1 #define LDAP_AUTH_OTHERKIND 0x86L
2 #define LDAP_AUTH_NEGOTIATE (LDAP_AUTH_OTHERKIND | 0x0400)
5 THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
6 ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
7 TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
10 Copyright (C) 1999 Microsoft Corporation. All rights reserved.
18 Set a user's password using the
19 Kerberos Change Password Protocol (I-D) variant for Windows 2000
23 * lib/krb5/os/changepw.c
25 * Copyright 1990 by the Massachusetts Institute of Technology.
26 * All Rights Reserved.
28 * Export of this software from the United States of America may
29 * require a specific license from the United States Government.
30 * It is the responsibility of any person or organization contemplating
31 * export to obtain such a license before exporting.
33 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
34 * distribute this software and its documentation for any purpose and
35 * without fee is hereby granted, provided that the above copyright
36 * notice appear in all copies and that both that copyright notice and
37 * this permission notice appear in supporting documentation, and that
38 * the name of M.I.T. not be used in advertising or publicity pertaining
39 * to distribution of the software without specific, written prior
40 * permission. M.I.T. makes no representations about the suitability of
41 * this software for any purpose. It is provided "as is" without express
42 * or implied warranty.
57 #include <sys/socket.h>
59 #include <sys/select.h>
65 #include <sys/timeb.h>
73 #define ULONG unsigned long
75 #ifndef krb5_is_krb_error
76 #define krb5_is_krb_error(dat)\
77 ((dat) && (dat)->length && ((dat)->data[0] == 0x7e ||\
78 (dat)->data[0] == 0x5e))
82 #define sleep(Seconds) Sleep(Seconds * 1000)
83 #define gethostbyname(Server) rgethostbyname(Server)
87 #if defined(_WIN32) && !defined(__CYGWIN32__)
89 #define ECONNABORTED WSAECONNABORTED
92 #define ECONNREFUSED WSAECONNREFUSED
95 #define EHOSTUNREACH WSAEHOSTUNREACH
97 #endif /* _WIN32 && !__CYGWIN32__ */
99 static const char rcsid[] = "$Id$";
101 static int frequency[26][26] =
102 { {4, 20, 28, 52, 2, 11, 28, 4, 32, 4, 6, 62, 23, 167, 2, 14, 0, 83, 76,
103 127, 7, 25, 8, 1, 9, 1}, /* aa - az */
104 {13, 0, 0, 0, 55, 0, 0, 0, 8, 2, 0, 22, 0, 0, 11, 0, 0, 15, 4, 2, 13, 0,
105 0, 0, 15, 0}, /* ba - bz */
106 {32, 0, 7, 1, 69, 0, 0, 33, 17, 0, 10, 9, 1, 0, 50, 3, 0, 10, 0, 28, 11,
107 0, 0, 0, 3, 0}, /* ca - cz */
108 {40, 16, 9, 5, 65, 18, 3, 9, 56, 0, 1, 4, 15, 6, 16, 4, 0, 21, 18, 53,
109 19, 5, 15, 0, 3, 0}, /* da - dz */
110 {84, 20, 55, 125, 51, 40, 19, 16, 50, 1, 4, 55, 54, 146, 35, 37, 6, 191,
111 149, 65, 9, 26, 21, 12, 5, 0}, /* ea - ez */
112 {19, 3, 5, 1, 19, 21, 1, 3, 30, 2, 0, 11, 1, 0, 51, 0, 0, 26, 8, 47, 6,
113 3, 3, 0, 2, 0}, /* fa - fz */
114 {20, 4, 3, 2, 35, 1, 3, 15, 18, 0, 0, 5, 1, 4, 21, 1, 1, 20, 9, 21, 9,
115 0, 5, 0, 1, 0}, /* ga - gz */
116 {101, 1, 3, 0, 270, 5, 1, 6, 57, 0, 0, 0, 3, 2, 44, 1, 0, 3, 10, 18, 6,
117 0, 5, 0, 3, 0}, /* ha - hz */
118 {40, 7, 51, 23, 25, 9, 11, 3, 0, 0, 2, 38, 25, 202, 56, 12, 1, 46, 79,
119 117, 1, 22, 0, 4, 0, 3}, /* ia - iz */
120 {3, 0, 0, 0, 5, 0, 0, 0, 1, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3, 0, 0, 0,
122 {1, 0, 0, 0, 11, 0, 0, 0, 13, 0, 0, 0, 0, 2, 0, 0, 0, 0, 6, 2, 1, 0, 2,
123 0, 1, 0}, /* ka - kz */
124 {44, 2, 5, 12, 62, 7, 5, 2, 42, 1, 1, 53, 2, 2, 25, 1, 1, 2, 16, 23, 9,
125 0, 1, 0, 33, 0}, /* la - lz */
126 {52, 14, 1, 0, 64, 0, 0, 3, 37, 0, 0, 0, 7, 1, 17, 18, 1, 2, 12, 3, 8,
127 0, 1, 0, 2, 0}, /* ma - mz */
128 {42, 10, 47, 122, 63, 19, 106, 12, 30, 1, 6, 6, 9, 7, 54, 7, 1, 7, 44,
129 124, 6, 1, 15, 0, 12, 0}, /* na - nz */
130 {7, 12, 14, 17, 5, 95, 3, 5, 14, 0, 0, 19, 41, 134, 13, 23, 0, 91, 23,
131 42, 55, 16, 28, 0, 4, 1}, /* oa - oz */
132 {19, 1, 0, 0, 37, 0, 0, 4, 8, 0, 0, 15, 1, 0, 27, 9, 0, 33, 14, 7, 6, 0,
133 0, 0, 0, 0}, /* pa - pz */
134 {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 17, 0, 0,
135 0, 0, 0}, /* qa - qz */
136 {83, 8, 16, 23, 169, 4, 8, 8, 77, 1, 10, 5, 26, 16, 60, 4, 0, 24, 37,
137 55, 6, 11, 4, 0, 28, 0}, /* ra - rz */
138 {65, 9, 17, 9, 73, 13, 1, 47, 75, 3, 0, 7, 11, 12, 56, 17, 6, 9, 48,
139 116, 35, 1, 28, 0, 4, 0}, /* sa - sz */
140 {57, 22, 3, 1, 76, 5, 2, 330, 126, 1, 0, 14, 10, 6, 79, 7, 0, 49, 50,
141 56, 21, 2, 27, 0, 24, 0}, /* ta - tz */
142 {11, 5, 9, 6, 9, 1, 6, 0, 9, 0, 1, 19, 5, 31, 1, 15, 0, 47, 39, 31, 0,
143 3, 0, 0, 0, 0}, /* ua - uz */
144 {7, 0, 0, 0, 72, 0, 0, 0, 28, 0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0,
145 0, 3, 0}, /* va - vz */
146 {36, 1, 1, 0, 38, 0, 0, 33, 36, 0, 0, 4, 1, 8, 15, 0, 0, 0, 4, 2, 0, 0,
147 1, 0, 0, 0}, /* wa - wz */
148 {1, 0, 2, 0, 0, 1, 0, 0, 3, 0, 0, 0, 0, 0, 1, 5, 0, 0, 0, 3, 0, 0, 1, 0,
150 {14, 5, 4, 2, 7, 12, 12, 6, 10, 0, 0, 3, 7, 5, 17, 3, 0, 4, 16, 30, 0,
151 0, 5, 0, 0, 0}, /* ya - yz */
152 {1, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
153 0, 0}}; /* za - zz */
156 * This MUST be equal to the sum of the equivalent rows above.
159 static int row_sums[26] =
160 {796,160,284,401,1276,262,199,539,777,
161 16,39,351,243,751,662,181,17,683,
162 662,968,248,115,180,17,162,5};
165 * Frequencies of starting characters
168 static int start_freq [26] =
169 {1299,425,725,271,375,470,93,223,1009,
170 24,20,355,379,319,823,618,21,317,
171 962,1991,271,104,516,6,16,14};
174 * This MUST be equal to the sum of all elements in the above array.
177 struct sockaddr_in kdc_server;
179 krb5_context context;
181 krb5_auth_context auth_context = NULL;
183 krb5_creds *credsp = NULL;
185 char connected_server[128];
187 static int total_sum = 11646;
189 int get_krb5_error(krb5_error_code rc, char *in, char *out);
190 int ad_connect(LDAP **ldap_handle, char *ldap_domain, char *dn_path,
191 char *Win2kPassword, char *Win2kUser, char *default_server,
192 int connect_to_kdc, char **ServerList, int *IgnoreServerListError);
193 int ad_kdc_connect(char *connectedServer);
194 int ad_server_connect(char *connectedServer, char *domain);
195 void ad_kdc_disconnect();
196 int compare_elements(const void *arg1, const void *arg2);
197 int convert_domain_to_dn(char *domain, char *dnp);
198 int set_password(char *user, char *password, char *domain);
200 int locate_ldap_server(char *domain, char **server_name);
203 void generate_password(char *password);
204 krb5_error_code encode_krb5_setpw
205 PROTOTYPE((const krb5_setpw *rep, krb5_data ** code));
207 krb5_error_code make_setpw_req(krb5_context context, krb5_auth_context auth_context,
208 krb5_data *ap_req, krb5_principal targprinc,
209 char *passwd, krb5_data *packet)
214 krb5_data *encoded_setpw;
215 krb5_replay_data replay;
217 register int count = 2;
219 memset(&setpw, 0, sizeof(krb5_setpw));
220 if (ret = krb5_auth_con_setflags(context, auth_context,
221 KRB5_AUTH_CONTEXT_DO_SEQUENCE))
223 setpw.targprinc = targprinc;
224 setpw.newpasswd.length = strlen(passwd);
225 setpw.newpasswd.data = passwd;
226 if ((ret = encode_krb5_setpw(&setpw, &encoded_setpw)))
228 if (ret = krb5_mk_priv(context, auth_context,
229 encoded_setpw, &cipherpw, &replay))
231 packet->length = 6 + ap_req->length + cipherpw.length;
232 packet->data = (char *) malloc(packet->length);
235 *ptr++ = (packet->length>>8) & 0xff;
236 *ptr++ = packet->length & 0xff;
240 /* ap_req length, big-endian */
241 *ptr++ = (ap_req->length>>8) & 0xff;
242 *ptr++ = ap_req->length & 0xff;
244 memcpy(ptr, ap_req->data, ap_req->length);
245 ptr += ap_req->length;
246 /* krb-priv of password */
247 memcpy(ptr, cipherpw.data, cipherpw.length);
249 /* krb5_free_data_contents(context, &cipherpw);*/
250 krb5_free_data(context, encoded_setpw);
254 krb5_error_code get_setpw_rep(krb5_context context, krb5_auth_context auth_context,
255 krb5_data *packet, int *result_code,
256 krb5_data *result_data)
263 krb5_data cipherresult;
264 krb5_data clearresult;
265 krb5_error *krberror;
266 krb5_replay_data replay;
268 krb5_ap_rep_enc_part *ap_rep_enc;
270 if (packet->length < 4)
271 return(KRB5KRB_AP_ERR_MODIFIED);
273 if (krb5_is_krb_error(packet))
275 ret = decode_krb5_error(packet, &krberror);
278 ret = krberror->error;
279 krb5_free_error(context, krberror);
283 plen = (*ptr++ & 0xff);
284 plen = (plen<<8) | (*ptr++ & 0xff);
285 if (plen != packet->length)
286 return(KRB5KRB_AP_ERR_MODIFIED);
287 vno = (*ptr++ & 0xff);
288 vno = (vno<<8) | (*ptr++ & 0xff);
289 if (vno != KRB5_KPASSWD_VERS_SETPW && vno != KRB5_KPASSWD_VERS_CHANGEPW)
290 return(KRB5KDC_ERR_BAD_PVNO);
291 /* read, check ap-rep length */
292 ap_rep.length = (*ptr++ & 0xff);
293 ap_rep.length = (ap_rep.length<<8) | (*ptr++ & 0xff);
294 if (ptr + ap_rep.length >= packet->data + packet->length)
295 return(KRB5KRB_AP_ERR_MODIFIED);
300 ptr += ap_rep.length;
301 if (ret = krb5_rd_rep(context, auth_context, &ap_rep, &ap_rep_enc))
303 krb5_free_ap_rep_enc_part(context, ap_rep_enc);
304 /* extract and decrypt the result */
305 cipherresult.data = ptr;
306 cipherresult.length = (packet->data + packet->length) - ptr;
307 /* XXX there's no api to do this right. The problem is that
308 if there's a remote subkey, it will be used. This is
309 not what the spec requires */
310 tmp = auth_context->remote_subkey;
311 auth_context->remote_subkey = NULL;
312 ret = krb5_rd_priv(context, auth_context, &cipherresult, &clearresult,
314 auth_context->remote_subkey = tmp;
320 cipherresult.data = ptr;
321 cipherresult.length = (packet->data + packet->length) - ptr;
323 if (ret = krb5_rd_error(context, &cipherresult, &krberror))
326 clearresult = krberror->e_data;
328 if (clearresult.length < 2)
330 ret = KRB5KRB_AP_ERR_MODIFIED;
333 ptr = clearresult.data;
334 *result_code = (*ptr++ & 0xff);
335 *result_code = (*result_code<<8) | (*ptr++ & 0xff);
336 if ((*result_code < KRB5_KPASSWD_SUCCESS) ||
337 (*result_code > KRB5_KPASSWD_ACCESSDENIED))
339 ret = KRB5KRB_AP_ERR_MODIFIED;
342 /* all success replies should be authenticated/encrypted */
343 if ((ap_rep.length == 0) && (*result_code == KRB5_KPASSWD_SUCCESS))
345 ret = KRB5KRB_AP_ERR_MODIFIED;
348 result_data->length = (clearresult.data + clearresult.length) - ptr;
349 if (result_data->length)
351 result_data->data = (char *) malloc(result_data->length);
352 memcpy(result_data->data, ptr, result_data->length);
355 result_data->data = NULL;
359 free(clearresult.data);
361 krb5_free_error(context, krberror);
365 krb5_error_code kdc_set_password(krb5_context context, krb5_ccache ccache,
366 char *newpw, char *user, char *domain,
371 krb5_data result_string;
372 krb5_address local_kaddr;
373 krb5_address remote_kaddr;
376 krb5_error_code code;
377 struct sockaddr local_addr;
378 struct sockaddr remote_addr;
382 int local_result_code;
384 krb5_principal targprinc;
385 struct timeval TimeVal;
388 memset(&local_addr, 0, sizeof(local_addr));
389 memset(&local_kaddr, 0, sizeof(local_kaddr));
390 memset(&result_string, 0, sizeof(result_string));
391 memset(&remote_kaddr, 0, sizeof(remote_kaddr));
392 memset(&chpw_snd, 0, sizeof(krb5_data));
393 memset(&chpw_rcv, 0, sizeof(krb5_data));
394 memset(userrealm, '\0', sizeof(userrealm));
397 chpw_rcv.length = 1500;
398 chpw_rcv.data = (char *) calloc(1, chpw_rcv.length);
400 for (i = 0; i < (int)strlen(domain); i++)
401 userrealm[i] = toupper(domain[i]);
403 sprintf(temp, "%s@%s", user, userrealm);
404 krb5_parse_name(context, temp, &targprinc);
408 memset(&creds, 0, sizeof(creds));
409 memset(&ap_req, 0, sizeof(krb5_data));
410 sprintf(temp, "%s@%s", "kadmin/changepw", userrealm);
411 if (code = krb5_parse_name(context, temp, &creds.server))
413 if (code = krb5_cc_get_principal(context, ccache, &creds.client))
415 if (code = krb5_get_credentials(context, 0, ccache, &creds, &credsp))
417 if (code = krb5_mk_req_extended(context, &auth_context, AP_OPTS_USE_SUBKEY,
418 NULL, credsp, &ap_req))
422 addrlen = sizeof(local_addr);
423 if (getsockname(kdc_socket, &local_addr, &addrlen) < 0)
425 code = KDC_GETSOCKNAME_ERROR;
428 if (((struct sockaddr_in *)&local_addr)->sin_addr.s_addr != 0)
430 local_kaddr.addrtype = ADDRTYPE_INET;
432 sizeof(((struct sockaddr_in *) &local_addr)->sin_addr);
433 local_kaddr.contents =
434 (char *) &(((struct sockaddr_in *) &local_addr)->sin_addr);
438 krb5_address **addrs;
439 krb5_os_localaddr(context, &addrs);
440 local_kaddr.magic = addrs[0]->magic;
441 local_kaddr.addrtype = addrs[0]->addrtype;
442 local_kaddr.length = addrs[0]->length;
443 local_kaddr.contents = calloc(1, addrs[0]->length);
444 memcpy(local_kaddr.contents, addrs[0]->contents, addrs[0]->length);
445 krb5_free_addresses(context, addrs);
448 addrlen = sizeof(remote_addr);
449 if (getpeername(kdc_socket, &remote_addr, &addrlen) < 0)
451 code = KDC_GETPEERNAME_ERROR;
454 remote_kaddr.addrtype = ADDRTYPE_INET;
455 remote_kaddr.length = sizeof(((struct sockaddr_in *) &remote_addr)->sin_addr);
456 remote_kaddr.contents = (char *) &(((struct sockaddr_in *) &remote_addr)->sin_addr);
458 if (code = krb5_auth_con_setaddrs(context, auth_context, &local_kaddr, NULL))
460 if (code = make_setpw_req(context, auth_context, &ap_req,
461 targprinc, newpw, &chpw_snd))
464 for (i = 0; i < 3; i++)
466 if ((cc = sendto(kdc_socket, chpw_snd.data, chpw_snd.length, 0,
468 0)) != chpw_snd.length)
470 code = KDC_SEND_ERROR;
478 FD_SET(kdc_socket, &readfds);
479 nfds = kdc_socket + 1;
480 code = select(nfds, &readfds, NULL, NULL, &TimeVal);
481 if ((code == 0) || (code == SOCKET_ERROR))
483 code = KDC_RECEIVE_TIMEOUT;
488 if ((cc = recvfrom(kdc_socket, chpw_rcv.data, chpw_rcv.length, 0,
491 code = KDC_RECEIVE_TIMEOUT;
495 chpw_rcv.length = cc;
496 if (code = krb5_auth_con_setaddrs(context, auth_context, NULL, &remote_kaddr))
501 local_result_code = 0;
502 code = get_setpw_rep(context, auth_context, &chpw_rcv,
503 &local_result_code, &result_string);
505 if (local_result_code)
507 if (local_result_code == KRB5_KPASSWD_SOFTERROR)
508 local_result_code = KRB5_KPASSWD_SUCCESS;
509 *result_code = local_result_code;
511 if ((code == 0) && (local_result_code == 0))
517 if (chpw_snd.data != NULL)
519 if (chpw_rcv.data != NULL)
521 if (targprinc != NULL)
522 krb5_free_principal(context, targprinc);
526 int set_password(char *user, char *password, char *domain)
529 krb5_error_code retval;
530 char pw[PW_LENGTH+1];
532 memset(pw, '\0', sizeof(pw));
533 if (strlen(password) != 0)
534 strcpy(pw, password);
536 generate_password(pw);
538 retval = kdc_set_password(context, ccache, pw, user, domain, &res_code);
545 void generate_password(char *password)
556 for (line = 22; line; --line)
558 for (word = 7; word; --word)
560 position = myrandom()%total_sum;
561 for(row_position = 0, j = 0; position >= row_position; row_position += start_freq[j], j++)
563 *(pwp = password) = j + 'a' - 1;
564 for (nchars = PW_LENGTH-1; nchars; --nchars)
568 position = myrandom()%row_sums[i];
569 for (row_position = 0, j = 0; position >= row_position; row_position += frequency[i][j], j++)
585 struct _timeb timebuffer;
596 srand(timebuffer.time ^ timebuffer.millitm ^ pid);
598 gettimeofday(&tv, (struct timezone *) NULL);
599 srandom(tv.tv_sec ^ tv.tv_usec ^ pid);
605 int get_krb5_error(krb5_error_code rc, char *in, char *out)
614 krb5Error = ((int)(rc & 255));
615 sprintf(out, "%s: %s(%ld)", in, error_message(rc), krb5Error);
621 case KDC_RECEIVE_TIMEOUT:
624 sprintf(out, "%s: %s(%d)", in, "Receive timeout", rc);
627 case KDC_RECEIVE_ERROR:
630 sprintf(out, "%s: %s(%d)", in, "Receive error", rc);
633 case KRB5_KPASSWD_MALFORMED:
635 sprintf(out, "%s: %s(%d)", in, "malformed password", rc);
638 case KRB5_KPASSWD_HARDERROR:
640 sprintf(out, "%s: %s(%d)", in, "hard error", rc);
643 case KRB5_KPASSWD_AUTHERROR:
646 sprintf(out, "%s: %s(%d)", in, "authentication error", rc);
649 case KRB5_KPASSWD_SOFTERROR:
652 sprintf(out, "%s: %s(%d)", in, "soft error", rc);
655 case KRB5_KPASSWD_ACCESSDENIED:
657 sprintf(out, "%s: %s(%d)", in, "Access denied", rc);
663 sprintf(out, "%s: %s(%d)", in, "Send error", rc);
666 case KDC_GETSOCKNAME_ERROR:
669 sprintf(out, "%s: %s(%d)", in, "Socket error - getsockname", rc);
672 case KDC_GETPEERNAME_ERROR:
675 sprintf(out, "%s: %s(%d)", in, "Socket error - getpeername", rc);
680 sprintf(out, "%s: %s(%d)", in, "unknown error", rc);
688 int ad_connect(LDAP **ldap_handle, char *ldap_domain, char *dn_path,
689 char *Win2kPassword, char *Win2kUser, char *default_server,
690 int connect_to_kdc, char **ServerList, int *IgnoreServerListError)
695 char *server_name[MAX_SERVER_NAMES];
696 static char temp[128];
697 ULONG version = LDAP_VERSION3;
699 int Max_wait_time = 500;
700 int Max_size_limit = LDAP_NO_LIMIT;
702 if (ldap_domain == NULL)
703 ldap_domain = "win.mit.edu";
704 convert_domain_to_dn(ldap_domain, dn_path);
705 if (strlen(dn_path) == 0)
709 while (ServerList[Count] != NULL)
712 memset(server_name, 0, sizeof(server_name[0]) * MAX_SERVER_NAMES);
713 if (locate_ldap_server(ldap_domain, server_name) == -1)
716 for (i = 0; i < MAX_SERVER_NAMES; i++)
718 if (server_name[i] != NULL)
720 if (Count >= MAX_SERVER_NAMES)
722 free(server_name[i]);
723 server_name[i] = NULL;
726 for (k = 0; k < (int)strlen(server_name[i]); k++)
727 server_name[i][k] = toupper(server_name[i][k]);
728 for (k = 0; k < Count; k++)
730 if (!strcasecmp(server_name[i], ServerList[k]))
732 free(server_name[i]);
733 server_name[i] = NULL;
739 ServerList[Count] = calloc(1, 256);
740 strcpy(ServerList[Count], server_name[i]);
741 ServerList[Count] = (char *)strdup((char *)server_name[i]);
743 free(server_name[i]);
748 for (i = 0; i < Count; i++)
750 if (ServerList[i] == NULL)
753 if (((*ldap_handle) = ldap_open(ServerList[i], LDAP_PORT)) != NULL)
755 rc = ldap_set_option((*ldap_handle), LDAP_OPT_PROTOCOL_VERSION, &version);
756 rc = ldap_set_option((*ldap_handle), LDAP_OPT_TIMELIMIT,
757 (void *)&Max_wait_time);
758 rc = ldap_set_option((*ldap_handle), LDAP_OPT_SIZELIMIT,
759 (void *)&Max_size_limit);
760 rc = ldap_set_option((*ldap_handle), LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
761 rc = ldap_adgssapi_bind((*ldap_handle), dn_path, GSSSASL_PRIVACY_PROTECTION);
762 if (rc == LDAP_SUCCESS)
766 if (!ad_server_connect(ServerList[i], ldap_domain))
768 ldap_unbind_s((*ldap_handle));
772 if (strlen(default_server) == 0)
773 strcpy(default_server, ServerList[i]);
774 strcpy(connected_server, ServerList[i]);
778 if ((i == 0) && ((*IgnoreServerListError) == 0))
780 (*IgnoreServerListError) = -1;
784 if (i >= MAX_SERVER_NAMES)
789 int ad_server_connect(char *connectedServer, char *domain)
797 unsigned short port = KDC_PORT;
801 memset(&ccache, 0, sizeof(ccache));
802 memset(&creds, 0, sizeof(creds));
803 memset(userrealm, '\0', sizeof(userrealm));
806 if (krb5_init_context(&context))
808 if (krb5_cc_default(context, &ccache))
811 for (i = 0; i < (int)strlen(domain); i++)
812 userrealm[i] = toupper(domain[i]);
813 sprintf(temp, "%s@%s", "kadmin/changepw", userrealm);
814 if (krb5_parse_name(context, temp, &creds.server))
816 if (krb5_cc_get_principal(context, ccache, &creds.client))
818 if (krb5_get_credentials(context, 0, ccache, &creds, &credsp))
821 rc = ad_kdc_connect(connectedServer);
827 krb5_cc_close(context, ccache);
828 krb5_free_context(context);
830 krb5_free_cred_contents(context, &creds);
832 krb5_free_creds(context, credsp);
837 int ad_kdc_connect(char *connectedServer)
843 hp = gethostbyname(connectedServer);
846 memset(&kdc_server, 0, sizeof(kdc_server));
847 memcpy(&(kdc_server.sin_addr),hp->h_addr_list[0],hp->h_length);
848 kdc_server.sin_family = hp->h_addrtype;
849 kdc_server.sin_port = htons(KDC_PORT);
851 if ((kdc_socket = socket(AF_INET, SOCK_DGRAM, 0)) == INVALID_SOCKET)
853 if (connect(kdc_socket, (struct sockaddr*)&kdc_server, sizeof(kdc_server)) == SOCKET_ERROR)
861 void ad_kdc_disconnect()
864 if (auth_context != NULL)
866 krb5_auth_con_free(context, auth_context);
867 if (ap_req.data != NULL)
869 krb5_free_cred_contents(context, &creds);
871 krb5_free_creds(context, credsp);
877 krb5_cc_close(context, ccache);
878 krb5_free_context(context);
880 closesocket(kdc_socket);
884 int convert_domain_to_dn(char *domain, char *dnp)
890 memset(dn, '\0', sizeof(dn));
893 for (fp = domain; *fp; fp++)
908 int compare_elements(const void *arg1, const void *arg2)
912 rc = strcmp((char*)arg1, (char*)arg2);