This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
+#include "smb_krb5.h"
+#include "libads/kerberos_proto.h"
+#include "../lib/util/asn1.h"
#ifdef HAVE_KRB5
-#define DEFAULT_KPASSWD_PORT 464
-#define KRB5_KPASSWD_VERS_CHANGEPW 1
-#define KRB5_KPASSWD_VERS_SETPW 0xff80
-#define KRB5_KPASSWD_ACCESSDENIED 5
-#define KRB5_KPASSWD_BAD_VERSION 6
+/* Those are defined by kerberos-set-passwd-02.txt and are probably
+ * not supported by M$ implementation */
+#define KRB5_KPASSWD_POLICY_REJECT 8
+#define KRB5_KPASSWD_BAD_PRINCIPAL 9
+#define KRB5_KPASSWD_ETYPE_NOSUPP 10
-/* This implements the Kerb password change protocol as specifed in
- * kerb-chg-password-02.txt
+/*
+ * we've got to be able to distinguish KRB_ERRORs from other
+ * requests - valid response for CHPW v2 replies.
*/
-static DATA_BLOB encode_krb5_setpw(const char *principal, const char *password)
-{
- char* princ_part1 = NULL;
- char* princ_part2 = NULL;
- char* realm = NULL;
- char* c;
- char* princ;
-
- ASN1_DATA req;
- DATA_BLOB ret;
-
-
- princ = strdup(principal);
-
- if ((c = strchr(princ, '/')) == NULL) {
- c = princ;
- } else {
- *c = '\0';
- c++;
- princ_part1 = princ;
- }
-
- princ_part2 = c;
- if ((c = strchr(c, '@')) != NULL) {
- *c = '\0';
- c++;
- realm = c;
- }
-
- memset(&req, 0, sizeof(req));
-
- asn1_push_tag(&req, ASN1_SEQUENCE(0));
- asn1_push_tag(&req, ASN1_CONTEXT(0));
- asn1_write_OctetString(&req, password, strlen(password));
- asn1_pop_tag(&req);
-
- asn1_push_tag(&req, ASN1_CONTEXT(1));
- asn1_push_tag(&req, ASN1_SEQUENCE(0));
-
- asn1_push_tag(&req, ASN1_CONTEXT(0));
- asn1_write_Integer(&req, 1);
- asn1_pop_tag(&req);
-
- asn1_push_tag(&req, ASN1_CONTEXT(1));
- asn1_push_tag(&req, ASN1_SEQUENCE(0));
-
- if (princ_part1)
- asn1_write_GeneralString(&req, princ_part1);
-
- asn1_write_GeneralString(&req, princ_part2);
- asn1_pop_tag(&req);
- asn1_pop_tag(&req);
- asn1_pop_tag(&req);
- asn1_pop_tag(&req);
-
- asn1_push_tag(&req, ASN1_CONTEXT(2));
- asn1_write_GeneralString(&req, realm);
- asn1_pop_tag(&req);
- asn1_pop_tag(&req);
-
- ret = data_blob(req.data, req.length);
- asn1_free(&req);
-
- free(princ);
-
- return ret;
-}
-
-static krb5_error_code build_setpw_request(krb5_context context,
- krb5_auth_context auth_context,
- krb5_data *ap_req,
- const char *princ,
- const char *passwd,
- krb5_data *packet)
+static krb5_error_code kpasswd_err_to_krb5_err(krb5_error_code res_code)
{
- krb5_error_code ret;
- krb5_data cipherpw;
- krb5_data encoded_setpw;
- krb5_replay_data replay;
- char *p;
- DATA_BLOB setpw;
-
- ret = krb5_auth_con_setflags(context,
- auth_context,KRB5_AUTH_CONTEXT_DO_SEQUENCE);
- if (ret) {
- DEBUG(1,("krb5_auth_con_setflags failed (%s)\n",
- error_message(ret)));
- return ret;
+ switch(res_code) {
+ case KRB5_KPASSWD_ACCESSDENIED:
+ return KRB5KDC_ERR_BADOPTION;
+ case KRB5_KPASSWD_INITIAL_FLAG_NEEDED:
+ return KRB5KDC_ERR_BADOPTION;
+ /* return KV5M_ALT_METHOD; MIT-only define */
+ case KRB5_KPASSWD_ETYPE_NOSUPP:
+ return KRB5KDC_ERR_ETYPE_NOSUPP;
+ case KRB5_KPASSWD_BAD_PRINCIPAL:
+ return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
+ case KRB5_KPASSWD_POLICY_REJECT:
+ case KRB5_KPASSWD_SOFTERROR:
+ return KRB5KDC_ERR_POLICY;
+ default:
+ return KRB5KRB_ERR_GENERIC;
}
-
- setpw = encode_krb5_setpw(princ, passwd);
-
- encoded_setpw.data = setpw.data;
- encoded_setpw.length = setpw.length;
-
- ret = krb5_mk_priv(context, auth_context,
- &encoded_setpw, &cipherpw, &replay);
-
- data_blob_free(&setpw); /*from 'encode_krb5_setpw(...)' */
-
- if (ret) {
- DEBUG(1,("krb5_mk_priv failed (%s)\n", error_message(ret)));
- return ret;
- }
-
- packet->data = (char *)malloc(ap_req->length + cipherpw.length + 6);
- if (!packet->data)
- return -1;
-
- /* see the RFC for details */
- p = ((char *)packet->data) + 2;
- RSSVAL(p, 0, 0xff80);
- p += 2;
- RSSVAL(p, 0, ap_req->length);
- p += 2;
- memcpy(p, ap_req->data, ap_req->length);
- p += ap_req->length;
- memcpy(p, cipherpw.data, cipherpw.length);
- p += cipherpw.length;
- packet->length = PTR_DIFF(p,packet->data);
- RSSVAL(packet->data, 0, packet->length);
-
- free(cipherpw.data); /* from 'krb5_mk_priv(...)' */
-
- return 0;
}
-static krb5_error_code parse_setpw_reply(krb5_context context,
- krb5_auth_context auth_context,
- krb5_data *packet)
+ADS_STATUS ads_krb5_set_password(const char *kdc_host, const char *principal,
+ const char *newpw, int time_offset)
{
- krb5_data ap_rep;
- char *p;
- int vnum, ret, res_code;
- krb5_data cipherresult;
- krb5_data clearresult;
- krb5_ap_rep_enc_part *ap_rep_enc;
- krb5_replay_data replay;
-
- if (packet->length < 4) {
- return KRB5KRB_AP_ERR_MODIFIED;
- }
-
- p = packet->data;
-
- if (((char *)packet->data)[0] == 0x7e || ((char *)packet->data)[0] == 0x5e) {
- /* it's an error packet. We should parse it ... */
- DEBUG(1,("Got error packet 0x%x from kpasswd server\n",
- ((char *)packet->data)[0]));
- return KRB5KRB_AP_ERR_MODIFIED;
- }
-
- if (RSVAL(p, 0) != packet->length) {
- DEBUG(1,("Bad packet length (%d/%d) from kpasswd server\n",
- RSVAL(p, 0), packet->length));
- return KRB5KRB_AP_ERR_MODIFIED;
- }
-
- p += 2;
-
- vnum = RSVAL(p, 0); p += 2;
-
- if (vnum != KRB5_KPASSWD_VERS_SETPW && vnum != KRB5_KPASSWD_VERS_CHANGEPW) {
- DEBUG(1,("Bad vnum (%d) from kpasswd server\n", vnum));
- return KRB5KDC_ERR_BAD_PVNO;
- }
-
- ap_rep.length = RSVAL(p, 0); p += 2;
-
- if (p + ap_rep.length >= (char *)packet->data + packet->length) {
- DEBUG(1,("ptr beyond end of packet from kpasswd server\n"));
- return KRB5KRB_AP_ERR_MODIFIED;
- }
-
- if (ap_rep.length == 0) {
- DEBUG(1,("got unencrypted setpw result?!\n"));
- return KRB5KRB_AP_ERR_MODIFIED;
- }
- /* verify ap_rep */
- ap_rep.data = p;
- p += ap_rep.length;
-
- ret = krb5_rd_rep(context, auth_context, &ap_rep, &ap_rep_enc);
- if (ret) {
- DEBUG(1,("failed to rd setpw reply (%s)\n", error_message(ret)));
- return KRB5KRB_AP_ERR_MODIFIED;
- }
-
- krb5_free_ap_rep_enc_part(context, ap_rep_enc);
-
- cipherresult.data = p;
- cipherresult.length = ((char *)packet->data + packet->length) - p;
-
- ret = krb5_rd_priv(context, auth_context, &cipherresult, &clearresult,
- &replay);
- if (ret) {
- DEBUG(1,("failed to decrypt setpw reply (%s)\n", error_message(ret)));
- return KRB5KRB_AP_ERR_MODIFIED;
- }
-
- if (clearresult.length < 2) {
- free(clearresult.data);
- ret = KRB5KRB_AP_ERR_MODIFIED;
- return KRB5KRB_AP_ERR_MODIFIED;
- }
-
- p = clearresult.data;
-
- res_code = RSVAL(p, 0);
-
- free(clearresult.data);
-
- if ((res_code < KRB5_KPASSWD_SUCCESS) ||
- (res_code >= KRB5_KPASSWD_ACCESSDENIED)) {
- return KRB5KRB_AP_ERR_MODIFIED;
- }
-
- return 0;
-}
-
-ADS_STATUS krb5_set_password(const char *kdc_host, const char *princ, const char *newpw,
- int time_offset)
-{
- krb5_context context;
- krb5_auth_context auth_context = NULL;
- krb5_principal principal;
- char *princ_name;
- char *realm;
- krb5_creds creds, *credsp;
- krb5_ccache ccache;
- krb5_data ap_req, chpw_req, chpw_rep;
- int ret, sock, addr_len;
- struct sockaddr remote_addr, local_addr;
- krb5_address local_kaddr, remote_kaddr;
+ ADS_STATUS aret;
+ krb5_error_code ret = 0;
+ krb5_context context = NULL;
+ krb5_principal princ = NULL;
+ krb5_ccache ccache = NULL;
+ int result_code;
+ krb5_data result_code_string = { 0 };
+ krb5_data result_string = { 0 };
+ initialize_krb5_error_table();
ret = krb5_init_context(&context);
if (ret) {
DEBUG(1,("Failed to init krb5 context (%s)\n", error_message(ret)));
return ADS_ERROR_KRB5(ret);
}
-
+
+ if (principal) {
+ ret = smb_krb5_parse_name(context, principal, &princ);
+ if (ret) {
+ krb5_free_context(context);
+ DEBUG(1, ("Failed to parse %s (%s)\n", principal,
+ error_message(ret)));
+ return ADS_ERROR_KRB5(ret);
+ }
+ }
+
if (time_offset != 0) {
krb5_set_real_time(context, time(NULL) + time_offset, 0);
}
ret = krb5_cc_default(context, &ccache);
if (ret) {
+ krb5_free_principal(context, princ);
krb5_free_context(context);
DEBUG(1,("Failed to get default creds (%s)\n", error_message(ret)));
return ADS_ERROR_KRB5(ret);
}
- ZERO_STRUCT(creds);
-
- realm = strchr(princ, '@');
- realm++;
-
- asprintf(&princ_name, "kadmin/changepw@%s", realm);
- ret = krb5_parse_name(context, princ_name, &creds.server);
+ ret = krb5_set_password_using_ccache(context, ccache, newpw, princ,
+ &result_code,
+ &result_code_string,
+ &result_string);
if (ret) {
- krb5_free_context(context);
- DEBUG(1,("Failed to parse kadmin/changepw (%s)\n", error_message(ret)));
- return ADS_ERROR_KRB5(ret);
+ DEBUG(1, ("krb5_set_password failed (%s)\n", error_message(ret)));
+ aret = ADS_ERROR_KRB5(ret);
+ goto done;
}
- free(princ_name);
- /* parse the principal we got as a function argument */
- ret = krb5_parse_name(context, princ, &principal);
- if (ret) {
- krb5_free_context(context);
- DEBUG(1,("Failed to parse %s (%s)\n", princ_name, error_message(ret)));
- return ADS_ERROR_KRB5(ret);
+ if (result_code != KRB5_KPASSWD_SUCCESS) {
+ ret = kpasswd_err_to_krb5_err(result_code);
+ DEBUG(1, ("krb5_set_password failed (%s)\n", error_message(ret)));
+ aret = ADS_ERROR_KRB5(ret);
+ goto done;
}
- krb5_princ_set_realm(context, creds.server,
- krb5_princ_realm(context, principal));
-
- ret = krb5_cc_get_principal(context, ccache, &creds.client);
- if (ret) {
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("Failed to get principal from ccache (%s)\n",
- error_message(ret)));
- return ADS_ERROR_KRB5(ret);
- }
-
- ret = krb5_get_credentials(context, 0, ccache, &creds, &credsp);
- if (ret) {
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("krb5_get_credentials failed (%s)\n", error_message(ret)));
- return ADS_ERROR_KRB5(ret);
- }
-
- /* we might have to call krb5_free_creds(...) from now on ... */
- ret = krb5_mk_req_extended(context, &auth_context, AP_OPTS_USE_SUBKEY,
- NULL, credsp, &ap_req);
- if (ret) {
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("krb5_mk_req_extended failed (%s)\n", error_message(ret)));
- return ADS_ERROR_KRB5(ret);
- }
-
- sock = open_udp_socket(kdc_host, DEFAULT_KPASSWD_PORT);
- if (sock == -1) {
- int rc = errno;
- free(ap_req.data);
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("failed to open kpasswd socket to %s (%s)\n",
- kdc_host, strerror(errno)));
- return ADS_ERROR_SYSTEM(rc);
- }
-
- addr_len = sizeof(remote_addr);
- getpeername(sock, &remote_addr, &addr_len);
- addr_len = sizeof(local_addr);
- getsockname(sock, &local_addr, &addr_len);
-
- setup_kaddr(&remote_kaddr, &remote_addr);
- setup_kaddr(&local_kaddr, &local_addr);
-
- ret = krb5_auth_con_setaddrs(context, auth_context, &local_kaddr, NULL);
- if (ret) {
- close(sock);
- free(ap_req.data);
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("krb5_auth_con_setaddrs failed (%s)\n", error_message(ret)));
- return ADS_ERROR_KRB5(ret);
- }
+ aret = ADS_SUCCESS;
- ret = build_setpw_request(context, auth_context, &ap_req,
- princ, newpw, &chpw_req);
- if (ret) {
- close(sock);
- free(ap_req.data);
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("build_setpw_request failed (%s)\n", error_message(ret)));
- return ADS_ERROR_KRB5(ret);
- }
+done:
+ kerberos_free_data_contents(context, &result_code_string);
+ kerberos_free_data_contents(context, &result_string);
+ krb5_free_principal(context, princ);
+ krb5_cc_close(context, ccache);
+ krb5_free_context(context);
- if (write(sock, chpw_req.data, chpw_req.length) != chpw_req.length) {
- close(sock);
- free(chpw_req.data);
- free(ap_req.data);
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("send of chpw failed (%s)\n", strerror(errno)));
- return ADS_ERROR_SYSTEM(errno);
- }
+ return aret;
+}
- free(chpw_req.data);
-
- chpw_rep.length = 1500;
- chpw_rep.data = (char *) malloc(chpw_rep.length);
- if (!chpw_rep.data) {
- close(sock);
- free(ap_req.data);
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("send of chpw failed (%s)\n", strerror(errno)));
- errno = ENOMEM;
- return ADS_ERROR_SYSTEM(errno);
+/*
+ we use a prompter to avoid a crash bug in the kerberos libs when
+ dealing with empty passwords
+ this prompter is just a string copy ...
+*/
+static krb5_error_code
+kerb_prompter(krb5_context ctx, void *data,
+ const char *name,
+ const char *banner,
+ int num_prompts,
+ krb5_prompt prompts[])
+{
+ if (num_prompts == 0) return 0;
+
+ memset(prompts[0].reply->data, 0, prompts[0].reply->length);
+ if (prompts[0].reply->length > 0) {
+ if (data) {
+ strncpy((char *)prompts[0].reply->data,
+ (const char *)data,
+ prompts[0].reply->length-1);
+ prompts[0].reply->length = strlen((const char *)prompts[0].reply->data);
+ } else {
+ prompts[0].reply->length = 0;
+ }
}
+ return 0;
+}
- ret = read(sock, chpw_rep.data, chpw_rep.length);
- if (ret < 0) {
- close(sock);
- free(chpw_rep.data);
- free(ap_req.data);
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("recv of chpw reply failed (%s)\n", strerror(errno)));
- return ADS_ERROR_SYSTEM(errno);
- }
+static ADS_STATUS ads_krb5_chg_password(const char *kdc_host,
+ const char *principal,
+ const char *oldpw,
+ const char *newpw,
+ int time_offset)
+{
+ ADS_STATUS aret;
+ krb5_error_code ret;
+ krb5_context context = NULL;
+ krb5_principal princ;
+ krb5_get_init_creds_opt opts;
+ krb5_creds creds;
+ char *chpw_princ = NULL, *password;
+ const char *realm = NULL;
+ int result_code;
+ krb5_data result_code_string = { 0 };
+ krb5_data result_string = { 0 };
+ smb_krb5_addresses *addr = NULL;
+
+ initialize_krb5_error_table();
+ ret = krb5_init_context(&context);
+ if (ret) {
+ DEBUG(1,("Failed to init krb5 context (%s)\n", error_message(ret)));
+ return ADS_ERROR_KRB5(ret);
+ }
- close(sock);
- chpw_rep.length = ret;
+ if ((ret = smb_krb5_parse_name(context, principal,
+ &princ))) {
+ krb5_free_context(context);
+ DEBUG(1,("Failed to parse %s (%s)\n", principal, error_message(ret)));
+ return ADS_ERROR_KRB5(ret);
+ }
- ret = krb5_auth_con_setaddrs(context, auth_context, NULL,&remote_kaddr);
- if (ret) {
- free(chpw_rep.data);
- free(ap_req.data);
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("krb5_auth_con_setaddrs on reply failed (%s)\n",
- error_message(ret)));
- return ADS_ERROR_KRB5(ret);
- }
+ krb5_get_init_creds_opt_init(&opts);
+
+ krb5_get_init_creds_opt_set_tkt_life(&opts, 5*60);
+ krb5_get_init_creds_opt_set_renew_life(&opts, 0);
+ krb5_get_init_creds_opt_set_forwardable(&opts, 0);
+ krb5_get_init_creds_opt_set_proxiable(&opts, 0);
+
+ /* note that heimdal will fill in the local addresses if the addresses
+ * in the creds_init_opt are all empty and then later fail with invalid
+ * address, sending our local netbios krb5 address - just like windows
+ * - avoids this - gd */
+ ret = smb_krb5_gen_netbios_krb5_address(&addr, lp_netbios_name());
+ if (ret) {
+ krb5_free_principal(context, princ);
+ krb5_free_context(context);
+ return ADS_ERROR_KRB5(ret);
+ }
+ krb5_get_init_creds_opt_set_address_list(&opts, addr->addrs);
- ret = parse_setpw_reply(context, auth_context, &chpw_rep);
- free(chpw_rep.data);
+ realm = smb_krb5_principal_get_realm(context, princ);
- if (ret) {
- free(ap_req.data);
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
- krb5_free_context(context);
- DEBUG(1,("parse_setpw_reply failed (%s)\n",
- error_message(ret)));
- return ADS_ERROR_KRB5(ret);
- }
+ /* We have to obtain an INITIAL changepw ticket for changing password */
+ if (asprintf(&chpw_princ, "kadmin/changepw@%s", realm) == -1) {
+ krb5_free_context(context);
+ free(realm);
+ DEBUG(1,("ads_krb5_chg_password: asprintf fail\n"));
+ return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+ }
- free(ap_req.data);
- krb5_free_creds(context, credsp);
- krb5_free_principal(context, creds.client);
- krb5_free_principal(context, principal);
+ free(realm);
+ password = SMB_STRDUP(oldpw);
+ ret = krb5_get_init_creds_password(context, &creds, princ, password,
+ kerb_prompter, NULL,
+ 0, chpw_princ, &opts);
+ SAFE_FREE(chpw_princ);
+ SAFE_FREE(password);
+
+ if (ret) {
+ if (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY)
+ DEBUG(1,("Password incorrect while getting initial ticket"));
+ else
+ DEBUG(1,("krb5_get_init_creds_password failed (%s)\n", error_message(ret)));
+
+ krb5_free_principal(context, princ);
krb5_free_context(context);
+ return ADS_ERROR_KRB5(ret);
+ }
+
+ ret = krb5_change_password(context, &creds, newpw, &result_code,
+ &result_code_string, &result_string);
+ if (ret) {
+ DEBUG(1, ("krb5_change_password failed (%s)\n", error_message(ret)));
+ aret = ADS_ERROR_KRB5(ret);
+ goto done;
+ }
+
+ if (result_code != KRB5_KPASSWD_SUCCESS) {
+ ret = kpasswd_err_to_krb5_err(result_code);
+ DEBUG(1, ("krb5_change_password failed (%s)\n", error_message(ret)));
+ aret = ADS_ERROR_KRB5(ret);
+ goto done;
+ }
- return ADS_SUCCESS;
+ aret = ADS_SUCCESS;
+
+done:
+ kerberos_free_data_contents(context, &result_code_string);
+ kerberos_free_data_contents(context, &result_string);
+ krb5_free_principal(context, princ);
+ krb5_free_context(context);
+
+ return aret;
}
{
int ret;
- if ((ret = kerberos_kinit_password(auth_principal, auth_password, time_offset))) {
+ if ((ret = kerberos_kinit_password(auth_principal, auth_password, time_offset, NULL))) {
DEBUG(1,("Failed kinit for principal %s (%s)\n", auth_principal, error_message(ret)));
return ADS_ERROR_KRB5(ret);
}
- return krb5_set_password(kpasswd_server, target_principal, new_password, time_offset);
-}
-
-
-/**
- * Set the machine account password
- * @param ads connection to ads server
- * @param hostname machine whose password is being set
- * @param password new password
- * @return status of password change
- **/
-ADS_STATUS ads_set_machine_password(ADS_STRUCT *ads,
- const char *hostname,
- const char *password)
-{
- ADS_STATUS status;
- char *host = strdup(hostname);
- char *principal;
-
- strlower(host);
-
- /*
- we need to use the '$' form of the name here, as otherwise the
- server might end up setting the password for a user instead
- */
- asprintf(&principal, "%s$@%s", host, ads->auth.realm);
-
- status = krb5_set_password(ads->auth.kdc_server, principal, password, ads->auth.time_offset);
-
- free(host);
- free(principal);
-
- return status;
+ if (!strcmp(auth_principal, target_principal))
+ return ads_krb5_chg_password(kpasswd_server, target_principal,
+ auth_password, new_password, time_offset);
+ else
+ return ads_krb5_set_password(kpasswd_server, target_principal,
+ new_password, time_offset);
}
#endif
git.samba.org / samba.git / blobdiff