17c478bdstevel@tonic-gate/*
27c478bdstevel@tonic-gate * kdc/policy.c
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * Copyright 1990 by the Massachusetts Institute of Technology.
57c478bdstevel@tonic-gate *
67c478bdstevel@tonic-gate * Export of this software from the United States of America may
77c478bdstevel@tonic-gate *   require a specific license from the United States Government.
87c478bdstevel@tonic-gate *   It is the responsibility of any person or organization contemplating
97c478bdstevel@tonic-gate *   export to obtain such a license before exporting.
107c478bdstevel@tonic-gate *
117c478bdstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
127c478bdstevel@tonic-gate * distribute this software and its documentation for any purpose and
137c478bdstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
147c478bdstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
157c478bdstevel@tonic-gate * this permission notice appear in supporting documentation, and that
167c478bdstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
177c478bdstevel@tonic-gate * to distribution of the software without specific, written prior
187c478bdstevel@tonic-gate * permission.  Furthermore if you modify this software you must label
197c478bdstevel@tonic-gate * your software as modified software and not distribute it in such a
207c478bdstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
217c478bdstevel@tonic-gate * M.I.T. makes no representations about the suitability of
227c478bdstevel@tonic-gate * this software for any purpose.  It is provided "as is" without express
237c478bdstevel@tonic-gate * or implied warranty.
247c478bdstevel@tonic-gate *
257c478bdstevel@tonic-gate *
267c478bdstevel@tonic-gate * Policy decision routines for KDC.
277c478bdstevel@tonic-gate */
287c478bdstevel@tonic-gate
297c478bdstevel@tonic-gate#pragma ident	"%Z%%M%	%I%	%E% SMI"
307c478bdstevel@tonic-gate
317c478bdstevel@tonic-gate
327c478bdstevel@tonic-gate#include "k5-int.h"
337c478bdstevel@tonic-gate#include "kdc_util.h"
347c478bdstevel@tonic-gate
357c478bdstevel@tonic-gateint
3656a424cmpagainst_local_policy_as(register krb5_kdc_req *request, krb5_db_entry client,
3756a424cmp			krb5_db_entry server, krb5_timestamp kdc_time,
3856a424cmp			const char **status)
397c478bdstevel@tonic-gate{
407c478bdstevel@tonic-gate#if 0
417c478bdstevel@tonic-gate     /* An AS request must include the addresses field */
427c478bdstevel@tonic-gate    if (request->addresses == 0) {
437c478bdstevel@tonic-gate	*status = "NO ADDRESS";
447c478bdstevel@tonic-gate	return KRB5KDC_ERR_POLICY;
457c478bdstevel@tonic-gate    }
467c478bdstevel@tonic-gate#endif
477c478bdstevel@tonic-gate
487c478bdstevel@tonic-gate    return 0;			/* not against policy */
497c478bdstevel@tonic-gate}
507c478bdstevel@tonic-gate
517c478bdstevel@tonic-gate/*
527c478bdstevel@tonic-gate * This is where local policy restrictions for the TGS should placed.
537c478bdstevel@tonic-gate */
547c478bdstevel@tonic-gatekrb5_error_code
5556a424cmpagainst_local_policy_tgs(register krb5_kdc_req *request, krb5_db_entry server,
5656a424cmp			 krb5_ticket *ticket, const char **status)
577c478bdstevel@tonic-gate{
587c478bdstevel@tonic-gate#if 0
597c478bdstevel@tonic-gate    /*
607c478bdstevel@tonic-gate     * For example, if your site wants to disallow ticket forwarding,
617c478bdstevel@tonic-gate     * you might do something like this:
627c478bdstevel@tonic-gate     */
637c478bdstevel@tonic-gate
647c478bdstevel@tonic-gate    if (isflagset(request->kdc_options, KDC_OPT_FORWARDED)) {
657c478bdstevel@tonic-gate	*status = "FORWARD POLICY";
667c478bdstevel@tonic-gate	return KRB5KDC_ERR_POLICY;
677c478bdstevel@tonic-gate    }
687c478bdstevel@tonic-gate#endif
697c478bdstevel@tonic-gate
707c478bdstevel@tonic-gate    return 0;				/* not against policy */
717c478bdstevel@tonic-gate}
727c478bdstevel@tonic-gate
737c478bdstevel@tonic-gate
747c478bdstevel@tonic-gate
757c478bdstevel@tonic-gate
767c478bdstevel@tonic-gate
777c478bdstevel@tonic-gate
787c478bdstevel@tonic-gate
79