diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2011-11-29 12:47:40 +1100 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2011-11-29 09:20:54 +0100 |
| commit | 2bff209128b85bd870ad36fa00ffcc92edbbab08 (patch) | |
| tree | 751e775ca78eda99455f88f9e8057611150f76c5 /source4/libnet | |
| parent | 8eef716598fa30b216ba144c74bcf5dfcfa870fd (diff) | |
| download | samba-2bff209128b85bd870ad36fa00ffcc92edbbab08.tar.gz samba-2bff209128b85bd870ad36fa00ffcc92edbbab08.tar.bz2 samba-2bff209128b85bd870ad36fa00ffcc92edbbab08.zip | |
s4-samba-tool: Add --principal argument to samba-tool domain exportkeytab
This allows only a particular principal to be exported to the keytab.
This is useful when setting up unix servers in a Samba controlled
domain.
Based on a request by Gémes Géza <geza@kzsdabas.hu>
Andrew Bartlett
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Nov 29 09:20:55 CET 2011 on sn-devel-104
Diffstat (limited to 'source4/libnet')
| -rw-r--r-- | source4/libnet/libnet_export_keytab.c | 22 | ||||
| -rw-r--r-- | source4/libnet/libnet_export_keytab.h | 1 | ||||
| -rw-r--r-- | source4/libnet/py_net.c | 8 |
3 files changed, 25 insertions, 6 deletions
diff --git a/source4/libnet/libnet_export_keytab.c b/source4/libnet/libnet_export_keytab.c index e8a0a1321d..2dae370b1a 100644 --- a/source4/libnet/libnet_export_keytab.c +++ b/source4/libnet/libnet_export_keytab.c @@ -45,13 +45,29 @@ NTSTATUS libnet_export_keytab(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, s return NT_STATUS_NO_MEMORY; } - unlink(r->in.keytab_name); + if (r->in.principal) { + /* TODO: Find a way not to have to use a fixed list */ + krb5_enctype enctypes[] = { + KRB5_ENCTYPE_DES_CBC_CRC, + KRB5_ENCTYPE_DES_CBC_MD5, + KRB5_ENCTYPE_AES128_CTS_HMAC_SHA1_96, + KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96, + KRB5_ENCTYPE_ARCFOUR_HMAC_MD5 + }; + ret = kt_copy_one_principal(smb_krb5_context->krb5_context, from_keytab, r->in.keytab_name, r->in.principal, 0, enctypes); + } else { + unlink(r->in.keytab_name); + ret = kt_copy(smb_krb5_context->krb5_context, from_keytab, r->in.keytab_name); + } - ret = kt_copy(smb_krb5_context->krb5_context, from_keytab, r->in.keytab_name); if(ret) { r->out.error_string = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, mem_ctx); - return NT_STATUS_UNSUCCESSFUL; + if (ret == KRB5_KT_NOTFOUND) { + return NT_STATUS_NO_SUCH_USER; + } else { + return NT_STATUS_UNSUCCESSFUL; + } } return NT_STATUS_OK; } diff --git a/source4/libnet/libnet_export_keytab.h b/source4/libnet/libnet_export_keytab.h index 194f8907a3..289d19c7a6 100644 --- a/source4/libnet/libnet_export_keytab.h +++ b/source4/libnet/libnet_export_keytab.h @@ -20,6 +20,7 @@ struct libnet_export_keytab { struct { const char *keytab_name; + const char *principal; } in; struct { const char *error_string; diff --git a/source4/libnet/py_net.c b/source4/libnet/py_net.c index 7c90572e12..cf37ccc380 100644 --- a/source4/libnet/py_net.c +++ b/source4/libnet/py_net.c @@ -188,11 +188,13 @@ static PyObject *py_net_export_keytab(py_net_Object *self, PyObject *args, PyObj { struct libnet_export_keytab r; TALLOC_CTX *mem_ctx; - const char *kwnames[] = { "keytab", NULL }; + const char *kwnames[] = { "keytab", "principal", NULL }; NTSTATUS status; + r.in.principal = NULL; - if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s:export_keytab", discard_const_p(char *, kwnames), - &r.in.keytab_name)) { + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|z:export_keytab", discard_const_p(char *, kwnames), + &r.in.keytab_name, + &r.in.principal)) { return NULL; } |