2 Unix SMB/CIFS implementation.
3 simple kerberos5 routines for active directory
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Luke Howard 2002
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #ifndef HAVE_KRB5_SET_REAL_TIME
28 * This function is not in the Heimdal mainline.
30 krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
35 ret = krb5_us_timeofday(context, &sec, &usec);
39 context->kdc_sec_offset = seconds - sec;
40 context->kdc_usec_offset = microseconds - usec;
46 #if defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES) && !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
47 krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
49 return krb5_set_default_in_tkt_etypes(ctx, enc);
53 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
55 void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
57 pkaddr->addr_type = KRB5_ADDRESS_INET;
58 pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
59 pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
61 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
63 void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
65 pkaddr->addrtype = ADDRTYPE_INET;
66 pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
67 pkaddr->contents = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
70 __ERROR__XX__UNKNOWN_ADDRTYPE
74 we can't use krb5_mk_req because w2k wants the service to be in a particular format
76 static krb5_error_code krb5_mk_req2(krb5_context context,
77 krb5_auth_context *auth_context,
78 const krb5_flags ap_req_options,
79 const char *principal,
83 krb5_error_code retval;
84 krb5_principal server;
89 retval = krb5_parse_name(context, principal, &server);
91 DEBUG(1,("Failed to parse principal %s\n", principal));
95 /* obtain ticket & session key */
96 memset((char *)&creds, 0, sizeof(creds));
97 if ((retval = krb5_copy_principal(context, server, &creds.server))) {
98 DEBUG(1,("krb5_copy_principal failed (%s)\n",
99 error_message(retval)));
103 if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
104 DEBUG(1,("krb5_cc_get_principal failed (%s)\n",
105 error_message(retval)));
109 if ((retval = krb5_get_credentials(context, 0,
110 ccache, &creds, &credsp))) {
111 DEBUG(1,("krb5_get_credentials failed for %s (%s)\n",
112 principal, error_message(retval)));
116 /* cope with the ticket being in the future due to clock skew */
117 if ((unsigned)credsp->times.starttime > time(NULL)) {
118 time_t t = time(NULL);
119 int time_offset = (unsigned)credsp->times.starttime - t;
120 DEBUG(4,("Advancing clock by %d seconds to cope with clock skew\n", time_offset));
121 krb5_set_real_time(context, t + time_offset + 1, 0);
125 retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
126 &in_data, credsp, outbuf);
128 DEBUG(1,("krb5_mk_req_extended failed (%s)\n",
129 error_message(retval)));
132 krb5_free_creds(context, credsp);
135 krb5_free_cred_contents(context, &creds);
138 krb5_free_principal(context, server);
144 get a kerberos5 ticket for the given service
146 DATA_BLOB krb5_get_ticket(const char *principal, time_t time_offset)
148 krb5_error_code retval;
151 krb5_context context;
152 krb5_auth_context auth_context = NULL;
154 krb5_enctype enc_types[] = {
155 #ifdef ENCTYPE_ARCFOUR_HMAC
156 ENCTYPE_ARCFOUR_HMAC,
161 retval = krb5_init_context(&context);
163 DEBUG(1,("krb5_init_context failed (%s)\n",
164 error_message(retval)));
168 if (time_offset != 0) {
169 krb5_set_real_time(context, time(NULL) + time_offset, 0);
172 if ((retval = krb5_cc_default(context, &ccdef))) {
173 DEBUG(1,("krb5_cc_default failed (%s)\n",
174 error_message(retval)));
178 if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
179 DEBUG(1,("krb5_set_default_tgs_ktypes failed (%s)\n",
180 error_message(retval)));
184 if ((retval = krb5_mk_req2(context,
192 ret = data_blob(packet.data, packet.length);
193 /* Hmm, heimdal dooesn't have this - what's the correct call? */
194 /* krb5_free_data_contents(context, &packet); */
195 krb5_free_context(context);
200 krb5_free_context(context);
202 return data_blob(NULL, 0);
206 #else /* HAVE_KRB5 */
207 /* this saves a few linking headaches */
208 DATA_BLOB krb5_get_ticket(const char *principal, time_t time_offset)
210 DEBUG(0,("NO KERBEROS SUPPORT\n"));
211 return data_blob(NULL, 0);