return code;
}
-int mit_samba_update_pac_data(struct mit_samba_context *ctx,
- krb5_db_entry *client,
- DATA_BLOB *pac_data,
- DATA_BLOB *logon_data)
-{
- TALLOC_CTX *tmp_ctx;
- DATA_BLOB *logon_blob;
- krb5_error_code code;
- NTSTATUS nt_status;
- krb5_pac pac = NULL;
- int ret;
- struct samba_kdc_entry *skdc_entry = NULL;
-
- if (client) {
- skdc_entry = talloc_get_type_abort(client->e_data,
- struct samba_kdc_entry);
- }
-
- /* The user account may be set not to want the PAC */
- if (client && !samba_princ_needs_pac(skdc_entry)) {
- return EINVAL;
- }
-
- tmp_ctx = talloc_named(ctx, 0, "mit_samba_update_pac_data context");
- if (!tmp_ctx) {
- return ENOMEM;
- }
-
- logon_blob = talloc_zero(tmp_ctx, DATA_BLOB);
- if (!logon_blob) {
- ret = ENOMEM;
- goto done;
- }
-
- code = krb5_pac_parse(ctx->context,
- pac_data->data, pac_data->length, &pac);
- if (code) {
- ret = EINVAL;
- goto done;
- }
-
- /* TODO: An implementation-specific decision will need to be
- * made as to when to check the KDC pac signature, and how to
- * untrust untrusted RODCs */
- nt_status = samba_kdc_update_pac_blob(tmp_ctx, ctx->context,
- pac, logon_blob, NULL, NULL);
- if (!NT_STATUS_IS_OK(nt_status)) {
- DEBUG(0, ("Building PAC failed: %s\n",
- nt_errstr(nt_status)));
- ret = EINVAL;
- goto done;
- }
-
- logon_data->data = (uint8_t *)malloc(logon_blob->length);
- if (!logon_data->data) {
- ret = ENOMEM;
- goto done;
- }
- memcpy(logon_data->data, logon_blob->data, logon_blob->length);
- logon_data->length = logon_blob->length;
-
- ret = 0;
-
-done:
- if (pac) krb5_pac_free(ctx->context, pac);
- talloc_free(tmp_ctx);
- return ret;
-}
-
krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
krb5_context context,
int flags,
krb5_keyblock *krbtgt_keyblock,
krb5_pac *pac);
-int mit_samba_update_pac_data(struct mit_samba_context *ctx,
- krb5_db_entry *client,
- DATA_BLOB *pac_data,
- DATA_BLOB *logon_data);
-
-int mit_samba_update_pac_data(struct mit_samba_context *ctx,
- krb5_db_entry *client,
- DATA_BLOB *pac_data,
- DATA_BLOB *logon_data);
-
int mit_samba_check_client_access(struct mit_samba_context *ctx,
krb5_db_entry *client,
const char *client_name,