2 Unix SMB/CIFS implementation.
3 krb5 set password implementation
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Remus Koos 2001 (remuskoos@yahoo.com)
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libads/kerberos_proto.h"
27 #define DEFAULT_KPASSWD_PORT 464
29 #define KRB5_KPASSWD_VERS_CHANGEPW 1
31 #define KRB5_KPASSWD_VERS_SETPW 0xff80
32 #define KRB5_KPASSWD_VERS_SETPW_ALT 2
34 #define KRB5_KPASSWD_SUCCESS 0
35 #define KRB5_KPASSWD_MALFORMED 1
36 #define KRB5_KPASSWD_HARDERROR 2
37 #define KRB5_KPASSWD_AUTHERROR 3
38 #define KRB5_KPASSWD_SOFTERROR 4
39 #define KRB5_KPASSWD_ACCESSDENIED 5
40 #define KRB5_KPASSWD_BAD_VERSION 6
41 #define KRB5_KPASSWD_INITIAL_FLAG_NEEDED 7
43 /* Those are defined by kerberos-set-passwd-02.txt and are probably
44 * not supported by M$ implementation */
45 #define KRB5_KPASSWD_POLICY_REJECT 8
46 #define KRB5_KPASSWD_BAD_PRINCIPAL 9
47 #define KRB5_KPASSWD_ETYPE_NOSUPP 10
50 * we've got to be able to distinguish KRB_ERRORs from other
51 * requests - valid response for CHPW v2 replies.
54 #define krb5_is_krb_error(packet) \
55 ( packet && packet->length && (((char *)packet->data)[0] == 0x7e || ((char *)packet->data)[0] == 0x5e))
57 /* This implements kerberos password change protocol as specified in
58 * kerb-chg-password-02.txt and kerberos-set-passwd-02.txt
59 * as well as microsoft version of the protocol
60 * as specified in kerberos-set-passwd-00.txt
62 static DATA_BLOB encode_krb5_setpw(const char *principal, const char *password)
64 char* princ_part1 = NULL;
65 char* princ_part2 = NULL;
74 princ = SMB_STRDUP(principal);
76 if ((c = strchr_m(princ, '/')) == NULL) {
86 if ((c = strchr_m(c, '@')) != NULL) {
91 /* We must have a realm component. */
92 return data_blob_null;
95 req = asn1_init(talloc_tos());
97 return data_blob_null;
100 asn1_push_tag(req, ASN1_SEQUENCE(0));
101 asn1_push_tag(req, ASN1_CONTEXT(0));
102 asn1_write_OctetString(req, password, strlen(password));
105 asn1_push_tag(req, ASN1_CONTEXT(1));
106 asn1_push_tag(req, ASN1_SEQUENCE(0));
108 asn1_push_tag(req, ASN1_CONTEXT(0));
109 asn1_write_Integer(req, 1);
112 asn1_push_tag(req, ASN1_CONTEXT(1));
113 asn1_push_tag(req, ASN1_SEQUENCE(0));
116 asn1_write_GeneralString(req, princ_part1);
119 asn1_write_GeneralString(req, princ_part2);
125 asn1_push_tag(req, ASN1_CONTEXT(2));
126 asn1_write_GeneralString(req, realm);
130 ret = data_blob(req->data, req->length);
138 static krb5_error_code build_kpasswd_request(uint16 pversion,
139 krb5_context context,
140 krb5_auth_context auth_context,
149 krb5_data encoded_setpw;
150 krb5_replay_data replay;
153 unsigned int msg_length;
155 ret = krb5_auth_con_setflags(context,
156 auth_context,KRB5_AUTH_CONTEXT_DO_SEQUENCE);
158 DEBUG(1,("krb5_auth_con_setflags failed (%s)\n",
159 error_message(ret)));
163 /* handle protocol differences in chpw and setpw */
164 if (pversion == KRB5_KPASSWD_VERS_CHANGEPW)
165 setpw = data_blob(passwd, strlen(passwd));
166 else if (pversion == KRB5_KPASSWD_VERS_SETPW ||
167 pversion == KRB5_KPASSWD_VERS_SETPW_ALT)
168 setpw = encode_krb5_setpw(princ, passwd);
172 if (setpw.data == NULL || setpw.length == 0) {
176 encoded_setpw.data = (char *)setpw.data;
177 encoded_setpw.length = setpw.length;
179 ret = krb5_mk_priv(context, auth_context,
180 &encoded_setpw, &cipherpw, &replay);
182 data_blob_free(&setpw); /*from 'encode_krb5_setpw(...)' */
185 DEBUG(1,("krb5_mk_priv failed (%s)\n", error_message(ret)));
189 packet->data = (char *)SMB_MALLOC(ap_req->length + cipherpw.length + (use_tcp ? 10 : 6 ));
195 /* see the RFC for details */
197 msg_start = p = ((char *)packet->data) + (use_tcp ? 4 : 0);
199 RSSVAL(p, 0, pversion);
201 RSSVAL(p, 0, ap_req->length);
203 memcpy(p, ap_req->data, ap_req->length);
205 memcpy(p, cipherpw.data, cipherpw.length);
206 p += cipherpw.length;
207 packet->length = PTR_DIFF(p,packet->data);
208 msg_length = PTR_DIFF(p,msg_start);
211 RSIVAL(packet->data, 0, msg_length);
213 RSSVAL(msg_start, 0, msg_length);
215 free(cipherpw.data); /* from 'krb5_mk_priv(...)' */
220 static const struct kpasswd_errors {
222 const char *error_string;
223 } kpasswd_errors[] = {
224 {KRB5_KPASSWD_MALFORMED, "Malformed request error"},
225 {KRB5_KPASSWD_HARDERROR, "Server error"},
226 {KRB5_KPASSWD_AUTHERROR, "Authentication error"},
227 {KRB5_KPASSWD_SOFTERROR, "Password change rejected"},
228 {KRB5_KPASSWD_ACCESSDENIED, "Client does not have proper authorization"},
229 {KRB5_KPASSWD_BAD_VERSION, "Protocol version not supported"},
230 {KRB5_KPASSWD_INITIAL_FLAG_NEEDED, "Authorization ticket must have initial flag set"},
231 {KRB5_KPASSWD_POLICY_REJECT, "Password rejected due to policy requirements"},
232 {KRB5_KPASSWD_BAD_PRINCIPAL, "Target principal does not exist"},
233 {KRB5_KPASSWD_ETYPE_NOSUPP, "Unsupported encryption type"},
237 static krb5_error_code setpw_result_code_string(krb5_context context,
239 const char **code_string)
241 unsigned int idx = 0;
243 while (kpasswd_errors[idx].error_string != NULL) {
244 if (kpasswd_errors[idx].result_code ==
246 *code_string = kpasswd_errors[idx].error_string;
251 *code_string = "Password change failed";
255 krb5_error_code kpasswd_err_to_krb5_err(krb5_error_code res_code)
258 case KRB5_KPASSWD_ACCESSDENIED:
259 return KRB5KDC_ERR_BADOPTION;
260 case KRB5_KPASSWD_INITIAL_FLAG_NEEDED:
261 return KRB5KDC_ERR_BADOPTION;
262 /* return KV5M_ALT_METHOD; MIT-only define */
263 case KRB5_KPASSWD_ETYPE_NOSUPP:
264 return KRB5KDC_ERR_ETYPE_NOSUPP;
265 case KRB5_KPASSWD_BAD_PRINCIPAL:
266 return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
267 case KRB5_KPASSWD_POLICY_REJECT:
268 case KRB5_KPASSWD_SOFTERROR:
269 return KRB5KDC_ERR_POLICY;
271 return KRB5KRB_ERR_GENERIC;
274 static krb5_error_code parse_setpw_reply(krb5_context context,
276 krb5_auth_context auth_context,
281 int vnum, ret, res_code;
282 krb5_data cipherresult;
283 krb5_data clearresult;
284 krb5_ap_rep_enc_part *ap_rep_enc;
285 krb5_replay_data replay;
286 unsigned int msg_length = packet->length;
289 if (packet->length < (use_tcp ? 8 : 4)) {
290 return KRB5KRB_AP_ERR_MODIFIED;
293 p = (char *)packet->data;
295 ** see if it is an error
297 if (krb5_is_krb_error(packet)) {
299 ret = handle_krberror_packet(context, packet);
309 if (RIVAL(p, 0) != msg_length) {
310 DEBUG(1,("Bad TCP packet length (%d/%d) from kpasswd server\n",
311 RIVAL(p, 0), msg_length));
312 return KRB5KRB_AP_ERR_MODIFIED;
318 if (RSVAL(p, 0) != msg_length) {
319 DEBUG(1,("Bad packet length (%d/%d) from kpasswd server\n",
320 RSVAL(p, 0), msg_length));
321 return KRB5KRB_AP_ERR_MODIFIED;
326 vnum = RSVAL(p, 0); p += 2;
328 /* FIXME: According to standard there is only one type of reply */
329 if (vnum != KRB5_KPASSWD_VERS_SETPW &&
330 vnum != KRB5_KPASSWD_VERS_SETPW_ALT &&
331 vnum != KRB5_KPASSWD_VERS_CHANGEPW) {
332 DEBUG(1,("Bad vnum (%d) from kpasswd server\n", vnum));
333 return KRB5KDC_ERR_BAD_PVNO;
336 ap_rep.length = RSVAL(p, 0); p += 2;
338 if (p + ap_rep.length >= (char *)packet->data + packet->length) {
339 DEBUG(1,("ptr beyond end of packet from kpasswd server\n"));
340 return KRB5KRB_AP_ERR_MODIFIED;
343 if (ap_rep.length == 0) {
344 DEBUG(1,("got unencrypted setpw result?!\n"));
345 return KRB5KRB_AP_ERR_MODIFIED;
352 ret = krb5_rd_rep(context, auth_context, &ap_rep, &ap_rep_enc);
354 DEBUG(1,("failed to rd setpw reply (%s)\n", error_message(ret)));
355 return KRB5KRB_AP_ERR_MODIFIED;
358 krb5_free_ap_rep_enc_part(context, ap_rep_enc);
360 cipherresult.data = p;
361 cipherresult.length = ((char *)packet->data + packet->length) - p;
363 ret = krb5_rd_priv(context, auth_context, &cipherresult, &clearresult,
366 DEBUG(1,("failed to decrypt setpw reply (%s)\n", error_message(ret)));
367 return KRB5KRB_AP_ERR_MODIFIED;
370 if (clearresult.length < 2) {
371 free(clearresult.data);
372 ret = KRB5KRB_AP_ERR_MODIFIED;
373 return KRB5KRB_AP_ERR_MODIFIED;
376 p = (char *)clearresult.data;
378 res_code = RSVAL(p, 0);
380 free(clearresult.data);
382 if ((res_code < KRB5_KPASSWD_SUCCESS) ||
383 (res_code > KRB5_KPASSWD_ETYPE_NOSUPP)) {
384 return KRB5KRB_AP_ERR_MODIFIED;
387 if (res_code == KRB5_KPASSWD_SUCCESS) {
391 setpw_result_code_string(context, res_code, &errstr);
392 DEBUG(1, ("Error changing password: %s (%d)\n", errstr, res_code));
394 return kpasswd_err_to_krb5_err(res_code);
398 static ADS_STATUS do_krb5_kpasswd_request(krb5_context context,
399 const char *kdc_host,
405 krb5_auth_context auth_context = NULL;
406 krb5_data ap_req, chpw_req, chpw_rep;
409 struct sockaddr_storage remote_addr, local_addr;
410 struct sockaddr_storage addr;
411 krb5_address local_kaddr, remote_kaddr;
412 bool use_tcp = False;
415 if (!interpret_string_addr(&addr, kdc_host, 0)) {
418 ret = krb5_mk_req_extended(context, &auth_context, AP_OPTS_USE_SUBKEY,
419 NULL, credsp, &ap_req);
421 DEBUG(1,("krb5_mk_req_extended failed (%s)\n", error_message(ret)));
422 return ADS_ERROR_KRB5(ret);
429 sock = open_udp_socket(kdc_host, DEFAULT_KPASSWD_PORT);
432 SAFE_FREE(ap_req.data);
433 krb5_auth_con_free(context, auth_context);
434 DEBUG(1,("failed to open kpasswd socket to %s "
435 "(%s)\n", kdc_host, strerror(errno)));
436 return ADS_ERROR_SYSTEM(rc);
440 status = open_socket_out(&addr, DEFAULT_KPASSWD_PORT,
441 LONG_CONNECT_TIMEOUT, &sock);
442 if (!NT_STATUS_IS_OK(status)) {
443 SAFE_FREE(ap_req.data);
444 krb5_auth_con_free(context, auth_context);
445 DEBUG(1,("failed to open kpasswd socket to %s "
448 return ADS_ERROR_NT(status);
452 addr_len = sizeof(remote_addr);
453 if (getpeername(sock, (struct sockaddr *)&remote_addr, &addr_len) != 0) {
455 SAFE_FREE(ap_req.data);
456 krb5_auth_con_free(context, auth_context);
457 DEBUG(1,("getpeername() failed (%s)\n", error_message(errno)));
458 return ADS_ERROR_SYSTEM(errno);
460 addr_len = sizeof(local_addr);
461 if (getsockname(sock, (struct sockaddr *)&local_addr, &addr_len) != 0) {
463 SAFE_FREE(ap_req.data);
464 krb5_auth_con_free(context, auth_context);
465 DEBUG(1,("getsockname() failed (%s)\n", error_message(errno)));
466 return ADS_ERROR_SYSTEM(errno);
468 if (!setup_kaddr(&remote_kaddr, &remote_addr) ||
469 !setup_kaddr(&local_kaddr, &local_addr)) {
470 DEBUG(1,("do_krb5_kpasswd_request: "
471 "Failed to setup addresses.\n"));
473 SAFE_FREE(ap_req.data);
474 krb5_auth_con_free(context, auth_context);
476 return ADS_ERROR_SYSTEM(EINVAL);
479 ret = krb5_auth_con_setaddrs(context, auth_context, &local_kaddr, NULL);
482 SAFE_FREE(ap_req.data);
483 krb5_auth_con_free(context, auth_context);
484 DEBUG(1,("krb5_auth_con_setaddrs failed (%s)\n", error_message(ret)));
485 return ADS_ERROR_KRB5(ret);
488 ret = build_kpasswd_request(pversion, context, auth_context, &ap_req,
489 princ, newpw, use_tcp, &chpw_req);
492 SAFE_FREE(ap_req.data);
493 krb5_auth_con_free(context, auth_context);
494 DEBUG(1,("build_setpw_request failed (%s)\n", error_message(ret)));
495 return ADS_ERROR_KRB5(ret);
498 ret = write(sock, chpw_req.data, chpw_req.length);
500 if (ret != chpw_req.length) {
502 SAFE_FREE(chpw_req.data);
503 SAFE_FREE(ap_req.data);
504 krb5_auth_con_free(context, auth_context);
505 DEBUG(1,("send of chpw failed (%s)\n", strerror(errno)));
506 return ADS_ERROR_SYSTEM(errno);
509 SAFE_FREE(chpw_req.data);
511 chpw_rep.length = 1500;
512 chpw_rep.data = (char *) SMB_MALLOC(chpw_rep.length);
513 if (!chpw_rep.data) {
515 SAFE_FREE(ap_req.data);
516 krb5_auth_con_free(context, auth_context);
517 DEBUG(1,("send of chpw failed (%s)\n", strerror(errno)));
519 return ADS_ERROR_SYSTEM(errno);
522 ret = read(sock, chpw_rep.data, chpw_rep.length);
525 SAFE_FREE(chpw_rep.data);
526 SAFE_FREE(ap_req.data);
527 krb5_auth_con_free(context, auth_context);
528 DEBUG(1,("recv of chpw reply failed (%s)\n", strerror(errno)));
529 return ADS_ERROR_SYSTEM(errno);
533 chpw_rep.length = ret;
535 ret = krb5_auth_con_setaddrs(context, auth_context, NULL,&remote_kaddr);
537 SAFE_FREE(chpw_rep.data);
538 SAFE_FREE(ap_req.data);
539 krb5_auth_con_free(context, auth_context);
540 DEBUG(1,("krb5_auth_con_setaddrs on reply failed (%s)\n",
541 error_message(ret)));
542 return ADS_ERROR_KRB5(ret);
545 ret = parse_setpw_reply(context, use_tcp, auth_context, &chpw_rep);
546 SAFE_FREE(chpw_rep.data);
550 if (ret == KRB5KRB_ERR_RESPONSE_TOO_BIG && !use_tcp) {
551 DEBUG(5, ("Trying setpw with TCP!!!\n"));
556 SAFE_FREE(ap_req.data);
557 krb5_auth_con_free(context, auth_context);
558 DEBUG(1,("parse_setpw_reply failed (%s)\n",
559 error_message(ret)));
560 return ADS_ERROR_KRB5(ret);
563 SAFE_FREE(ap_req.data);
564 krb5_auth_con_free(context, auth_context);
570 ADS_STATUS ads_krb5_set_password(const char *kdc_host, const char *princ,
571 const char *newpw, int time_offset)
575 krb5_error_code ret = 0;
576 krb5_context context = NULL;
577 krb5_principal principal = NULL;
578 char *princ_name = NULL;
580 krb5_creds creds, *credsp = NULL;
581 #if KRB5_PRINC_REALM_RETURNS_REALM
582 krb5_realm orig_realm;
584 krb5_data orig_realm;
586 krb5_ccache ccache = NULL;
590 initialize_krb5_error_table();
591 ret = krb5_init_context(&context);
593 DEBUG(1,("Failed to init krb5 context (%s)\n", error_message(ret)));
594 return ADS_ERROR_KRB5(ret);
597 if (time_offset != 0) {
598 krb5_set_real_time(context, time(NULL) + time_offset, 0);
601 ret = krb5_cc_default(context, &ccache);
603 krb5_free_context(context);
604 DEBUG(1,("Failed to get default creds (%s)\n", error_message(ret)));
605 return ADS_ERROR_KRB5(ret);
608 realm = strchr_m(princ, '@');
610 krb5_cc_close(context, ccache);
611 krb5_free_context(context);
612 DEBUG(1,("Failed to get realm\n"));
613 return ADS_ERROR_KRB5(-1);
617 if (asprintf(&princ_name, "kadmin/changepw@%s", realm) == -1) {
618 krb5_cc_close(context, ccache);
619 krb5_free_context(context);
620 DEBUG(1,("asprintf failed\n"));
621 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
624 ret = smb_krb5_parse_name(context, princ_name, &creds.server);
626 krb5_cc_close(context, ccache);
627 krb5_free_context(context);
628 DEBUG(1,("Failed to parse kadmin/changepw (%s)\n", error_message(ret)));
629 return ADS_ERROR_KRB5(ret);
632 /* parse the principal we got as a function argument */
633 ret = smb_krb5_parse_name(context, princ, &principal);
635 krb5_cc_close(context, ccache);
636 krb5_free_principal(context, creds.server);
637 krb5_free_context(context);
638 DEBUG(1,("Failed to parse %s (%s)\n", princ_name, error_message(ret)));
640 return ADS_ERROR_KRB5(ret);
645 /* The creds.server principal takes ownership of this memory.
646 Remember to set back to original value before freeing. */
647 orig_realm = *krb5_princ_realm(context, creds.server);
648 krb5_princ_set_realm(context, creds.server, krb5_princ_realm(context, principal));
650 ret = krb5_cc_get_principal(context, ccache, &creds.client);
652 krb5_cc_close(context, ccache);
653 krb5_princ_set_realm(context, creds.server, &orig_realm);
654 krb5_free_principal(context, creds.server);
655 krb5_free_principal(context, principal);
656 krb5_free_context(context);
657 DEBUG(1,("Failed to get principal from ccache (%s)\n",
658 error_message(ret)));
659 return ADS_ERROR_KRB5(ret);
662 ret = krb5_get_credentials(context, 0, ccache, &creds, &credsp);
664 krb5_cc_close(context, ccache);
665 krb5_free_principal(context, creds.client);
666 krb5_princ_set_realm(context, creds.server, &orig_realm);
667 krb5_free_principal(context, creds.server);
668 krb5_free_principal(context, principal);
669 krb5_free_context(context);
670 DEBUG(1,("krb5_get_credentials failed (%s)\n", error_message(ret)));
671 return ADS_ERROR_KRB5(ret);
674 /* we might have to call krb5_free_creds(...) from now on ... */
676 aret = do_krb5_kpasswd_request(context, kdc_host,
677 KRB5_KPASSWD_VERS_SETPW,
678 credsp, princ, newpw);
680 krb5_free_creds(context, credsp);
681 krb5_free_principal(context, creds.client);
682 krb5_princ_set_realm(context, creds.server, &orig_realm);
683 krb5_free_principal(context, creds.server);
684 krb5_free_principal(context, principal);
685 krb5_cc_close(context, ccache);
686 krb5_free_context(context);
692 we use a prompter to avoid a crash bug in the kerberos libs when
693 dealing with empty passwords
694 this prompter is just a string copy ...
696 static krb5_error_code
697 kerb_prompter(krb5_context ctx, void *data,
701 krb5_prompt prompts[])
703 if (num_prompts == 0) return 0;
705 memset(prompts[0].reply->data, 0, prompts[0].reply->length);
706 if (prompts[0].reply->length > 0) {
708 strncpy((char *)prompts[0].reply->data,
710 prompts[0].reply->length-1);
711 prompts[0].reply->length = strlen((const char *)prompts[0].reply->data);
713 prompts[0].reply->length = 0;
719 static ADS_STATUS ads_krb5_chg_password(const char *kdc_host,
720 const char *principal,
727 krb5_context context = NULL;
728 krb5_principal princ;
729 krb5_get_init_creds_opt opts;
731 char *chpw_princ = NULL, *password;
733 initialize_krb5_error_table();
734 ret = krb5_init_context(&context);
736 DEBUG(1,("Failed to init krb5 context (%s)\n", error_message(ret)));
737 return ADS_ERROR_KRB5(ret);
740 if ((ret = smb_krb5_parse_name(context, principal,
742 krb5_free_context(context);
743 DEBUG(1,("Failed to parse %s (%s)\n", principal, error_message(ret)));
744 return ADS_ERROR_KRB5(ret);
747 krb5_get_init_creds_opt_init(&opts);
748 krb5_get_init_creds_opt_set_tkt_life(&opts, 5*60);
749 krb5_get_init_creds_opt_set_renew_life(&opts, 0);
750 krb5_get_init_creds_opt_set_forwardable(&opts, 0);
751 krb5_get_init_creds_opt_set_proxiable(&opts, 0);
753 /* We have to obtain an INITIAL changepw ticket for changing password */
754 if (asprintf(&chpw_princ, "kadmin/changepw@%s",
755 (char *) krb5_princ_realm(context, princ)) == -1) {
756 krb5_free_context(context);
757 DEBUG(1,("ads_krb5_chg_password: asprintf fail\n"));
758 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
761 password = SMB_STRDUP(oldpw);
762 ret = krb5_get_init_creds_password(context, &creds, princ, password,
764 0, chpw_princ, &opts);
765 SAFE_FREE(chpw_princ);
769 if (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY)
770 DEBUG(1,("Password incorrect while getting initial ticket"));
772 DEBUG(1,("krb5_get_init_creds_password failed (%s)\n", error_message(ret)));
774 krb5_free_principal(context, princ);
775 krb5_free_context(context);
776 return ADS_ERROR_KRB5(ret);
779 aret = do_krb5_kpasswd_request(context, kdc_host,
780 KRB5_KPASSWD_VERS_CHANGEPW,
781 &creds, principal, newpw);
783 krb5_free_principal(context, princ);
784 krb5_free_context(context);
790 ADS_STATUS kerberos_set_password(const char *kpasswd_server,
791 const char *auth_principal, const char *auth_password,
792 const char *target_principal, const char *new_password,
797 if ((ret = kerberos_kinit_password(auth_principal, auth_password, time_offset, NULL))) {
798 DEBUG(1,("Failed kinit for principal %s (%s)\n", auth_principal, error_message(ret)));
799 return ADS_ERROR_KRB5(ret);
802 if (!strcmp(auth_principal, target_principal))
803 return ads_krb5_chg_password(kpasswd_server, target_principal,
804 auth_password, new_password, time_offset);
806 return ads_krb5_set_password(kpasswd_server, target_principal,
807 new_password, time_offset);