine * friendly to the user
256b528cefcSMark Murray */
2574137ff4cSJacques Vidrine krb5_get_credentials(context, KRB5_GC_CACHED, cache, &in, &out);
258b528cefcSMark Murray }
259b528cefcSMark Murray
260c19800e8SDoug Rabson flags.i = 0;
261c19800e8SDoug Rabson flags.b.renewable = flags.b.renew = renew;
262c19800e8SDoug Rabson flags.b.validate = validate;
263c19800e8SDoug Rabson
264c19800e8SDoug Rabson if (forwardable_flag != -1)
265c19800e8SDoug Rabson flags.b.forwardable = forwardable_flag;
266c19800e8SDoug Rabson else if (out)
267c19800e8SDoug Rabson flags.b.forwardable = out->flags.b.forwardable;
268c19800e8SDoug Rabson
269b528cefcSMark Murray if (proxiable_flag != -1)
270b528cefcSMark Murray flags.b.proxiable = proxiable_flag;
271b528cefcSMark Murray else if (out)
272c19800e8SDoug Rabson flags.b.proxiable = out->flags.b.proxiable;
273adb0ddaeSAssar Westerlund
2745e9cd1aeSAssar Westerlund if (anonymous_flag)
275c19800e8SDoug Rabson flags.b.request_anonymous = anonymous_flag;
276c19800e8SDoug Rabson if(life)
277c19800e8SDoug Rabson in.times.endtime = time(NULL) + life;
278adb0ddaeSAssar Westerlund
2795e9cd1aeSAssar Westerlund if (out) {
280c19800e8SDoug Rabson krb5_free_creds (context, out);
281c19800e8SDoug Rabson out = NULL;
282c19800e8SDoug Rabson }
283adb0ddaeSAssar Westerlund
2845e9cd1aeSAssar Westerlund
285b528cefcSMark Murray ret = krb5_get_kdc_cred(context,
286b528cefcSMark Murray cache,
287b528cefcSMark Murray flags,
288c19800e8SDoug Rabson NULL,
289c19800e8SDoug Rabson NULL,
290c19800e8SDoug Rabson &in,
291c19800e8SDoug Rabson &out);
292c19800e8SDoug Rabson if(ret) {
293c19800e8SDoug Rabson krb5_warn(context, ret, "krb5_get_kdc_cred");
294b528cefcSMark Murray goto out;
295b528cefcSMark Murray }
296b528cefcSMark Murray ret = krb5_cc_initialize(context, cache, in.client);
297b528cefcSMark Murray if(ret) {
298b528cefcSMark Murray krb5_free_creds (context, out);
299b528cefcSMark Murray krb5_warn(context, ret, "krb5_cc_initialize");
300b528cefcSMark Murray goto out;
301b528cefcSMark Murray }
302b528cefcSMark Murray ret = krb5_cc_store_cred(context, cache, out);
303b528cefcSMark Murray
304b528cefcSMark Murray if(ret == 0 && server == NULL) {
305b528cefcSMark Murray /* only do this if it's a general renew-my-tgt request */
306b528cefcSMark Murray #ifndef NO_AFS
307b528cefcSMark Murray if(do_afslog && k_hasafs())
308b528cefcSMark Murray krb5_afslog(context, cache, NULL, NULL);
309b528cefcSMark Murray #endif
310b528cefcSMark Murray }
311b528cefcSMark Murray
3124137ff4cSJacques Vidrine krb5_free_creds (context, out);
3134137ff4cSJacques Vidrine if(ret) {
3144137ff4cSJacques Vidrine krb5_warn(context, ret, "krb5_cc_store_cred");
3154137ff4cSJacques Vidrine goto out;
3164137ff4cSJacques Vidrine }
3174137ff4cSJacques Vidrine out:
3184137ff4cSJacques Vidrine krb5_free_cred_contents(context, &in);
3194137ff4cSJacques Vidrine return ret;
3204137ff4cSJacques Vidrine }
321b528cefcSMark Murray
322b528cefcSMark Murray #ifndef NO_NTLM
323b528cefcSMark Murray
324b528cefcSMark Murray static krb5_error_code
store_ntlmkey(krb5_context context,krb5_ccache id,const char * domain,struct ntlm_buf * buf)325b528cefcSMark Murray store_ntlmkey(krb5_context context, krb5_ccache id,
326b528cefcSMark Murray const char *domain, struct ntlm_buf *buf)
327c19800e8SDoug Rabson {
328b528cefcSMark Murray krb5_error_code ret;
329b528cefcSMark Murray krb5_data data;
330b528cefcSMark Murray char *name;
3314137ff4cSJacques Vidrine
332c19800e8SDoug Rabson asprintf(&name, "ntlm-key-%s", domain);
333c19800e8SDoug Rabson if (name == NULL) {
334c19800e8SDoug Rabson krb5_clear_error_message(context);
335c19800e8SDoug Rabson return ENOMEM;
336c19800e8SDoug Rabson }
337c19800e8SDoug Rabson
338c19800e8SDoug Rabson data.length = buf->length;
339c19800e8SDoug Rabson data.data = buf->data;
340c19800e8SDoug Rabson
341c19800e8SDoug Rabson ret = krb5_cc_set_config(context, id, NULL, name, &data);
342c19800e8SDoug Rabson free(name);
343c19800e8SDoug Rabson return ret;
344c19800e8SDoug Rabson }
345c19800e8SDoug Rabson #endif
346c19800e8SDoug Rabson
347c19800e8SDoug Rabson static krb5_error_code
get_new_tickets(krb5_context context,krb5_principal principal,krb5_ccache ccache,krb5_deltat ticket_life,int interactive)348c19800e8SDoug Rabson get_new_tickets(krb5_context context,
349c19800e8SDoug Rabson krb5_principal principal,
350c19800e8SDoug Rabson krb5_ccache ccache,
351c19800e8SDoug Rabson krb5_deltat ticket_life,
352c19800e8SDoug Rabson int interactive)
353c19800e8SDoug Rabson {
354c19800e8SDoug Rabson krb5_error_code ret;
355c19800e8SDoug Rabson krb5_get_init_creds_opt *opt;
356c19800e8SDoug Rabson krb5_creds cred;
357c19800e8SDoug Rabson char passwd[256];
358c19800e8SDoug Rabson krb5_deltat start_time = 0;
359c19800e8SDoug Rabson krb5_deltat renew = 0;
360c19800e8SDoug Rabson const char *renewstr = NULL;
361c19800e8SDoug Rabson krb5_enctype *enctype = NULL;
362c19800e8SDoug Rabson krb5_ccache tempccache;
363c19800e8SDoug Rabson #ifndef NO_NTLM
364c19800e8SDoug Rabson struct ntlm_buf ntlmkey;
3654137ff4cSJacques Vidrine memset(&ntlmkey, 0, sizeof(ntlmkey));
3664137ff4cSJacques Vidrine #endif
3674137ff4cSJacques Vidrine passwd[0] = '\0';
368c19800e8SDoug Rabson
369c19800e8SDoug Rabson if (password_file) {
370b528cefcSMark Murray FILE *f;
371b528cefcSMark Murray
372c19800e8SDoug Rabson if (strcasecmp("STDIN", password_file) == 0)
3734137ff4cSJacques Vidrine f = stdin;
3745e9cd1aeSAssar Westerlund else
3754137ff4cSJacques Vidrine f = fopen(password_file, "r");
3768373020dSJacques Vidrine if (f == NULL)
377c19800e8SDoug Rabson krb5_errx(context, 1, "Failed to open the password file %s",
378c19800e8SDoug Rabson password_file);
379c19800e8SDoug Rabson
380c19800e8SDoug Rabson if (fgets(passwd, sizeof(passwd), f) == NULL)
381c19800e8SDoug Rabson krb5_errx(context, 1,
382c19800e8SDoug Rabson N_("Failed to read password from file %s", ""),
383c19800e8SDoug Rabson password_file);
384c19800e8SDoug Rabson if (f != stdin)
385c19800e8SDoug Rabson fclose(f);
386c19800e8SDoug Rabson passwd[strcspn(passwd, "\n")] = '\0';
387c19800e8SDoug Rabson }
388c19800e8SDoug Rabson
389c19800e8SDoug Rabson #ifdef __APPLE__
390c19800e8SDoug Rabson if (passwd[0] == '\0') {
391c19800e8SDoug Rabson const char *realm;
392c19800e8SDoug Rabson OSStatus osret;
393c19800e8SDoug Rabson UInt32 length;
394c19800e8SDoug Rabson void *buffer;
395c19800e8SDoug Rabson char *name;
396c19800e8SDoug Rabson
397c19800e8SDoug Rabson realm = krb5_principal_get_realm(context, principal);
398c19800e8SDoug Rabson
399c19800e8SDoug Rabson ret = krb5_unparse_name_flags(context, principal,
400c19800e8SDoug Rabson KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
401c19800e8SDoug Rabson if (ret)
402c19800e8SDoug Rabson goto nopassword;
403c19800e8SDoug Rabson
404b528cefcSMark Murray osret = SecKeychainFindGenericPassword(NULL, strlen(realm), realm,
405b528cefcSMark Murray strlen(name), name,
406b528cefcSMark Murray &length, &buffer, NULL);
407c19800e8SDoug Rabson free(name);
408c19800e8SDoug Rabson if (osret == noErr && length < sizeof(passwd) - 1) {
409c19800e8SDoug Rabson memcpy(passwd, buffer, length);
410b528cefcSMark Murray passwd[length] = '\0';
4115e9cd1aeSAssar Westerlund }
412c19800e8SDoug Rabson nopassword:
4135e9cd1aeSAssar Westerlund do { } while(0);
4145e9cd1aeSAssar Westerlund }
415c19800e8SDoug Rabson #endif
4165e9cd1aeSAssar Westerlund
417c19800e8SDoug Rabson memset(&cred, 0, sizeof(cred));
4185e9cd1aeSAssar Westerlund
419c19800e8SDoug Rabson ret = krb5_get_init_creds_opt_alloc (context, &opt);
420c19800e8SDoug Rabson if (ret)
421c19800e8SDoug Rabson krb5_err(context, 1, ret, "krb5_get_init_creds_opt_alloc");
422c19800e8SDoug Rabson
423c19800e8SDoug Rabson krb5_get_init_creds_opt_set_default_flags(context, "kinit",
424c19800e8SDoug Rabson krb5_principal_get_realm(context, principal), opt);
425c19800e8SDoug Rabson
426c19800e8SDoug Rabson if(forwardable_flag != -1)
427c19800e8SDoug Rabson krb5_get_init_creds_opt_set_forwardable (opt, forwardable_flag);
428c19800e8SDoug Rabson if(proxiable_flag != -1)
429c19800e8SDoug Rabson krb5_get_init_creds_opt_set_proxiable (opt, proxiable_flag);
430c19800e8SDoug Rabson if(anonymous_flag)
431c19800e8SDoug Rabson krb5_get_init_creds_opt_set_anonymous (opt, anonymous_flag);
432c19800e8SDoug Rabson if (pac_flag != -1)
433c19800e8SDoug Rabson krb5_get_init_creds_opt_set_pac_request(context, opt,
434c19800e8SDoug Rabson pac_flag ? TRUE : FALSE);
435c19800e8SDoug Rabson if (canonicalize_flag)
436c19800e8SDoug Rabson krb5_get_init_creds_opt_set_canonicalize(context, opt, TRUE);
437c19800e8SDoug Rabson if (pk_enterprise_flag || enterprise_flag || canonicalize_flag || windows_flag)
438b528cefcSMark Murray krb5_get_init_creds_opt_set_win2k(context, opt, TRUE);
439b528cefcSMark Murray if (pk_user_id || ent_user_id || anonymous_flag) {
440c19800e8SDoug Rabson ret = krb5_get_init_creds_opt_set_pkinit(context, opt,
441c19800e8SDoug Rabson principal,
442c19800e8SDoug Rabson pk_user_id,
443b528cefcSMark Murray pk_x509_anchors,
444c19800e8SDoug Rabson NULL,
445c19800e8SDoug Rabson NULL,
446c19800e8SDoug Rabson pk_use_enckey ? 2 : 0 |
447c19800e8SDoug Rabson anonymous_flag ? 4 : 0,
448c19800e8SDoug Rabson krb5_prompter_posix,
449c19800e8SDoug Rabson NULL,
450c19800e8SDoug Rabson passwd);
451c19800e8SDoug Rabson if (ret)
452c19800e8SDoug Rabson krb5_err(context, 1, ret, "krb5_get_init_creds_opt_set_pkinit");
453c19800e8SDoug Rabson if (ent_user_id)
4541c43270aSJacques Vidrine krb5_get_init_creds_opt_set_pkinit_user_certs(context, opt, ent_user_id);
4558373020dSJacques Vidrine }
456b528cefcSMark Murray
457c19800e8SDoug Rabson if (addrs_flag != -1)
458b528cefcSMark Murray krb5_get_init_creds_opt_set_addressless(context, opt,
459b528cefcSMark Murray addrs_flag ? FALSE : TRUE);
460b528cefcSMark Murray
461b528cefcSMark Murray if (renew_life == NULL && renewable_flag)
462b528cefcSMark Murray renewstr = "1 month";
463b528cefcSMark Murray if (renew_life)
464b528cefcSMark Murray renewstr = renew_life;
465b528cefcSMark Murray if (renewstr) {
466b528cefcSMark Murray renew = parse_time (renewstr, "s");
467b528cefcSMark Murray if (renew < 0)
468b528cefcSMark Murray errx (1, "unparsable time: %s", renewstr);
469c19800e8SDoug Rabson
470b528cefcSMark Murray krb5_get_init_creds_opt_set_renew_life (opt, renew);
471b528cefcSMark Murray }
472b528cefcSMark Murray
473b528cefcSMark Murray if(ticket_life != 0)
474b528cefcSMark Murray krb5_get_init_creds_opt_set_tkt_life (opt, ticket_life);
475b528cefcSMark Murray
476b528cefcSMark Murray if(start_str) {
477b528cefcSMark Murray int tmp = parse_time (start_str, "s");
478b528cefcSMark Murray if (tmp < 0)
479b528cefcSMark Murray errx (1, N_("unparsable time: %s", ""), start_str);
480c19800e8SDoug Rabson
481b528cefcSMark Murray start_time = tmp;
482b528cefcSMark Murray }
483b528cefcSMark Murray
484b528cefcSMark Murray if(etype_str.num_strings) {
485b528cefcSMark Murray int i;
486b528cefcSMark Murray
487b528cefcSMark Murray enctype = malloc(etype_str.num_strings * sizeof(*enctype));
488b528cefcSMark Murray if(enctype == NULL)
489b528cefcSMark Murray errx(1, "out of memory");
490b528cefcSMark Murray for(i = 0; i < etype_str.num_strings; i++) {
491b528cefcSMark Murray ret = krb5_string_to_enctype(context,
492b528cefcSMark Murray etype_str.strings[i],
493b528cefcSMark Murray &enctype[i]);
494b528cefcSMark Murray if(ret)
495b528cefcSMark Murray errx(1, "unrecognized enctype: %s", etype_str.strings[i]);
496b528cefcSMark Murray }
497c19800e8SDoug Rabson krb5_get_init_creds_opt_set_etype_list(opt, enctype,
498c19800e8SDoug Rabson etype_str.num_strings);
499b528cefcSMark Murray }
500c19800e8SDoug Rabson
501c19800e8SDoug Rabson if(use_keytab || keytab_str) {
502c19800e8SDoug Rabson krb5_keytab kt;
503c19800e8SDoug Rabson if(keytab_str)
504c19800e8SDoug Rabson ret = krb5_kt_resolve(context, keytab_str, &kt);
505c19800e8SDoug Rabson else
506c19800e8SDoug Rabson ret = krb5_kt_default(context, &kt);
507c19800e8SDoug Rabson if (ret)
508c19800e8SDoug Rabson krb5_err (context, 1, ret, "resolving keytab");
509c19800e8SDoug Rabson ret = krb5_get_init_creds_keytab (context,
510c19800e8SDoug Rabson &cred,
511c19800e8SDoug Rabson principal,
512c19800e8SDoug Rabson kt,
513c19800e8SDoug Rabson start_time,
5145e9cd1aeSAssar Westerlund server_str,
515c19800e8SDoug Rabson opt);
516c19800e8SDoug Rabson krb5_kt_close(context, kt);
5175e9cd1aeSAssar Westerlund } else if (pk_user_id || ent_user_id || anonymous_flag) {
5185e9cd1aeSAssar Westerlund ret = krb5_get_init_creds_password (context,
5195e9cd1aeSAssar Westerlund &cred,
5205e9cd1aeSAssar Westerlund principal,
5215e9cd1aeSAssar Westerlund passwd,
5225e9cd1aeSAssar Westerlund krb5_prompter_posix,
523c19800e8SDoug Rabson NULL,
5245e9cd1aeSAssar Westerlund start_time,
5255e9cd1aeSAssar Westerlund server_str,
5265e9cd1aeSAssar Westerlund opt);
5275e9cd1aeSAssar Westerlund } else if (!interactive) {
528c19800e8SDoug Rabson krb5_warnx(context, "Not interactive, failed to get initial ticket");
529c19800e8SDoug Rabson krb5_get_init_creds_opt_free(context, opt);
5305e9cd1aeSAssar Westerlund return 0;
531b528cefcSMark Murray } else {
532b528cefcSMark Murray
533b528cefcSMark Murray if (passwd[0] == '\0') {
5345e9cd1aeSAssar Westerlund char *p, *prompt;
535b528cefcSMark Murray
536b528cefcSMark Murray krb5_unparse_name (context, principal, &p);
537b528cefcSMark Murray asprintf (&prompt, N_("%s's Password: ", ""), p);
538c19800e8SDoug Rabson free (p);
539c19800e8SDoug Rabson
5405e9cd1aeSAssar Westerlund if (UI_UTIL_read_pw_string(passwd, sizeof(passwd)-1, prompt, 0)){
541c19800e8SDoug Rabson memset(passwd, 0, sizeof(passwd));
542c19800e8SDoug Rabson exit(1);
543c19800e8SDoug Rabson }
5445e9cd1aeSAssar Westerlund free (prompt);
5455e9cd1aeSAssar Westerlund }
546b528cefcSMark Murray
547b528cefcSMark Murray
548b528cefcSMark Murray ret = krb5_get_init_creds_password (context,
549b528cefcSMark Murray &cred,
550b528cefcSMark Murray principal,
551b528cefcSMark Murray passwd,
552b528cefcSMark Murray krb5_prompter_posix,
553c19800e8SDoug Rabson NULL,
554b528cefcSMark Murray start_time,
555b528cefcSMark Murray server_str,
556c19800e8SDoug Rabson opt);
557c19800e8SDoug Rabson }
558c19800e8SDoug Rabson krb5_get_init_creds_opt_free(context, opt);
559b528cefcSMark Murray #ifndef NO_NTLM
560b528cefcSMark Murray if (ntlm_domain && passwd[0])
561b528cefcSMark Murray heim_ntlm_nt_key(passwd, &ntlmkey);
562b528cefcSMark Murray #endif
5638373020dSJacques Vidrine memset(passwd, 0, sizeof(passwd));
5648373020dSJacques Vidrine
565c19800e8SDoug Rabson switch(ret){
566c19800e8SDoug Rabson case 0:
5678373020dSJacques Vidrine break;
5688373020dSJacques Vidrine case KRB5_LIBOS_PWDINTR: /* don't print anything if it was just C-c:ed */
5698373020dSJacques Vidrine exit(1);
5708373020dSJacques Vidrine case KRB5KRB_AP_ERR_BAD_INTEGRITY:
571c19800e8SDoug Rabson case KRB5KRB_AP_ERR_MODIFIED:
5728373020dSJacques Vidrine case KRB5KDC_ERR_PREAUTH_FAILED:
573c19800e8SDoug Rabson krb5_errx(context, 1, N_("Password incorrect", ""));
574c19800e8SDoug Rabson break;
5758373020dSJacques Vidrine case KRB5KRB_AP_ERR_V4_REPLY:
5768373020dSJacques Vidrine krb5_errx(context, 1, N_("Looks like a Kerberos 4 reply", ""));
5778373020dSJacques Vidrine break;
5788373020dSJacques Vidrine default:
5798373020dSJacques Vidrine krb5_err(context, 1, ret, "krb5_get_init_creds");
5808373020dSJacques Vidrine }
581c19800e8SDoug Rabson
582c19800e8SDoug Rabson if(ticket_life != 0) {
583c19800e8SDoug Rabson if(abs(cred.times.endtime - cred.times.starttime - ticket_life) > 30) {
584c19800e8SDoug Rabson char life[64];
585c19800e8SDoug Rabson unparse_time_approx(cred.times.endtime - cred.times.starttime,
586c19800e8SDoug Rabson life, sizeof(life));
587b528cefcSMark Murray krb5_warnx(context, N_("NOTICE: ticket lifetime is %s", ""), life);
588b528cefcSMark Murray }
589b528cefcSMark Murray }
590c19800e8SDoug Rabson if(renew_life) {
591b528cefcSMark Murray if(abs(cred.times.renew_till - cred.times.starttime - renew) > 30) {
592b528cefcSMark Murray char life[64];
593b528cefcSMark Murray unparse_time_approx(cred.times.renew_till - cred.times.starttime,
594c19800e8SDoug Rabson life, sizeof(life));
595c19800e8SDoug Rabson krb5_warnx(context,
596c19800e8SDoug Rabson N_("NOTICE: ticket renewable lifetime is %s", ""),
597c19800e8SDoug Rabson life);
598c19800e8SDoug Rabson }
599c19800e8SDoug Rabson }
600c19800e8SDoug Rabson
601c19800e8SDoug Rabson ret = krb5_cc_new_unique(context, krb5_cc_get_type(context, ccache),
602c19800e8SDoug Rabson NULL, &tempccache);
603c19800e8SDoug Rabson if (ret)
604c19800e8SDoug Rabson krb5_err (context, 1, ret, "krb5_cc_new_unique");
6054137ff4cSJacques Vidrine
6064137ff4cSJacques Vidrine ret = krb5_cc_initialize (context, tempccache, cred.client);
607b528cefcSMark Murray if (ret)
6084137ff4cSJacques Vidrine krb5_err (context, 1, ret, "krb5_cc_initialize");
609c19800e8SDoug Rabson
610c19800e8SDoug Rabson ret = krb5_cc_store_cred (context, tempccache, &cred);
611c19800e8SDoug Rabson if (ret)
612c19800e8SDoug Rabson krb5_err (context, 1, ret, "krb5_cc_store_cred");
613c19800e8SDoug Rabson
614c19800e8SDoug Rabson krb5_free_cred_contents (context, &cred);
615c19800e8SDoug Rabson
616c19800e8SDoug Rabson ret = krb5_cc_move(context, tempccache, ccache);
617c19800e8SDoug Rabson if (ret)
618c19800e8SDoug Rabson krb5_err (context, 1, ret, "krb5_cc_move");
619c19800e8SDoug Rabson
620c19800e8SDoug Rabson if (switch_cache_flags)
621c19800e8SDoug Rabson krb5_cc_switch(context, ccache);
622c19800e8SDoug Rabson
623c19800e8SDoug Rabson #ifndef NO_NTLM
624c19800e8SDoug Rabson if (ntlm_domain && ntlmkey.data)
625c19800e8SDoug Rabson store_ntlmkey(context, ccache, ntlm_domain, &ntlmkey);
626c19800e8SDoug Rabson #endif
627c19800e8SDoug Rabson
628c19800e8SDoug Rabson if (ok_as_delegate_flag || windows_flag || use_referrals_flag) {
629c19800e8SDoug Rabson unsigned char d = 0;
630c19800e8SDoug Rabson krb5_data data;
631c19800e8SDoug Rabson
632c19800e8SDoug Rabson if (ok_as_delegate_flag || windows_flag)
633c19800e8SDoug Rabson d |= 1;
634c19800e8SDoug Rabson if (use_referrals_flag || windows_flag)
635c19800e8SDoug Rabson d |= 2;
636c19800e8SDoug Rabson
637c19800e8SDoug Rabson data.length = 1;
638c19800e8SDoug Rabson data.data = &d;
639c19800e8SDoug Rabson
640c19800e8SDoug Rabson krb5_cc_set_config(context, ccache, NULL, "realm-config", &data);
641c19800e8SDoug Rabson }
642c19800e8SDoug Rabson
643c19800e8SDoug Rabson
644c19800e8SDoug Rabson if (enctype)
645c19800e8SDoug Rabson free(enctype);
646c19800e8SDoug Rabson
647c19800e8SDoug Rabson return 0;
648c19800e8SDoug Rabson }
649c19800e8SDoug Rabson
650c19800e8SDoug Rabson static time_t
ticket_lifetime(krb5_context context,krb5_ccache cache,krb5_principal client,const char * server)651c19800e8SDoug Rabson ticket_lifetime(krb5_context context, krb5_ccache cache,
652c19800e8SDoug Rabson krb5_principal client, const char *server)
653c19800e8SDoug Rabson {
654c19800e8SDoug Rabson krb5_creds in_cred, *cred;
655c19800e8SDoug Rabson krb5_error_code ret;
656c19800e8SDoug Rabson time_t timeout;
657c19800e8SDoug Rabson
658c19800e8SDoug Rabson memset(&in_cred, 0, sizeof(in_cred));
659c19800e8SDoug Rabson
660c19800e8SDoug Rabson ret = krb5_cc_get_principal(context, cache, &in_cred.client);
661c19800e8SDoug Rabson if(ret) {
662c19800e8SDoug Rabson krb5_warn(context, ret, "krb5_cc_get_principal");
663c19800e8SDoug Rabson return 0;
664c19800e8SDoug Rabson }
665c19800e8SDoug Rabson ret = get_server(context, in_cred.client, server, &in_cred.server);
666c19800e8SDoug Rabson if(ret) {
667c19800e8SDoug Rabson krb5_free_principal(context, in_cred.client);
668c19800e8SDoug Rabson krb5_warn(context, ret, "get_server");
669c19800e8SDoug Rabson return 0;
670c19800e8SDoug Rabson }
671c19800e8SDoug Rabson
672c19800e8SDoug Rabson ret = krb5_get_credentials(context, KRB5_GC_CACHED,
673c19800e8SDoug Rabson cache, &in_cred, &cred);
674c19800e8SDoug Rabson krb5_free_principal(context, in_cred.client);
675c19800e8SDoug Rabson krb5_free_principal(context, in_cred.server);
676c19800e8SDoug Rabson if(ret) {
677c19800e8SDoug Rabson krb5_warn(context, ret, "krb5_get_credentials");
678c19800e8SDoug Rabson return 0;
679c19800e8SDoug Rabson }
680c19800e8SDoug Rabson timeout = cred->times.endtime - cred->times.starttime;
681c19800e8SDoug Rabson if (timeout < 0)
682c19800e8SDoug Rabson timeout = 0;
6834137ff4cSJacques Vidrine krb5_free_creds(context, cred);
6844137ff4cSJacques Vidrine return timeout;
6854137ff4cSJacques Vidrine }
6864137ff4cSJacques Vidrine
6874137ff4cSJacques Vidrine struct renew_ctx {
6884137ff4cSJacques Vidrine krb5_context context;
6894137ff4cSJacques Vidrine krb5_ccache ccache;
690c19800e8SDoug Rabson krb5_principal principal;
6914137ff4cSJacques Vidrine krb5_deltat ticket_life;
692c19800e8SDoug Rabson };
6934137ff4cSJacques Vidrine
6944137ff4cSJacques Vidrine static time_t
renew_func(void * ptr)6954137ff4cSJacques Vidrine renew_func(void *ptr)
6964137ff4cSJacques Vidrine {
697c19800e8SDoug Rabson struct renew_ctx *ctx = ptr;
698c19800e8SDoug Rabson krb5_error_code ret;
699c19800e8SDoug Rabson time_t expire;
7004137ff4cSJacques Vidrine int new_tickets = 0;
7014137ff4cSJacques Vidrine
702c19800e8SDoug Rabson if (renewable_flag) {
7034137ff4cSJacques Vidrine ret = renew_validate(ctx->context, renewable_flag, validate_flag,
7044137ff4cSJacques Vidrine ctx->ccache, server_str, ctx->ticket_life);
7054137ff4cSJacques Vidrine if (ret)
7064137ff4cSJacques Vidrine new_tickets = 1;
7074137ff4cSJacques Vidrine } else
7084137ff4cSJacques Vidrine new_tickets = 1;
7094137ff4cSJacques Vidrine
7104137ff4cSJacques Vidrine if (new_tickets)
7114137ff4cSJacques Vidrine get_new_tickets(ctx->context, ctx->principal,
7124137ff4cSJacques Vidrine ctx->ccache, ctx->ticket_life, 0);
713c19800e8SDoug Rabson
714c19800e8SDoug Rabson #ifndef NO_AFS
715c19800e8SDoug Rabson if(do_afslog && k_hasafs())
716c19800e8SDoug Rabson krb5_afslog(ctx->context, ctx->ccache, NULL, NULL);
717c19800e8SDoug Rabson #endif
7184137ff4cSJacques Vidrine
7194137ff4cSJacques Vidrine expire = ticket_lifetime(ctx->context, ctx->ccache, ctx->principal,
720c19800e8SDoug Rabson server_str) / 2;
7214137ff4cSJacques Vidrine return expire + 1;
7224137ff4cSJacques Vidrine }
7234137ff4cSJacques Vidrine
724c19800e8SDoug Rabson int
main(int argc,char ** argv)7254137ff4cSJacques Vidrine main (int argc, char **argv)
7264137ff4cSJacques Vidrine {
7274137ff4cSJacques Vidrine krb5_error_code ret;
7284137ff4cSJacques Vidrine krb5_context context;
7294137ff4cSJacques Vidrine krb5_ccache ccache;
7304137ff4cSJacques Vidrine krb5_principal principal;
7314137ff4cSJacques Vidrine int optidx = 0;
732c19800e8SDoug Rabson krb5_deltat ticket_life = 0;
733c19800e8SDoug Rabson int parseflags = 0;
734c19800e8SDoug Rabson
735c19800e8SDoug Rabson setprogname (argv[0]);
736c19800e8SDoug Rabson
737c19800e8SDoug Rabson setlocale (LC_ALL, "");
738c19800e8SDoug Rabson bindtextdomain ("heimdal_kuser", HEIMDAL_LOCALEDIR);
739c19800e8SDoug Rabson textdomain("heimdal_kuser");
740c19800e8SDoug Rabson
741c19800e8SDoug Rabson ret = krb5_init_context (&context);
742c19800e8SDoug Rabson if (ret == KRB5_CONFIG_BADFORMAT)
743c19800e8SDoug Rabson errx (1, "krb5_init_context failed to parse configuration file");
744c19800e8SDoug Rabson else if (ret)
745c19800e8SDoug Rabson errx(1, "krb5_init_context failed: %d", ret);
7464137ff4cSJacques Vidrine
7474137ff4cSJacques Vidrine if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
7484137ff4cSJacques Vidrine usage(1);
7494137ff4cSJacques Vidrine
7504137ff4cSJacques Vidrine if (help_flag)
7514137ff4cSJacques Vidrine usage (0);
7524137ff4cSJacques Vidrine
7534137ff4cSJacques Vidrine if(version_flag) {
7544137ff4cSJacques Vidrine print_version(NULL);
7554137ff4cSJacques Vidrine exit(0);
7564137ff4cSJacques Vidrine }
7574137ff4cSJacques Vidrine
758c19800e8SDoug Rabson argc -= optidx;
7594137ff4cSJacques Vidrine argv += optidx;
760c19800e8SDoug Rabson
761c19800e8SDoug Rabson if (canonicalize_flag || enterprise_flag)
762c19800e8SDoug Rabson parseflags |= KRB5_PRINCIPAL_PARSE_ENTERPRISE;
7634137ff4cSJacques Vidrine
764c19800e8SDoug Rabson if (pk_enterprise_flag) {
765c19800e8SDoug Rabson ret = krb5_pk_enterprise_cert(context, pk_user_id,
766c19800e8SDoug Rabson argv[0], &principal,
767c19800e8SDoug Rabson &ent_user_id);
7684137ff4cSJacques Vidrine if (ret)
7694137ff4cSJacques Vidrine krb5_err(context, 1, ret, "krb5_pk_enterprise_certs");
770c19800e8SDoug Rabson
771c19800e8SDoug Rabson pk_user_id = NULL;
772c19800e8SDoug Rabson
7734137ff4cSJacques Vidrine } else if (anonymous_flag) {
7744137ff4cSJacques Vidrine
775c19800e8SDoug Rabson ret = krb5_make_principal(context, &principal, argv[0],
7764137ff4cSJacques Vidrine KRB5_WELLKNOWN_NAME, KRB5_ANON_NAME,
7774137ff4cSJacques Vidrine NULL);
7784137ff4cSJacques Vidrine if (ret)
7798d4ba808SJacques Vidrine krb5_err(context, 1, ret, "krb5_make_principal");
7808d4ba808SJacques Vidrine krb5_principal_set_type(context, principal, KRB5_NT_WELLKNOWN);
7818d4ba808SJacques Vidrine
7824137ff4cSJacques Vidrine } else {
7834137ff4cSJacques Vidrine if (argv[0]) {
7844137ff4cSJacques Vidrine ret = krb5_parse_name_flags (context, argv[0], parseflags,
7854137ff4cSJacques Vidrine &principal);
7864137ff4cSJacques Vidrine if (ret)
7874137ff4cSJacques Vidrine krb5_err (context, 1, ret, "krb5_parse_name");
7884137ff4cSJacques Vidrine } else {
7894137ff4cSJacques Vidrine ret = krb5_get_default_principal (context, &principal);
790c19800e8SDoug Rabson if (ret)
7918373020dSJacques Vidrine krb5_err (context, 1, ret, "krb5_get_default_principal");
7928373020dSJacques Vidrine }
7938373020dSJacques Vidrine }
7948373020dSJacques Vidrine
7958373020dSJacques Vidrine if(fcache_version)
7968373020dSJacques Vidrine krb5_set_fcache_version(context, fcache_version);
7978373020dSJacques Vidrine
7988373020dSJacques Vidrine if(renewable_flag == -1)
7998373020dSJacques Vidrine /* this seems somewhat pointless, but whatever */
8008373020dSJacques Vidrine krb5_appdefault_boolean(context, "kinit",
8018373020dSJacques Vidrine krb5_principal_get_realm(context, principal),
8028373020dSJacques Vidrine "renewable", FALSE, &renewable_flag);
8038373020dSJacques Vidrine if(do_afslog == -1)
8048373020dSJacques Vidrine krb5_appdefault_boolean(context, "kinit",
8058373020dSJacques Vidrine krb5_principal_get_realm(context, principal),
8068373020dSJacques Vidrine "afslog", TRUE, &do_afslog);
8078373020dSJacques Vidrine
8084137ff4cSJacques Vidrine if(cred_cache)
8094137ff4cSJacques Vidrine ret = krb5_cc_resolve(context, cred_cache, &ccache);
810c19800e8SDoug Rabson else {
8114137ff4cSJacques Vidrine if(argc > 1) {
8124137ff4cSJacques Vidrine char s[1024];
8134137ff4cSJacques Vidrine ret = krb5_cc_new_unique(context, NULL, NULL, &ccache);
8144137ff4cSJacques Vidrine if(ret)
815c19800e8SDoug Rabson krb5_err(context, 1, ret, "creating cred cache");
8164137ff4cSJacques Vidrine snprintf(s, sizeof(s), "%s:%s",
817c19800e8SDoug Rabson krb5_cc_get_type(context, ccache),
818c19800e8SDoug Rabson krb5_cc_get_name(context, ccache));
819b528cefcSMark Murray setenv("KRB5CCNAME", s, 1);
820b528cefcSMark Murray } else {
821adb0ddaeSAssar Westerlund ret = krb5_cc_cache_match(context, principal, &ccache);
822c19800e8SDoug Rabson if (ret) {
823c19800e8SDoug Rabson const char *type;
824c19800e8SDoug Rabson ret = krb5_cc_default (context, &ccache);
825c19800e8SDoug Rabson if (ret)
826c19800e8SDoug Rabson krb5_err (context, 1, ret, N_("resolving credentials cache", ""));
827c19800e8SDoug Rabson
828c19800e8SDoug Rabson /*
829c19800e8SDoug Rabson * Check if the type support switching, and we do,
830c19800e8SDoug Rabson * then do that instead over overwriting the current
831c19800e8SDoug Rabson * default credential
832c19800e8SDoug Rabson */
833c19800e8SDoug Rabson type = krb5_cc_get_type(context, ccache);
834c19800e8SDoug Rabson if (krb5_cc_support_switch(context, type)) {
835c19800e8SDoug Rabson krb5_cc_close(context, ccache);
836c19800e8SDoug Rabson ret = krb5_cc_new_unique(context, type, NULL, &ccache);
837c19800e8SDoug Rabson }
838c19800e8SDoug Rabson }
839c19800e8SDoug Rabson }
840c19800e8SDoug Rabson }
841adb0ddaeSAssar Westerlund if (ret)
842c19800e8SDoug Rabson krb5_err (context, 1, ret, N_("resolving credentials cache", ""));
843adb0ddaeSAssar Westerlund
844adb0ddaeSAssar Westerlund #ifndef NO_AFS
8451c43270aSJacques Vidrine if(argc > 1 && k_hasafs ())
846b528cefcSMark Murray k_setpag();
8471c43270aSJacques Vidrine #endif
8481c43270aSJacques Vidrine
8494137ff4cSJacques Vidrine if (lifetime) {
850b528cefcSMark Murray int tmp = parse_time (lifetime, "s");
8511c43270aSJacques Vidrine if (tmp < 0)
852b528cefcSMark Murray errx (1, N_("unparsable time: %s", ""), lifetime);
853
854 ticket_life = tmp;
855 }
856
857 if(addrs_flag == 0 && extra_addresses.num_strings > 0)
858 krb5_errx(context, 1,
859 N_("specifying both extra addresses and "
860 "no addresses makes no sense", ""));
861 {
862 int i;
863 krb5_addresses addresses;
864 memset(&addresses, 0, sizeof(addresses));
865 for(i = 0; i < extra_addresses.num_strings; i++) {
866 ret = krb5_parse_address(context, extra_addresses.strings[i],
867 &addresses);
868 if (ret == 0) {
869 krb5_add_extra_addresses(context, &addresses);
870 krb5_free_addresses(context, &addresses);
871 }
872 }
873 free_getarg_strings(&extra_addresses);
874 }
875
876 if(renew_flag || validate_flag) {
877 ret = renew_validate(context, renew_flag, validate_flag,
878 ccache, server_str, ticket_life);
879 exit(ret != 0);
880 }
881
882 get_new_tickets(context, principal, ccache, ticket_life, 1);
883
884 #ifndef NO_AFS
885 if(do_afslog && k_hasafs())
886 krb5_afslog(context, ccache, NULL, NULL);
887 #endif
888 if(argc > 1) {
889 struct renew_ctx ctx;
890 time_t timeout;
891
892 timeout = ticket_lifetime(context, ccache, principal, server_str) / 2;
893
894 ctx.context = context;
895 ctx.ccache = ccache;
896 ctx.principal = principal;
897 ctx.ticket_life = ticket_life;
898
899 ret = simple_execvp_timed(argv[1], argv+1,
900 renew_func, &ctx, timeout);
901 #define EX_NOEXEC 126
902 #define EX_NOTFOUND 127
903 if(ret == EX_NOEXEC)
904 krb5_warnx(context, N_("permission denied: %s", ""), argv[1]);
905 else if(ret == EX_NOTFOUND)
906 krb5_warnx(context, N_("command not found: %s", ""), argv[1]);
907
908 krb5_cc_destroy(context, ccache);
909 #ifndef NO_AFS
910 if(k_hasafs())
911 k_unlog();
912 #endif
913 } else {
914 krb5_cc_close (context, ccache);
915 ret = 0;
916 }
917 krb5_free_principal(context, principal);
918 krb5_free_context (context);
919 return ret;
920 }
921