1/* $NetBSD: ad.c,v 1.4 2017/01/28 21:31:49 christos Exp $ */
2
3/*
4 * Copyright (c) 2004 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36#define HAVE_TSASL 1
37
38#include "kadm5_locl.h"
39#if 1
40#undef OPENLDAP
41#undef HAVE_TSASL
42#endif
43#ifdef OPENLDAP
44#include <ldap.h>
45#ifdef HAVE_TSASL
46#include <tsasl.h>
47#endif
48#include <krb5/resolve.h>
49#include <krb5/base64.h>
50#endif
51
52__RCSID("$NetBSD: ad.c,v 1.4 2017/01/28 21:31:49 christos Exp $");
53
54#ifdef OPENLDAP
55
56#define CTX2LP(context) ((LDAP *)((context)->ldap_conn))
57#define CTX2BASE(context) ((context)->base_dn)
58
59/*
60 * userAccountControl
61 */
62
63#define UF_SCRIPT 0x00000001
64#define UF_ACCOUNTDISABLE 0x00000002
65#define UF_UNUSED_0 0x00000004
66#define UF_HOMEDIR_REQUIRED 0x00000008
67#define UF_LOCKOUT 0x00000010
68#define UF_PASSWD_NOTREQD 0x00000020
69#define UF_PASSWD_CANT_CHANGE 0x00000040
70#define UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED 0x00000080
71#define UF_TEMP_DUPLICATE_ACCOUNT 0x00000100
72#define UF_NORMAL_ACCOUNT 0x00000200
73#define UF_UNUSED_1 0x00000400
74#define UF_INTERDOMAIN_TRUST_ACCOUNT 0x00000800
75#define UF_WORKSTATION_TRUST_ACCOUNT 0x00001000
76#define UF_SERVER_TRUST_ACCOUNT 0x00002000
77#define UF_UNUSED_2 0x00004000
78#define UF_UNUSED_3 0x00008000
79#define UF_PASSWD_NOT_EXPIRE 0x00010000
80#define UF_MNS_LOGON_ACCOUNT 0x00020000
81#define UF_SMARTCARD_REQUIRED 0x00040000
82#define UF_TRUSTED_FOR_DELEGATION 0x00080000
83#define UF_NOT_DELEGATED 0x00100000
84#define UF_USE_DES_KEY_ONLY 0x00200000
85#define UF_DONT_REQUIRE_PREAUTH 0x00400000
86#define UF_UNUSED_4 0x00800000
87#define UF_UNUSED_5 0x01000000
88#define UF_UNUSED_6 0x02000000
89#define UF_UNUSED_7 0x04000000
90#define UF_UNUSED_8 0x08000000
91#define UF_UNUSED_9 0x10000000
92#define UF_UNUSED_10 0x20000000
93#define UF_UNUSED_11 0x40000000
94#define UF_UNUSED_12 0x80000000
95
96/*
97 *
98 */
99
100#ifndef HAVE_TSASL
101static int
102sasl_interact(LDAP *ld, unsigned flags, void *defaults, void *interact)
103{
104 return LDAP_SUCCESS;
105}
106#endif
107
108#if 0
109static Sockbuf_IO ldap_tsasl_io = {
110 NULL, /* sbi_setup */
111 NULL, /* sbi_remove */
112 NULL, /* sbi_ctrl */
113 NULL, /* sbi_read */
114 NULL, /* sbi_write */
115 NULL /* sbi_close */
116};
117#endif
118
119#ifdef HAVE_TSASL
120static int
121ldap_tsasl_bind_s(LDAP *ld,
122 LDAP_CONST char *dn,
123 LDAPControl **serverControls,
124 LDAPControl **clientControls,
125 const char *host)
126{
127 char *attrs[] = { "supportedSASLMechanisms", NULL };
128 struct tsasl_peer *peer = NULL;
129 struct tsasl_buffer in, out;
130 struct berval ccred, *scred;
131 LDAPMessage *m, *m0;
132 const char *mech;
133 char **vals;
134 int ret, rc;
135
136 ret = tsasl_peer_init(TSASL_FLAGS_INITIATOR | TSASL_FLAGS_CLEAR,
137 "ldap", host, &peer);
138 if (ret != TSASL_DONE) {
139 rc = LDAP_LOCAL_ERROR;
140 goto out;
141 }
142
143 rc = ldap_search_s(ld, "", LDAP_SCOPE_BASE, NULL, attrs, 0, &m0);
144 if (rc != LDAP_SUCCESS)
145 goto out;
146
147 m = ldap_first_entry(ld, m0);
148 if (m == NULL) {
149 ldap_msgfree(m0);
150 goto out;
151 }
152
153 vals = ldap_get_values(ld, m, "supportedSASLMechanisms");
154 if (vals == NULL) {
155 ldap_msgfree(m0);
156 goto out;
157 }
158
159 ret = tsasl_find_best_mech(peer, vals, &mech);
160 if (ret) {
161 ldap_msgfree(m0);
162 goto out;
163 }
164
165 ldap_msgfree(m0);
166
167 ret = tsasl_select_mech(peer, mech);
168 if (ret != TSASL_DONE) {
169 rc = LDAP_LOCAL_ERROR;
170 goto out;
171 }
172
173 in.tb_data = NULL;
174 in.tb_size = 0;
175
176 do {
177 ret = tsasl_request(peer, &in, &out);
178 if (in.tb_size != 0) {
179 free(in.tb_data);
180 in.tb_data = NULL;
181 in.tb_size = 0;
182 }
183 if (ret != TSASL_DONE && ret != TSASL_CONTINUE) {
184 rc = LDAP_AUTH_UNKNOWN;
185 goto out;
186 }
187
188 ccred.bv_val = out.tb_data;
189 ccred.bv_len = out.tb_size;
190
191 rc = ldap_sasl_bind_s(ld, dn, mech, &ccred,
192 serverControls, clientControls, &scred);
193 tsasl_buffer_free(&out);
194
195 if (rc != LDAP_SUCCESS && rc != LDAP_SASL_BIND_IN_PROGRESS) {
196 if(scred && scred->bv_len)
197 ber_bvfree(scred);
198 goto out;
199 }
200
201 in.tb_data = malloc(scred->bv_len);
202 if (in.tb_data == NULL) {
203 rc = LDAP_LOCAL_ERROR;
204 goto out;
205 }
206 memcpy(in.tb_data, scred->bv_val, scred->bv_len);
207 in.tb_size = scred->bv_len;
208 ber_bvfree(scred);
209
210 } while (rc == LDAP_SASL_BIND_IN_PROGRESS);
211
212 out:
213 if (rc == LDAP_SUCCESS) {
214#if 0
215 ber_sockbuf_add_io(ld->ld_conns->lconn_sb, &ldap_tsasl_io,
216 LBER_SBIOD_LEVEL_APPLICATION, peer);
217
218#endif
219 } else if (peer != NULL)
220 tsasl_peer_free(peer);
221
222 return rc;
223}
224#endif /* HAVE_TSASL */
225
226
227static int
228check_ldap(kadm5_ad_context *context, int ret)
229{
230 switch (ret) {
231 case LDAP_SUCCESS:
232 return 0;
233 case LDAP_SERVER_DOWN: {
234 LDAP *lp = CTX2LP(context);
235 ldap_unbind(lp);
236 context->ldap_conn = NULL;
237 free(context->base_dn);
238 context->base_dn = NULL;
239 return 1;
240 }
241 default:
242 return 1;
243 }
244}
245
246/*
247 *
248 */
249
250static void
251laddattr(char ***al, int *attrlen, char *attr)
252{
253 char **a;
254 a = realloc(*al, (*attrlen + 2) * sizeof(**al));
255 if (a == NULL)
256 return;
257 a[*attrlen] = attr;
258 a[*attrlen + 1] = NULL;
259 (*attrlen)++;
260 *al = a;
261}
262
263static kadm5_ret_t
264_kadm5_ad_connect(void *server_handle)
265{
266 kadm5_ad_context *context = server_handle;
267 struct {
268 char *server;
269 int port;
270 } *s, *servers = NULL;
271 int i, num_servers = 0;
272
273 if (context->ldap_conn)
274 return 0;
275
276 {
277 struct dns_reply *r;
278 struct resource_record *rr;
279 char *domain;
280
281 asprintf(&domain, "_ldap._tcp.%s", context->realm);
282 if (domain == NULL) {
283 krb5_set_error_message(context->context, KADM5_NO_SRV, "malloc");
284 return KADM5_NO_SRV;
285 }
286
287 r = dns_lookup(domain, "SRV");
288 free(domain);
289 if (r == NULL) {
290 krb5_set_error_message(context->context, KADM5_NO_SRV, "Didn't find ldap dns");
291 return KADM5_NO_SRV;
292 }
293
294 for (rr = r->head ; rr != NULL; rr = rr->next) {
295 if (rr->type != rk_ns_t_srv)
296 continue;
297 s = realloc(servers, sizeof(*servers) * (num_servers + 1));
298 if (s == NULL) {
299 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "malloc");
300 dns_free_data(r);
301 goto fail;
302 }
303 servers = s;
304 num_servers++;
305 servers[num_servers - 1].port = rr->u.srv->port;
306 servers[num_servers - 1].server = strdup(rr->u.srv->target);
307 }
308 dns_free_data(r);
309 }
310
311 if (num_servers == 0) {
312 krb5_set_error_message(context->context, KADM5_NO_SRV, "No AD server found in DNS");
313 return KADM5_NO_SRV;
314 }
315
316 for (i = 0; i < num_servers; i++) {
317 int lret, version = LDAP_VERSION3;
318 LDAP *lp;
319
320 lp = ldap_init(servers[i].server, servers[i].port);
321 if (lp == NULL)
322 continue;
323
324 if (ldap_set_option(lp, LDAP_OPT_PROTOCOL_VERSION, &version)) {
325 ldap_unbind(lp);
326 continue;
327 }
328
329 if (ldap_set_option(lp, LDAP_OPT_REFERRALS, LDAP_OPT_OFF)) {
330 ldap_unbind(lp);
331 continue;
332 }
333
334#ifdef HAVE_TSASL
335 lret = ldap_tsasl_bind_s(lp, NULL, NULL, NULL, servers[i].server);
336
337#else
338 lret = ldap_sasl_interactive_bind_s(lp, NULL, NULL, NULL, NULL,
339 LDAP_SASL_QUIET,
340 sasl_interact, NULL);
341#endif
342 if (lret != LDAP_SUCCESS) {
343 krb5_set_error_message(context->context, 0,
344 "Couldn't contact any AD servers: %s",
345 ldap_err2string(lret));
346 ldap_unbind(lp);
347 continue;
348 }
349
350 context->ldap_conn = lp;
351 break;
352 }
353 if (i >= num_servers) {
354 goto fail;
355 }
356
357 {
358 LDAPMessage *m, *m0;
359 char **attr = NULL;
360 int attrlen = 0;
361 char **vals;
362 int ret;
363
364 laddattr(&attr, &attrlen, "defaultNamingContext");
365
366 ret = ldap_search_s(CTX2LP(context), "", LDAP_SCOPE_BASE,
367 "objectclass=*", attr, 0, &m);
368 free(attr);
369 if (check_ldap(context, ret))
370 goto fail;
371
372 if (ldap_count_entries(CTX2LP(context), m) > 0) {
373 m0 = ldap_first_entry(CTX2LP(context), m);
374 if (m0 == NULL) {
375 krb5_set_error_message(context->context, KADM5_RPC_ERROR,
376 "Error in AD ldap responce");
377 ldap_msgfree(m);
378 goto fail;
379 }
380 vals = ldap_get_values(CTX2LP(context),
381 m0, "defaultNamingContext");
382 if (vals == NULL) {
383 krb5_set_error_message(context->context, KADM5_RPC_ERROR,
384 "No naming context found");
385 goto fail;
386 }
387 context->base_dn = strdup(vals[0]);
388 } else
389 goto fail;
390 ldap_msgfree(m);
391 }
392
393 for (i = 0; i < num_servers; i++)
394 free(servers[i].server);
395 free(servers);
396
397 return 0;
398
399 fail:
400 for (i = 0; i < num_servers; i++)
401 free(servers[i].server);
402 free(servers);
403
404 if (context->ldap_conn) {
405 ldap_unbind(CTX2LP(context));
406 context->ldap_conn = NULL;
407 }
408 return KADM5_RPC_ERROR;
409}
410
411#define NTTIME_EPOCH 0x019DB1DED53E8000LL
412
413static time_t
414nt2unixtime(const char *str)
415{
416 unsigned long long t;
417 t = strtoll(str, NULL, 10);
418 t = ((t - NTTIME_EPOCH) / (long long)10000000);
419 if (t > (((time_t)(~(long long)0)) >> 1))
420 return 0;
421 return (time_t)t;
422}
423
424static long long
425unix2nttime(time_t unix_time)
426{
427 long long wt;
428 wt = unix_time * (long long)10000000 + (long long)NTTIME_EPOCH;
429 return wt;
430}
431
432/* XXX create filter in a better way */
433
434static int
435ad_find_entry(kadm5_ad_context *context,
436 const char *fqdn,
437 const char *pn,
438 char **name)
439{
440 LDAPMessage *m, *m0;
441 char *attr[] = { "distinguishedName", NULL };
442 char *filter;
443 int ret;
444
445 if (name)
446 *name = NULL;
447
448 if (fqdn)
449 asprintf(&filter,
450 "(&(objectClass=computer)(|(dNSHostName=%s)(servicePrincipalName=%s)))",
451 fqdn, pn);
452 else if(pn)
453 asprintf(&filter, "(&(objectClass=account)(userPrincipalName=%s))", pn);
454 else
455 return KADM5_RPC_ERROR;
456
457 ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
458 LDAP_SCOPE_SUBTREE,
459 filter, attr, 0, &m);
460 free(filter);
461 if (check_ldap(context, ret))
462 return KADM5_RPC_ERROR;
463
464 if (ldap_count_entries(CTX2LP(context), m) > 0) {
465 char **vals;
466 m0 = ldap_first_entry(CTX2LP(context), m);
467 vals = ldap_get_values(CTX2LP(context), m0, "distinguishedName");
468 if (vals == NULL || vals[0] == NULL) {
469 ldap_msgfree(m);
470 return KADM5_RPC_ERROR;
471 }
472 if (name)
473 *name = strdup(vals[0]);
474 ldap_msgfree(m);
475 } else
476 return KADM5_UNK_PRINC;
477
478 return 0;
479}
480
481#endif /* OPENLDAP */
482
483static kadm5_ret_t
484ad_get_cred(kadm5_ad_context *context, const char *password)
485{
486 kadm5_ret_t ret;
487 krb5_ccache cc;
488 char *service;
489 int aret;
490
491 if (context->ccache)
492 return 0;
493
494 aret = asprintf(&service, "%s/%s@%s", KRB5_TGS_NAME,
495 context->realm, context->realm);
496 if (aret == -1 || service == NULL)
497 return ENOMEM;
498
499 ret = _kadm5_c_get_cred_cache(context->context,
500 context->client_name,
501 service,
502 password, krb5_prompter_posix,
503 NULL, NULL, &cc);
504 free(service);
505 if(ret)
506 return ret; /* XXX */
507 context->ccache = cc;
508 return 0;
509}
510
511static kadm5_ret_t
512kadm5_ad_chpass_principal(void *server_handle,
513 krb5_principal principal,
514 int keepold,
515 int n_ks_tuple,
516 krb5_key_salt_tuple *ks_tuple,
517 const char *password)
518{
519 kadm5_ad_context *context = server_handle;
520 krb5_data result_code_string, result_string;
521 int result_code;
522 kadm5_ret_t ret;
523
524 if (keepold)
525 return KADM5_KEEPOLD_NOSUPP;
526
527 if (n_ks_tuple > 0)
528 return KADM5_KS_TUPLE_NOSUPP;
529
530 ret = ad_get_cred(context, NULL);
531 if (ret)
532 return ret;
533
534 krb5_data_zero (&result_code_string);
535 krb5_data_zero (&result_string);
536
537 ret = krb5_set_password_using_ccache (context->context,
538 context->ccache,
539 password,
540 principal,
541 &result_code,
542 &result_code_string,
543 &result_string);
544
545 krb5_data_free (&result_code_string);
546 krb5_data_free (&result_string);
547
548 /* XXX do mapping here on error codes */
549
550 return ret;
551}
552
553#ifdef OPENLDAP
554static const char *
555get_fqdn(krb5_context context, const krb5_principal p)
556{
557 const char *s, *hosttypes[] = { "host", "ldap", "gc", "cifs", "dns" };
558 int i;
559
560 s = krb5_principal_get_comp_string(context, p, 0);
561 if (p == NULL)
562 return NULL;
563
564 for (i = 0; i < sizeof(hosttypes)/sizeof(hosttypes[0]); i++) {
565 if (strcasecmp(s, hosttypes[i]) == 0)
566 return krb5_principal_get_comp_string(context, p, 1);
567 }
568 return 0;
569}
570#endif
571
572
573static kadm5_ret_t
574kadm5_ad_create_principal(void *server_handle,
575 kadm5_principal_ent_t entry,
576 uint32_t mask,
577 int n_ks_tuple,
578 krb5_key_salt_tuple *ks_tuple,
579 const char *password)
580{
581 kadm5_ad_context *context = server_handle;
582
583 /*
584 * KADM5_PRINC_EXPIRE_TIME
585 *
586 * return 0 || KADM5_DUP;
587 */
588
589#ifdef OPENLDAP
590 LDAPMod *attrs[8], rattrs[7], *a;
591 char *useraccvals[2] = { NULL, NULL },
592 *samvals[2], *dnsvals[2], *spnvals[5], *upnvals[2], *tv[2];
593 char *ocvals_spn[] = { "top", "person", "organizationalPerson",
594 "user", "computer", NULL};
595 char *p, *realmless_p, *p_msrealm = NULL, *dn = NULL;
596 const char *fqdn;
597 char *s, *samname = NULL, *short_spn = NULL;
598 int ret, i;
599 int32_t uf_flags = 0;
600
601 if ((mask & KADM5_PRINCIPAL) == 0)
602 return KADM5_BAD_MASK;
603
604 /*
605 * We should get around to implementing this... At the moment, the
606 * the server side API is implemented but the wire protocol has not
607 * been updated.
608 */
609 if (n_ks_tuple > 0)
610 return KADM5_KS_TUPLE_NOSUPP;
611
612 for (i = 0; i < sizeof(rattrs)/sizeof(rattrs[0]); i++)
613 attrs[i] = &rattrs[i];
614 attrs[i] = NULL;
615
616 ret = ad_get_cred(context, NULL);
617 if (ret)
618 return ret;
619
620 ret = _kadm5_ad_connect(server_handle);
621 if (ret)
622 return ret;
623
624 fqdn = get_fqdn(context->context, entry->principal);
625
626 ret = krb5_unparse_name(context->context, entry->principal, &p);
627 if (ret)
628 return ret;
629
630 if (ad_find_entry(context, fqdn, p, NULL) == 0) {
631 free(p);
632 return KADM5_DUP;
633 }
634
635 if (mask & KADM5_ATTRIBUTES) {
636 if (entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)
637 uf_flags |= UF_ACCOUNTDISABLE|UF_LOCKOUT;
638 if ((entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH) == 0)
639 uf_flags |= UF_DONT_REQUIRE_PREAUTH;
640 if (entry->attributes & KRB5_KDB_REQUIRES_HW_AUTH)
641 uf_flags |= UF_SMARTCARD_REQUIRED;
642 }
643
644 realmless_p = strdup(p);
645 if (realmless_p == NULL) {
646 ret = ENOMEM;
647 goto out;
648 }
649 s = strrchr(realmless_p, '@');
650 if (s)
651 *s = '\0';
652
653 if (fqdn) {
654 /* create computer account */
655 asprintf(&samname, "%s$", fqdn);
656 if (samname == NULL) {
657 ret = ENOMEM;
658 goto out;
659 }
660 s = strchr(samname, '.');
661 if (s) {
662 s[0] = '$';
663 s[1] = '\0';
664 }
665
666 short_spn = strdup(p);
667 if (short_spn == NULL) {
668 errno = ENOMEM;
669 goto out;
670 }
671 s = strchr(short_spn, '.');
672 if (s) {
673 *s = '\0';
674 } else {
675 free(short_spn);
676 short_spn = NULL;
677 }
678
679 p_msrealm = strdup(p);
680 if (p_msrealm == NULL) {
681 errno = ENOMEM;
682 goto out;
683 }
684 s = strrchr(p_msrealm, '@');
685 if (s) {
686 *s = '/';
687 } else {
688 free(p_msrealm);
689 p_msrealm = NULL;
690 }
691
692 asprintf(&dn, "cn=%s, cn=Computers, %s", fqdn, CTX2BASE(context));
693 if (dn == NULL) {
694 ret = ENOMEM;
695 goto out;
696 }
697
698 a = &rattrs[0];
699 a->mod_op = LDAP_MOD_ADD;
700 a->mod_type = "objectClass";
701 a->mod_values = ocvals_spn;
702 a++;
703
704 a->mod_op = LDAP_MOD_ADD;
705 a->mod_type = "userAccountControl";
706 a->mod_values = useraccvals;
707 asprintf(&useraccvals[0], "%d",
708 uf_flags |
709 UF_PASSWD_NOT_EXPIRE |
710 UF_WORKSTATION_TRUST_ACCOUNT);
711 useraccvals[1] = NULL;
712 a++;
713
714 a->mod_op = LDAP_MOD_ADD;
715 a->mod_type = "sAMAccountName";
716 a->mod_values = samvals;
717 samvals[0] = samname;
718 samvals[1] = NULL;
719 a++;
720
721 a->mod_op = LDAP_MOD_ADD;
722 a->mod_type = "dNSHostName";
723 a->mod_values = dnsvals;
724 dnsvals[0] = (char *)fqdn;
725 dnsvals[1] = NULL;
726 a++;
727
728 /* XXX add even more spn's */
729 a->mod_op = LDAP_MOD_ADD;
730 a->mod_type = "servicePrincipalName";
731 a->mod_values = spnvals;
732 i = 0;
733 spnvals[i++] = p;
734 spnvals[i++] = realmless_p;
735 if (short_spn)
736 spnvals[i++] = short_spn;
737 if (p_msrealm)
738 spnvals[i++] = p_msrealm;
739 spnvals[i++] = NULL;
740 a++;
741
742 a->mod_op = LDAP_MOD_ADD;
743 a->mod_type = "userPrincipalName";
744 a->mod_values = upnvals;
745 upnvals[0] = p;
746 upnvals[1] = NULL;
747 a++;
748
749 a->mod_op = LDAP_MOD_ADD;
750 a->mod_type = "accountExpires";
751 a->mod_values = tv;
752 tv[0] = "9223372036854775807"; /* "never" */
753 tv[1] = NULL;
754 a++;
755
756 } else {
757 /* create user account */
758
759 a = &rattrs[0];
760 a->mod_op = LDAP_MOD_ADD;
761 a->mod_type = "userAccountControl";
762 a->mod_values = useraccvals;
763 asprintf(&useraccvals[0], "%d",
764 uf_flags |
765 UF_PASSWD_NOT_EXPIRE);
766 useraccvals[1] = NULL;
767 a++;
768
769 a->mod_op = LDAP_MOD_ADD;
770 a->mod_type = "sAMAccountName";
771 a->mod_values = samvals;
772 samvals[0] = realmless_p;
773 samvals[1] = NULL;
774 a++;
775
776 a->mod_op = LDAP_MOD_ADD;
777 a->mod_type = "userPrincipalName";
778 a->mod_values = upnvals;
779 upnvals[0] = p;
780 upnvals[1] = NULL;
781 a++;
782
783 a->mod_op = LDAP_MOD_ADD;
784 a->mod_type = "accountExpires";
785 a->mod_values = tv;
786 tv[0] = "9223372036854775807"; /* "never" */
787 tv[1] = NULL;
788 a++;
789 }
790
791 attrs[a - &rattrs[0]] = NULL;
792
793 ret = ldap_add_s(CTX2LP(context), dn, attrs);
794
795 out:
796 if (useraccvals[0])
797 free(useraccvals[0]);
798 if (realmless_p)
799 free(realmless_p);
800 if (samname)
801 free(samname);
802 if (short_spn)
803 free(short_spn);
804 if (p_msrealm)
805 free(p_msrealm);
806 free(p);
807
808 if (check_ldap(context, ret))
809 return KADM5_RPC_ERROR;
810
811 return 0;
812#else
813 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
814 return KADM5_RPC_ERROR;
815#endif
816}
817
818static kadm5_ret_t
819kadm5_ad_delete_principal(void *server_handle, krb5_principal principal)
820{
821 kadm5_ad_context *context = server_handle;
822#ifdef OPENLDAP
823 char *p, *dn = NULL;
824 const char *fqdn;
825 int ret;
826
827 ret = ad_get_cred(context, NULL);
828 if (ret)
829 return ret;
830
831 ret = _kadm5_ad_connect(server_handle);
832 if (ret)
833 return ret;
834
835 fqdn = get_fqdn(context->context, principal);
836
837 ret = krb5_unparse_name(context->context, principal, &p);
838 if (ret)
839 return ret;
840
841 if (ad_find_entry(context, fqdn, p, &dn) != 0) {
842 free(p);
843 return KADM5_UNK_PRINC;
844 }
845
846 ret = ldap_delete_s(CTX2LP(context), dn);
847
848 free(dn);
849 free(p);
850
851 if (check_ldap(context, ret))
852 return KADM5_RPC_ERROR;
853 return 0;
854#else
855 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
856 return KADM5_RPC_ERROR;
857#endif
858}
859
860static kadm5_ret_t
861kadm5_ad_destroy(void *server_handle)
862{
863 kadm5_ad_context *context = server_handle;
864
865 if (context->ccache)
866 krb5_cc_destroy(context->context, context->ccache);
867
868#ifdef OPENLDAP
869 {
870 LDAP *lp = CTX2LP(context);
871 if (lp)
872 ldap_unbind(lp);
873 if (context->base_dn)
874 free(context->base_dn);
875 }
876#endif
877 free(context->realm);
878 free(context->client_name);
879 krb5_free_principal(context->context, context->caller);
880 if(context->my_context)
881 krb5_free_context(context->context);
882 return 0;
883}
884
885static kadm5_ret_t
886kadm5_ad_flush(void *server_handle)
887{
888 kadm5_ad_context *context = server_handle;
889 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
890 return KADM5_RPC_ERROR;
891}
892
893static kadm5_ret_t
894kadm5_ad_get_principal(void *server_handle,
895 krb5_principal principal,
896 kadm5_principal_ent_t entry,
897 uint32_t mask)
898{
899 kadm5_ad_context *context = server_handle;
900#ifdef OPENLDAP
901 LDAPMessage *m, *m0;
902 char **attr = NULL;
903 int attrlen = 0;
904 char *filter, *p, *q, *u;
905 int ret;
906
907 /*
908 * principal
909 * KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES
910 */
911
912 /*
913 * return 0 || KADM5_DUP;
914 */
915
916 memset(entry, 0, sizeof(*entry));
917
918 if (mask & KADM5_KVNO)
919 laddattr(&attr, &attrlen, "msDS-KeyVersionNumber");
920
921 if (mask & KADM5_PRINCIPAL) {
922 laddattr(&attr, &attrlen, "userPrincipalName");
923 laddattr(&attr, &attrlen, "servicePrincipalName");
924 }
925 laddattr(&attr, &attrlen, "objectClass");
926 laddattr(&attr, &attrlen, "lastLogon");
927 laddattr(&attr, &attrlen, "badPwdCount");
928 laddattr(&attr, &attrlen, "badPasswordTime");
929 laddattr(&attr, &attrlen, "pwdLastSet");
930 laddattr(&attr, &attrlen, "accountExpires");
931 laddattr(&attr, &attrlen, "userAccountControl");
932
933 krb5_unparse_name_short(context->context, principal, &p);
934 krb5_unparse_name(context->context, principal, &u);
935
936 /* replace @ in domain part with a / */
937 q = strrchr(p, '@');
938 if (q && (p != q && *(q - 1) != '\\'))
939 *q = '/';
940
941 asprintf(&filter,
942 "(|(userPrincipalName=%s)(servicePrincipalName=%s)(servicePrincipalName=%s))",
943 u, p, u);
944 free(p);
945 free(u);
946
947 ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
948 LDAP_SCOPE_SUBTREE,
949 filter, attr, 0, &m);
950 free(attr);
951 if (check_ldap(context, ret))
952 return KADM5_RPC_ERROR;
953
954 if (ldap_count_entries(CTX2LP(context), m) > 0) {
955 char **vals;
956 m0 = ldap_first_entry(CTX2LP(context), m);
957 if (m0 == NULL) {
958 ldap_msgfree(m);
959 goto fail;
960 }
961#if 0
962 vals = ldap_get_values(CTX2LP(context), m0, "servicePrincipalName");
963 if (vals)
964 printf("servicePrincipalName %s\n", vals[0]);
965 vals = ldap_get_values(CTX2LP(context), m0, "userPrincipalName");
966 if (vals)
967 printf("userPrincipalName %s\n", vals[0]);
968 vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
969 if (vals)
970 printf("userAccountControl %s\n", vals[0]);
971#endif
972 entry->princ_expire_time = 0;
973 if (mask & KADM5_PRINC_EXPIRE_TIME) {
974 vals = ldap_get_values(CTX2LP(context), m0, "accountExpires");
975 if (vals)
976 entry->princ_expire_time = nt2unixtime(vals[0]);
977 }
978 entry->last_success = 0;
979 if (mask & KADM5_LAST_SUCCESS) {
980 vals = ldap_get_values(CTX2LP(context), m0, "lastLogon");
981 if (vals)
982 entry->last_success = nt2unixtime(vals[0]);
983 }
984 if (mask & KADM5_LAST_FAILED) {
985 vals = ldap_get_values(CTX2LP(context), m0, "badPasswordTime");
986 if (vals)
987 entry->last_failed = nt2unixtime(vals[0]);
988 }
989 if (mask & KADM5_LAST_PWD_CHANGE) {
990 vals = ldap_get_values(CTX2LP(context), m0, "pwdLastSet");
991 if (vals)
992 entry->last_pwd_change = nt2unixtime(vals[0]);
993 }
994 if (mask & KADM5_FAIL_AUTH_COUNT) {
995 vals = ldap_get_values(CTX2LP(context), m0, "badPwdCount");
996 if (vals)
997 entry->fail_auth_count = atoi(vals[0]);
998 }
999 if (mask & KADM5_ATTRIBUTES) {
1000 vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
1001 if (vals) {
1002 uint32_t i;
1003 i = atoi(vals[0]);
1004 if (i & (UF_ACCOUNTDISABLE|UF_LOCKOUT))
1005 entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
1006 if ((i & UF_DONT_REQUIRE_PREAUTH) == 0)
1007 entry->attributes |= KRB5_KDB_REQUIRES_PRE_AUTH;
1008 if (i & UF_SMARTCARD_REQUIRED)
1009 entry->attributes |= KRB5_KDB_REQUIRES_HW_AUTH;
1010 if ((i & UF_WORKSTATION_TRUST_ACCOUNT) == 0)
1011 entry->attributes |= KRB5_KDB_DISALLOW_SVR;
1012 }
1013 }
1014 if (mask & KADM5_KVNO) {
1015 vals = ldap_get_values(CTX2LP(context), m0,
1016 "msDS-KeyVersionNumber");
1017 if (vals)
1018 entry->kvno = atoi(vals[0]);
1019 else
1020 entry->kvno = 0;
1021 }
1022 ldap_msgfree(m);
1023 } else {
1024 return KADM5_UNK_PRINC;
1025 }
1026
1027 if (mask & KADM5_PRINCIPAL)
1028 krb5_copy_principal(context->context, principal, &entry->principal);
1029
1030 return 0;
1031 fail:
1032 return KADM5_RPC_ERROR;
1033#else
1034 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1035 return KADM5_RPC_ERROR;
1036#endif
1037}
1038
1039static kadm5_ret_t
1040kadm5_ad_get_principals(void *server_handle,
1041 const char *expression,
1042 char ***principals,
1043 int *count)
1044{
1045 kadm5_ad_context *context = server_handle;
1046
1047 /*
1048 * KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES
1049 */
1050
1051#ifdef OPENLDAP
1052 kadm5_ret_t ret;
1053
1054 ret = ad_get_cred(context, NULL);
1055 if (ret)
1056 return ret;
1057
1058 ret = _kadm5_ad_connect(server_handle);
1059 if (ret)
1060 return ret;
1061
1062 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1063 return KADM5_RPC_ERROR;
1064#else
1065 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1066 return KADM5_RPC_ERROR;
1067#endif
1068}
1069
1070static kadm5_ret_t
1071kadm5_ad_get_privs(void *server_handle, uint32_t*privs)
1072{
1073 kadm5_ad_context *context = server_handle;
1074 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1075 return KADM5_RPC_ERROR;
1076}
1077
1078static kadm5_ret_t
1079kadm5_ad_modify_principal(void *server_handle,
1080 kadm5_principal_ent_t entry,
1081 uint32_t mask)
1082{
1083 kadm5_ad_context *context = server_handle;
1084
1085 /*
1086 * KADM5_ATTRIBUTES
1087 * KRB5_KDB_DISALLOW_ALL_TIX (| KADM5_KVNO)
1088 */
1089
1090#ifdef OPENLDAP
1091 LDAPMessage *m = NULL, *m0;
1092 kadm5_ret_t ret;
1093 char **attr = NULL;
1094 int attrlen = 0;
1095 char *p = NULL, *s = NULL, *q;
1096 char **vals;
1097 LDAPMod *attrs[4], rattrs[3], *a;
1098 char *uaf[2] = { NULL, NULL };
1099 char *kvno[2] = { NULL, NULL };
1100 char *tv[2] = { NULL, NULL };
1101 char *filter, *dn;
1102 int i;
1103
1104 for (i = 0; i < sizeof(rattrs)/sizeof(rattrs[0]); i++)
1105 attrs[i] = &rattrs[i];
1106 attrs[i] = NULL;
1107 a = &rattrs[0];
1108
1109 ret = _kadm5_ad_connect(server_handle);
1110 if (ret)
1111 return ret;
1112
1113 if (mask & KADM5_KVNO)
1114 laddattr(&attr, &attrlen, "msDS-KeyVersionNumber");
1115 if (mask & KADM5_PRINC_EXPIRE_TIME)
1116 laddattr(&attr, &attrlen, "accountExpires");
1117 if (mask & KADM5_ATTRIBUTES)
1118 laddattr(&attr, &attrlen, "userAccountControl");
1119 laddattr(&attr, &attrlen, "distinguishedName");
1120
1121 krb5_unparse_name(context->context, entry->principal, &p);
1122
1123 s = strdup(p);
1124
1125 q = strrchr(s, '@');
1126 if (q && (p != q && *(q - 1) != '\\'))
1127 *q = '\0';
1128
1129 asprintf(&filter,
1130 "(|(userPrincipalName=%s)(servicePrincipalName=%s))",
1131 s, s);
1132 free(p);
1133 free(s);
1134
1135 ret = ldap_search_s(CTX2LP(context), CTX2BASE(context),
1136 LDAP_SCOPE_SUBTREE,
1137 filter, attr, 0, &m);
1138 free(attr);
1139 free(filter);
1140 if (check_ldap(context, ret))
1141 return KADM5_RPC_ERROR;
1142
1143 if (ldap_count_entries(CTX2LP(context), m) <= 0) {
1144 ret = KADM5_RPC_ERROR;
1145 goto out;
1146 }
1147
1148 m0 = ldap_first_entry(CTX2LP(context), m);
1149
1150 if (mask & KADM5_ATTRIBUTES) {
1151 int32_t i;
1152
1153 vals = ldap_get_values(CTX2LP(context), m0, "userAccountControl");
1154 if (vals == NULL) {
1155 ret = KADM5_RPC_ERROR;
1156 goto out;
1157 }
1158
1159 i = atoi(vals[0]);
1160 if (i == 0)
1161 return KADM5_RPC_ERROR;
1162
1163 if (entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)
1164 i |= (UF_ACCOUNTDISABLE|UF_LOCKOUT);
1165 else
1166 i &= ~(UF_ACCOUNTDISABLE|UF_LOCKOUT);
1167 if (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)
1168 i &= ~UF_DONT_REQUIRE_PREAUTH;
1169 else
1170 i |= UF_DONT_REQUIRE_PREAUTH;
1171 if (entry->attributes & KRB5_KDB_REQUIRES_HW_AUTH)
1172 i |= UF_SMARTCARD_REQUIRED;
1173 else
1174 i &= UF_SMARTCARD_REQUIRED;
1175 if (entry->attributes & KRB5_KDB_DISALLOW_SVR)
1176 i &= ~UF_WORKSTATION_TRUST_ACCOUNT;
1177 else
1178 i |= UF_WORKSTATION_TRUST_ACCOUNT;
1179
1180 asprintf(&uaf[0], "%d", i);
1181
1182 a->mod_op = LDAP_MOD_REPLACE;
1183 a->mod_type = "userAccountControl";
1184 a->mod_values = uaf;
1185 a++;
1186 }
1187
1188 if (mask & KADM5_KVNO) {
1189 vals = ldap_get_values(CTX2LP(context), m0, "msDS-KeyVersionNumber");
1190 if (vals == NULL) {
1191 entry->kvno = 0;
1192 } else {
1193 asprintf(&kvno[0], "%d", entry->kvno);
1194
1195 a->mod_op = LDAP_MOD_REPLACE;
1196 a->mod_type = "msDS-KeyVersionNumber";
1197 a->mod_values = kvno;
1198 a++;
1199 }
1200 }
1201
1202 if (mask & KADM5_PRINC_EXPIRE_TIME) {
1203 long long wt;
1204 vals = ldap_get_values(CTX2LP(context), m0, "accountExpires");
1205 if (vals == NULL) {
1206 ret = KADM5_RPC_ERROR;
1207 goto out;
1208 }
1209
1210 wt = unix2nttime(entry->princ_expire_time);
1211
1212 asprintf(&tv[0], "%llu", wt);
1213
1214 a->mod_op = LDAP_MOD_REPLACE;
1215 a->mod_type = "accountExpires";
1216 a->mod_values = tv;
1217 a++;
1218 }
1219
1220 vals = ldap_get_values(CTX2LP(context), m0, "distinguishedName");
1221 if (vals == NULL) {
1222 ret = KADM5_RPC_ERROR;
1223 goto out;
1224 }
1225 dn = vals[0];
1226
1227 attrs[a - &rattrs[0]] = NULL;
1228
1229 ret = ldap_modify_s(CTX2LP(context), dn, attrs);
1230 if (check_ldap(context, ret))
1231 return KADM5_RPC_ERROR;
1232
1233 out:
1234 if (m)
1235 ldap_msgfree(m);
1236 if (uaf[0])
1237 free(uaf[0]);
1238 if (kvno[0])
1239 free(kvno[0]);
1240 if (tv[0])
1241 free(tv[0]);
1242 return ret;
1243#else
1244 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1245 return KADM5_RPC_ERROR;
1246#endif
1247}
1248
1249/*ARGSUSED*/
1250static kadm5_ret_t
1251kadm5_ad_randkey_principal(void *server_handle,
1252 krb5_principal principal,
1253 krb5_boolean keepold,
1254 int n_ks_tuple,
1255 krb5_key_salt_tuple *ks_tuple,
1256 krb5_keyblock **keys,
1257 int *n_keys)
1258{
1259 kadm5_ad_context *context = server_handle;
1260
1261 if (keepold)
1262 return KADM5_KEEPOLD_NOSUPP;
1263
1264 /*
1265 * random key
1266 */
1267
1268#ifdef OPENLDAP
1269 krb5_data result_code_string, result_string;
1270 int result_code, plen;
1271 kadm5_ret_t ret;
1272 char *password;
1273
1274 *keys = NULL;
1275 *n_keys = 0;
1276
1277 {
1278 char p[64];
1279 krb5_generate_random_block(p, sizeof(p));
1280 plen = rk_base64_encode(p, sizeof(p), &password);
1281 if (plen < 0)
1282 return ENOMEM;
1283 }
1284
1285 ret = ad_get_cred(context, NULL);
1286 if (ret) {
1287 free(password);
1288 return ret;
1289 }
1290
1291 krb5_data_zero (&result_code_string);
1292 krb5_data_zero (&result_string);
1293
1294 ret = krb5_set_password_using_ccache (context->context,
1295 context->ccache,
1296 password,
1297 principal,
1298 &result_code,
1299 &result_code_string,
1300 &result_string);
1301
1302 krb5_data_free (&result_code_string);
1303 krb5_data_free (&result_string);
1304
1305 if (ret == 0) {
1306
1307 *keys = malloc(sizeof(**keys) * 1);
1308 if (*keys == NULL) {
1309 ret = ENOMEM;
1310 goto out;
1311 }
1312 *n_keys = 1;
1313
1314 ret = krb5_string_to_key(context->context,
1315 ENCTYPE_ARCFOUR_HMAC_MD5,
1316 password,
1317 principal,
1318 &(*keys)[0]);
1319 memset(password, 0, plen);
1320 if (ret) {
1321 free(*keys);
1322 *keys = NULL;
1323 *n_keys = 0;
1324 goto out;
1325 }
1326 }
1327 memset(password, 0, plen);
1328 free(password);
1329 out:
1330 return ret;
1331#else
1332 *keys = NULL;
1333 *n_keys = 0;
1334
1335 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1336 return KADM5_RPC_ERROR;
1337#endif
1338}
1339
1340static kadm5_ret_t
1341kadm5_ad_rename_principal(void *server_handle,
1342 krb5_principal from,
1343 krb5_principal to)
1344{
1345 kadm5_ad_context *context = server_handle;
1346 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1347 return KADM5_RPC_ERROR;
1348}
1349
1350static kadm5_ret_t
1351kadm5_ad_chpass_principal_with_key(void *server_handle,
1352 krb5_principal princ,
1353 int keepold,
1354 int n_key_data,
1355 krb5_key_data *key_data)
1356{
1357 kadm5_ad_context *context = server_handle;
1358 krb5_set_error_message(context->context, KADM5_RPC_ERROR, "Function not implemented");
1359 return KADM5_RPC_ERROR;
1360}
1361
1362static kadm5_ret_t
1363kadm5_ad_lock(void *server_handle)
1364{
1365 return ENOTSUP;
1366}
1367
1368static kadm5_ret_t
1369kadm5_ad_unlock(void *server_handle)
1370{
1371 return ENOTSUP;
1372}
1373
1374static void
1375set_funcs(kadm5_ad_context *c)
1376{
1377#define SET(C, F) (C)->funcs.F = kadm5_ad_ ## F
1378#define SETNOTIMP(C, F) (C)->funcs.F = 0
1379 SET(c, chpass_principal);
1380 SET(c, chpass_principal_with_key);
1381 SET(c, create_principal);
1382 SET(c, delete_principal);
1383 SET(c, destroy);
1384 SET(c, flush);
1385 SET(c, get_principal);
1386 SET(c, get_principals);
1387 SET(c, get_privs);
1388 SET(c, modify_principal);
1389 SET(c, randkey_principal);
1390 SET(c, rename_principal);
1391 SET(c, lock);
1392 SET(c, unlock);
1393 SETNOTIMP(c, setkey_principal_3);
1394}
1395
1396kadm5_ret_t
1397kadm5_ad_init_with_password_ctx(krb5_context context,
1398 const char *client_name,
1399 const char *password,
1400 const char *service_name,
1401 kadm5_config_params *realm_params,
1402 unsigned long struct_version,
1403 unsigned long api_version,
1404 void **server_handle)
1405{
1406 kadm5_ret_t ret;
1407 kadm5_ad_context *ctx;
1408
1409 ctx = malloc(sizeof(*ctx));
1410 if(ctx == NULL)
1411 return ENOMEM;
1412 memset(ctx, 0, sizeof(*ctx));
1413 set_funcs(ctx);
1414
1415 ctx->context = context;
1416 krb5_add_et_list (context, initialize_kadm5_error_table_r);
1417
1418 ret = krb5_parse_name(ctx->context, client_name, &ctx->caller);
1419 if(ret) {
1420 free(ctx);
1421 return ret;
1422 }
1423
1424 if(realm_params->mask & KADM5_CONFIG_REALM) {
1425 ret = 0;
1426 ctx->realm = strdup(realm_params->realm);
1427 if (ctx->realm == NULL)
1428 ret = ENOMEM;
1429 } else
1430 ret = krb5_get_default_realm(ctx->context, &ctx->realm);
1431 if (ret) {
1432 free(ctx);
1433 return ret;
1434 }
1435
1436 ctx->client_name = strdup(client_name);
1437
1438 if(password != NULL && *password != '\0')
1439 ret = ad_get_cred(ctx, password);
1440 else
1441 ret = ad_get_cred(ctx, NULL);
1442 if(ret) {
1443 kadm5_ad_destroy(ctx);
1444 return ret;
1445 }
1446
1447#ifdef OPENLDAP
1448 ret = _kadm5_ad_connect(ctx);
1449 if (ret) {
1450 kadm5_ad_destroy(ctx);
1451 return ret;
1452 }
1453#endif
1454
1455 *server_handle = ctx;
1456 return 0;
1457}
1458
1459kadm5_ret_t
1460kadm5_ad_init_with_password(const char *client_name,
1461 const char *password,
1462 const char *service_name,
1463 kadm5_config_params *realm_params,
1464 unsigned long struct_version,
1465 unsigned long api_version,
1466 void **server_handle)
1467{
1468 krb5_context context;
1469 kadm5_ret_t ret;
1470 kadm5_ad_context *ctx;
1471
1472 ret = krb5_init_context(&context);
1473 if (ret)
1474 return ret;
1475 ret = kadm5_ad_init_with_password_ctx(context,
1476 client_name,
1477 password,
1478 service_name,
1479 realm_params,
1480 struct_version,
1481 api_version,
1482 server_handle);
1483 if(ret) {
1484 krb5_free_context(context);
1485 return ret;
1486 }
1487 ctx = *server_handle;
1488 ctx->my_context = 1;
1489 return 0;
1490}
1491