summaryrefslogtreecommitdiff
path: root/source4/dsdb/samdb
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2007-02-04 07:17:03 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 14:44:31 -0500
commit744dddd75be73e4e883241b808b37a12a7a39ac1 (patch)
treebe0695eb7e6692452f515395663edb63df52d56e /source4/dsdb/samdb
parent627595b7a3c91d02fe8a29737beb77b2a4c4ae0f (diff)
downloadsamba-744dddd75be73e4e883241b808b37a12a7a39ac1.tar.gz
samba-744dddd75be73e4e883241b808b37a12a7a39ac1.tar.bz2
samba-744dddd75be73e4e883241b808b37a12a7a39ac1.zip
r21135: Instead of having hooks to update keytabs as an explicit thing, update
them as a hook on ldb modify, via a module. This should allow the secrets.ldb to be edited by the admin, and to have things update in the on-disk keytab just as an in-memory keytab would. This isn't really a dsdb plugin, but I don't have any other good ideas about where to put it. Andrew Bartlett (This used to be commit 6ce557a1aff4754d2622be8f1c6695d9ee788d54)
Diffstat (limited to 'source4/dsdb/samdb')
-rw-r--r--source4/dsdb/samdb/ldb_modules/config.mk16
-rw-r--r--source4/dsdb/samdb/ldb_modules/update_keytab.c189
2 files changed, 203 insertions, 2 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/config.mk b/source4/dsdb/samdb/ldb_modules/config.mk
index 929d0bcead..b50e275ebf 100644
--- a/source4/dsdb/samdb/ldb_modules/config.mk
+++ b/source4/dsdb/samdb/ldb_modules/config.mk
@@ -133,8 +133,7 @@ OBJ_FILES = \
SUBSYSTEM = ldb
INIT_FUNCTION = password_hash_module_init
OBJ_FILES = password_hash.o
-PUBLIC_DEPENDENCIES = HEIMDAL_KRB5
-PRIVATE_DEPENDENCIES = HEIMDAL_HDB_KEYS LIBTALLOC
+PRIVATE_DEPENDENCIES = HEIMDAL_HDB_KEYS LIBTALLOC HEIMDAL_KRB5
#
# End MODULE ldb_password_hash
################################################
@@ -212,3 +211,16 @@ OBJ_FILES = \
# End MODULE ldb_schema
################################################
+################################################
+# Start MODULE ldb_update_kt
+[MODULE::ldb_update_kt]
+SUBSYSTEM = ldb
+PRIVATE_DEPENDENCIES = LIBTALLOC CREDENTIALS_KRB5
+#Also depends on credentials, but that would loop
+INIT_FUNCTION = ldb_update_kt_init
+OBJ_FILES = \
+ update_keytab.o
+#
+# End MODULE ldb_update_kt
+################################################
+
diff --git a/source4/dsdb/samdb/ldb_modules/update_keytab.c b/source4/dsdb/samdb/ldb_modules/update_keytab.c
new file mode 100644
index 0000000000..411f8c98ef
--- /dev/null
+++ b/source4/dsdb/samdb/ldb_modules/update_keytab.c
@@ -0,0 +1,189 @@
+/*
+ ldb database library
+
+ Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+/*
+ * Name: ldb
+ *
+ * Component: ldb update_keytabs module
+ *
+ * Description: Update keytabs whenever their matching secret record changes
+ *
+ * Author: Andrew Bartlett
+ */
+
+#include "includes.h"
+#include "ldb/include/includes.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
+#include "system/kerberos.h"
+
+struct dn_list {
+ struct cli_credentials *creds;
+ struct dn_list *prev, *next;
+};
+
+struct update_kt_private {
+ struct dn_list *changed_dns;
+};
+
+static int add_modified(struct ldb_module *module, struct ldb_dn *dn, BOOL delete) {
+ struct update_kt_private *data = talloc_get_type(module->private_data, struct update_kt_private);
+ struct dn_list *item = talloc(data->changed_dns? (void *)data->changed_dns: (void *)data, struct dn_list);
+ char *filter;
+ NTSTATUS status;
+ if (!item) {
+ ldb_oom(module->ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ item->creds = cli_credentials_init(item);
+ if (!item->creds) {
+ DEBUG(1, ("cli_credentials_init failed!"));
+ ldb_oom(module->ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ cli_credentials_set_conf(item->creds);
+ filter = talloc_asprintf(item, "(&(&(objectClass=kerberosSecret)(&(privateKeytab=*)(|(secret=*)(ntPwdHash=*))))(dn=%s))",
+ ldb_dn_get_linearized(dn));
+ status = cli_credentials_set_secrets(item->creds, module->ldb, NULL, filter);
+ talloc_free(filter);
+ if (NT_STATUS_IS_OK(status)) {
+ if (delete) {
+ /* Ensure we don't helpfully keep an old keytab entry */
+ cli_credentials_set_kvno(item->creds, cli_credentials_get_kvno(item->creds)+2);
+ /* Wipe passwords */
+ cli_credentials_set_nt_hash(item->creds, NULL,
+ CRED_SPECIFIED);
+ }
+ DLIST_ADD_END(data->changed_dns, item, struct dn_list *);
+ }
+ return LDB_SUCCESS;
+}
+
+/* add */
+static int update_kt_add(struct ldb_module *module, struct ldb_request *req)
+{
+ int ret;
+ ret = ldb_next_request(module, req);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ return add_modified(module, req->op.add.message->dn, False);
+}
+
+/* modify */
+static int update_kt_modify(struct ldb_module *module, struct ldb_request *req)
+{
+ int ret;
+ ret = ldb_next_request(module, req);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ return add_modified(module, req->op.mod.message->dn, False);
+}
+
+/* delete */
+static int update_kt_delete(struct ldb_module *module, struct ldb_request *req)
+{
+ int ret;
+ /* Before we delete it, record the details */
+ ret = add_modified(module, req->op.del.dn, True);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ return ldb_next_request(module, req);
+}
+
+/* rename */
+static int update_kt_rename(struct ldb_module *module, struct ldb_request *req)
+{
+ int ret;
+ ret = ldb_next_request(module, req);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ return add_modified(module, req->op.rename.newdn, False);
+}
+
+/* end a transaction */
+static int update_kt_end_trans(struct ldb_module *module)
+{
+ struct update_kt_private *data = talloc_get_type(module->private_data, struct update_kt_private);
+
+ struct dn_list *p;
+ for (p=data->changed_dns; p; p = p->next) {
+ int kret;
+ kret = cli_credentials_update_keytab(p->creds);
+ if (kret != 0) {
+ talloc_free(data->changed_dns);
+ data->changed_dns = NULL;
+ ldb_asprintf_errstring(module->ldb, "Failed to update keytab: %s", error_message(kret));
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ }
+
+ talloc_free(data->changed_dns);
+ data->changed_dns = NULL;
+ return ldb_next_end_trans(module);
+}
+
+/* end a transaction */
+static int update_kt_del_trans(struct ldb_module *module)
+{
+ struct update_kt_private *data = talloc_get_type(module->private_data, struct update_kt_private);
+
+ talloc_free(data->changed_dns);
+ data->changed_dns = NULL;
+
+ return ldb_next_end_trans(module);
+}
+
+static int update_kt_init(struct ldb_module *module)
+{
+ struct update_kt_private *data;
+
+ data = talloc(module, struct update_kt_private);
+ if (data == NULL) {
+ ldb_oom(module->ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ module->private_data = data;
+ data->changed_dns = NULL;
+
+ return ldb_next_init(module);
+}
+
+static const struct ldb_module_ops update_kt_ops = {
+ .name = "update_keytab",
+ .init_context = update_kt_init,
+ .add = update_kt_add,
+ .modify = update_kt_modify,
+ .rename = update_kt_rename,
+ .del = update_kt_delete,
+ .end_transaction = update_kt_end_trans,
+ .del_transaction = update_kt_del_trans,
+};
+
+int ldb_update_kt_init(void)
+{
+ return ldb_register_module(&update_kt_ops);
+}