r23973: For debugging, add (undocumented) net ads kerberos commands (kinit, renew,

pac).

Guenther
(This used to be commit 4cada7c1485c9957e553d6e75cb6f30f4338489f)

2 files changed, 112 insertions, 1 deletions

diff --git a/source3/libads/authdata.c b/source3/libads/authdata.c
index 5616ccd5a5..b19bec43c5 100644
--- a/source3/libads/authdata.c
+++ b/source3/libads/authdata.c
@@ -723,7 +723,7 @@ char *pac_group_attr_string(uint32 attr)
 }
 
 /* just for debugging, will be removed later - Guenther */
-static void dump_pac_logon_info(int lvl, PAC_LOGON_INFO *logon_info)
+void dump_pac_logon_info(int lvl, PAC_LOGON_INFO *logon_info)
 {
 	DOM_SID dom_sid, res_group_dom_sid;
 	int i;
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index 71217b5137..f92985091e 100644
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -2505,6 +2505,111 @@ use keytab functions.\n");
 	return net_run_function(argc, argv, func, net_ads_keytab_usage);
 }
 
+static int net_ads_kerberos_usage(int argc, const char **argv)
+{
+	d_printf(
+		"net ads kerberos <COMMAND>\n"\
+		"<COMMAND> can be either:\n"\
+		"  RENEW     Renew TGT from existing credential cache\n"\
+		"  PAC       Dumps the Kerberos PAC\n"\
+		"  KINIT     Retrieve Ticket Granting Ticket (TGT)\n"\
+		"\n"
+	);
+
+	return -1;
+}
+
+static int net_ads_kerberos_renew(int argc, const char **argv)
+{
+	int ret = smb_krb5_renew_ticket(NULL, NULL, NULL, NULL);
+	if (ret) {
+		d_printf("failed to renew kerberos ticket: %s\n",
+			error_message(ret));
+	}
+	return ret;
+}
+
+static int net_ads_kerberos_pac(int argc, const char **argv)
+{
+	PAC_DATA *pac = NULL;
+	PAC_LOGON_INFO *info = NULL;
+	TALLOC_CTX *mem_ctx = NULL;
+	NTSTATUS status;
+	int ret = -1;
+
+	mem_ctx = talloc_init("net_ads_kerberos_pac");
+	if (!mem_ctx) {
+		goto out;
+	}
+
+	opt_password = net_prompt_pass(opt_user_name);
+
+	status = kerberos_return_pac(mem_ctx,
+				     opt_user_name,
+				     opt_password,
+				     0, &pac);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("failed to query kerberos PAC: %s\n",
+			nt_errstr(status));
+		goto out;
+	}
+
+	info = get_logon_info_from_pac(pac);
+	if (info) {
+		dump_pac_logon_info(0, info);
+	}
+
+	ret = 0;
+ out:
+	TALLOC_FREE(mem_ctx);
+	return ret;
+}
+
+static int net_ads_kerberos_kinit(int argc, const char **argv)
+{
+	TALLOC_CTX *mem_ctx = NULL;
+	int ret = -1;
+	NTSTATUS status;
+
+	mem_ctx = talloc_init("net_ads_kerberos_kinit");
+	if (!mem_ctx) {
+		goto out;
+	}
+
+	opt_password = net_prompt_pass(opt_user_name);
+
+	ret = kerberos_kinit_password_ext(opt_user_name,
+					  opt_password,
+					  0,
+					  NULL,
+					  NULL,
+					  NULL,
+					  True,
+					  True,
+					  2592000, /* one month */
+					  &status);
+	if (ret) {
+		d_printf("failed to kinit password: %s\n",
+			nt_errstr(status));
+	}
+ out:
+	return ret;
+}
+
+int net_ads_kerberos(int argc, const char **argv)
+{
+	struct functable func[] = {
+		{"KINIT", net_ads_kerberos_kinit},
+		{"RENEW", net_ads_kerberos_renew},
+		{"PAC", net_ads_kerberos_pac},
+		{"HELP", net_ads_kerberos_usage},
+		{NULL, NULL}
+	};
+
+	return net_run_function(argc, argv, func, net_ads_kerberos_usage);
+}
+
+
 int net_ads_help(int argc, const char **argv)
 {
 	struct functable func[] = {
@@ -2546,6 +2651,7 @@ int net_ads(int argc, const char **argv)
 		{"LOOKUP", net_ads_lookup},
 		{"KEYTAB", net_ads_keytab},
 		{"GPO", net_ads_gpo},
+		{"KERBEROS", net_ads_kerberos},
 		{"HELP", net_ads_help},
 		{NULL, NULL}
 	};
@@ -2566,6 +2672,11 @@ int net_ads_keytab(int argc, const char **argv)
 	return net_ads_noads();
 }
 
+int net_ads_kerberos(int argc, const char **argv)
+{
+	return net_ads_noads();
+}
+
 int net_ads_usage(int argc, const char **argv)
 {
 	return net_ads_noads();