[Heimdal-source-changes] [heimdal/heimdal] 62c179: kadm5: pre/post-commit plugin hook for kadm5 updat...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: 62c1790bf5cf7266a53b7cc22dcbebeead5557b1
      https://github.com/heimdal/heimdal/commit/62c1790bf5cf7266a53b7cc22dcbebeead5557b1
  Author: Luke Howard <lukeh at padl.com>
  Date:   2018-12-26 (Wed, 26 Dec 2018)

  Changed paths:
    M lib/kadm5/Makefile.am
    M lib/kadm5/NTMakefile
    M lib/kadm5/chpass_s.c
    M lib/kadm5/context_s.c
    M lib/kadm5/create_s.c
    M lib/kadm5/delete_s.c
    M lib/kadm5/destroy_s.c
    A lib/kadm5/kadm5-hook.h
    M lib/kadm5/kadm5_err.et
    M lib/kadm5/modify_s.c
    M lib/kadm5/private.h
    M lib/kadm5/randkey_s.c
    M lib/kadm5/rename_s.c
    A lib/kadm5/sample_hook.c
    A lib/kadm5/server_hooks.c
    M lib/kadm5/setkey3_s.c

  Log Message:
  -----------
  kadm5: pre/post-commit plugin hook for kadm5 update operations (#397)

This change adds plugin support to the kadmin libraries for performing
actions before and after a password change is committed to the KDC database
and after a change is made to the attributes of a principal (specifically,
a change to DISALLOW_ALL_TIX).

This change adds a hook_libraries configuration option to the [kadmin]
section of krb5.conf (or kdc.conf if you use that file) that must be set
to load the module. That configuration option is in the form:

[kadmin]
  hook_libraries = /usr/local/lib/krb5/plugins/kadm5_hook/krb5_sync.so

where the value is the full path to the plugin that you want to load. If
this option is not present, kadmind will not load a plugin and the changes
from the patch will be inactive. If this option is given and the plugin
cannot be loaded, kadmind startup will abort with a (hopefully useful)
error message in syslog.

Any plugin used with this patch must expose a public function named
kadm5_hook_init of type kadm5_hook_init_t that returns a kadm5_hook structure.
See sample_hook.c for an example of this initialization function.

typedef struct kadm5_hook {
    const char *name;
    uint32_t version;
    const char *vendor;
    void (KRB5_CALLCONV *fini)(krb5_context, void *data);

    krb5_error_code (KRB5_CALLCONV *chpass)(krb5_context context,
   void *data,
   enum kadm5_hook_stage stage,
                                      krb5_error_code code,
                                      krb5_const_principal princ,
                                      uint32_t flags,
                                      size_t n_ks_tuple,
                                      krb5_key_salt_tuple *ks_tuple,
                                      const char *password,
                                      char **error_msg);
    ...
};

where enum kadm5_hook_stage is:

enum kadm5_hook_stage {
    KADM5_HOOK_STAGE_PRECOMMIT,
    KADM5_HOOK_STAGE_POSTCOMMIT
};

init creates a hook context that is passed into all subsequent calls.
chpass is called for password changes, create is called for principal
creation (with the newly-created principal in the kadm5_principal_ent_t
argument), and modify is called when a principal is modified. The purpose of
the remaining functions should be self-explanatory.

returning 0 on success and a Kerberos error code on failure, setting the
Kerberos error message in the provided context. The error code passed in is
valid for post-commit hooks and contains the result of the update operation.

This change is submitted under the following license

Copyright 2012, 2013
The Board of Trustees of the Leland Stanford Junior University

Portions Copyright 2018 AuriStor Inc.

Copying and distribution of this file, with or without modification, are
permitted in any medium without royalty provided the copyright notice and
this notice are preserved. This file is offered as-is, without any
warranty.


  Commit: c6bf100b4301750f6c2b038d2b83c2a17ce4e2a6
      https://github.com/heimdal/heimdal/commit/c6bf100b4301750f6c2b038d2b83c2a17ce4e2a6
  Author: Luke Howard <lukeh at padl.com>
  Date:   2018-12-26 (Wed, 26 Dec 2018)

  Changed paths:
    M doc/setup.texi
    M kadmin/server.c
    M kpasswd/kpasswdd.c
    M lib/kadm5/acl.c
    M lib/kadm5/chpass_s.c
    M lib/kadm5/create_s.c

  Log Message:
  -----------
  kadm5: move password quality checks out of daemons and into libkadm5

Note that this has a slight behavior change to c89d3f3b in order to continue
allow kadmin in local mode to bypass password quality checks. Password quality
checks are always bypassed if the *client* kadmin principal is kadmin/admin,
i.e. that of the kadmin service itself. This is the case when running kadmin in
local mode. As this is the equivalent of a superuser account, one would
anticipate that deployments would use specific administrator instances for
appropriate ACLs for day-to-day administration; operations by these will be
subject to password quality checks if enforce_on_admin_set is TRUE, or if the
user is changing their own password.


Compare: https://github.com/heimdal/heimdal/compare/d150c9989bc0...c6bf100b4301
      **NOTE:** This service has been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.