
This change adds plugin support to the kadmin libraries for performing actions before and after a password change is committed to the KDC database and after a change is made to the attributes of a principal (specifically, a change to DISALLOW_ALL_TIX). This change adds a hook_libraries configuration option to the [kadmin] section of krb5.conf (or kdc.conf if you use that file) that must be set to load the module. That configuration option is in the form: [kadmin] hook_libraries = /usr/local/lib/krb5/plugins/kadm5_hook/krb5_sync.so where the value is the full path to the plugin that you want to load. If this option is not present, kadmind will not load a plugin and the changes from the patch will be inactive. If this option is given and the plugin cannot be loaded, kadmind startup will abort with a (hopefully useful) error message in syslog. Any plugin used with this patch must expose a public function named kadm5_hook_init of type kadm5_hook_init_t that returns a kadm5_hook structure. See sample_hook.c for an example of this initialization function. typedef struct kadm5_hook { const char *name; uint32_t version; const char *vendor; void (KRB5_CALLCONV *fini)(krb5_context, void *data); krb5_error_code (KRB5_CALLCONV *chpass)(krb5_context context, void *data, enum kadm5_hook_stage stage, krb5_error_code code, krb5_const_principal princ, uint32_t flags, size_t n_ks_tuple, krb5_key_salt_tuple *ks_tuple, const char *password, char **error_msg); ... }; where enum kadm5_hook_stage is: enum kadm5_hook_stage { KADM5_HOOK_STAGE_PRECOMMIT, KADM5_HOOK_STAGE_POSTCOMMIT }; init creates a hook context that is passed into all subsequent calls. chpass is called for password changes, create is called for principal creation (with the newly-created principal in the kadm5_principal_ent_t argument), and modify is called when a principal is modified. The purpose of the remaining functions should be self-explanatory. returning 0 on success and a Kerberos error code on failure, setting the Kerberos error message in the provided context. The error code passed in is valid for post-commit hooks and contains the result of the update operation. This change is submitted under the following license Copyright 2012, 2013 The Board of Trustees of the Leland Stanford Junior University Portions Copyright 2018 AuriStor Inc. Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.
186 lines
5.1 KiB
C
186 lines
5.1 KiB
C
/*
|
|
* Copyright (c) 2018, AuriStor Inc.
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* - Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
*
|
|
* - Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in
|
|
* the documentation and/or other materials provided with the
|
|
* distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
|
|
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
|
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*
|
|
*/
|
|
|
|
#include "kadm5_locl.h"
|
|
|
|
static char sample_data[1];
|
|
|
|
static krb5_error_code
|
|
sample_log(krb5_context context,
|
|
void *data,
|
|
enum kadm5_hook_stage stage,
|
|
const char *tag,
|
|
krb5_error_code code,
|
|
krb5_const_principal princ)
|
|
{
|
|
char *p = NULL;
|
|
krb5_error_code ret;
|
|
|
|
if (data != sample_data)
|
|
return EINVAL;
|
|
if (code != 0 && stage == KADM5_HOOK_STAGE_PRECOMMIT)
|
|
return EINVAL;
|
|
|
|
if (princ)
|
|
ret = krb5_unparse_name(context, princ, &p);
|
|
|
|
krb5_warn(context, code, "sample_hook: %s %s hook princ '%s'", tag,
|
|
stage == KADM5_HOOK_STAGE_PRECOMMIT ? "pre-commit" : "post-commit",
|
|
p != NULL ? p : "<unknown>");
|
|
|
|
krb5_xfree(p);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void KRB5_CALLCONV
|
|
sample_fini(krb5_context context, void *data)
|
|
{
|
|
krb5_warn(context, 0, "sample_hook: shutting down\n");
|
|
}
|
|
|
|
static krb5_error_code KRB5_CALLCONV
|
|
sample_chpass_hook(krb5_context context,
|
|
void *data,
|
|
enum kadm5_hook_stage stage,
|
|
krb5_error_code code,
|
|
krb5_const_principal princ,
|
|
uint32_t flags,
|
|
size_t n_ks_tuple,
|
|
krb5_key_salt_tuple *ks_tuple,
|
|
const char *password)
|
|
{
|
|
return sample_log(context, data, stage, "chpass", code, princ);
|
|
}
|
|
|
|
static krb5_error_code KRB5_CALLCONV
|
|
sample_create_hook(krb5_context context,
|
|
void *data,
|
|
enum kadm5_hook_stage stage,
|
|
krb5_error_code code,
|
|
kadm5_principal_ent_t ent,
|
|
uint32_t mask,
|
|
const char *password)
|
|
{
|
|
return sample_log(context, data, stage, "create", code, ent->principal);
|
|
}
|
|
|
|
static krb5_error_code KRB5_CALLCONV
|
|
sample_modify_hook(krb5_context context,
|
|
void *data,
|
|
enum kadm5_hook_stage stage,
|
|
krb5_error_code code,
|
|
kadm5_principal_ent_t ent,
|
|
uint32_t mask)
|
|
{
|
|
return sample_log(context, data, stage, "modify", code, ent->principal);
|
|
}
|
|
|
|
static krb5_error_code KRB5_CALLCONV
|
|
sample_delete_hook(krb5_context context,
|
|
void *data,
|
|
enum kadm5_hook_stage stage,
|
|
krb5_error_code code,
|
|
krb5_const_principal princ)
|
|
{
|
|
return sample_log(context, data, stage, "delete", code, princ);
|
|
}
|
|
|
|
static krb5_error_code KRB5_CALLCONV
|
|
sample_randkey_hook(krb5_context context,
|
|
void *data,
|
|
enum kadm5_hook_stage stage,
|
|
krb5_error_code code,
|
|
krb5_const_principal princ)
|
|
{
|
|
return sample_log(context, data, stage, "randkey", code, princ);
|
|
}
|
|
|
|
static krb5_error_code KRB5_CALLCONV
|
|
sample_rename_hook(krb5_context context,
|
|
void *data,
|
|
enum kadm5_hook_stage stage,
|
|
krb5_error_code code,
|
|
krb5_const_principal source,
|
|
krb5_const_principal target)
|
|
{
|
|
return sample_log(context, data, stage, "rename", code, source);
|
|
}
|
|
|
|
static krb5_error_code KRB5_CALLCONV
|
|
sample_set_keys_hook(krb5_context context,
|
|
void *data,
|
|
enum kadm5_hook_stage stage,
|
|
krb5_error_code code,
|
|
krb5_const_principal princ,
|
|
uint32_t flags,
|
|
size_t n_ks_tuple,
|
|
krb5_key_salt_tuple *ks_tuple,
|
|
size_t n_keys,
|
|
krb5_keyblock *keyblocks)
|
|
{
|
|
return sample_log(context, data, stage, "set_keys", code, princ);
|
|
}
|
|
|
|
static struct kadm5_hook sample_hook = {
|
|
"sample-hook",
|
|
KADM5_HOOK_VERSION_V1,
|
|
"Heimdal",
|
|
krb5_init_context,
|
|
sample_fini,
|
|
sample_chpass_hook,
|
|
sample_create_hook,
|
|
sample_modify_hook,
|
|
sample_delete_hook,
|
|
sample_randkey_hook,
|
|
sample_rename_hook,
|
|
sample_set_keys_hook
|
|
};
|
|
|
|
krb5_error_code
|
|
kadm5_hook_init(krb5_context context, uint32_t vers_max,
|
|
const kadm5_hook **hook, void **data);
|
|
|
|
krb5_error_code
|
|
kadm5_hook_init(krb5_context context, uint32_t vers_max,
|
|
const kadm5_hook **hook, void **data)
|
|
{
|
|
if (vers_max < KADM5_HOOK_VERSION_V1)
|
|
return EINVAL;
|
|
|
|
krb5_warn(context, 0, "sample_hook: init version %u\n", vers_max);
|
|
|
|
*hook = &sample_hook;
|
|
*data = sample_data;
|
|
|
|
return 0;
|
|
}
|