2001-12-20 10:46:24 +03:00
/*
2002-01-30 09:08:46 +03:00
Unix SMB / CIFS implementation .
2001-12-20 10:46:24 +03:00
krb5 set password implementation
Copyright ( C ) Remus Koos 2001 ( remuskoos @ yahoo . com )
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
2007-07-09 23:25:36 +04:00
the Free Software Foundation ; either version 3 of the License , or
2001-12-20 10:46:24 +03:00
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
2007-07-10 04:52:41 +04:00
along with this program . If not , see < http : //www.gnu.org/licenses/>.
2001-12-20 10:46:24 +03:00
*/
# include "includes.h"
2010-07-02 02:32:52 +04:00
# include "ads.h"
2001-12-20 10:46:24 +03:00
# ifdef HAVE_KRB5
ADS_STATUS ads_change_trust_account_password ( ADS_STRUCT * ads , char * host_principal )
{
2004-11-02 05:21:26 +03:00
char * password ;
char * new_password ;
ADS_STATUS ret ;
2009-10-13 12:15:34 +04:00
enum netr_SchannelType sec_channel_type ;
2003-04-21 18:09:03 +04:00
2004-11-02 05:21:26 +03:00
if ( ( password = secrets_fetch_machine_password ( lp_workgroup ( ) , NULL , & sec_channel_type ) ) = = NULL ) {
DEBUG ( 1 , ( " Failed to retrieve password for principal %s \n " , host_principal ) ) ;
return ADS_ERROR_SYSTEM ( ENOENT ) ;
}
2001-12-20 10:46:24 +03:00
2008-10-19 12:05:48 +04:00
new_password = generate_random_str ( talloc_tos ( ) , DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH ) ;
2003-04-21 18:09:03 +04:00
2006-06-09 14:50:28 +04:00
ret = kerberos_set_password ( ads - > auth . kdc_server , host_principal , password , host_principal , new_password , ads - > auth . time_offset ) ;
2003-02-24 05:55:00 +03:00
2004-11-02 05:21:26 +03:00
if ( ! ADS_ERR_OK ( ret ) ) {
goto failed ;
}
2001-12-20 10:46:24 +03:00
2007-03-13 23:53:38 +03:00
if ( ! secrets_store_machine_password ( new_password , lp_workgroup ( ) , sec_channel_type ) ) {
2004-11-02 05:21:26 +03:00
DEBUG ( 1 , ( " Failed to save machine password \n " ) ) ;
ret = ADS_ERROR_SYSTEM ( EACCES ) ;
goto failed ;
}
2001-12-20 10:46:24 +03:00
2004-11-02 05:21:26 +03:00
failed :
SAFE_FREE ( password ) ;
return ret ;
2001-12-20 10:46:24 +03:00
}
2007-08-30 19:39:51 +04:00
ADS_STATUS ads_guess_service_principal ( ADS_STRUCT * ads ,
char * * returned_principal )
{
char * princ = NULL ;
if ( ads - > server . realm & & ads - > server . ldap_server ) {
2007-09-28 22:15:34 +04:00
char * server , * server_realm ;
2007-08-30 19:39:51 +04:00
server = SMB_STRDUP ( ads - > server . ldap_server ) ;
server_realm = SMB_STRDUP ( ads - > server . realm ) ;
2007-09-28 22:15:34 +04:00
if ( ! server | | ! server_realm ) {
2008-05-29 21:00:46 +04:00
SAFE_FREE ( server ) ;
SAFE_FREE ( server_realm ) ;
2007-09-28 22:15:34 +04:00
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
}
strlower_m ( server ) ;
strupper_m ( server_realm ) ;
2008-12-23 23:11:12 +03:00
if ( asprintf ( & princ , " ldap/%s@%s " , server , server_realm ) = = - 1 ) {
SAFE_FREE ( server ) ;
SAFE_FREE ( server_realm ) ;
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
}
2007-09-28 22:15:34 +04:00
SAFE_FREE ( server ) ;
SAFE_FREE ( server_realm ) ;
if ( ! princ ) {
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
2007-08-30 19:39:51 +04:00
}
} else if ( ads - > config . realm & & ads - > config . ldap_server_name ) {
2007-09-28 22:15:34 +04:00
char * server , * server_realm ;
2007-08-30 19:39:51 +04:00
server = SMB_STRDUP ( ads - > config . ldap_server_name ) ;
server_realm = SMB_STRDUP ( ads - > config . realm ) ;
2007-09-28 22:15:34 +04:00
if ( ! server | | ! server_realm ) {
2008-10-05 00:17:30 +04:00
SAFE_FREE ( server ) ;
SAFE_FREE ( server_realm ) ;
2007-09-28 22:15:34 +04:00
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
}
strlower_m ( server ) ;
strupper_m ( server_realm ) ;
2008-12-23 23:11:12 +03:00
if ( asprintf ( & princ , " ldap/%s@%s " , server , server_realm ) = = - 1 ) {
SAFE_FREE ( server ) ;
SAFE_FREE ( server_realm ) ;
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
}
2007-08-30 19:39:51 +04:00
2007-09-28 22:15:34 +04:00
SAFE_FREE ( server ) ;
SAFE_FREE ( server_realm ) ;
if ( ! princ ) {
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
}
}
2007-09-28 07:54:42 +04:00
2007-08-30 19:39:51 +04:00
if ( ! princ ) {
2007-09-28 22:15:34 +04:00
return ADS_ERROR ( LDAP_PARAM_ERROR ) ;
2007-08-30 19:39:51 +04:00
}
* returned_principal = princ ;
2007-09-28 22:15:34 +04:00
return ADS_SUCCESS ;
2007-08-30 19:39:51 +04:00
}
2001-12-20 10:46:24 +03:00
# endif