Commit Graph

16 Commits

Author SHA1 Message Date
Luke Howard
803efebca5 krb5, kadm5: refactor plugin API
Refactor plugin framework to use a single list of loaded plugins; add a new
plugin API where DSOs export a load function that can declare dependencies and
export multiple plugins; refactor kadm5 hook API to use krb5 plugin framework.

More information in krb5-plugin(7).
2019-01-03 20:06:27 -06:00
Radoslav Bodo
f3f06fcba9 kadmin selective prune of historic key for principal 2018-12-31 14:17:10 -06:00
Luke Howard
62c1790bf5 kadm5: pre/post-commit plugin hook for kadm5 update operations (#397)
This change adds plugin support to the kadmin libraries for performing
actions before and after a password change is committed to the KDC database
and after a change is made to the attributes of a principal (specifically,
a change to DISALLOW_ALL_TIX).

This change adds a hook_libraries configuration option to the [kadmin]
section of krb5.conf (or kdc.conf if you use that file) that must be set
to load the module. That configuration option is in the form:

[kadmin]
  hook_libraries = /usr/local/lib/krb5/plugins/kadm5_hook/krb5_sync.so

where the value is the full path to the plugin that you want to load. If
this option is not present, kadmind will not load a plugin and the changes
from the patch will be inactive. If this option is given and the plugin
cannot be loaded, kadmind startup will abort with a (hopefully useful)
error message in syslog.

Any plugin used with this patch must expose a public function named
kadm5_hook_init of type kadm5_hook_init_t that returns a kadm5_hook structure.
See sample_hook.c for an example of this initialization function.

typedef struct kadm5_hook {
    const char *name;
    uint32_t version;
    const char *vendor;
    void (KRB5_CALLCONV *fini)(krb5_context, void *data);

    krb5_error_code (KRB5_CALLCONV *chpass)(krb5_context context,
					    void *data,
					    enum kadm5_hook_stage stage,
                                            krb5_error_code code,
                                            krb5_const_principal princ,
                                            uint32_t flags,
                                            size_t n_ks_tuple,
                                            krb5_key_salt_tuple *ks_tuple,
                                            const char *password,
                                            char **error_msg);
    ...
};

where enum kadm5_hook_stage is:

enum kadm5_hook_stage {
    KADM5_HOOK_STAGE_PRECOMMIT,
    KADM5_HOOK_STAGE_POSTCOMMIT
};

init creates a hook context that is passed into all subsequent calls.
chpass is called for password changes, create is called for principal
creation (with the newly-created principal in the kadm5_principal_ent_t
argument), and modify is called when a principal is modified. The purpose of
the remaining functions should be self-explanatory.

returning 0 on success and a Kerberos error code on failure, setting the
Kerberos error message in the provided context. The error code passed in is
valid for post-commit hooks and contains the result of the update operation.

This change is submitted under the following license

Copyright 2012, 2013
The Board of Trustees of the Leland Stanford Junior University

Portions Copyright 2018 AuriStor Inc.

Copying and distribution of this file, with or without modification, are
permitted in any medium without royalty provided the copyright notice and
this notice are preserved. This file is offered as-is, without any
warranty.
2018-12-26 11:04:05 -06:00
Nicolas Williams
2d9f7257b9 Also build setkey3_s on Windows 2016-02-26 22:23:54 -06:00
Jeffrey Altman
902aa4ee02 tests on Windows
Modify the NTMakefile rules for tests so that a failed test does
not prevent subsequent tests from being executed.

Change-Id: I9595ad4a1527feae7c402241bf06ab21a0b76d4a
2015-03-21 15:44:48 -04:00
Jeffrey Altman
3c3e2ad5e6 Windows: ktutil.exe requires libkadmsrv and libhdb
Include libkadmsrv.dll and libhdb.dll in the assembly which are
required for ktutil.exe to load.

Change-Id: Ic72d51e72daac71683a7f7000fe084197ee3c94a
2013-09-13 22:17:43 -04:00
Luke Howard
775a452313 some Windows build fixes 2011-09-12 20:11:36 +10:00
Asanka C. Herath
e8dd4bfaf3 Windows: Build kadm5 tools in a separate build-step
The application manifests for Heimdal can't be built until the
libraries are built.  Since tools depend on application manifests, we
need to build them separately.
2010-11-24 15:32:21 -05:00
Asanka C. Herath
f40fe926ad Windows: Comprehensive clean target 2010-11-24 15:32:13 -05:00
Asanka Herath
48017d046a Windows: Build test binaries for kadm5 2010-09-14 08:03:40 -04:00
Asanka Herath
ba44354336 Windows: Check exported symbols
During a test run, cross check the Windows exports list against the
version-script files.  For the test to pass, all symbols on either
list should be accounted for.

If there are symbols that are specific to Windows or symbols that are
not included on Windows, they should be annotated in the .def file as
follows:

    ;!  non_windows_symbol

    	common_symbol

        windows_only_symbol ;!
2010-08-20 13:06:55 -04:00
Asanka Herath
cdcdc5cad5 Windows: Version information for binaries 2010-08-20 13:06:54 -04:00
Asanka Herath
d83611238a Windows: Build a single heimdal.dll
Heimdal.dll is a combination of libasn1, libwind, libhcrypto, libhx509
and libkrb5.
2010-08-20 13:06:54 -04:00
Asanka Herath
ea4d8dbfdb Windows: Use EXEPREP and DLLPREP macros for processing binaries
Once DLLs and EXEs are built, they need to have their manifests
processed and signed.  These steps are encapsulated in the EXEPREP and
DLLPREP Makefile macros.  Use them instead of invoking each processing
macro individually.
2010-08-20 13:04:06 -04:00
Asanka Herath
e9160dbcfa Support parallelized builds on Windows 2010-08-20 13:03:32 -04:00
Love Hornquist Astrand
c6bbdb545b First drop of Windows build infrastructure from Secure Endpoints 2009-11-24 12:12:53 -08:00