Class: Kerberos::Kadm5

Inherits:

Object

• Object
• Kerberos::Kadm5

Defined in:

ext/rkerberos/kadm5.c

Defined Under Namespace

Classes: Exception, PrincipalNotFoundException

Constant Summary

DISALLOW_POSTDATED =

Constants

INT2FIX(KRB5_KDB_DISALLOW_POSTDATED)

DISALLOW_FORWARDABLE =

INT2FIX(KRB5_KDB_DISALLOW_FORWARDABLE)

DISALLOW_TGT_BASED =

INT2FIX(KRB5_KDB_DISALLOW_TGT_BASED)

DISALLOW_RENEWABLE =

INT2FIX(KRB5_KDB_DISALLOW_RENEWABLE)

DISALLOW_PROXIABLE =

INT2FIX(KRB5_KDB_DISALLOW_PROXIABLE)

DISALLOW_DUP_SKEY =

INT2FIX(KRB5_KDB_DISALLOW_DUP_SKEY)

DISALLOW_ALL_TIX =

INT2FIX(KRB5_KDB_DISALLOW_ALL_TIX)

REQUIRES_PRE_AUTH =

INT2FIX(KRB5_KDB_REQUIRES_PRE_AUTH)

REQUIRES_HW_AUTH =

INT2FIX(KRB5_KDB_REQUIRES_HW_AUTH)

REQUIRES_PWCHANGE =

INT2FIX(KRB5_KDB_REQUIRES_PWCHANGE)

DISALLOW_SVR =

INT2FIX(KRB5_KDB_DISALLOW_SVR)

PWCHANGE_SERVICE =

INT2FIX(KRB5_KDB_PWCHANGE_SERVICE)

SUPPORT_DESMD5 =

INT2FIX(KRB5_KDB_SUPPORT_DESMD5)

NEW_PRINC =

INT2FIX(KRB5_KDB_NEW_PRINC)

Instance Method Summary

• #close ⇒ Object

  Closes the kadm5 object.

• #create_policy(*args) ⇒ Object
• #create_principal(*args) ⇒ Object
• #delete_policy(v_policy) ⇒ Object
• #delete_principal(v_user) ⇒ Object
• #find_policy(v_name) ⇒ Object
• #find_principal(v_user) ⇒ Object
• #generate_random_key(v_user) ⇒ Object
• #get_policies(*args) ⇒ Object
• #get_policy(v_name) ⇒ Object
• #get_principal(v_user) ⇒ Object
• #get_principals(*args) ⇒ Object
• #get_privileges(*args) ⇒ Object
• #initialize(*args) ⇒ Object constructor

  Creates and returns a new Kerberos::Kadm5 object.

• #modify_policy(v_policy) ⇒ Object
• #set_password(v_user, v_pass) ⇒ Object
• #set_pwexpire(v_user, v_pwexpire) ⇒ Object

Constructor Details

#Kerberos::Kadm5.new(principal: 'name', password: 'xxxxx') ⇒ Object #Kerberos::Kadm5.new(principal: 'name', keytab: '/path/to/your/keytab') ⇒ Object #Kerberos::Kadm5.new(principal: 'name', keytab: true) ⇒ Object #Kerberos::Kadm5.new(principal: 'name', ccache: ccache_object) ⇒ Object

Creates and returns a new Kerberos::Kadm5 object. Keyword arguments allow you to specify a principal and a password, a keytab file, or a credentials cache.

If you pass a string as the :keytab value it will attempt to use that file for the keytab. If you pass true as the value it will attempt to use the default keytab file, typically /etc/krb5.keytab.

If you pass a Kerberos::Krb5::CredentialsCache object as the :ccache value, it will authenticate using the credentials stored in that cache via kadm5_init_with_creds.

You may also pass the :service option to specify the service name. The default is kadmin/admin.

There is also a :db_args option, which is a single string or array of strings containing options usually passed to kadmin with the -x switch. For a list of available options, see the kadmin manpage.

Only one of :password, :keytab, or :ccache may be specified.

# File 'ext/rkerberos/kadm5.c', line 87

static VALUE rkadm5_initialize(int argc, VALUE* argv, VALUE self){
  RUBY_KADM5* ptr;
  VALUE v_opts, v_principal, v_password, v_keytab, v_service, v_db_args, v_context, v_ccache;
  ID kw_table[7] = {
    rb_intern("principal"), rb_intern("password"), rb_intern("keytab"),
    rb_intern("ccache"), rb_intern("service"), rb_intern("db_args"),
    rb_intern("context")
  };
  VALUE kw_vals[7];
  char* user;
  char* pass = NULL;
  char* keytab = NULL;
  char* service = NULL;
  char default_keytab_name[MAX_KEYTAB_NAME_LEN];
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
  rb_scan_args(argc, argv, "0:", &v_opts);

  if(NIL_P(v_opts))
    v_opts = rb_hash_new();

  rb_get_kwargs(v_opts, kw_table, 0, 7, kw_vals);
  v_principal = kw_vals[0] == Qundef ? Qnil : kw_vals[0];
  v_password = kw_vals[1] == Qundef ? Qnil : kw_vals[1];
  v_keytab = kw_vals[2] == Qundef ? Qnil : kw_vals[2];
  v_ccache = kw_vals[3] == Qundef ? Qnil : kw_vals[3];
  v_service = kw_vals[4] == Qundef ? Qnil : kw_vals[4];
  v_db_args = kw_vals[5] == Qundef ? Qnil : kw_vals[5];
  v_context = kw_vals[6] == Qundef ? Qnil : kw_vals[6];

  // Validate mutual exclusivity
  {
    int auth_count = 0;
    if(RTEST(v_password)) auth_count++;
    if(RTEST(v_keytab))   auth_count++;
    if(RTEST(v_ccache))   auth_count++;

    if(auth_count > 1)
      rb_raise(rb_eArgError, "only one of password, keytab, or ccache may be specified");

    if(auth_count == 0)
      rb_raise(rb_eArgError, "one of password, keytab, or ccache must be specified");
  }

  // Principal must be specified if using a password
  if(RTEST(v_password)){
    if(NIL_P(v_principal))
      rb_raise(rb_eArgError, "principal must be specified");

    Check_Type(v_password, T_STRING);
    Check_Type(v_principal, T_STRING);

    pass = StringValueCStr(v_password);
  }

  if(RTEST(v_ccache) && NIL_P(v_principal)){
    if(NIL_P(v_principal))
      v_principal = rb_funcall(v_ccache, rb_intern("principal"), 0);
  }

  // For a keytab use the first entry's principal
  if(RTEST(v_keytab) && NIL_P(v_principal)) {
    VALUE v_enum, v_first;
    v_enum = rb_funcall(v_keytab, rb_intern("each"), 0);
    v_first = rb_funcall(v_enum, rb_intern("first"), 0);
    v_principal = rb_iv_get(v_first, "@principal");
  }

  user = StringValueCStr(v_principal);
  if(NIL_P(v_service)){
    service = (char *) "kadmin/admin";
  }
  else{
    Check_Type(v_service, T_STRING);
    service = StringValueCStr(v_service);
  }

  ptr->db_args = parse_db_args(v_db_args);

  // Initialize or borrow the context
  if(!NIL_P(v_context)){
    RUBY_KRB5_CONTEXT* ctx_ptr;

    if(!rb_obj_is_kind_of(v_context, cKrb5Context))
      rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");

    TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ctx_ptr);

    if(!ctx_ptr->ctx)
      rb_raise(cKrb5Exception, "context is closed");

    ptr->ctx = ctx_ptr->ctx;
    ptr->rb_context = v_context;
  }
  else{
    kerror = krb5_init_context(&ptr->ctx);

    if(kerror)
      rb_raise(cKadm5Exception, "krb5_init_context: %s", error_message(kerror));

    ptr->rb_context = Qnil;
  }

  // The docs say I can use NULL to get the default, but reality appears to be otherwise.
  if(RTEST(v_keytab)){
    if(TYPE(v_keytab) == T_TRUE){
      kerror = krb5_kt_default_name(ptr->ctx, default_keytab_name, MAX_KEYTAB_NAME_LEN);

      if(kerror)
        rb_raise(cKrb5Exception, "krb5_kt_default_name: %s", error_message(kerror));

      keytab = default_keytab_name;
    }
    else{
      Check_Type(v_keytab, T_STRING);
      keytab = StringValueCStr(v_keytab);
    }
  }

  if(RTEST(v_password)){
    kerror = kadm5_init_with_password(
      ptr->ctx,
      user,
      pass,
      service,
      NULL,
      KADM5_STRUCT_VERSION,
      KADM5_API_VERSION_3,
      ptr->db_args,
      &ptr->handle
    );

    if(kerror)
      rb_raise(cKadm5Exception, "kadm5_init_with_password: %s", error_message(kerror));
  }
  else if(RTEST(v_keytab)){
    kerror = kadm5_init_with_skey(
      ptr->ctx,
      user,
      keytab,
      service,
      NULL,
      KADM5_STRUCT_VERSION,
      KADM5_API_VERSION_3,
      ptr->db_args,
      &ptr->handle
    );

    if(kerror)
      rb_raise(cKadm5Exception, "kadm5_init_with_skey: %s", error_message(kerror));
  }
  else if(RTEST(v_ccache)){
    RUBY_KRB5_CCACHE* cc_ptr;

    if(!rb_obj_is_kind_of(v_ccache, cKrb5CCache))
      rb_raise(rb_eTypeError, "ccache must be a Kerberos::Krb5::CredentialsCache object");

    TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, cc_ptr);

    if(!cc_ptr->ccache)
      rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");

    kerror = kadm5_init_with_creds(
      ptr->ctx,
      user,
      cc_ptr->ccache,
      service,
      NULL,
      KADM5_STRUCT_VERSION,
      KADM5_API_VERSION_3,
      ptr->db_args,
      &ptr->handle
    );

    if(kerror)
      rb_raise(cKadm5Exception, "kadm5_init_with_creds: %s", error_message(kerror));
  }

  if(rb_block_given_p()){
    rb_ensure(rb_yield, self, rkadm5_close, self);
    return Qnil;
  }

  return self;
}

Instance Method Details

#close ⇒ Object

Closes the kadm5 object. Specifically, it frees the principal and context associated with the kadm5 object, as well as the server handle.

Any attempt to call a method on a kadm5 object after it has been closed will fail with an error message indicating a lack of context.

# File 'ext/rkerberos/kadm5.c', line 570

static VALUE rkadm5_close(VALUE self){
  RUBY_KADM5* ptr;
  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);

  if(ptr->handle)
    kadm5_destroy(ptr->handle);

  if(ptr->princ)
    krb5_free_principal(ptr->ctx, ptr->princ);

  if(ptr->ctx && ptr->rb_context == Qnil)
    krb5_free_context(ptr->ctx);

  free_db_args(ptr->db_args);

  ptr->db_args = NULL;
  ptr->ctx    = NULL;
  ptr->princ  = NULL;
  ptr->handle = NULL;
  ptr->rb_context = Qnil;

  return self;
}

#create_policy(*args) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 787

static VALUE rkadm5_create_policy(int argc, VALUE* argv, VALUE self){
  RUBY_KADM5* ptr;
  kadm5_ret_t kerror;
  kadm5_policy_ent_rec ent;
  long mask = KADM5_POLICY;
  VALUE v_policy, v_kwargs;
  VALUE v_name, v_min_classes, v_min_life, v_max_life, v_min_length, v_history_num;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);

  rb_scan_args(argc, argv, "01:", &v_policy, &v_kwargs);

  if(!NIL_P(v_kwargs)){
    VALUE v_args[1];
    if(!NIL_P(v_policy))
      rb_raise(rb_eArgError, "provide a Policy object or keyword arguments, not both");

    v_args[0] = v_kwargs;
    v_policy = rb_class_new_instance_kw(1, v_args, cKadm5Policy, RB_PASS_KEYWORDS);
  }

  if(NIL_P(v_policy))
    rb_raise(rb_eArgError, "a Policy object or policy keywords are required");

  if(!rb_obj_is_kind_of(v_policy, cKadm5Policy))
    rb_raise(rb_eTypeError, "expected a Kerberos::Kadm5::Policy object or policy keywords");

  v_name        = rb_iv_get(v_policy, "@policy");
  v_min_classes = rb_iv_get(v_policy, "@min_classes");
  v_min_length  = rb_iv_get(v_policy, "@min_length");
  v_min_life    = rb_iv_get(v_policy, "@min_life");
  v_max_life    = rb_iv_get(v_policy, "@max_life");
  v_history_num = rb_iv_get(v_policy, "@history_num");

  memset(&ent, 0, sizeof(ent));
  ent.policy = StringValueCStr(v_name);

  if(RTEST(v_min_classes)){
    mask |= KADM5_PW_MIN_CLASSES;
    ent.pw_min_classes = NUM2LONG(v_min_classes);
  }

  if(RTEST(v_min_length)){
    mask |= KADM5_PW_MIN_LENGTH;
    ent.pw_min_length = NUM2LONG(v_min_length);
  }

  if(RTEST(v_min_life)){
    mask |= KADM5_PW_MIN_LIFE;
    ent.pw_min_life = NUM2LONG(v_min_life);
  }

  if(RTEST(v_max_life)){
    mask |= KADM5_PW_MAX_LIFE;
    ent.pw_max_life = NUM2LONG(v_max_life);
  }

  if(RTEST(v_history_num)){
    mask |= KADM5_PW_HISTORY_NUM;
    ent.pw_history_num = NUM2LONG(v_history_num);
  }

  kerror = kadm5_create_policy(ptr->handle, &ent, mask);

  if(kerror)
    rb_raise(cKadm5Exception, "kadm5_create_policy: %s (%li)", error_message(kerror), kerror);

  return self;
}

#create_principal(*args) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 388

static VALUE rkadm5_create_principal(int argc, VALUE* argv, VALUE self){
  RUBY_KADM5* ptr;
  char* pass;
  char** db_args;
  int mask;
  kadm5_principal_ent_rec princ;
  krb5_error_code kerror;
  VALUE v_opts, v_name, v_principal, v_pass, v_db_args;
  ID kw_table[4] = { rb_intern("name"), rb_intern("principal"), rb_intern("password"), rb_intern("db_args") };
  VALUE kw_vals[4];

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);

  rb_scan_args(argc, argv, "0:", &v_opts);

  if(NIL_P(v_opts))
    v_opts = rb_hash_new();

  rb_get_kwargs(v_opts, kw_table, 0, 4, kw_vals);
  v_name = kw_vals[0] == Qundef ? Qnil : kw_vals[0];
  v_principal = kw_vals[1] == Qundef ? Qnil : kw_vals[1];
  v_pass = kw_vals[2] == Qundef ? Qnil : kw_vals[2];
  v_db_args = kw_vals[3] == Qundef ? Qnil : kw_vals[3];

  if(NIL_P(v_pass))
    rb_raise(rb_eArgError, "password: is required");

  Check_Type(v_pass, T_STRING);

  if(NIL_P(v_name) && NIL_P(v_principal))
    rb_raise(rb_eArgError, "name: or principal: is required");

  if(RTEST(v_name) && RTEST(v_principal))
    rb_raise(rb_eArgError, "name: and principal: are mutually exclusive");

  memset(&princ, 0, sizeof(princ));

  mask = KADM5_PRINCIPAL | KADM5_TL_DATA;
  pass = StringValueCStr(v_pass);

  db_args = parse_db_args(v_db_args);
  add_db_args(&princ, db_args);
  free_db_args(db_args);

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  // Determine the principal name and populate mask from the principal object
  if(RTEST(v_principal)){
    VALUE v_princ_name, v_policy, v_expire, v_pw_expire, v_max_life, v_max_renew, v_attrs;

    if(!rb_obj_is_kind_of(v_principal, cKrb5Principal))
      rb_raise(rb_eTypeError, "principal: must be a Kerberos::Krb5::Principal object");

    v_princ_name = rb_iv_get(v_principal, "@principal");

    if(NIL_P(v_princ_name))
      rb_raise(rb_eArgError, "principal object has no name set");

    Check_Type(v_princ_name, T_STRING);

    kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_princ_name), &princ.principal);

    if(kerror){
      free_tl_data(princ.tl_data);
      rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));
    }

    // Forward optional attributes from the Principal object
    v_policy = rb_iv_get(v_principal, "@policy");

    if(RTEST(v_policy)){
      Check_Type(v_policy, T_STRING);
      princ.policy = StringValueCStr(v_policy);
      mask |= KADM5_POLICY;
    }

    v_expire = rb_iv_get(v_principal, "@expire_time");

    if(RTEST(v_expire)){
      princ.princ_expire_time = (krb5_timestamp)NUM2LONG(rb_funcall(v_expire, rb_intern("to_i"), 0));
      mask |= KADM5_PRINC_EXPIRE_TIME;
    }

    v_pw_expire = rb_iv_get(v_principal, "@password_expiration");

    if(RTEST(v_pw_expire)){
      princ.pw_expiration = (krb5_timestamp)NUM2LONG(rb_funcall(v_pw_expire, rb_intern("to_i"), 0));
      mask |= KADM5_PW_EXPIRATION;
    }

    v_max_life = rb_iv_get(v_principal, "@max_life");

    if(RTEST(v_max_life)){
      princ.max_life = NUM2LONG(v_max_life);
      mask |= KADM5_MAX_LIFE;
    }

    v_max_renew = rb_iv_get(v_principal, "@max_renewable_life");

    if(RTEST(v_max_renew)){
      princ.max_renewable_life = NUM2LONG(v_max_renew);
      mask |= KADM5_MAX_RLIFE;
    }

    v_attrs = rb_iv_get(v_principal, "@attributes");

    if(RTEST(v_attrs)){
      princ.attributes = NUM2LONG(v_attrs);
      mask |= KADM5_ATTRIBUTES;
    }
  }
  else{
    Check_Type(v_name, T_STRING);

    kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_name), &princ.principal);

    if(kerror){
      free_tl_data(princ.tl_data);
      rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));
    }
  }

  kerror = kadm5_create_principal(ptr->handle, &princ, mask, pass);

  if(kerror){
    krb5_free_principal(ptr->ctx, princ.principal);
    free_tl_data(princ.tl_data);
    rb_raise(cKadm5Exception, "kadm5_create_principal: %s", error_message(kerror));
  }

  krb5_free_principal(ptr->ctx, princ.principal);
  free_tl_data(princ.tl_data);

  return self;
}

#delete_policy(v_policy) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 867

static VALUE rkadm5_delete_policy(VALUE self, VALUE v_policy){
  RUBY_KADM5* ptr;
  kadm5_ret_t kerror;
  char* policy;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);

  policy = StringValueCStr(v_policy);

  kerror = kadm5_delete_policy(ptr->handle, policy);

  if(kerror)
    rb_raise(cKadm5Exception, "kadm5_delete_policy: %s (%li)", error_message(kerror), kerror);

  return self;
}

#delete_principal(v_user) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 530

static VALUE rkadm5_delete_principal(VALUE self, VALUE v_user){
  RUBY_KADM5* ptr;
  char* user;
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
  Check_Type(v_user, T_STRING);
  user = StringValueCStr(v_user);

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  if(ptr->princ){
    krb5_free_principal(ptr->ctx, ptr->princ);
    ptr->princ = NULL;
  }

  kerror = krb5_parse_name(ptr->ctx, user, &ptr->princ);

  if(kerror)
    rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));

  kerror = kadm5_delete_principal(ptr->handle, ptr->princ);

  if(kerror)
    rb_raise(cKadm5Exception, "kadm5_delete_principal: %s", error_message(kerror));

  return self;
}

#find_policy(v_name) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 948

static VALUE rkadm5_find_policy(VALUE self, VALUE v_name){
  RUBY_KADM5* ptr;
  VALUE v_policy = Qnil;
  kadm5_policy_ent_rec ent;
  kadm5_ret_t kerror;
  char* policy_name;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
  memset(&ent, 0, sizeof(ent));

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  policy_name = StringValueCStr(v_name);

  kerror = kadm5_get_policy(ptr->handle, policy_name, &ent);

  // Return nil if not found rather than raising an error.
  if(kerror){
    if(kerror != KADM5_UNK_POLICY){
      rb_raise(
        cKadm5Exception,
        "kadm5_get_policy: %s (%li)", error_message(kerror), kerror
      );
    }
  }
  else{
    VALUE v_arg[1];
    VALUE v_hash = rb_hash_new();

    rb_hash_aset(v_hash, ID2SYM(rb_intern("name")), rb_str_new2(ent.policy));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_life")), LONG2FIX(ent.pw_min_life));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("max_life")), LONG2FIX(ent.pw_max_life));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_length")), LONG2FIX(ent.pw_min_length));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_classes")), LONG2FIX(ent.pw_min_classes));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("history_num")), LONG2FIX(ent.pw_history_num));

    v_arg[0] = v_hash;

    v_policy = rb_class_new_instance_kw(1, v_arg, cKadm5Policy, RB_PASS_KEYWORDS);

    kadm5_free_policy_ent(ptr->handle, &ent);
  }

  return v_policy;
}

#find_principal(v_user) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 663

static VALUE rkadm5_find_principal(VALUE self, VALUE v_user){
  RUBY_KADM5* ptr;
  VALUE v_principal;
  char* user;
  int mask;
  kadm5_principal_ent_rec ent;
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
  Check_Type(v_user, T_STRING);
  user = StringValueCStr(v_user);

  memset(&ent, 0, sizeof(ent));

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  if(ptr->princ){
    krb5_free_principal(ptr->ctx, ptr->princ);
    ptr->princ = NULL;
  }

  kerror = krb5_parse_name(ptr->ctx, user, &ptr->princ);

  if(kerror)
    rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));

  mask = KADM5_PRINCIPAL_NORMAL_MASK;

  kerror = kadm5_get_principal(
    ptr->handle,
    ptr->princ,
    &ent,
    mask
  );

  // Return nil if not found instead of raising an error.
  if(kerror){
    if(kerror == KADM5_UNK_PRINC)
      v_principal = Qnil;
    else
      rb_raise(cKadm5Exception, "kadm5_get_principal: %s", error_message(kerror));
  }
  else{
    v_principal = create_principal_from_entry(v_user, ptr, &ent);
  }

  return v_principal;
}

#generate_random_key(v_user) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 1191

static VALUE rkadm5_randkey_principal(VALUE self, VALUE v_user){
  RUBY_KADM5* ptr;
  krb5_keyblock* keys;
  kadm5_ret_t kerror;
  krb5_principal princ;
  char* user;
  int n_keys, i;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);

  user = StringValueCStr(v_user);

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  kerror = krb5_parse_name(ptr->ctx, user, &princ);

  if(kerror)
    rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));

  kerror = kadm5_randkey_principal(ptr->handle, princ, &keys, &n_keys);

  if(kerror){
    krb5_free_principal(ptr->ctx, princ);
    rb_raise(cKadm5Exception, "kadm5_randkey_principal: %s (%li)", error_message(kerror), kerror);
  }

  for(i = 0; i < n_keys; i++)
    krb5_free_keyblock_contents(ptr->ctx, &keys[i]);

  free(keys);
  krb5_free_principal(ptr->ctx, princ);

  return INT2NUM(n_keys);
}

#get_policies(*args) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 1052

static VALUE rkadm5_get_policies(int argc, VALUE* argv, VALUE self){
  RUBY_KADM5* ptr;
  VALUE v_array, v_expr;
  kadm5_ret_t kerror;
  char** pols;
  char* expr;
  int i, count;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);

  rb_scan_args(argc, argv, "01", &v_expr);

  if(NIL_P(v_expr))
    expr = NULL;
  else
    expr = StringValueCStr(v_expr);

  kerror = kadm5_get_policies(ptr->handle, expr, &pols, &count);

  if(kerror)
    rb_raise(cKadm5Exception, "kadm5_get_policies: %s (%li)", error_message(kerror), kerror);

  v_array = rb_ary_new();

  for(i = 0; i < count; i++){
    rb_ary_push(v_array, rb_str_new2(pols[i]));
  }

  kadm5_free_name_list(ptr->handle, pols, count);

  return v_array;
}

#get_policy(v_name) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 894

static VALUE rkadm5_get_policy(VALUE self, VALUE v_name){
  RUBY_KADM5* ptr;
  VALUE v_policy = Qnil;
  kadm5_policy_ent_rec ent;
  kadm5_ret_t kerror;
  char* policy_name;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
  memset(&ent, 0, sizeof(ent));

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  policy_name = StringValueCStr(v_name);

  kerror = kadm5_get_policy(ptr->handle, policy_name, &ent);

  if(kerror){
    rb_raise(
      cKadm5Exception,
      "kadm5_get_policy: %s (%li)", error_message(kerror), kerror
    );
  }
  else{
    VALUE v_arg[1];
    VALUE v_hash = rb_hash_new();

    rb_hash_aset(v_hash, ID2SYM(rb_intern("name")), rb_str_new2(ent.policy));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_life")), LONG2FIX(ent.pw_min_life));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("max_life")), LONG2FIX(ent.pw_max_life));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_length")), LONG2FIX(ent.pw_min_length));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_classes")), LONG2FIX(ent.pw_min_classes));
    rb_hash_aset(v_hash, ID2SYM(rb_intern("history_num")), LONG2FIX(ent.pw_history_num));

    v_arg[0] = v_hash;

    v_policy = rb_class_new_instance_kw(1, v_arg, cKadm5Policy, RB_PASS_KEYWORDS);

    kadm5_free_policy_ent(ptr->handle, &ent);
  }

  return v_policy;
}

#get_principal(v_user) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 724

static VALUE rkadm5_get_principal(VALUE self, VALUE v_user){
  RUBY_KADM5* ptr;
  VALUE v_principal;
  char* user;
  int mask;
  kadm5_principal_ent_rec ent;
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
  Check_Type(v_user, T_STRING);
  user = StringValueCStr(v_user);

  memset(&ent, 0, sizeof(ent));

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  if(ptr->princ){
    krb5_free_principal(ptr->ctx, ptr->princ);
    ptr->princ = NULL;
  }

  kerror = krb5_parse_name(ptr->ctx, user, &ptr->princ);

  if(kerror)
    rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));

  mask = KADM5_PRINCIPAL_NORMAL_MASK;

  kerror = kadm5_get_principal(
    ptr->handle,
    ptr->princ,
    &ent,
    mask
  );

  if(kerror){
    if(kerror == KADM5_UNK_PRINC)
      rb_raise(cKadm5PrincipalNotFoundException, "principal not found");
    else
      rb_raise(cKadm5Exception, "kadm5_get_principal: %s", error_message(kerror));
  }

  v_principal = create_principal_from_entry(v_user, ptr, &ent);

  return v_principal;
}

#get_principals(*args) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 1100

static VALUE rkadm5_get_principals(int argc, VALUE* argv, VALUE self){
  RUBY_KADM5* ptr;
  VALUE v_array, v_expr;
  kadm5_ret_t kerror;
  char** princs;
  char* expr;
  int i, count;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);

  rb_scan_args(argc, argv, "01", &v_expr);

  if(NIL_P(v_expr))
    expr = NULL;
  else
    expr = StringValueCStr(v_expr);

  kerror = kadm5_get_principals(ptr->handle, expr, &princs, &count);

  if(kerror)
    rb_raise(cKadm5Exception, "kadm5_get_principals: %s (%li)", error_message(kerror), kerror);

  v_array = rb_ary_new();

  for(i = 0; i < count; i++){
    rb_ary_push(v_array, rb_str_new2(princs[i]));
  }

  kadm5_free_name_list(ptr->handle, princs, count);

  return v_array;
}

#get_privileges(*args) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 1149

static VALUE rkadm5_get_privs(int argc, VALUE* argv, VALUE self){
  RUBY_KADM5* ptr;
  VALUE v_return = Qnil;
  VALUE v_strings = Qfalse;
  kadm5_ret_t kerror;
  long privs;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);

  rb_scan_args(argc, argv, "01", &v_strings);

  kerror = kadm5_get_privs(ptr->handle, &privs);

  if(kerror)
    rb_raise(cKadm5Exception, "kadm5_get_privs: %s (%li)", error_message(kerror), kerror);

  if(RTEST(v_strings)){
    v_return = rb_ary_new();

    if(privs & KADM5_PRIV_GET)
      rb_ary_push(v_return, rb_str_new2("GET"));
    if(privs & KADM5_PRIV_ADD)
      rb_ary_push(v_return, rb_str_new2("ADD"));
    if(privs & KADM5_PRIV_MODIFY)
      rb_ary_push(v_return, rb_str_new2("MODIFY"));
    if(privs & KADM5_PRIV_DELETE)
      rb_ary_push(v_return, rb_str_new2("DELETE"));
  }
  else{
    v_return = LONG2FIX(privs);
  }

  return v_return;
}

#modify_policy(v_policy) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 1007

static VALUE rkadm5_modify_policy(VALUE self, VALUE v_policy){
  RUBY_KADM5* ptr;
  RUBY_KADM5_POLICY* pptr;
  kadm5_ret_t kerror;
  long mask = KADM5_POLICY;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
  TypedData_Get_Struct(v_policy, RUBY_KADM5_POLICY, &rkadm5_policy_data_type, pptr);

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  if(pptr->policy.pw_min_classes)
    mask |= KADM5_PW_MIN_CLASSES;

  if(pptr->policy.pw_min_length)
    mask |= KADM5_PW_MIN_LENGTH;

  if(pptr->policy.pw_min_life)
    mask |= KADM5_PW_MIN_LIFE;

  if(pptr->policy.pw_max_life)
    mask |= KADM5_PW_MAX_LIFE;

  kerror = kadm5_modify_policy(ptr->handle, &pptr->policy, mask);

  if(kerror)
    rb_raise(cKadm5Exception, "kadm5_modify_policy: %s (%li)", error_message(kerror), kerror);

  return self;
}

#set_password(v_user, v_pass) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 279

static VALUE rkadm5_set_password(VALUE self, VALUE v_user, VALUE v_pass){
  RUBY_KADM5* ptr;
  krb5_error_code kerror;
  char *user;
  char *pass;

  Check_Type(v_user, T_STRING);
  Check_Type(v_pass, T_STRING);

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
  user = StringValueCStr(v_user);
  pass = StringValueCStr(v_pass);

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  if(ptr->princ){
    krb5_free_principal(ptr->ctx, ptr->princ);
    ptr->princ = NULL;
  }

  kerror = krb5_parse_name(ptr->ctx, user, &ptr->princ);

  if(kerror)
    rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));

  kerror = kadm5_chpass_principal(ptr->handle, ptr->princ, pass);

  if(kerror)
    rb_raise(cKadm5Exception, "kadm5_chpass_principal: %s", error_message(kerror));

  return self;
}

#set_pwexpire(v_user, v_pwexpire) ⇒ Object

# File 'ext/rkerberos/kadm5.c', line 318

static VALUE rkadm5_set_pwexpire(VALUE self, VALUE v_user, VALUE v_pwexpire){
  Check_Type(v_user, T_STRING);
  Check_Type(v_pwexpire, T_FIXNUM);

  RUBY_KADM5* ptr;
  kadm5_principal_ent_rec ent;
  char* user = StringValuePtr(v_user);
  int pwexpire = NUM2INT(v_pwexpire);
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKadm5Exception, "no context has been established");

  if(ptr->princ){
    krb5_free_principal(ptr->ctx, ptr->princ);
    ptr->princ = NULL;
  }

  kerror = krb5_parse_name(ptr->ctx, user, &ptr->princ);

  if(kerror)
    rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));

  memset(&ent, 0, sizeof(ent));
  kerror = kadm5_get_principal(
    ptr->handle,
    ptr->princ,
    &ent,
    KADM5_PRINCIPAL_NORMAL_MASK
  );

  if(kerror)
    rb_raise(cKadm5Exception, "krb5_get_principal: %s", error_message(kerror));

  ent.pw_expiration=pwexpire;
  kerror = kadm5_modify_principal(ptr->handle, &ent, KADM5_PW_EXPIRATION);

  kadm5_free_principal_ent(ptr->handle, &ent);

  if(kerror)
    rb_raise(cKadm5Exception, "kadm5_set_pwexpire: %s", error_message(kerror));

  return self;
}