62c1790bf5
This change adds plugin support to the kadmin libraries for performing
actions before and after a password change is committed to the KDC database
and after a change is made to the attributes of a principal (specifically,
a change to DISALLOW_ALL_TIX).
This change adds a hook_libraries configuration option to the [kadmin]
section of krb5.conf (or kdc.conf if you use that file) that must be set
to load the module. That configuration option is in the form:
[kadmin]
hook_libraries = /usr/local/lib/krb5/plugins/kadm5_hook/krb5_sync.so
where the value is the full path to the plugin that you want to load. If
this option is not present, kadmind will not load a plugin and the changes
from the patch will be inactive. If this option is given and the plugin
cannot be loaded, kadmind startup will abort with a (hopefully useful)
error message in syslog.
Any plugin used with this patch must expose a public function named
kadm5_hook_init of type kadm5_hook_init_t that returns a kadm5_hook structure.
See sample_hook.c for an example of this initialization function.
typedef struct kadm5_hook {
const char *name;
uint32_t version;
const char *vendor;
void (KRB5_CALLCONV *fini)(krb5_context, void *data);
krb5_error_code (KRB5_CALLCONV *chpass)(krb5_context context,
void *data,
enum kadm5_hook_stage stage,
krb5_error_code code,
krb5_const_principal princ,
uint32_t flags,
size_t n_ks_tuple,
krb5_key_salt_tuple *ks_tuple,
const char *password,
char **error_msg);
...
};
where enum kadm5_hook_stage is:
enum kadm5_hook_stage {
KADM5_HOOK_STAGE_PRECOMMIT,
KADM5_HOOK_STAGE_POSTCOMMIT
};
init creates a hook context that is passed into all subsequent calls.
chpass is called for password changes, create is called for principal
creation (with the newly-created principal in the kadm5_principal_ent_t
argument), and modify is called when a principal is modified. The purpose of
the remaining functions should be self-explanatory.
returning 0 on success and a Kerberos error code on failure, setting the
Kerberos error message in the provided context. The error code passed in is
valid for post-commit hooks and contains the result of the update operation.
This change is submitted under the following license
Copyright 2012, 2013
The Board of Trustees of the Leland Stanford Junior University
Portions Copyright 2018 AuriStor Inc.
Copying and distribution of this file, with or without modification, are
permitted in any medium without royalty provided the copyright notice and
this notice are preserved. This file is offered as-is, without any
warranty.
74 lines
4.4 KiB
Plaintext
74 lines
4.4 KiB
Plaintext
#
|
|
# Error messages for the kadm5 library
|
|
#
|
|
# This might look like a com_err file, but is not
|
|
#
|
|
id "$Id$"
|
|
|
|
error_table ovk kadm5
|
|
|
|
prefix KADM5
|
|
error_code FAILURE, "Operation failed for unspecified reason"
|
|
error_code AUTH_GET, "Operation requires `get' privilege"
|
|
error_code AUTH_ADD, "Operation requires `add' privilege"
|
|
error_code AUTH_MODIFY, "Operation requires `modify' privilege"
|
|
error_code AUTH_DELETE, "Operation requires `delete' privilege"
|
|
error_code AUTH_INSUFFICIENT, "Insufficient authorization for operation"
|
|
error_code BAD_DB, "Database inconsistency detected"
|
|
error_code DUP, "Principal or policy already exists"
|
|
error_code RPC_ERROR, "Communication failure with server"
|
|
error_code NO_SRV, "No administration server found for realm"
|
|
error_code BAD_HIST_KEY, "Password history principal key version mismatch"
|
|
error_code NOT_INIT, "Connection to server not initialized"
|
|
error_code UNK_PRINC, "Principal does not exist"
|
|
error_code UNK_POLICY, "Policy does not exist"
|
|
error_code BAD_MASK, "Invalid field mask for operation"
|
|
error_code BAD_CLASS, "Invalid number of character classes"
|
|
error_code BAD_LENGTH, "Invalid password length"
|
|
error_code BAD_POLICY, "Invalid policy name"
|
|
error_code BAD_PRINCIPAL, "Invalid principal name."
|
|
error_code BAD_AUX_ATTR, "Invalid auxillary attributes"
|
|
error_code BAD_HISTORY, "Invalid password history count"
|
|
error_code BAD_MIN_PASS_LIFE, "Password minimum life is greater than password maximum life"
|
|
error_code PASS_Q_TOOSHORT, "Password is too short"
|
|
error_code PASS_Q_CLASS, "Password does not contain enough character classes"
|
|
error_code PASS_Q_DICT, "Password is in the password dictionary"
|
|
error_code PASS_REUSE, "Can't reuse password"
|
|
error_code PASS_TOOSOON, "Current password's minimum life has not expired"
|
|
error_code POLICY_REF, "Policy is in use"
|
|
error_code INIT, "Connection to server already initialized"
|
|
error_code BAD_PASSWORD, "Incorrect password"
|
|
error_code PROTECT_PRINCIPAL, "Can't change protected principal"
|
|
error_code BAD_SERVER_HANDLE, "Programmer error! Bad Admin server handle"
|
|
error_code BAD_STRUCT_VERSION, "Programmer error! Bad API structure version"
|
|
error_code OLD_STRUCT_VERSION, "API structure version specified by application is no longer supported"
|
|
error_code NEW_STRUCT_VERSION, "API structure version specified by application is unknown to libraries"
|
|
error_code BAD_API_VERSION, "Programmer error! Bad API version"
|
|
error_code OLD_LIB_API_VERSION, "API version specified by application is no longer supported by libraries"
|
|
error_code OLD_SERVER_API_VERSION,"API version specified by application is no longer supported by server"
|
|
error_code NEW_LIB_API_VERSION, "API version specified by application is unknown to libraries"
|
|
error_code NEW_SERVER_API_VERSION,"API version specified by application is unknown to server"
|
|
error_code SECURE_PRINC_MISSING,"Database error! Required principal missing"
|
|
error_code NO_RENAME_SALT, "The salt type of the specified principal does not support renaming"
|
|
error_code BAD_CLIENT_PARAMS, "Invalid configuration parameter for remote KADM5 client"
|
|
error_code BAD_SERVER_PARAMS, "Invalid configuration parameter for local KADM5 client."
|
|
error_code AUTH_LIST, "Operation requires `list' privilege"
|
|
error_code AUTH_CHANGEPW, "Operation requires `change-password' privilege"
|
|
error_code BAD_TL_TYPE, "Invalid tagged data list element type"
|
|
error_code MISSING_CONF_PARAMS, "Required parameters in kdc.conf missing"
|
|
error_code BAD_SERVER_NAME, "Bad krb5 admin server hostname"
|
|
error_code KS_TUPLE_NOSUPP, "Key/salt tuples not supported by this function"
|
|
error_code SETKEY3_ETYPE_MISMATCH, "Key/salt tuples don't match keys"
|
|
error_code DECRYPT_USAGE_NOSUPP, "Given usage of kadm5_decrypt() not supported"
|
|
error_code POLICY_OP_NOSUPP, "Policy operations not supported"
|
|
error_code KEEPOLD_NOSUPP, "Keep old keys option not supported"
|
|
error_code AUTH_GET_KEYS, "Operation requires `get-keys' privilege"
|
|
error_code ALREADY_LOCKED, "Database already locked"
|
|
error_code NOT_LOCKED, "Database not locked"
|
|
error_code LOG_CORRUPT, "Incremental propagation log got corrupted"
|
|
error_code LOG_NEEDS_UPGRADE, "Incremental propagation log must be upgraded"
|
|
error_code BAD_SERVER_HOOK, "Bad KADM5 server hook"
|
|
error_code SERVER_HOOK_NOT_FOUND, "Cannot find KADM5 server hook"
|
|
error_code OLD_SERVER_HOOK_VERSION, "KADM5 server hook is too old for this version of Heimdal"
|
|
error_code NEW_SERVER_HOOK_VERSION, "KADM5 server hook is too new for this version of Heimdal"
|