1b528cefcSMark Murray /*
2c19800e8SDoug Rabson * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
3b528cefcSMark Murray * (Royal Institute of Technology, Stockholm, Sweden).
4b528cefcSMark Murray * All rights reserved.
5b528cefcSMark Murray *
6b528cefcSMark Murray * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7b528cefcSMark Murray *
8b528cefcSMark Murray * Redistribution and use in source and binary forms, with or without
9b528cefcSMark Murray * modification, are permitted provided that the following conditions
10b528cefcSMark Murray * are met:
11b528cefcSMark Murray *
12b528cefcSMark Murray * 1. Redistributions of source code must retain the above copyright
13b528cefcSMark Murray * notice, this list of conditions and the following disclaimer.
14b528cefcSMark Murray *
15b528cefcSMark Murray * 2. Redistributions in binary form must reproduce the above copyright
16b528cefcSMark Murray * notice, this list of conditions and the following disclaimer in the
17b528cefcSMark Murray * documentation and/or other materials provided with the distribution.
18b528cefcSMark Murray *
19b528cefcSMark Murray * 3. Neither the name of the Institute nor the names of its contributors
20b528cefcSMark Murray * may be used to endorse or promote products derived from this software
21b528cefcSMark Murray * without specific prior written permission.
22b528cefcSMark Murray *
23b528cefcSMark Murray * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24b528cefcSMark Murray * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25b528cefcSMark Murray * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26b528cefcSMark Murray * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27b528cefcSMark Murray * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28b528cefcSMark Murray * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29b528cefcSMark Murray * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30b528cefcSMark Murray * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31b528cefcSMark Murray * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32b528cefcSMark Murray * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33b528cefcSMark Murray * SUCH DAMAGE.
34b528cefcSMark Murray */
35b528cefcSMark Murray
36c19800e8SDoug Rabson #include "krb5_locl.h"
37b528cefcSMark Murray
38c19800e8SDoug Rabson /**
39b528cefcSMark Murray * @page krb5_ccache_intro The credential cache functions
40b528cefcSMark Murray * @section section_krb5_ccache Kerberos credential caches
41c19800e8SDoug Rabson *
42c19800e8SDoug Rabson * krb5_ccache structure holds a Kerberos credential cache.
43c19800e8SDoug Rabson *
44c19800e8SDoug Rabson * Heimdal support the follow types of credential caches:
45c19800e8SDoug Rabson *
46c19800e8SDoug Rabson * - SCC
47c19800e8SDoug Rabson * Store the credential in a database
48c19800e8SDoug Rabson * - FILE
49c19800e8SDoug Rabson * Store the credential in memory
50b528cefcSMark Murray * - MEMORY
51b528cefcSMark Murray * Store the credential in memory
52c19800e8SDoug Rabson * - API
53b528cefcSMark Murray * A credential cache server based solution for Mac OS X
54b528cefcSMark Murray * - KCM
55b528cefcSMark Murray * A credential cache server based solution for all platforms
56b528cefcSMark Murray *
57b528cefcSMark Murray * @subsection Example
58b528cefcSMark Murray *
59b528cefcSMark Murray * This is a minimalistic version of klist:
60b528cefcSMark Murray @code
618373020dSJacques Vidrine #include <krb5.h>
62adb0ddaeSAssar Westerlund
63adb0ddaeSAssar Westerlund int
64adb0ddaeSAssar Westerlund main (int argc, char **argv)
65b528cefcSMark Murray {
66b528cefcSMark Murray krb5_context context;
678373020dSJacques Vidrine krb5_cc_cursor cursor;
68b528cefcSMark Murray krb5_error_code ret;
69adb0ddaeSAssar Westerlund krb5_ccache id;
70b528cefcSMark Murray krb5_creds creds;
71b528cefcSMark Murray
72b528cefcSMark Murray if (krb5_init_context (&context) != 0)
73b528cefcSMark Murray errx(1, "krb5_context");
74adb0ddaeSAssar Westerlund
75adb0ddaeSAssar Westerlund ret = krb5_cc_default (context, &id);
76b528cefcSMark Murray if (ret)
77adb0ddaeSAssar Westerlund krb5_err(context, 1, ret, "krb5_cc_default");
78b528cefcSMark Murray
79b528cefcSMark Murray ret = krb5_cc_start_seq_get(context, id, &cursor);
80b528cefcSMark Murray if (ret)
81b528cefcSMark Murray krb5_err(context, 1, ret, "krb5_cc_start_seq_get");
82b528cefcSMark Murray
83b528cefcSMark Murray while((ret = krb5_cc_next_cred(context, id, &cursor, &creds)) == 0){
84b528cefcSMark Murray char *principal;
85b528cefcSMark Murray
86b528cefcSMark Murray krb5_unparse_name(context, creds.server, &principal);
87b528cefcSMark Murray printf("principal: %s\\n", principal);
88c19800e8SDoug Rabson free(principal);
89c19800e8SDoug Rabson krb5_free_cred_contents (context, &creds);
90b528cefcSMark Murray }
91b528cefcSMark Murray ret = krb5_cc_end_seq_get(context, id, &cursor);
92c19800e8SDoug Rabson if (ret)
93c19800e8SDoug Rabson krb5_err(context, 1, ret, "krb5_cc_end_seq_get");
94b528cefcSMark Murray
95b528cefcSMark Murray krb5_cc_close(context, id);
96b528cefcSMark Murray
97b528cefcSMark Murray krb5_free_context(context);
98b528cefcSMark Murray return 0;
99b528cefcSMark Murray }
100adb0ddaeSAssar Westerlund * @endcode
101adb0ddaeSAssar Westerlund */
102b528cefcSMark Murray
103adb0ddaeSAssar Westerlund /**
104b528cefcSMark Murray * Add a new ccache type with operations `ops', overwriting any
105b528cefcSMark Murray * existing one if `override'.
106c19800e8SDoug Rabson *
107c19800e8SDoug Rabson * @param context a Keberos context
108b528cefcSMark Murray * @param ops type of plugin symbol
109b528cefcSMark Murray * @param override flag to select if the registration is to overide
110b528cefcSMark Murray * an existing ops with the same name.
111c19800e8SDoug Rabson *
112c19800e8SDoug Rabson * @return Return an error code or 0, see krb5_get_error_message().
113b528cefcSMark Murray *
114b528cefcSMark Murray * @ingroup krb5_ccache
115c19800e8SDoug Rabson */
116c19800e8SDoug Rabson
117c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_register(krb5_context context,const krb5_cc_ops * ops,krb5_boolean override)118c19800e8SDoug Rabson krb5_cc_register(krb5_context context,
119c19800e8SDoug Rabson const krb5_cc_ops *ops,
120c19800e8SDoug Rabson krb5_boolean override)
121c19800e8SDoug Rabson {
122c19800e8SDoug Rabson int i;
123c19800e8SDoug Rabson
124c19800e8SDoug Rabson for(i = 0; i < context->num_cc_ops && context->cc_ops[i]->prefix; i++) {
125c19800e8SDoug Rabson if(strcmp(context->cc_ops[i]->prefix, ops->prefix) == 0) {
126c19800e8SDoug Rabson if(!override) {
127c19800e8SDoug Rabson krb5_set_error_message(context,
128c19800e8SDoug Rabson KRB5_CC_TYPE_EXISTS,
129c19800e8SDoug Rabson N_("cache type %s already exists", "type"),
130c19800e8SDoug Rabson ops->prefix);
131c19800e8SDoug Rabson return KRB5_CC_TYPE_EXISTS;
132c19800e8SDoug Rabson }
133c19800e8SDoug Rabson break;
134c19800e8SDoug Rabson }
135c19800e8SDoug Rabson }
136c19800e8SDoug Rabson if(i == context->num_cc_ops) {
137c19800e8SDoug Rabson const krb5_cc_ops **o = realloc(rk_UNCONST(context->cc_ops),
138c19800e8SDoug Rabson (context->num_cc_ops + 1) *
139c19800e8SDoug Rabson sizeof(context->cc_ops[0]));
140c19800e8SDoug Rabson if(o == NULL) {
141c19800e8SDoug Rabson krb5_set_error_message(context, KRB5_CC_NOMEM,
142c19800e8SDoug Rabson N_("malloc: out of memory", ""));
143c19800e8SDoug Rabson return KRB5_CC_NOMEM;
144c19800e8SDoug Rabson }
145c19800e8SDoug Rabson context->cc_ops = o;
146c19800e8SDoug Rabson context->cc_ops[context->num_cc_ops] = NULL;
147c19800e8SDoug Rabson context->num_cc_ops++;
148b528cefcSMark Murray }
149b528cefcSMark Murray context->cc_ops[i] = ops;
150b528cefcSMark Murray return 0;
151b528cefcSMark Murray }
152b528cefcSMark Murray
153b528cefcSMark Murray /*
154c19800e8SDoug Rabson * Allocate the memory for a `id' and the that function table to
155c19800e8SDoug Rabson * `ops'. Returns 0 or and error code.
156b528cefcSMark Murray */
157b528cefcSMark Murray
158b528cefcSMark Murray krb5_error_code
_krb5_cc_allocate(krb5_context context,const krb5_cc_ops * ops,krb5_ccache * id)159b528cefcSMark Murray _krb5_cc_allocate(krb5_context context,
160b528cefcSMark Murray const krb5_cc_ops *ops,
161b528cefcSMark Murray krb5_ccache *id)
162b528cefcSMark Murray {
163b528cefcSMark Murray krb5_ccache p;
164b528cefcSMark Murray
165b528cefcSMark Murray p = malloc (sizeof(*p));
166b528cefcSMark Murray if(p == NULL) {
167b528cefcSMark Murray krb5_set_error_message(context, KRB5_CC_NOMEM,
168adb0ddaeSAssar Westerlund N_("malloc: out of memory", ""));
169adb0ddaeSAssar Westerlund return KRB5_CC_NOMEM;
170b528cefcSMark Murray }
171b528cefcSMark Murray p->ops = ops;
172adb0ddaeSAssar Westerlund *id = p;
173b528cefcSMark Murray
174c19800e8SDoug Rabson return 0;
175b528cefcSMark Murray }
176c19800e8SDoug Rabson
177c19800e8SDoug Rabson /*
178c19800e8SDoug Rabson * Allocate memory for a new ccache in `id' with operations `ops'
179c19800e8SDoug Rabson * and name `residual'. Return 0 or an error code.
180b528cefcSMark Murray */
181b528cefcSMark Murray
182c19800e8SDoug Rabson static krb5_error_code
allocate_ccache(krb5_context context,const krb5_cc_ops * ops,const char * residual,krb5_ccache * id)183c19800e8SDoug Rabson allocate_ccache (krb5_context context,
184b528cefcSMark Murray const krb5_cc_ops *ops,
185b528cefcSMark Murray const char *residual,
186b528cefcSMark Murray krb5_ccache *id)
187b528cefcSMark Murray {
188c19800e8SDoug Rabson krb5_error_code ret;
189b528cefcSMark Murray #ifdef KRB5_USE_PATH_TOKENS
190b528cefcSMark Murray char * exp_residual = NULL;
191c19800e8SDoug Rabson
192c19800e8SDoug Rabson ret = _krb5_expand_path_tokens(context, residual, &exp_residual);
193c19800e8SDoug Rabson if (ret)
194c19800e8SDoug Rabson return ret;
195c19800e8SDoug Rabson
196c19800e8SDoug Rabson residual = exp_residual;
197c19800e8SDoug Rabson #endif
198c19800e8SDoug Rabson
199c19800e8SDoug Rabson ret = _krb5_cc_allocate(context, ops, id);
200c19800e8SDoug Rabson if (ret) {
201b528cefcSMark Murray #ifdef KRB5_USE_PATH_TOKENS
202b528cefcSMark Murray if (exp_residual)
203c19800e8SDoug Rabson free(exp_residual);
204c19800e8SDoug Rabson #endif
205c19800e8SDoug Rabson return ret;
206c19800e8SDoug Rabson }
207c19800e8SDoug Rabson
208c19800e8SDoug Rabson ret = (*id)->ops->resolve(context, id, residual);
209c19800e8SDoug Rabson if(ret) {
210c19800e8SDoug Rabson free(*id);
211c19800e8SDoug Rabson *id = NULL;
212c19800e8SDoug Rabson }
213c19800e8SDoug Rabson
214c19800e8SDoug Rabson #ifdef KRB5_USE_PATH_TOKENS
215c19800e8SDoug Rabson if (exp_residual)
216c19800e8SDoug Rabson free(exp_residual);
217c19800e8SDoug Rabson #endif
218c19800e8SDoug Rabson
219c19800e8SDoug Rabson return ret;
220c19800e8SDoug Rabson }
221c19800e8SDoug Rabson
222c19800e8SDoug Rabson static int
is_possible_path_name(const char * name)223c19800e8SDoug Rabson is_possible_path_name(const char * name)
224c19800e8SDoug Rabson {
225c19800e8SDoug Rabson const char * colon;
226c19800e8SDoug Rabson
227c19800e8SDoug Rabson if ((colon = strchr(name, ':')) == NULL)
228c19800e8SDoug Rabson return TRUE;
229c19800e8SDoug Rabson
230c19800e8SDoug Rabson #ifdef _WIN32
231c19800e8SDoug Rabson /* <drive letter>:\path\to\cache ? */
232c19800e8SDoug Rabson
233b528cefcSMark Murray if (colon == name + 1 &&
234b528cefcSMark Murray strchr(colon + 1, ':') == NULL)
235b528cefcSMark Murray return TRUE;
236b528cefcSMark Murray #endif
237b528cefcSMark Murray
238b528cefcSMark Murray return FALSE;
239c19800e8SDoug Rabson }
240b528cefcSMark Murray
241c19800e8SDoug Rabson /**
242c19800e8SDoug Rabson * Find and allocate a ccache in `id' from the specification in `residual'.
243b528cefcSMark Murray * If the ccache name doesn't contain any colon, interpret it as a file name.
244b528cefcSMark Murray *
245c19800e8SDoug Rabson * @param context a Keberos context.
246c19800e8SDoug Rabson * @param name string name of a credential cache.
247b528cefcSMark Murray * @param id return pointer to a found credential cache.
248b528cefcSMark Murray *
249b528cefcSMark Murray * @return Return 0 or an error code. In case of an error, id is set
250b528cefcSMark Murray * to NULL, see krb5_get_error_message().
251b528cefcSMark Murray *
252b528cefcSMark Murray * @ingroup krb5_ccache
253c19800e8SDoug Rabson */
254c19800e8SDoug Rabson
255c19800e8SDoug Rabson
256c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_resolve(krb5_context context,const char * name,krb5_ccache * id)257c19800e8SDoug Rabson krb5_cc_resolve(krb5_context context,
258c19800e8SDoug Rabson const char *name,
259bbd80c28SJacques Vidrine krb5_ccache *id)
260bbd80c28SJacques Vidrine {
261c19800e8SDoug Rabson int i;
262c19800e8SDoug Rabson
263c19800e8SDoug Rabson *id = NULL;
264c19800e8SDoug Rabson
265c19800e8SDoug Rabson for(i = 0; i < context->num_cc_ops && context->cc_ops[i]->prefix; i++) {
266c19800e8SDoug Rabson size_t prefix_len = strlen(context->cc_ops[i]->prefix);
267c19800e8SDoug Rabson
268c19800e8SDoug Rabson if(strncmp(context->cc_ops[i]->prefix, name, prefix_len) == 0
269c19800e8SDoug Rabson && name[prefix_len] == ':') {
270c19800e8SDoug Rabson return allocate_ccache (context, context->cc_ops[i],
271c19800e8SDoug Rabson name + prefix_len + 1,
272c19800e8SDoug Rabson id);
273c19800e8SDoug Rabson }
274c19800e8SDoug Rabson }
275c19800e8SDoug Rabson if (is_possible_path_name(name))
276c19800e8SDoug Rabson return allocate_ccache (context, &krb5_fcc_ops, name, id);
277c19800e8SDoug Rabson else {
278c19800e8SDoug Rabson krb5_set_error_message(context, KRB5_CC_UNKNOWN_TYPE,
279c19800e8SDoug Rabson N_("unknown ccache type %s", "name"), name);
280c19800e8SDoug Rabson return KRB5_CC_UNKNOWN_TYPE;
281c19800e8SDoug Rabson }
282c19800e8SDoug Rabson }
283c19800e8SDoug Rabson
284c19800e8SDoug Rabson /**
285c19800e8SDoug Rabson * Generates a new unique ccache of `type` in `id'. If `type' is NULL,
286c19800e8SDoug Rabson * the library chooses the default credential cache type. The supplied
287c19800e8SDoug Rabson * `hint' (that can be NULL) is a string that the credential cache
288c19800e8SDoug Rabson * type can use to base the name of the credential on, this is to make
289c19800e8SDoug Rabson * it easier for the user to differentiate the credentials.
290c19800e8SDoug Rabson *
291c19800e8SDoug Rabson * @return Return an error code or 0, see krb5_get_error_message().
292c19800e8SDoug Rabson *
293c19800e8SDoug Rabson * @ingroup krb5_ccache
294c19800e8SDoug Rabson */
295c19800e8SDoug Rabson
296c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_new_unique(krb5_context context,const char * type,const char * hint,krb5_ccache * id)297c19800e8SDoug Rabson krb5_cc_new_unique(krb5_context context, const char *type,
298bbd80c28SJacques Vidrine const char *hint, krb5_ccache *id)
299bbd80c28SJacques Vidrine {
300bbd80c28SJacques Vidrine const krb5_cc_ops *ops;
301bbd80c28SJacques Vidrine krb5_error_code ret;
302bbd80c28SJacques Vidrine
303bbd80c28SJacques Vidrine ops = krb5_cc_get_prefix_ops(context, type);
304bbd80c28SJacques Vidrine if (ops == NULL) {
305c19800e8SDoug Rabson krb5_set_error_message(context, KRB5_CC_UNKNOWN_TYPE,
306bbd80c28SJacques Vidrine "Credential cache type %s is unknown", type);
307bbd80c28SJacques Vidrine return KRB5_CC_UNKNOWN_TYPE;
308bbd80c28SJacques Vidrine }
309c19800e8SDoug Rabson
310c19800e8SDoug Rabson ret = _krb5_cc_allocate(context, ops, id);
311c19800e8SDoug Rabson if (ret)
312c19800e8SDoug Rabson return ret;
313c19800e8SDoug Rabson ret = (*id)->ops->gen_new(context, id);
314c19800e8SDoug Rabson if (ret) {
315c19800e8SDoug Rabson free(*id);
316c19800e8SDoug Rabson *id = NULL;
317c19800e8SDoug Rabson }
318c19800e8SDoug Rabson return ret;
319c19800e8SDoug Rabson }
320c19800e8SDoug Rabson
321c19800e8SDoug Rabson /**
322c19800e8SDoug Rabson * Return the name of the ccache `id'
323c19800e8SDoug Rabson *
324c19800e8SDoug Rabson * @ingroup krb5_ccache
325c19800e8SDoug Rabson */
326c19800e8SDoug Rabson
327c19800e8SDoug Rabson
328c19800e8SDoug Rabson KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_cc_get_name(krb5_context context,krb5_ccache id)329c19800e8SDoug Rabson krb5_cc_get_name(krb5_context context,
330c19800e8SDoug Rabson krb5_ccache id)
331c19800e8SDoug Rabson {
332c19800e8SDoug Rabson return id->ops->get_name(context, id);
333c19800e8SDoug Rabson }
334c19800e8SDoug Rabson
335c19800e8SDoug Rabson /**
336c19800e8SDoug Rabson * Return the type of the ccache `id'.
337c19800e8SDoug Rabson *
338c19800e8SDoug Rabson * @ingroup krb5_ccache
339c19800e8SDoug Rabson */
340c19800e8SDoug Rabson
341c19800e8SDoug Rabson
342c19800e8SDoug Rabson KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_cc_get_type(krb5_context context,krb5_ccache id)343c19800e8SDoug Rabson krb5_cc_get_type(krb5_context context,
344c19800e8SDoug Rabson krb5_ccache id)
345c19800e8SDoug Rabson {
346c19800e8SDoug Rabson return id->ops->prefix;
347c19800e8SDoug Rabson }
348c19800e8SDoug Rabson
349c19800e8SDoug Rabson /**
350c19800e8SDoug Rabson * Return the complete resolvable name the cache
351c19800e8SDoug Rabson
352c19800e8SDoug Rabson * @param context a Keberos context
353c19800e8SDoug Rabson * @param id return pointer to a found credential cache
354c19800e8SDoug Rabson * @param str the returned name of a credential cache, free with krb5_xfree()
355c19800e8SDoug Rabson *
356c19800e8SDoug Rabson * @return Returns 0 or an error (and then *str is set to NULL).
357c19800e8SDoug Rabson *
358c19800e8SDoug Rabson * @ingroup krb5_ccache
359c19800e8SDoug Rabson */
360c19800e8SDoug Rabson
361c19800e8SDoug Rabson
362c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_full_name(krb5_context context,krb5_ccache id,char ** str)363c19800e8SDoug Rabson krb5_cc_get_full_name(krb5_context context,
364c19800e8SDoug Rabson krb5_ccache id,
365c19800e8SDoug Rabson char **str)
366c19800e8SDoug Rabson {
367c19800e8SDoug Rabson const char *type, *name;
368c19800e8SDoug Rabson
369c19800e8SDoug Rabson *str = NULL;
370c19800e8SDoug Rabson
371c19800e8SDoug Rabson type = krb5_cc_get_type(context, id);
372c19800e8SDoug Rabson if (type == NULL) {
373c19800e8SDoug Rabson krb5_set_error_message(context, KRB5_CC_UNKNOWN_TYPE,
374c19800e8SDoug Rabson "cache have no name of type");
375c19800e8SDoug Rabson return KRB5_CC_UNKNOWN_TYPE;
376c19800e8SDoug Rabson }
377c19800e8SDoug Rabson
378c19800e8SDoug Rabson name = krb5_cc_get_name(context, id);
379c19800e8SDoug Rabson if (name == NULL) {
380c19800e8SDoug Rabson krb5_set_error_message(context, KRB5_CC_BADNAME,
381c19800e8SDoug Rabson "cache of type %s have no name", type);
382c19800e8SDoug Rabson return KRB5_CC_BADNAME;
383c19800e8SDoug Rabson }
384c19800e8SDoug Rabson
385c19800e8SDoug Rabson if (asprintf(str, "%s:%s", type, name) == -1) {
386c19800e8SDoug Rabson krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
387c19800e8SDoug Rabson *str = NULL;
388c19800e8SDoug Rabson return ENOMEM;
389c19800e8SDoug Rabson }
390c19800e8SDoug Rabson return 0;
391c19800e8SDoug Rabson }
392c19800e8SDoug Rabson
393c19800e8SDoug Rabson /**
394c19800e8SDoug Rabson * Return krb5_cc_ops of a the ccache `id'.
395c19800e8SDoug Rabson *
396c19800e8SDoug Rabson * @ingroup krb5_ccache
397c19800e8SDoug Rabson */
398c19800e8SDoug Rabson
399c19800e8SDoug Rabson
400c19800e8SDoug Rabson KRB5_LIB_FUNCTION const krb5_cc_ops * KRB5_LIB_CALL
krb5_cc_get_ops(krb5_context context,krb5_ccache id)401c19800e8SDoug Rabson krb5_cc_get_ops(krb5_context context, krb5_ccache id)
402c19800e8SDoug Rabson {
403c19800e8SDoug Rabson return id->ops;
404c19800e8SDoug Rabson }
405c19800e8SDoug Rabson
406c19800e8SDoug Rabson /*
407c19800e8SDoug Rabson * Expand variables in `str' into `res'
408c19800e8SDoug Rabson */
409c19800e8SDoug Rabson
410c19800e8SDoug Rabson krb5_error_code
_krb5_expand_default_cc_name(krb5_context context,const char * str,char ** res)411c19800e8SDoug Rabson _krb5_expand_default_cc_name(krb5_context context, const char *str, char **res)
412c19800e8SDoug Rabson {
413c19800e8SDoug Rabson return _krb5_expand_path_tokens(context, str, res);
414c19800e8SDoug Rabson }
415c19800e8SDoug Rabson
416bbd80c28SJacques Vidrine /*
417bbd80c28SJacques Vidrine * Return non-zero if envirnoment that will determine default krb5cc
418bbd80c28SJacques Vidrine * name has changed.
419bbd80c28SJacques Vidrine */
420bbd80c28SJacques Vidrine
421bbd80c28SJacques Vidrine static int
environment_changed(krb5_context context)422c19800e8SDoug Rabson environment_changed(krb5_context context)
423bbd80c28SJacques Vidrine {
424c19800e8SDoug Rabson const char *e;
425c19800e8SDoug Rabson
426c19800e8SDoug Rabson /* if the cc name was set, don't change it */
427c19800e8SDoug Rabson if (context->default_cc_name_set)
428c19800e8SDoug Rabson return 0;
429c19800e8SDoug Rabson
430c19800e8SDoug Rabson /* XXX performance: always ask KCM/API if default name has changed */
431c19800e8SDoug Rabson if (context->default_cc_name &&
432c19800e8SDoug Rabson (strncmp(context->default_cc_name, "KCM:", 4) == 0 ||
433c19800e8SDoug Rabson strncmp(context->default_cc_name, "API:", 4) == 0))
434c19800e8SDoug Rabson return 1;
435c19800e8SDoug Rabson
436c19800e8SDoug Rabson if(issuid())
437c19800e8SDoug Rabson return 0;
438c19800e8SDoug Rabson
439c19800e8SDoug Rabson e = getenv("KRB5CCNAME");
440c19800e8SDoug Rabson if (e == NULL) {
441c19800e8SDoug Rabson if (context->default_cc_name_env) {
442c19800e8SDoug Rabson free(context->default_cc_name_env);
443c19800e8SDoug Rabson context->default_cc_name_env = NULL;
444c19800e8SDoug Rabson return 1;
445c19800e8SDoug Rabson }
446c19800e8SDoug Rabson } else {
447c19800e8SDoug Rabson if (context->default_cc_name_env == NULL)
448c19800e8SDoug Rabson return 1;
449c19800e8SDoug Rabson if (strcmp(e, context->default_cc_name_env) != 0)
450c19800e8SDoug Rabson return 1;
451c19800e8SDoug Rabson }
452c19800e8SDoug Rabson return 0;
453c19800e8SDoug Rabson }
454c19800e8SDoug Rabson
455c19800e8SDoug Rabson /**
456bbd80c28SJacques Vidrine * Switch the default default credential cache for a specific
457c19800e8SDoug Rabson * credcache type (and name for some implementations).
458bbd80c28SJacques Vidrine *
459bbd80c28SJacques Vidrine * @return Return an error code or 0, see krb5_get_error_message().
460bbd80c28SJacques Vidrine *
461bbd80c28SJacques Vidrine * @ingroup krb5_ccache
462bbd80c28SJacques Vidrine */
463bbd80c28SJacques Vidrine
464bbd80c28SJacques Vidrine KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_switch(krb5_context context,krb5_ccache id)465bbd80c28SJacques Vidrine krb5_cc_switch(krb5_context context, krb5_ccache id)
466bbd80c28SJacques Vidrine {
467c19800e8SDoug Rabson #ifdef _WIN32
468c19800e8SDoug Rabson _krb5_set_default_cc_name_to_registry(context, id);
469c19800e8SDoug Rabson #endif
470c19800e8SDoug Rabson
471c19800e8SDoug Rabson if (id->ops->set_default == NULL)
472c19800e8SDoug Rabson return 0;
473c19800e8SDoug Rabson
474b528cefcSMark Murray return (*id->ops->set_default)(context, id);
475b528cefcSMark Murray }
476c19800e8SDoug Rabson
477c19800e8SDoug Rabson /**
478b528cefcSMark Murray * Return true if the default credential cache support switch
479b528cefcSMark Murray *
480c19800e8SDoug Rabson * @ingroup krb5_ccache
481bbd80c28SJacques Vidrine */
482b528cefcSMark Murray
483bbd80c28SJacques Vidrine KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
krb5_cc_support_switch(krb5_context context,const char * type)484b528cefcSMark Murray krb5_cc_support_switch(krb5_context context, const char *type)
485b528cefcSMark Murray {
486c19800e8SDoug Rabson const krb5_cc_ops *ops;
487b528cefcSMark Murray
488c19800e8SDoug Rabson ops = krb5_cc_get_prefix_ops(context, type);
489c19800e8SDoug Rabson if (ops && ops->set_default)
490c19800e8SDoug Rabson return 1;
491c19800e8SDoug Rabson return FALSE;
492b528cefcSMark Murray }
493b528cefcSMark Murray
494c19800e8SDoug Rabson /**
495c19800e8SDoug Rabson * Set the default cc name for `context' to `name'.
496b528cefcSMark Murray *
497b528cefcSMark Murray * @ingroup krb5_ccache
498b528cefcSMark Murray */
499bbd80c28SJacques Vidrine
500bbd80c28SJacques Vidrine KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_default_name(krb5_context context,const char * name)501c19800e8SDoug Rabson krb5_cc_set_default_name(krb5_context context, const char *name)
502c19800e8SDoug Rabson {
503bbd80c28SJacques Vidrine krb5_error_code ret = 0;
504c19800e8SDoug Rabson char *p = NULL, *exp_p = NULL;
505bbd80c28SJacques Vidrine
506b528cefcSMark Murray if (name == NULL) {
507b528cefcSMark Murray const char *e = NULL;
508c19800e8SDoug Rabson
509b528cefcSMark Murray if(!issuid()) {
510c19800e8SDoug Rabson e = getenv("KRB5CCNAME");
511c19800e8SDoug Rabson if (e) {
512c19800e8SDoug Rabson p = strdup(e);
513c19800e8SDoug Rabson if (context->default_cc_name_env)
514b528cefcSMark Murray free(context->default_cc_name_env);
515b528cefcSMark Murray context->default_cc_name_env = strdup(e);
516c19800e8SDoug Rabson }
517c19800e8SDoug Rabson }
518b528cefcSMark Murray
519b528cefcSMark Murray #ifdef _WIN32
520b528cefcSMark Murray if (e == NULL) {
521b528cefcSMark Murray e = p = _krb5_get_default_cc_name_from_registry(context);
522c19800e8SDoug Rabson }
523b528cefcSMark Murray #endif
524b528cefcSMark Murray if (e == NULL) {
525b528cefcSMark Murray e = krb5_config_get_string(context, NULL, "libdefaults",
526c19800e8SDoug Rabson "default_cc_name", NULL);
527b528cefcSMark Murray if (e) {
528c19800e8SDoug Rabson ret = _krb5_expand_default_cc_name(context, e, &p);
529c19800e8SDoug Rabson if (ret)
530c19800e8SDoug Rabson return ret;
531c19800e8SDoug Rabson }
532b528cefcSMark Murray if (e == NULL) {
533b528cefcSMark Murray const krb5_cc_ops *ops = KRB5_DEFAULT_CCTYPE;
534c19800e8SDoug Rabson e = krb5_config_get_string(context, NULL, "libdefaults",
535c19800e8SDoug Rabson "default_cc_type", NULL);
536b528cefcSMark Murray if (e) {
537b528cefcSMark Murray ops = krb5_cc_get_prefix_ops(context, e);
538b528cefcSMark Murray if (ops == NULL) {
539b528cefcSMark Murray krb5_set_error_message(context,
540b528cefcSMark Murray KRB5_CC_UNKNOWN_TYPE,
541c19800e8SDoug Rabson "Credential cache type %s "
542b528cefcSMark Murray "is unknown", e);
543b528cefcSMark Murray return KRB5_CC_UNKNOWN_TYPE;
544b528cefcSMark Murray }
545b528cefcSMark Murray }
546c19800e8SDoug Rabson ret = (*ops->get_default_name)(context, &p);
547b528cefcSMark Murray if (ret)
548c19800e8SDoug Rabson return ret;
549c19800e8SDoug Rabson }
550c19800e8SDoug Rabson }
551c19800e8SDoug Rabson context->default_cc_name_set = 0;
552b528cefcSMark Murray } else {
553b528cefcSMark Murray p = strdup(name);
554c19800e8SDoug Rabson context->default_cc_name_set = 1;
555c19800e8SDoug Rabson }
556b528cefcSMark Murray
557b528cefcSMark Murray if (p == NULL) {
558b528cefcSMark Murray krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
559b528cefcSMark Murray return ENOMEM;
560c19800e8SDoug Rabson }
561b528cefcSMark Murray
562b528cefcSMark Murray ret = _krb5_expand_path_tokens(context, p, &exp_p);
563b528cefcSMark Murray free(p);
564b528cefcSMark Murray if (ret)
565c19800e8SDoug Rabson return ret;
566b528cefcSMark Murray
567c19800e8SDoug Rabson if (context->default_cc_name)
568c19800e8SDoug Rabson free(context->default_cc_name);
569c19800e8SDoug Rabson
570c19800e8SDoug Rabson context->default_cc_name = exp_p;
571b528cefcSMark Murray
572b528cefcSMark Murray return 0;
573c19800e8SDoug Rabson }
574c19800e8SDoug Rabson
575b528cefcSMark Murray /**
576b528cefcSMark Murray * Return a pointer to a context static string containing the default
577b528cefcSMark Murray * ccache name.
578b528cefcSMark Murray *
579c19800e8SDoug Rabson * @return String to the default credential cache name.
580b528cefcSMark Murray *
581b528cefcSMark Murray * @ingroup krb5_ccache
582c19800e8SDoug Rabson */
583b528cefcSMark Murray
584c19800e8SDoug Rabson
585c19800e8SDoug Rabson KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_cc_default_name(krb5_context context)586c19800e8SDoug Rabson krb5_cc_default_name(krb5_context context)
587c19800e8SDoug Rabson {
588c19800e8SDoug Rabson if (context->default_cc_name == NULL || environment_changed(context))
589c19800e8SDoug Rabson krb5_cc_set_default_name(context, NULL);
590b528cefcSMark Murray
591b528cefcSMark Murray return context->default_cc_name;
592c19800e8SDoug Rabson }
593c19800e8SDoug Rabson
594b528cefcSMark Murray /**
595b528cefcSMark Murray * Open the default ccache in `id'.
596b528cefcSMark Murray *
597b528cefcSMark Murray * @return Return an error code or 0, see krb5_get_error_message().
598b528cefcSMark Murray *
599b528cefcSMark Murray * @ingroup krb5_ccache
600b528cefcSMark Murray */
601b528cefcSMark Murray
602c19800e8SDoug Rabson
603c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_default(krb5_context context,krb5_ccache * id)604c19800e8SDoug Rabson krb5_cc_default(krb5_context context,
605c19800e8SDoug Rabson krb5_ccache *id)
606c19800e8SDoug Rabson {
607c19800e8SDoug Rabson const char *p = krb5_cc_default_name(context);
608c19800e8SDoug Rabson
609c19800e8SDoug Rabson if (p == NULL) {
610c19800e8SDoug Rabson krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
611adb0ddaeSAssar Westerlund return ENOMEM;
612b528cefcSMark Murray }
613b528cefcSMark Murray return krb5_cc_resolve(context, p, id);
614b528cefcSMark Murray }
615b528cefcSMark Murray
616c19800e8SDoug Rabson /**
617b528cefcSMark Murray * Create a new ccache in `id' for `primary_principal'.
618b528cefcSMark Murray *
619b528cefcSMark Murray * @return Return an error code or 0, see krb5_get_error_message().
620b528cefcSMark Murray *
621b528cefcSMark Murray * @ingroup krb5_ccache
622c19800e8SDoug Rabson */
623b528cefcSMark Murray
624c19800e8SDoug Rabson
625c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_initialize(krb5_context context,krb5_ccache id,krb5_principal primary_principal)626c19800e8SDoug Rabson krb5_cc_initialize(krb5_context context,
627c19800e8SDoug Rabson krb5_ccache id,
628b528cefcSMark Murray krb5_principal primary_principal)
629b528cefcSMark Murray {
630c19800e8SDoug Rabson return (*id->ops->init)(context, id, primary_principal);
631c19800e8SDoug Rabson }
632b528cefcSMark Murray
633b528cefcSMark Murray
634b528cefcSMark Murray /**
635b528cefcSMark Murray * Remove the ccache `id'.
636c19800e8SDoug Rabson *
637b528cefcSMark Murray * @return Return an error code or 0, see krb5_get_error_message().
638b528cefcSMark Murray *
639c19800e8SDoug Rabson * @ingroup krb5_ccache
640b528cefcSMark Murray */
641b528cefcSMark Murray
642c19800e8SDoug Rabson
643c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_destroy(krb5_context context,krb5_ccache id)644c19800e8SDoug Rabson krb5_cc_destroy(krb5_context context,
645c19800e8SDoug Rabson krb5_ccache id)
646b528cefcSMark Murray {
647b528cefcSMark Murray krb5_error_code ret;
648c19800e8SDoug Rabson
649c19800e8SDoug Rabson ret = (*id->ops->destroy)(context, id);
650b528cefcSMark Murray krb5_cc_close (context, id);
651b528cefcSMark Murray return ret;
652b528cefcSMark Murray }
653b528cefcSMark Murray
654c19800e8SDoug Rabson /**
655b528cefcSMark Murray * Stop using the ccache `id' and free the related resources.
656b528cefcSMark Murray *
657c19800e8SDoug Rabson * @return Return an error code or 0, see krb5_get_error_message().
658b528cefcSMark Murray *
659b528cefcSMark Murray * @ingroup krb5_ccache
660c19800e8SDoug Rabson */
661c19800e8SDoug Rabson
662c19800e8SDoug Rabson
663c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_close(krb5_context context,krb5_ccache id)664b528cefcSMark Murray krb5_cc_close(krb5_context context,
665b528cefcSMark Murray krb5_ccache id)
666c19800e8SDoug Rabson {
667c19800e8SDoug Rabson krb5_error_code ret;
668b528cefcSMark Murray ret = (*id->ops->close)(context, id);
669b528cefcSMark Murray free(id);
670adb0ddaeSAssar Westerlund return ret;
671adb0ddaeSAssar Westerlund }
672b528cefcSMark Murray
673c19800e8SDoug Rabson /**
674b528cefcSMark Murray * Store `creds' in the ccache `id'.
675b528cefcSMark Murray *
676c19800e8SDoug Rabson * @return Return an error code or 0, see krb5_get_error_message().
677c19800e8SDoug Rabson *
678c19800e8SDoug Rabson * @ingroup krb5_ccache
679c19800e8SDoug Rabson */
680b528cefcSMark Murray
681b528cefcSMark Murray
682c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_store_cred(krb5_context context,krb5_ccache id,krb5_creds * creds)683c19800e8SDoug Rabson krb5_cc_store_cred(krb5_context context,
684c19800e8SDoug Rabson krb5_ccache id,
685c19800e8SDoug Rabson krb5_creds *creds)
686c19800e8SDoug Rabson {
687c19800e8SDoug Rabson return (*id->ops->store)(context, id, creds);
688c19800e8SDoug Rabson }
689c19800e8SDoug Rabson
690c19800e8SDoug Rabson /**
691c19800e8SDoug Rabson * Retrieve the credential identified by `mcreds' (and `whichfields')
692c19800e8SDoug Rabson * from `id' in `creds'. 'creds' must be free by the caller using
693c19800e8SDoug Rabson * krb5_free_cred_contents.
694c19800e8SDoug Rabson *
695c19800e8SDoug Rabson * @param context A Kerberos 5 context
696c19800e8SDoug Rabson * @param id a Kerberos 5 credential cache
697c19800e8SDoug Rabson * @param whichfields what fields to use for matching credentials, same
698c19800e8SDoug Rabson * flags as whichfields in krb5_compare_creds()
699c19800e8SDoug Rabson * @param mcreds template credential to use for comparing
700c19800e8SDoug Rabson * @param creds returned credential, free with krb5_free_cred_contents()
701c19800e8SDoug Rabson *
702c19800e8SDoug Rabson * @return Return an error code or 0, see krb5_get_error_message().
703c19800e8SDoug Rabson *
704c19800e8SDoug Rabson * @ingroup krb5_ccache
705c19800e8SDoug Rabson */
706c19800e8SDoug Rabson
707c19800e8SDoug Rabson
708c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_retrieve_cred(krb5_context context,krb5_ccache id,krb5_flags whichfields,const krb5_creds * mcreds,krb5_creds * creds)709c19800e8SDoug Rabson krb5_cc_retrieve_cred(krb5_context context,
710b528cefcSMark Murray krb5_ccache id,
711b528cefcSMark Murray krb5_flags whichfields,
712b528cefcSMark Murray const krb5_creds *mcreds,
713b528cefcSMark Murray krb5_creds *creds)
714c19800e8SDoug Rabson {
715b528cefcSMark Murray krb5_error_code ret;
716b528cefcSMark Murray krb5_cc_cursor cursor;
717c19800e8SDoug Rabson
718b528cefcSMark Murray if (id->ops->retrieve != NULL) {
719c19800e8SDoug Rabson return (*id->ops->retrieve)(context, id, whichfields,
720c19800e8SDoug Rabson mcreds, creds);
721b528cefcSMark Murray }
722b528cefcSMark Murray
723c19800e8SDoug Rabson ret = krb5_cc_start_seq_get(context, id, &cursor);
724c19800e8SDoug Rabson if (ret)
725b528cefcSMark Murray return ret;
726b528cefcSMark Murray while((ret = krb5_cc_next_cred(context, id, &cursor, creds)) == 0){
727b528cefcSMark Murray if(krb5_compare_creds(context, whichfields, mcreds, creds)){
728b528cefcSMark Murray ret = 0;
729b528cefcSMark Murray break;
730adb0ddaeSAssar Westerlund }
731adb0ddaeSAssar Westerlund krb5_free_cred_contents (context, creds);
732adb0ddaeSAssar Westerlund }
733adb0ddaeSAssar Westerlund krb5_cc_end_seq_get(context, id, &cursor);
7345e9cd1aeSAssar Westerlund return ret;
735adb0ddaeSAssar Westerlund }
7365e9cd1aeSAssar Westerlund
737b528cefcSMark Murray /**
738b528cefcSMark Murray * Return the principal of `id' in `principal'.
739c19800e8SDoug Rabson *
740b528cefcSMark Murray * @return Return an error code or 0, see krb5_get_error_message().
741c19800e8SDoug Rabson *
742c19800e8SDoug Rabson * @ingroup krb5_ccache
743b528cefcSMark Murray */
744b528cefcSMark Murray
745c19800e8SDoug Rabson
746c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_principal(krb5_context context,krb5_ccache id,krb5_principal * principal)747b528cefcSMark Murray krb5_cc_get_principal(krb5_context context,
748b528cefcSMark Murray krb5_ccache id,
749b528cefcSMark Murray krb5_principal *principal)
750b528cefcSMark Murray {
751c19800e8SDoug Rabson return (*id->ops->get_princ)(context, id, principal);
752b528cefcSMark Murray }
753b528cefcSMark Murray
754c19800e8SDoug Rabson /**
755b528cefcSMark Murray * Start iterating over `id', `cursor' is initialized to the
756c19800e8SDoug Rabson * beginning. Caller must free the cursor with krb5_cc_end_seq_get().
757c19800e8SDoug Rabson *
758b528cefcSMark Murray * @return Return an error code or 0, see krb5_get_error_message().
759b528cefcSMark Murray *
760c19800e8SDoug Rabson * @ingroup krb5_ccache
761c19800e8SDoug Rabson */
762c19800e8SDoug Rabson
763b528cefcSMark Murray
764c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_start_seq_get(krb5_context context,const krb5_ccache id,krb5_cc_cursor * cursor)765c19800e8SDoug Rabson krb5_cc_start_seq_get (krb5_context context,
766c19800e8SDoug Rabson const krb5_ccache id,
767c19800e8SDoug Rabson krb5_cc_cursor *cursor)
768b528cefcSMark Murray {
769b528cefcSMark Murray return (*id->ops->get_first)(context, id, cursor);
770b528cefcSMark Murray }
771b528cefcSMark Murray
772b528cefcSMark Murray /**
773b528cefcSMark Murray * Retrieve the next cred pointed to by (`id', `cursor') in `creds'
774b528cefcSMark Murray * and advance `cursor'.
775b528cefcSMark Murray *
776b528cefcSMark Murray * @return Return an error code or 0, see krb5_get_error_message().
777b528cefcSMark Murray *
778b528cefcSMark Murray * @ingroup krb5_ccache
779b528cefcSMark Murray */
780b528cefcSMark Murray
781b528cefcSMark Murray
782b528cefcSMark Murray KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_next_cred(krb5_context context,const krb5_ccache id,krb5_cc_cursor * cursor,krb5_creds * creds)783b528cefcSMark Murray krb5_cc_next_cred (krb5_context context,
784b528cefcSMark Murray const krb5_ccache id,
785b528cefcSMark Murray krb5_cc_cursor *cursor,
786b528cefcSMark Murray krb5_creds *creds)
787c19800e8SDoug Rabson {
788c19800e8SDoug Rabson return (*id->ops->get_next)(context, id, cursor, creds);
789c19800e8SDoug Rabson }
790c19800e8SDoug Rabson
791c19800e8SDoug Rabson /**
792c19800e8SDoug Rabson * Destroy the cursor `cursor'.
793c19800e8SDoug Rabson *
794b528cefcSMark Murray * @ingroup krb5_ccache
795c19800e8SDoug Rabson */
796b528cefcSMark Murray
797b528cefcSMark Murray
798b528cefcSMark Murray KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_end_seq_get(krb5_context context,const krb5_ccache id,krb5_cc_cursor * cursor)799b528cefcSMark Murray krb5_cc_end_seq_get (krb5_context context,
800b528cefcSMark Murray const krb5_ccache id,
801b528cefcSMark Murray krb5_cc_cursor *cursor)
802c19800e8SDoug Rabson {
803c19800e8SDoug Rabson return (*id->ops->end_get)(context, id, cursor);
804c19800e8SDoug Rabson }
805c19800e8SDoug Rabson
806b528cefcSMark Murray /**
807b528cefcSMark Murray * Remove the credential identified by `cred', `which' from `id'.
808c19800e8SDoug Rabson *
809c19800e8SDoug Rabson * @ingroup krb5_ccache
810c19800e8SDoug Rabson */
811c19800e8SDoug Rabson
812c19800e8SDoug Rabson
813c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_remove_cred(krb5_context context,krb5_ccache id,krb5_flags which,krb5_creds * cred)814c19800e8SDoug Rabson krb5_cc_remove_cred(krb5_context context,
815c19800e8SDoug Rabson krb5_ccache id,
816c19800e8SDoug Rabson krb5_flags which,
817c19800e8SDoug Rabson krb5_creds *cred)
818c19800e8SDoug Rabson {
819c19800e8SDoug Rabson if(id->ops->remove_cred == NULL) {
820c19800e8SDoug Rabson krb5_set_error_message(context,
821c19800e8SDoug Rabson EACCES,
822c19800e8SDoug Rabson "ccache %s does not support remove_cred",
823c19800e8SDoug Rabson id->ops->prefix);
824c19800e8SDoug Rabson return EACCES; /* XXX */
825b528cefcSMark Murray }
826b528cefcSMark Murray return (*id->ops->remove_cred)(context, id, which, cred);
827b528cefcSMark Murray }
828b528cefcSMark Murray
829c19800e8SDoug Rabson /**
830b528cefcSMark Murray * Set the flags of `id' to `flags'.
831b528cefcSMark Murray *
832b528cefcSMark Murray * @ingroup krb5_ccache
833c19800e8SDoug Rabson */
834c19800e8SDoug Rabson
835c19800e8SDoug Rabson
836c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_flags(krb5_context context,krb5_ccache id,krb5_flags flags)837c19800e8SDoug Rabson krb5_cc_set_flags(krb5_context context,
838c19800e8SDoug Rabson krb5_ccache id,
839c19800e8SDoug Rabson krb5_flags flags)
840c19800e8SDoug Rabson {
841c19800e8SDoug Rabson return (*id->ops->set_flags)(context, id, flags);
842c19800e8SDoug Rabson }
843c19800e8SDoug Rabson
844c19800e8SDoug Rabson /**
845c19800e8SDoug Rabson * Get the flags of `id', store them in `flags'.
846c19800e8SDoug Rabson *
847c19800e8SDoug Rabson * @ingroup krb5_ccache
848c19800e8SDoug Rabson */
849c19800e8SDoug Rabson
850c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_flags(krb5_context context,krb5_ccache id,krb5_flags * flags)851c19800e8SDoug Rabson krb5_cc_get_flags(krb5_context context,
852c19800e8SDoug Rabson krb5_ccache id,
853c19800e8SDoug Rabson krb5_flags *flags)
854c19800e8SDoug Rabson {
855c19800e8SDoug Rabson *flags = 0;
856c19800e8SDoug Rabson return 0;
857c19800e8SDoug Rabson }
858c19800e8SDoug Rabson
859c19800e8SDoug Rabson /**
860c19800e8SDoug Rabson * Copy the contents of `from' to `to' if the given match function
861c19800e8SDoug Rabson * return true.
862c19800e8SDoug Rabson *
863c19800e8SDoug Rabson * @param context A Kerberos 5 context.
864c19800e8SDoug Rabson * @param from the cache to copy data from.
865c19800e8SDoug Rabson * @param to the cache to copy data to.
866c19800e8SDoug Rabson * @param match a match function that should return TRUE if cred argument should be copied, if NULL, all credentials are copied.
867c19800e8SDoug Rabson * @param matchctx context passed to match function.
868c19800e8SDoug Rabson * @param matched set to true if there was a credential that matched, may be NULL.
869c19800e8SDoug Rabson *
870c19800e8SDoug Rabson * @return Return an error code or 0, see krb5_get_error_message().
871c19800e8SDoug Rabson *
872c19800e8SDoug Rabson * @ingroup krb5_ccache
873c19800e8SDoug Rabson */
874c19800e8SDoug Rabson
875c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_copy_match_f(krb5_context context,const krb5_ccache from,krb5_ccache to,krb5_boolean (* match)(krb5_context,void *,const krb5_creds *),void * matchctx,unsigned int * matched)876c19800e8SDoug Rabson krb5_cc_copy_match_f(krb5_context context,
877c19800e8SDoug Rabson const krb5_ccache from,
878c19800e8SDoug Rabson krb5_ccache to,
879c19800e8SDoug Rabson krb5_boolean (*match)(krb5_context, void *, const krb5_creds *),
880c19800e8SDoug Rabson void *matchctx,
881c19800e8SDoug Rabson unsigned int *matched)
882c19800e8SDoug Rabson {
883c19800e8SDoug Rabson krb5_error_code ret;
884c19800e8SDoug Rabson krb5_cc_cursor cursor;
885c19800e8SDoug Rabson krb5_creds cred;
886c19800e8SDoug Rabson krb5_principal princ;
887c19800e8SDoug Rabson
888c19800e8SDoug Rabson if (matched)
889c19800e8SDoug Rabson *matched = 0;
890c19800e8SDoug Rabson
891c19800e8SDoug Rabson ret = krb5_cc_get_principal(context, from, &princ);
892c19800e8SDoug Rabson if (ret)
893c19800e8SDoug Rabson return ret;
894c19800e8SDoug Rabson ret = krb5_cc_initialize(context, to, princ);
895c19800e8SDoug Rabson if (ret) {
896c19800e8SDoug Rabson krb5_free_principal(context, princ);
897c19800e8SDoug Rabson return ret;
898c19800e8SDoug Rabson }
899c19800e8SDoug Rabson ret = krb5_cc_start_seq_get(context, from, &cursor);
900c19800e8SDoug Rabson if (ret) {
901c19800e8SDoug Rabson krb5_free_principal(context, princ);
902c19800e8SDoug Rabson return ret;
903c19800e8SDoug Rabson }
904c19800e8SDoug Rabson
905c19800e8SDoug Rabson while ((ret = krb5_cc_next_cred(context, from, &cursor, &cred)) == 0) {
906c19800e8SDoug Rabson if (match == NULL || (*match)(context, matchctx, &cred) == 0) {
907c19800e8SDoug Rabson if (matched)
908c19800e8SDoug Rabson (*matched)++;
909c19800e8SDoug Rabson ret = krb5_cc_store_cred(context, to, &cred);
910c19800e8SDoug Rabson if (ret)
911c19800e8SDoug Rabson break;
912c19800e8SDoug Rabson }
913c19800e8SDoug Rabson krb5_free_cred_contents(context, &cred);
914c19800e8SDoug Rabson }
915c19800e8SDoug Rabson krb5_cc_end_seq_get(context, from, &cursor);
916c19800e8SDoug Rabson krb5_free_principal(context, princ);
917c19800e8SDoug Rabson if (ret == KRB5_CC_END)
918c19800e8SDoug Rabson ret = 0;
919c19800e8SDoug Rabson return ret;
920c19800e8SDoug Rabson }
921c19800e8SDoug Rabson
922c19800e8SDoug Rabson /**
923c19800e8SDoug Rabson * Just like krb5_cc_copy_match_f(), but copy everything.
924c19800e8SDoug Rabson *
925c19800e8SDoug Rabson * @ingroup @krb5_ccache
926c19800e8SDoug Rabson */
927c19800e8SDoug Rabson
928c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_copy_cache(krb5_context context,const krb5_ccache from,krb5_ccache to)929c19800e8SDoug Rabson krb5_cc_copy_cache(krb5_context context,
930c19800e8SDoug Rabson const krb5_ccache from,
931c19800e8SDoug Rabson krb5_ccache to)
932c19800e8SDoug Rabson {
933c19800e8SDoug Rabson return krb5_cc_copy_match_f(context, from, to, NULL, NULL, NULL);
934c19800e8SDoug Rabson }
935c19800e8SDoug Rabson
936c19800e8SDoug Rabson /**
937c19800e8SDoug Rabson * Return the version of `id'.
938c19800e8SDoug Rabson *
939c19800e8SDoug Rabson * @ingroup krb5_ccache
940c19800e8SDoug Rabson */
941c19800e8SDoug Rabson
942c19800e8SDoug Rabson
943c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_version(krb5_context context,const krb5_ccache id)944c19800e8SDoug Rabson krb5_cc_get_version(krb5_context context,
945c19800e8SDoug Rabson const krb5_ccache id)
946c19800e8SDoug Rabson {
947c19800e8SDoug Rabson if(id->ops->get_version)
948c19800e8SDoug Rabson return (*id->ops->get_version)(context, id);
949c19800e8SDoug Rabson else
950c19800e8SDoug Rabson return 0;
951c19800e8SDoug Rabson }
952c19800e8SDoug Rabson
953c19800e8SDoug Rabson /**
954c19800e8SDoug Rabson * Clear `mcreds' so it can be used with krb5_cc_retrieve_cred
955c19800e8SDoug Rabson *
956c19800e8SDoug Rabson * @ingroup krb5_ccache
957c19800e8SDoug Rabson */
958c19800e8SDoug Rabson
959c19800e8SDoug Rabson
960c19800e8SDoug Rabson KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_cc_clear_mcred(krb5_creds * mcred)961c19800e8SDoug Rabson krb5_cc_clear_mcred(krb5_creds *mcred)
962c19800e8SDoug Rabson {
963c19800e8SDoug Rabson memset(mcred, 0, sizeof(*mcred));
964c19800e8SDoug Rabson }
965c19800e8SDoug Rabson
966c19800e8SDoug Rabson /**
967c19800e8SDoug Rabson * Get the cc ops that is registered in `context' to handle the
968c19800e8SDoug Rabson * prefix. prefix can be a complete credential cache name or a
969c19800e8SDoug Rabson * prefix, the function will only use part up to the first colon (:)
970c19800e8SDoug Rabson * if there is one. If prefix the argument is NULL, the default ccache
971c19800e8SDoug Rabson * implemtation is returned.
972c19800e8SDoug Rabson *
973c19800e8SDoug Rabson * @return Returns NULL if ops not found.
974c19800e8SDoug Rabson *
975c19800e8SDoug Rabson * @ingroup krb5_ccache
976c19800e8SDoug Rabson */
977c19800e8SDoug Rabson
978c19800e8SDoug Rabson
979c19800e8SDoug Rabson KRB5_LIB_FUNCTION const krb5_cc_ops * KRB5_LIB_CALL
krb5_cc_get_prefix_ops(krb5_context context,const char * prefix)980c19800e8SDoug Rabson krb5_cc_get_prefix_ops(krb5_context context, const char *prefix)
981c19800e8SDoug Rabson {
982c19800e8SDoug Rabson char *p, *p1;
983c19800e8SDoug Rabson int i;
984c19800e8SDoug Rabson
985c19800e8SDoug Rabson if (prefix == NULL)
986c19800e8SDoug Rabson return KRB5_DEFAULT_CCTYPE;
987c19800e8SDoug Rabson if (prefix[0] == '/')
988c19800e8SDoug Rabson return &krb5_fcc_ops;
989c19800e8SDoug Rabson
990c19800e8SDoug Rabson p = strdup(prefix);
991c19800e8SDoug Rabson if (p == NULL) {
992c19800e8SDoug Rabson krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
993c19800e8SDoug Rabson return NULL;
994c19800e8SDoug Rabson }
995c19800e8SDoug Rabson p1 = strchr(p, ':');
996c19800e8SDoug Rabson if (p1)
997c19800e8SDoug Rabson *p1 = '\0';
998c19800e8SDoug Rabson
999c19800e8SDoug Rabson for(i = 0; i < context->num_cc_ops && context->cc_ops[i]->prefix; i++) {
1000c19800e8SDoug Rabson if(strcmp(context->cc_ops[i]->prefix, p) == 0) {
1001c19800e8SDoug Rabson free(p);
1002c19800e8SDoug Rabson return context->cc_ops[i];
1003c19800e8SDoug Rabson }
1004c19800e8SDoug Rabson }
1005c19800e8SDoug Rabson free(p);
1006c19800e8SDoug Rabson return NULL;
1007c19800e8SDoug Rabson }
1008c19800e8SDoug Rabson
1009c19800e8SDoug Rabson struct krb5_cc_cache_cursor_data {
1010c19800e8SDoug Rabson const krb5_cc_ops *ops;
1011c19800e8SDoug Rabson krb5_cc_cursor cursor;
1012c19800e8SDoug Rabson };
1013c19800e8SDoug Rabson
1014c19800e8SDoug Rabson /**
1015c19800e8SDoug Rabson * Start iterating over all caches of specified type. See also
1016c19800e8SDoug Rabson * krb5_cccol_cursor_new().
1017c19800e8SDoug Rabson
1018c19800e8SDoug Rabson * @param context A Kerberos 5 context
1019c19800e8SDoug Rabson * @param type optional type to iterate over, if NULL, the default cache is used.
1020c19800e8SDoug Rabson * @param cursor cursor should be freed with krb5_cc_cache_end_seq_get().
1021c19800e8SDoug Rabson *
1022c19800e8SDoug Rabson * @return Return an error code or 0, see krb5_get_error_message().
1023c19800e8SDoug Rabson *
1024c19800e8SDoug Rabson * @ingroup krb5_ccache
1025c19800e8SDoug Rabson */
1026c19800e8SDoug Rabson
1027c19800e8SDoug Rabson
1028c19800e8SDoug Rabson KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_cache_get_first(krb5_context context,const char * type,krb5_cc_cache_cursor * cursor)1029c19800e8SDoug Rabson krb5_cc_cache_get_first (krb5_context context,
1030c19800e8SDoug Rabson const char *type,
1031c19800e8SDoug Rabson krb5_cc_cache_cursor *cursor)
1032c19800e8SDoug Rabson {
1033c19800e8SDoug Rabson const krb5_cc_ops *ops;
1034c19800e8SDoug Rabson krb5_error_code ret;
1035c19800e8SDoug Rabson
1036c19800e8SDoug Rabson if (type == NULL)
1037c19800e8SDoug Rabson type = krb5_cc_default_name(context);
1038c19800e8SDoug Rabson
1039c19800e8SDoug Rabson ops = krb5_cc_get_prefix_ops(context, type);
1040c19800e8SDoug Rabson if (ops == NULL) {
1041c19800e8SDoug Rabson krb5_set_error_message(context, KRB5_CC_UNKNOWN_TYPE,
1042c19800e8SDoug Rabson "Unknown type \"%s\" when iterating "
1043c19800e8SDoug Rabson "trying to iterate the credential caches", type);
1044c19800e8SDoug Rabson return KRB5_CC_UNKNOWN_TYPE;
1045c19800e8SDoug Rabson }
1046c19800e8SDoug Rabson
1047c19800e8SDoug Rabson if (ops->get_cache_first == NULL) {
1048c19800e8SDoug Rabson krb5_set_error_message(context, KRB5_CC_NOSUPP,
1049c19800e8SDoug Rabson N_("Credential cache type %s doesn't support "
1050c19800e8SDoug Rabson "iterations over caches", "type"),
1051c19800e8SDoug Rabson ops->prefix);
1052c19800e8SDoug Rabson return KRB5_CC_NOSUPP;
1053c19800e8SDoug Rabson }
1054c19800e8SDoug Rabson
1055c19800e8SDoug Rabson *cursor = calloc(1, sizeof(**cursor));
1056c19800e8SDoug Rabson if (*cursor == NULL) {
1057c19800e8SDoug Rabson krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1058c19800e8SDoug Rabson return ENOMEM;
1059c19800e8SDoug Rabson }
1060c19800e8SDoug Rabson
1061c19800e8SDoug Rabson (*cursor)->ops = ops;
1062c19800e8SDoug Rabson
1063c19800e8SDoug Rabson ret = ops->get_cache_first(context, &(*cursor)->cursor);
1064c19800e8SDoug Rabson if (ret) {
1065c19800e8SDoug Rabson free(*cursor);
1066c19800e8SDoug Rabson *cursor = NULL;
1067c19800e8SDoug Rabson }
1068c19800e8SDoug Rabson return ret;
1069c19800e8SDoug Rabson }
1070c19800e8SDoug Rabson
1071c19800e8SDoug Rabson /**
1072c19800e8SDoug Rabson * Retrieve the next cache pointed to by (`cursor') in `id'
1073c19800e8SDoug Rabson * and advance `cursor'.
1074 *
1075 * @param context A Kerberos 5 context
1076 * @param cursor the iterator cursor, returned by krb5_cc_cache_get_first()
1077 * @param id next ccache
1078 *
1079 * @return Return 0 or an error code. Returns KRB5_CC_END when the end
1080 * of caches is reached, see krb5_get_error_message().
1081 *
1082 * @ingroup krb5_ccache
1083 */
1084
1085
1086 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_cache_next(krb5_context context,krb5_cc_cache_cursor cursor,krb5_ccache * id)1087 krb5_cc_cache_next (krb5_context context,
1088 krb5_cc_cache_cursor cursor,
1089 krb5_ccache *id)
1090 {
1091 return cursor->ops->get_cache_next(context, cursor->cursor, id);
1092 }
1093
1094 /**
1095 * Destroy the cursor `cursor'.
1096 *
1097 * @return Return an error code or 0, see krb5_get_error_message().
1098 *
1099 * @ingroup krb5_ccache
1100 */
1101
1102
1103 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_cache_end_seq_get(krb5_context context,krb5_cc_cache_cursor cursor)1104 krb5_cc_cache_end_seq_get (krb5_context context,
1105 krb5_cc_cache_cursor cursor)
1106 {
1107 krb5_error_code ret;
1108 ret = cursor->ops->end_cache_get(context, cursor->cursor);
1109 cursor->ops = NULL;
1110 free(cursor);
1111 return ret;
1112 }
1113
1114 /**
1115 * Search for a matching credential cache that have the
1116 * `principal' as the default principal. On success, `id' needs to be
1117 * freed with krb5_cc_close() or krb5_cc_destroy().
1118 *
1119 * @param context A Kerberos 5 context
1120 * @param client The principal to search for
1121 * @param id the returned credential cache
1122 *
1123 * @return On failure, error code is returned and `id' is set to NULL.
1124 *
1125 * @ingroup krb5_ccache
1126 */
1127
1128
1129 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_cache_match(krb5_context context,krb5_principal client,krb5_ccache * id)1130 krb5_cc_cache_match (krb5_context context,
1131 krb5_principal client,
1132 krb5_ccache *id)
1133 {
1134 krb5_cccol_cursor cursor;
1135 krb5_error_code ret;
1136 krb5_ccache cache = NULL;
1137
1138 *id = NULL;
1139
1140 ret = krb5_cccol_cursor_new (context, &cursor);
1141 if (ret)
1142 return ret;
1143
1144 while (krb5_cccol_cursor_next (context, cursor, &cache) == 0 && cache != NULL) {
1145 krb5_principal principal;
1146
1147 ret = krb5_cc_get_principal(context, cache, &principal);
1148 if (ret == 0) {
1149 krb5_boolean match;
1150
1151 match = krb5_principal_compare(context, principal, client);
1152 krb5_free_principal(context, principal);
1153 if (match)
1154 break;
1155 }
1156
1157 krb5_cc_close(context, cache);
1158 cache = NULL;
1159 }
1160
1161 krb5_cccol_cursor_free(context, &cursor);
1162
1163 if (cache == NULL) {
1164 char *str;
1165
1166 krb5_unparse_name(context, client, &str);
1167
1168 krb5_set_error_message(context, KRB5_CC_NOTFOUND,
1169 N_("Principal %s not found in any "
1170 "credential cache", ""),
1171 str ? str : "<out of memory>");
1172 if (str)
1173 free(str);
1174 return KRB5_CC_NOTFOUND;
1175 }
1176 *id = cache;
1177
1178 return 0;
1179 }
1180
1181 /**
1182 * Move the content from one credential cache to another. The
1183 * operation is an atomic switch.
1184 *
1185 * @param context a Keberos context
1186 * @param from the credential cache to move the content from
1187 * @param to the credential cache to move the content to
1188
1189 * @return On sucess, from is freed. On failure, error code is
1190 * returned and from and to are both still allocated, see krb5_get_error_message().
1191 *
1192 * @ingroup krb5_ccache
1193 */
1194
1195 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_move(krb5_context context,krb5_ccache from,krb5_ccache to)1196 krb5_cc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
1197 {
1198 krb5_error_code ret;
1199
1200 if (strcmp(from->ops->prefix, to->ops->prefix) != 0) {
1201 krb5_set_error_message(context, KRB5_CC_NOSUPP,
1202 N_("Moving credentials between diffrent "
1203 "types not yet supported", ""));
1204 return KRB5_CC_NOSUPP;
1205 }
1206
1207 ret = (*to->ops->move)(context, from, to);
1208 if (ret == 0) {
1209 memset(from, 0, sizeof(*from));
1210 free(from);
1211 }
1212 return ret;
1213 }
1214
1215 #define KRB5_CONF_NAME "krb5_ccache_conf_data"
1216 #define KRB5_REALM_NAME "X-CACHECONF:"
1217
1218 static krb5_error_code
build_conf_principals(krb5_context context,krb5_ccache id,krb5_const_principal principal,const char * name,krb5_creds * cred)1219 build_conf_principals(krb5_context context, krb5_ccache id,
1220 krb5_const_principal principal,
1221 const char *name, krb5_creds *cred)
1222 {
1223 krb5_principal client;
1224 krb5_error_code ret;
1225 char *pname = NULL;
1226
1227 memset(cred, 0, sizeof(*cred));
1228
1229 ret = krb5_cc_get_principal(context, id, &client);
1230 if (ret)
1231 return ret;
1232
1233 if (principal) {
1234 ret = krb5_unparse_name(context, principal, &pname);
1235 if (ret)
1236 return ret;
1237 }
1238
1239 ret = krb5_make_principal(context, &cred->server,
1240 KRB5_REALM_NAME,
1241 KRB5_CONF_NAME, name, pname, NULL);
1242 free(pname);
1243 if (ret) {
1244 krb5_free_principal(context, client);
1245 return ret;
1246 }
1247 ret = krb5_copy_principal(context, client, &cred->client);
1248 krb5_free_principal(context, client);
1249 return ret;
1250 }
1251
1252 /**
1253 * Return TRUE (non zero) if the principal is a configuration
1254 * principal (generated part of krb5_cc_set_config()). Returns FALSE
1255 * (zero) if not a configuration principal.
1256 *
1257 * @param context a Keberos context
1258 * @param principal principal to check if it a configuration principal
1259 *
1260 * @ingroup krb5_ccache
1261 */
1262
1263 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
krb5_is_config_principal(krb5_context context,krb5_const_principal principal)1264 krb5_is_config_principal(krb5_context context,
1265 krb5_const_principal principal)
1266 {
1267 if (strcmp(principal->realm, KRB5_REALM_NAME) != 0)
1268 return FALSE;
1269
1270 if (principal->name.name_string.len == 0 ||
1271 strcmp(principal->name.name_string.val[0], KRB5_CONF_NAME) != 0)
1272 return FALSE;
1273
1274 return TRUE;
1275 }
1276
1277 /**
1278 * Store some configuration for the credential cache in the cache.
1279 * Existing configuration under the same name is over-written.
1280 *
1281 * @param context a Keberos context
1282 * @param id the credential cache to store the data for
1283 * @param principal configuration for a specific principal, if
1284 * NULL, global for the whole cache.
1285 * @param name name under which the configuraion is stored.
1286 * @param data data to store, if NULL, configure is removed.
1287 *
1288 * @ingroup krb5_ccache
1289 */
1290
1291 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_config(krb5_context context,krb5_ccache id,krb5_const_principal principal,const char * name,krb5_data * data)1292 krb5_cc_set_config(krb5_context context, krb5_ccache id,
1293 krb5_const_principal principal,
1294 const char *name, krb5_data *data)
1295 {
1296 krb5_error_code ret;
1297 krb5_creds cred;
1298
1299 ret = build_conf_principals(context, id, principal, name, &cred);
1300 if (ret)
1301 goto out;
1302
1303 /* Remove old configuration */
1304 ret = krb5_cc_remove_cred(context, id, 0, &cred);
1305 if (ret && ret != KRB5_CC_NOTFOUND)
1306 goto out;
1307
1308 if (data) {
1309 /* not that anyone care when this expire */
1310 cred.times.authtime = time(NULL);
1311 cred.times.endtime = cred.times.authtime + 3600 * 24 * 30;
1312
1313 ret = krb5_data_copy(&cred.ticket, data->data, data->length);
1314 if (ret)
1315 goto out;
1316
1317 ret = krb5_cc_store_cred(context, id, &cred);
1318 }
1319
1320 out:
1321 krb5_free_cred_contents (context, &cred);
1322 return ret;
1323 }
1324
1325 /**
1326 * Get some configuration for the credential cache in the cache.
1327 *
1328 * @param context a Keberos context
1329 * @param id the credential cache to store the data for
1330 * @param principal configuration for a specific principal, if
1331 * NULL, global for the whole cache.
1332 * @param name name under which the configuraion is stored.
1333 * @param data data to fetched, free with krb5_data_free()
1334 *
1335 * @ingroup krb5_ccache
1336 */
1337
1338
1339 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_config(krb5_context context,krb5_ccache id,krb5_const_principal principal,const char * name,krb5_data * data)1340 krb5_cc_get_config(krb5_context context, krb5_ccache id,
1341 krb5_const_principal principal,
1342 const char *name, krb5_data *data)
1343 {
1344 krb5_creds mcred, cred;
1345 krb5_error_code ret;
1346
1347 memset(&cred, 0, sizeof(cred));
1348 krb5_data_zero(data);
1349
1350 ret = build_conf_principals(context, id, principal, name, &mcred);
1351 if (ret)
1352 goto out;
1353
1354 ret = krb5_cc_retrieve_cred(context, id, 0, &mcred, &cred);
1355 if (ret)
1356 goto out;
1357
1358 ret = krb5_data_copy(data, cred.ticket.data, cred.ticket.length);
1359
1360 out:
1361 krb5_free_cred_contents (context, &cred);
1362 krb5_free_cred_contents (context, &mcred);
1363 return ret;
1364 }
1365
1366 /*
1367 *
1368 */
1369
1370 struct krb5_cccol_cursor_data {
1371 int idx;
1372 krb5_cc_cache_cursor cursor;
1373 };
1374
1375 /**
1376 * Get a new cache interation cursor that will interate over all
1377 * credentials caches independent of type.
1378 *
1379 * @param context a Keberos context
1380 * @param cursor passed into krb5_cccol_cursor_next() and free with krb5_cccol_cursor_free().
1381 *
1382 * @return Returns 0 or and error code, see krb5_get_error_message().
1383 *
1384 * @ingroup krb5_ccache
1385 */
1386
1387 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cccol_cursor_new(krb5_context context,krb5_cccol_cursor * cursor)1388 krb5_cccol_cursor_new(krb5_context context, krb5_cccol_cursor *cursor)
1389 {
1390 *cursor = calloc(1, sizeof(**cursor));
1391 if (*cursor == NULL) {
1392 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1393 return ENOMEM;
1394 }
1395 (*cursor)->idx = 0;
1396 (*cursor)->cursor = NULL;
1397
1398 return 0;
1399 }
1400
1401 /**
1402 * Get next credential cache from the iteration.
1403 *
1404 * @param context A Kerberos 5 context
1405 * @param cursor the iteration cursor
1406 * @param cache the returned cursor, pointer is set to NULL on failure
1407 * and a cache on success. The returned cache needs to be freed
1408 * with krb5_cc_close() or destroyed with krb5_cc_destroy().
1409 * MIT Kerberos behavies slightly diffrent and sets cache to NULL
1410 * when all caches are iterated over and return 0.
1411 *
1412 * @return Return 0 or and error, KRB5_CC_END is returned at the end
1413 * of iteration. See krb5_get_error_message().
1414 *
1415 * @ingroup krb5_ccache
1416 */
1417
1418
1419 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cccol_cursor_next(krb5_context context,krb5_cccol_cursor cursor,krb5_ccache * cache)1420 krb5_cccol_cursor_next(krb5_context context, krb5_cccol_cursor cursor,
1421 krb5_ccache *cache)
1422 {
1423 krb5_error_code ret;
1424
1425 *cache = NULL;
1426
1427 while (cursor->idx < context->num_cc_ops) {
1428
1429 if (cursor->cursor == NULL) {
1430 ret = krb5_cc_cache_get_first (context,
1431 context->cc_ops[cursor->idx]->prefix,
1432 &cursor->cursor);
1433 if (ret) {
1434 cursor->idx++;
1435 continue;
1436 }
1437 }
1438 ret = krb5_cc_cache_next(context, cursor->cursor, cache);
1439 if (ret == 0)
1440 break;
1441
1442 krb5_cc_cache_end_seq_get(context, cursor->cursor);
1443 cursor->cursor = NULL;
1444 if (ret != KRB5_CC_END)
1445 break;
1446
1447 cursor->idx++;
1448 }
1449 if (cursor->idx >= context->num_cc_ops) {
1450 krb5_set_error_message(context, KRB5_CC_END,
1451 N_("Reached end of credential caches", ""));
1452 return KRB5_CC_END;
1453 }
1454
1455 return 0;
1456 }
1457
1458 /**
1459 * End an iteration and free all resources, can be done before end is reached.
1460 *
1461 * @param context A Kerberos 5 context
1462 * @param cursor the iteration cursor to be freed.
1463 *
1464 * @return Return 0 or and error, KRB5_CC_END is returned at the end
1465 * of iteration. See krb5_get_error_message().
1466 *
1467 * @ingroup krb5_ccache
1468 */
1469
1470 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cccol_cursor_free(krb5_context context,krb5_cccol_cursor * cursor)1471 krb5_cccol_cursor_free(krb5_context context, krb5_cccol_cursor *cursor)
1472 {
1473 krb5_cccol_cursor c = *cursor;
1474
1475 *cursor = NULL;
1476 if (c) {
1477 if (c->cursor)
1478 krb5_cc_cache_end_seq_get(context, c->cursor);
1479 free(c);
1480 }
1481 return 0;
1482 }
1483
1484 /**
1485 * Return the last time the credential cache was modified.
1486 *
1487 * @param context A Kerberos 5 context
1488 * @param id The credential cache to probe
1489 * @param mtime the last modification time, set to 0 on error.
1490
1491 * @return Return 0 or and error. See krb5_get_error_message().
1492 *
1493 * @ingroup krb5_ccache
1494 */
1495
1496
1497 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_last_change_time(krb5_context context,krb5_ccache id,krb5_timestamp * mtime)1498 krb5_cc_last_change_time(krb5_context context,
1499 krb5_ccache id,
1500 krb5_timestamp *mtime)
1501 {
1502 *mtime = 0;
1503 return (*id->ops->lastchange)(context, id, mtime);
1504 }
1505
1506 /**
1507 * Return the last modfication time for a cache collection. The query
1508 * can be limited to a specific cache type. If the function return 0
1509 * and mtime is 0, there was no credentials in the caches.
1510 *
1511 * @param context A Kerberos 5 context
1512 * @param type The credential cache to probe, if NULL, all type are traversed.
1513 * @param mtime the last modification time, set to 0 on error.
1514
1515 * @return Return 0 or and error. See krb5_get_error_message().
1516 *
1517 * @ingroup krb5_ccache
1518 */
1519
1520 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cccol_last_change_time(krb5_context context,const char * type,krb5_timestamp * mtime)1521 krb5_cccol_last_change_time(krb5_context context,
1522 const char *type,
1523 krb5_timestamp *mtime)
1524 {
1525 krb5_cccol_cursor cursor;
1526 krb5_error_code ret;
1527 krb5_ccache id;
1528 krb5_timestamp t = 0;
1529
1530 *mtime = 0;
1531
1532 ret = krb5_cccol_cursor_new (context, &cursor);
1533 if (ret)
1534 return ret;
1535
1536 while (krb5_cccol_cursor_next(context, cursor, &id) == 0 && id != NULL) {
1537
1538 if (type && strcmp(krb5_cc_get_type(context, id), type) != 0)
1539 continue;
1540
1541 ret = krb5_cc_last_change_time(context, id, &t);
1542 krb5_cc_close(context, id);
1543 if (ret)
1544 continue;
1545 if (t > *mtime)
1546 *mtime = t;
1547 }
1548
1549 krb5_cccol_cursor_free(context, &cursor);
1550
1551 return 0;
1552 }
1553 /**
1554 * Return a friendly name on credential cache. Free the result with krb5_xfree().
1555 *
1556 * @return Return an error code or 0, see krb5_get_error_message().
1557 *
1558 * @ingroup krb5_ccache
1559 */
1560
1561 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_friendly_name(krb5_context context,krb5_ccache id,char ** name)1562 krb5_cc_get_friendly_name(krb5_context context,
1563 krb5_ccache id,
1564 char **name)
1565 {
1566 krb5_error_code ret;
1567 krb5_data data;
1568
1569 ret = krb5_cc_get_config(context, id, NULL, "FriendlyName", &data);
1570 if (ret) {
1571 krb5_principal principal;
1572 ret = krb5_cc_get_principal(context, id, &principal);
1573 if (ret)
1574 return ret;
1575 ret = krb5_unparse_name(context, principal, name);
1576 krb5_free_principal(context, principal);
1577 } else {
1578 ret = asprintf(name, "%.*s", (int)data.length, (char *)data.data);
1579 krb5_data_free(&data);
1580 if (ret <= 0) {
1581 ret = ENOMEM;
1582 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
1583 } else
1584 ret = 0;
1585 }
1586
1587 return ret;
1588 }
1589
1590 /**
1591 * Set the friendly name on credential cache.
1592 *
1593 * @return Return an error code or 0, see krb5_get_error_message().
1594 *
1595 * @ingroup krb5_ccache
1596 */
1597
1598 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_friendly_name(krb5_context context,krb5_ccache id,const char * name)1599 krb5_cc_set_friendly_name(krb5_context context,
1600 krb5_ccache id,
1601 const char *name)
1602 {
1603 krb5_data data;
1604
1605 data.data = rk_UNCONST(name);
1606 data.length = strlen(name);
1607
1608 return krb5_cc_set_config(context, id, NULL, "FriendlyName", &data);
1609 }
1610
1611 /**
1612 * Get the lifetime of the initial ticket in the cache
1613 *
1614 * Get the lifetime of the initial ticket in the cache, if the initial
1615 * ticket was not found, the error code KRB5_CC_END is returned.
1616 *
1617 * @param context A Kerberos 5 context.
1618 * @param id a credential cache
1619 * @param t the relative lifetime of the initial ticket
1620 *
1621 * @return Return an error code or 0, see krb5_get_error_message().
1622 *
1623 * @ingroup krb5_ccache
1624 */
1625
1626 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_lifetime(krb5_context context,krb5_ccache id,time_t * t)1627 krb5_cc_get_lifetime(krb5_context context, krb5_ccache id, time_t *t)
1628 {
1629 krb5_cc_cursor cursor;
1630 krb5_error_code ret;
1631 krb5_creds cred;
1632 time_t now;
1633
1634 *t = 0;
1635 now = time(NULL);
1636
1637 ret = krb5_cc_start_seq_get(context, id, &cursor);
1638 if (ret)
1639 return ret;
1640
1641 while ((ret = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) {
1642 if (cred.flags.b.initial) {
1643 if (now < cred.times.endtime)
1644 *t = cred.times.endtime - now;
1645 krb5_free_cred_contents(context, &cred);
1646 break;
1647 }
1648 krb5_free_cred_contents(context, &cred);
1649 }
1650
1651 krb5_cc_end_seq_get(context, id, &cursor);
1652
1653 return ret;
1654 }
1655
1656 /**
1657 * Set the time offset betwen the client and the KDC
1658 *
1659 * If the backend doesn't support KDC offset, use the context global setting.
1660 *
1661 * @param context A Kerberos 5 context.
1662 * @param id a credential cache
1663 * @param offset the offset in seconds
1664 *
1665 * @return Return an error code or 0, see krb5_get_error_message().
1666 *
1667 * @ingroup krb5_ccache
1668 */
1669
1670 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_kdc_offset(krb5_context context,krb5_ccache id,krb5_deltat offset)1671 krb5_cc_set_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat offset)
1672 {
1673 if (id->ops->set_kdc_offset == NULL) {
1674 context->kdc_sec_offset = offset;
1675 context->kdc_usec_offset = 0;
1676 return 0;
1677 }
1678 return (*id->ops->set_kdc_offset)(context, id, offset);
1679 }
1680
1681 /**
1682 * Get the time offset betwen the client and the KDC
1683 *
1684 * If the backend doesn't support KDC offset, use the context global setting.
1685 *
1686 * @param context A Kerberos 5 context.
1687 * @param id a credential cache
1688 * @param offset the offset in seconds
1689 *
1690 * @return Return an error code or 0, see krb5_get_error_message().
1691 *
1692 * @ingroup krb5_ccache
1693 */
1694
1695 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_kdc_offset(krb5_context context,krb5_ccache id,krb5_deltat * offset)1696 krb5_cc_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *offset)
1697 {
1698 if (id->ops->get_kdc_offset == NULL) {
1699 *offset = context->kdc_sec_offset;
1700 return 0;
1701 }
1702 return (*id->ops->get_kdc_offset)(context, id, offset);
1703 }
1704
1705
1706 #ifdef _WIN32
1707
1708 #define REGPATH_MIT_KRB5 "SOFTWARE\\MIT\\Kerberos5"
1709 char *
_krb5_get_default_cc_name_from_registry(krb5_context context)1710 _krb5_get_default_cc_name_from_registry(krb5_context context)
1711 {
1712 HKEY hk_k5 = 0;
1713 LONG code;
1714 char * ccname = NULL;
1715
1716 code = RegOpenKeyEx(HKEY_CURRENT_USER,
1717 REGPATH_MIT_KRB5,
1718 0, KEY_READ, &hk_k5);
1719
1720 if (code != ERROR_SUCCESS)
1721 return NULL;
1722
1723 ccname = _krb5_parse_reg_value_as_string(context, hk_k5, "ccname",
1724 REG_NONE, 0);
1725
1726 RegCloseKey(hk_k5);
1727
1728 return ccname;
1729 }
1730
1731 int
_krb5_set_default_cc_name_to_registry(krb5_context context,krb5_ccache id)1732 _krb5_set_default_cc_name_to_registry(krb5_context context, krb5_ccache id)
1733 {
1734 HKEY hk_k5 = 0;
1735 LONG code;
1736 int ret = -1;
1737 char * ccname = NULL;
1738
1739 code = RegOpenKeyEx(HKEY_CURRENT_USER,
1740 REGPATH_MIT_KRB5,
1741 0, KEY_READ|KEY_WRITE, &hk_k5);
1742
1743 if (code != ERROR_SUCCESS)
1744 return -1;
1745
1746 ret = asprintf(&ccname, "%s:%s", krb5_cc_get_type(context, id), krb5_cc_get_name(context, id));
1747 if (ret < 0)
1748 goto cleanup;
1749
1750 ret = _krb5_store_string_to_reg_value(context, hk_k5, "ccname",
1751 REG_SZ, ccname, -1, 0);
1752
1753 cleanup:
1754
1755 if (ccname)
1756 free(ccname);
1757
1758 RegCloseKey(hk_k5);
1759
1760 return ret;
1761 }
1762
1763 #endif
1764