1c19800e8SDoug Rabson.\" Copyright (c) 2003 - 2004 Kungliga Tekniska Högskolan 2c19800e8SDoug Rabson.\" (Royal Institute of Technology, Stockholm, Sweden). 3c19800e8SDoug Rabson.\" All rights reserved. 4c19800e8SDoug Rabson.\" 5c19800e8SDoug Rabson.\" Redistribution and use in source and binary forms, with or without 6c19800e8SDoug Rabson.\" modification, are permitted provided that the following conditions 7c19800e8SDoug Rabson.\" are met: 8c19800e8SDoug Rabson.\" 9c19800e8SDoug Rabson.\" 1. Redistributions of source code must retain the above copyright 10c19800e8SDoug Rabson.\" notice, this list of conditions and the following disclaimer. 11c19800e8SDoug Rabson.\" 12c19800e8SDoug Rabson.\" 2. Redistributions in binary form must reproduce the above copyright 13c19800e8SDoug Rabson.\" notice, this list of conditions and the following disclaimer in the 14c19800e8SDoug Rabson.\" documentation and/or other materials provided with the distribution. 15c19800e8SDoug Rabson.\" 16c19800e8SDoug Rabson.\" 3. Neither the name of the Institute nor the names of its contributors 17c19800e8SDoug Rabson.\" may be used to endorse or promote products derived from this software 18c19800e8SDoug Rabson.\" without specific prior written permission. 19c19800e8SDoug Rabson.\" 20c19800e8SDoug Rabson.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 21c19800e8SDoug Rabson.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22c19800e8SDoug Rabson.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23c19800e8SDoug Rabson.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 24c19800e8SDoug Rabson.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25c19800e8SDoug Rabson.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26c19800e8SDoug Rabson.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27c19800e8SDoug Rabson.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28c19800e8SDoug Rabson.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29c19800e8SDoug Rabson.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30c19800e8SDoug Rabson.\" SUCH DAMAGE. 31c19800e8SDoug Rabson.\" 32c19800e8SDoug Rabson.\" $Id$ 33c19800e8SDoug Rabson.\" 34c19800e8SDoug Rabson.Dd February 29, 2004 35c19800e8SDoug Rabson.Dt KADM5_PWCHECK 3 36c19800e8SDoug Rabson.Os HEIMDAL 37c19800e8SDoug Rabson.Sh NAME 38c19800e8SDoug Rabson.Nm krb5_pwcheck , 39c19800e8SDoug Rabson.Nm kadm5_setup_passwd_quality_check , 40c19800e8SDoug Rabson.Nm kadm5_add_passwd_quality_verifier , 41c19800e8SDoug Rabson.Nm kadm5_check_password_quality 42c19800e8SDoug Rabson.Nd Heimdal warning and error functions 43c19800e8SDoug Rabson.Sh LIBRARY 44c19800e8SDoug RabsonKerberos 5 Library (libkadm5srv, -lkadm5srv) 45c19800e8SDoug Rabson.Sh SYNOPSIS 46c19800e8SDoug Rabson.In kadm5-protos.h 47c19800e8SDoug Rabson.In kadm5-pwcheck.h 48c19800e8SDoug Rabson.Ft void 49c19800e8SDoug Rabson.Fo kadm5_setup_passwd_quality_check 50c19800e8SDoug Rabson.Fa "krb5_context context" 51c19800e8SDoug Rabson.Fa "const char *check_library" 52c19800e8SDoug Rabson.Fa "const char *check_function" 53c19800e8SDoug Rabson.Fc 54c19800e8SDoug Rabson.Ft "krb5_error_code" 55c19800e8SDoug Rabson.Fo kadm5_add_passwd_quality_verifier 56c19800e8SDoug Rabson.Fa "krb5_context context" 57c19800e8SDoug Rabson.Fa "const char *check_library" 58c19800e8SDoug Rabson.Fc 59c19800e8SDoug Rabson.Ft "const char *" 60c19800e8SDoug Rabson.Fo kadm5_check_password_quality 61c19800e8SDoug Rabson.Fa "krb5_context context" 62c19800e8SDoug Rabson.Fa "krb5_principal principal" 63c19800e8SDoug Rabson.Fa "krb5_data *pwd_data" 64c19800e8SDoug Rabson.Fc 65c19800e8SDoug Rabson.Ft int 66c19800e8SDoug Rabson.Fo "(*kadm5_passwd_quality_check_func)" 67c19800e8SDoug Rabson.Fa "krb5_context context" 68c19800e8SDoug Rabson.Fa "krb5_principal principal" 69c19800e8SDoug Rabson.Fa "krb5_data *password" 70c19800e8SDoug Rabson.Fa "const char *tuning" 71c19800e8SDoug Rabson.Fa "char *message" 72c19800e8SDoug Rabson.Fa "size_t length" 73c19800e8SDoug Rabson.Fc 74c19800e8SDoug Rabson.Sh DESCRIPTION 75c19800e8SDoug RabsonThese functions perform the quality check for the heimdal database 76c19800e8SDoug Rabsonlibrary. 77c19800e8SDoug Rabson.Pp 78c19800e8SDoug RabsonThere are two versions of the shared object API; the old version (0) 79c19800e8SDoug Rabsonis deprecated, but still supported. The new version (1) supports 80c19800e8SDoug Rabsonmultiple password quality checking policies in the same shared object. 81c19800e8SDoug RabsonSee below for details. 82c19800e8SDoug Rabson.Pp 83c19800e8SDoug RabsonThe password quality checker will run all policies that are 84c19800e8SDoug Rabsonconfigured by the user. If any policy rejects the password, the password 85c19800e8SDoug Rabsonwill be rejected. 86c19800e8SDoug Rabson.Pp 87c19800e8SDoug RabsonPolicy names are of the form 88c19800e8SDoug Rabson.Ql module-name:policy-name 89c19800e8SDoug Rabsonor, if the the policy name is unique enough, just 90c19800e8SDoug Rabson.Ql policy-name . 91c19800e8SDoug Rabson.Sh IMPLEMENTING A PASSWORD QUALITY CHECKING SHARED OBJECT 92c19800e8SDoug Rabson(This refers to the version 1 API only.) 93c19800e8SDoug Rabson.Pp 94c19800e8SDoug RabsonModule shared objects may conveniently be compiled and linked with 95c19800e8SDoug Rabson.Xr libtool 1 . 96c19800e8SDoug RabsonAn object needs to export a symbol called 97c19800e8SDoug Rabson.Ql kadm5_password_verifier 98c19800e8SDoug Rabsonof the type 99c19800e8SDoug Rabson.Ft "struct kadm5_pw_policy_verifier" . 100c19800e8SDoug Rabson.Pp 101c19800e8SDoug RabsonIts 102c19800e8SDoug Rabson.Ft name 103c19800e8SDoug Rabsonand 104c19800e8SDoug Rabson.Ft vendor 105c19800e8SDoug Rabsonfields should contain the obvious information. 106c19800e8SDoug Rabson.Ft name 107c19800e8SDoug Rabsonmust match the 108c19800e8SDoug Rabson.Ql module-name 109c19800e8SDoug Rabsonportion of the policy name (the part before the colon), if the policy name 110c19800e8SDoug Rabsoncontains a colon, or the policy will not be run. 111c19800e8SDoug Rabson.Ft version 112c19800e8SDoug Rabsonshould be 113c19800e8SDoug Rabson.Dv KADM5_PASSWD_VERSION_V1 . 114c19800e8SDoug Rabson.Pp 115c19800e8SDoug Rabson.Ft funcs 116c19800e8SDoug Rabsoncontains an array of 117c19800e8SDoug Rabson.Ft "struct kadm5_pw_policy_check_func" 118c19800e8SDoug Rabsonstructures that is terminated with an entry whose 119c19800e8SDoug Rabson.Ft name 120c19800e8SDoug Rabsoncomponent is 121c19800e8SDoug Rabson.Dv NULL . 122c19800e8SDoug RabsonThe 123c19800e8SDoug Rabson.Ft name 124c19800e8SDoug Rabsonfield of the array must match the 125c19800e8SDoug Rabson.Ql policy-name 126c19800e8SDoug Rabsonportion of a policy name (the part after the colon, or the complete policy 127c19800e8SDoug Rabsonname if there is no colon) specified by the user or the policy will not be 128c19800e8SDoug Rabsonrun. The 129c19800e8SDoug Rabson.Ft func 130c19800e8SDoug Rabsonfields of the array elements are functions that are exported by the 131c19800e8SDoug Rabsonmodule to be called to check the password. They get the following 132c19800e8SDoug Rabsonarguments: the Kerberos context, principal, password, a tuning parameter, and 133c19800e8SDoug Rabsona pointer to a message buffer and its length. The tuning parameter 134c19800e8SDoug Rabsonfor the quality check function is currently always 135c19800e8SDoug Rabson.Dv NULL . 136c19800e8SDoug RabsonIf the password is acceptable, the function returns zero. Otherwise 137c19800e8SDoug Rabsonit returns non-zero and fills in the message buffer with an 138c19800e8SDoug Rabsonappropriate explanation. 139c19800e8SDoug Rabson.Sh RUNNING THE CHECKS 140c19800e8SDoug Rabson.Nm kadm5_setup_passwd_quality_check 141c19800e8SDoug Rabsonsets up type 0 checks. It sets up all type 0 checks defined in 142c19800e8SDoug Rabson.Xr krb5.conf 5 143c19800e8SDoug Rabsonif called with the last two arguments null. 144c19800e8SDoug Rabson.Pp 145c19800e8SDoug Rabson.Nm kadm5_add_passwd_quality_verifier 146c19800e8SDoug Rabsonsets up type 1 checks. It sets up all type 1 tests defined in 147.Xr krb5.conf 5 148if called with a null second argument. 149.Nm kadm5_check_password_quality 150runs the checks in the order in which they are defined in 151.Xr krb5.conf 5 152and the order in which they occur in a 153module's 154.Ft funcs 155array until one returns non-zero. 156.Sh SEE ALSO 157.Xr libtool 1 , 158.Xr krb5 3 , 159.Xr krb5.conf 5 160