1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
|
# Wallet::Kadmin::Heimdal -- Wallet Kerberos administration API for Heimdal.
#
# Written by Jon Robertson <jonrober@stanford.edu>
# Copyright 2009, 2010 Board of Trustees, Leland Stanford Jr. University
#
# See LICENSE for licensing terms.
##############################################################################
# Modules and declarations
##############################################################################
package Wallet::Kadmin::Heimdal;
require 5.006;
use strict;
use vars qw(@ISA $VERSION);
use Heimdal::Kadm5 qw(KRB5_KDB_DISALLOW_ALL_TIX);
use Wallet::Config ();
use Wallet::Kadmin ();
@ISA = qw(Wallet::Kadmin);
# This version should be increased on any code change to this module. Always
# use two digits for the minor version with a leading zero if necessary so
# that it will sort properly.
$VERSION = '0.03';
##############################################################################
# Utility functions
##############################################################################
# Add the realm to the end of the principal if no realm is currently present.
sub canonicalize_principal {
my ($self, $principal) = @_;
if ($Wallet::Config::KEYTAB_REALM && $principal !~ /\@/) {
$principal .= '@' . $Wallet::Config::KEYTAB_REALM;
}
return $principal;
}
##############################################################################
# Public interfaces
##############################################################################
# Check whether a given principal already exists in Kerberos. Returns true if
# so, false otherwise.
sub exists {
my ($self, $principal) = @_;
$principal = $self->canonicalize_principal ($principal);
my $kadmin = $self->{client};
my $princdata = eval { $kadmin->getPrincipal ($principal) };
if ($@) {
$self->error ("error getting principal: $@");
return;
}
return $princdata ? 1 : 0;
}
# Create a principal in Kerberos. If there is an error, return undef and set
# the error. Return 1 on success or the principal already existing.
sub create {
my ($self, $principal) = @_;
$principal = $self->canonicalize_principal ($principal);
my $exists = eval { $self->exists ($principal) };
if ($@) {
$self->error ("error adding principal $principal: $@");
return;
}
return 1 if $exists;
# The way Heimdal::Kadm5 works, we create a principal object, create the
# actual principal set inactive, then randomize it and activate it.
#
# TODO - Paranoia makes me want to set the password to something random
# on creation even if it is inactive until after randomized by
# module.
my $kadmin = $self->{client};
eval {
my $princdata = $kadmin->makePrincipal ($principal);
my $attrs = $princdata->getAttributes;
$attrs |= KRB5_KDB_DISALLOW_ALL_TIX;
$princdata->setAttributes ($attrs);
my $password = 'inactive';
$kadmin->createPrincipal ($princdata, $password, 0);
$kadmin->randKeyPrincipal ($principal);
$kadmin->enablePrincipal ($principal);
};
if ($@) {
$self->error ("error adding principal $principal: $@");
return;
}
return 1;
}
# Create a keytab from a principal. Takes the principal, the file, and
# optionally a list of encryption types to which to limit the keytab. Return
# true if successful, false otherwise. If the keytab creation fails, sets the
# error.
sub keytab {
my ($self, $principal, $file, @enctypes) = @_;
$principal = $self->canonicalize_principal ($principal);
# The way Heimdal works, you can only remove enctypes from a principal,
# not add them back in. So we need to run randkeyPrincipal first each
# time to restore all possible enctypes and then whittle them back down
# to those we have been asked for this time.
my $kadmin = $self->{client};
eval { $kadmin->randKeyPrincipal ($principal) };
if ($@) {
$self->error ("error creating keytab for $principal: could not"
. " reinit enctypes: $@");
return;
}
my $princdata = eval { $kadmin->getPrincipal ($principal) };
if ($@) {
$self->error ("error creating keytab for $principal: $@");
return;
} elsif (!$princdata) {
$self->error ("error creating keytab for $principal: principal does"
. " not exist");
return;
}
# Now actually remove any non-requested enctypes, if we requested any.
if (@enctypes) {
my $alltypes = $princdata->getKeytypes;
my %wanted = map { $_ => 1 } @enctypes;
for my $key (@{ $alltypes }) {
my $keytype = $key->[0];
next if exists $wanted{$keytype};
eval { $princdata->delKeytypes ($keytype) };
if ($@) {
$self->error ("error removing keytype $keytype from the"
. " keytab: $@");
return;
}
}
eval { $kadmin->modifyPrincipal ($princdata) };
if ($@) {
$self->error ("error saving principal modifications: $@");
return;
}
}
# Create the keytab.
eval { $kadmin->extractKeytab ($princdata, $file) };
if ($@) {
$self->error ("error creating keytab for principal: $@");
return;
}
return 1;
}
# Delete a principal from Kerberos. Return true if successful, false
# otherwise. If the deletion fails, sets the error. If the principal doesn't
# exist, return success; we're bringing reality in line with our expectations.
sub destroy {
my ($self, $principal) = @_;
$principal = $self->canonicalize_principal ($principal);
my $exists = eval { $self->exists ($principal) };
if ($@) {
$self->error ("error checking principal existance: $@");
return;
} elsif (not $exists) {
return 1;
}
my $kadmin = $self->{client};
my $retval = eval { $kadmin->deletePrincipal ($principal) };
if ($@) {
$self->error ("error deleting $principal: $@");
return;
}
return 1;
}
# Create a new Wallet::Kadmin::Heimdal object and its underlying
# Heimdal::Kadm5 object.
sub new {
my ($class) = @_;
unless (defined ($Wallet::Config::KEYTAB_PRINCIPAL)
and defined ($Wallet::Config::KEYTAB_FILE)
and defined ($Wallet::Config::KEYTAB_REALM)) {
die "keytab object implementation not configured\n";
}
my @options = (RaiseError => 1,
Principal => $Wallet::Config::KEYTAB_PRINCIPAL,
Realm => $Wallet::Config::KEYTAB_REALM,
Keytab => $Wallet::Config::KEYTAB_FILE);
if ($Wallet::Config::KEYTAB_HOST) {
push (@options, Server => $Wallet::Config::KEYTAB_HOST);
}
my $client = Heimdal::Kadm5::Client->new (@options);
my $self = { client => $client };
bless ($self, $class);
return $self;
}
1;
__END__
##############################################################################
# Documentation
##############################################################################
=for stopwords
keytabs keytab kadmin KDC API Allbery Heimdal
=head1 NAME
Wallet::Kadmin::Heimdal - Wallet Kerberos administration API for Heimdal
=head1 SYNOPSIS
my $kadmin = Wallet::Kadmin::Heimdal->new;
$kadmin->create ("host/foo.example.com");
$kadmin->keytab ("host/foo.example.com", "aes256-cts-hmac-sha1-96");
my $exists = $kadmin->exists ("host/oldshell.example.com");
$kadmin->destroy ("host/oldshell.example.com") if $exists;
=head1 DESCRIPTION
Wallet::Kadmin::Heimdal implements the Wallet::Kadmin API for Heimdal,
providing an interface to create and delete principals and create keytabs.
It provides the API documented in Wallet::Kadmin(3) for a Heimdal KDC.
To use this object, several configuration parameters must be set. See
Wallet::Config(3) for details on those configuration parameters and
information about how to set wallet configuration.
=head1 SEE ALSO
kadmin(8), Wallet::Config(3), Wallet::Kadmin(3),
Wallet::Object::Keytab(3), wallet-backend(8)
This module is part of the wallet system. The current version is
available from L<http://www.eyrie.org/~eagle/software/wallet/>.
=head1 AUTHORS
Russ Allbery <rra@stanford.edu> and Jon Robertson <jonrober@stanford.edu>.
=cut
|
