17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * kdc/policy.c
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * Copyright 1990 by the Massachusetts Institute of Technology.
57c478bd9Sstevel@tonic-gate *
67c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may
77c478bd9Sstevel@tonic-gate * require a specific license from the United States Government.
87c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
97c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting.
10*2a8bcb4eSToomas Soome *
117c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
127c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
137c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
147c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
157c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
167c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
177c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
187c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
197c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a
207c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
217c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
227c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
237c478bd9Sstevel@tonic-gate * or implied warranty.
24*2a8bcb4eSToomas Soome *
257c478bd9Sstevel@tonic-gate *
267c478bd9Sstevel@tonic-gate * Policy decision routines for KDC.
277c478bd9Sstevel@tonic-gate */
287c478bd9Sstevel@tonic-gate
297c478bd9Sstevel@tonic-gate #include "k5-int.h"
307c478bd9Sstevel@tonic-gate #include "kdc_util.h"
317c478bd9Sstevel@tonic-gate
327c478bd9Sstevel@tonic-gate int
against_local_policy_as(register krb5_kdc_req * request,krb5_db_entry client,krb5_db_entry server,krb5_timestamp kdc_time,const char ** status)3356a424ccSmp against_local_policy_as(register krb5_kdc_req *request, krb5_db_entry client,
3456a424ccSmp krb5_db_entry server, krb5_timestamp kdc_time,
3556a424ccSmp const char **status)
367c478bd9Sstevel@tonic-gate {
377c478bd9Sstevel@tonic-gate #if 0
387c478bd9Sstevel@tonic-gate /* An AS request must include the addresses field */
397c478bd9Sstevel@tonic-gate if (request->addresses == 0) {
407c478bd9Sstevel@tonic-gate *status = "NO ADDRESS";
417c478bd9Sstevel@tonic-gate return KRB5KDC_ERR_POLICY;
427c478bd9Sstevel@tonic-gate }
437c478bd9Sstevel@tonic-gate #endif
44*2a8bcb4eSToomas Soome
457c478bd9Sstevel@tonic-gate return 0; /* not against policy */
467c478bd9Sstevel@tonic-gate }
477c478bd9Sstevel@tonic-gate
487c478bd9Sstevel@tonic-gate /*
497c478bd9Sstevel@tonic-gate * This is where local policy restrictions for the TGS should placed.
507c478bd9Sstevel@tonic-gate */
517c478bd9Sstevel@tonic-gate krb5_error_code
against_local_policy_tgs(register krb5_kdc_req * request,krb5_db_entry server,krb5_ticket * ticket,const char ** status)5256a424ccSmp against_local_policy_tgs(register krb5_kdc_req *request, krb5_db_entry server,
5356a424ccSmp krb5_ticket *ticket, const char **status)
547c478bd9Sstevel@tonic-gate {
557c478bd9Sstevel@tonic-gate #if 0
567c478bd9Sstevel@tonic-gate /*
577c478bd9Sstevel@tonic-gate * For example, if your site wants to disallow ticket forwarding,
587c478bd9Sstevel@tonic-gate * you might do something like this:
597c478bd9Sstevel@tonic-gate */
60*2a8bcb4eSToomas Soome
617c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_FORWARDED)) {
627c478bd9Sstevel@tonic-gate *status = "FORWARD POLICY";
637c478bd9Sstevel@tonic-gate return KRB5KDC_ERR_POLICY;
647c478bd9Sstevel@tonic-gate }
657c478bd9Sstevel@tonic-gate #endif
66*2a8bcb4eSToomas Soome
677c478bd9Sstevel@tonic-gate return 0; /* not against policy */
687c478bd9Sstevel@tonic-gate }
697c478bd9Sstevel@tonic-gate
707c478bd9Sstevel@tonic-gate
717c478bd9Sstevel@tonic-gate
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate
747c478bd9Sstevel@tonic-gate
757c478bd9Sstevel@tonic-gate
76