xref: /illumos-gate/usr/src/lib/krb5/kadm5/clnt/client_init.c (revision 55fea89d)

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */



/*
 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved
 */

/*
 * Copyright (C) 1998 by the FundsXpress, INC.
 *
 * All rights reserved.
 *
 * Export of this software from the United States of America may require
 * a specific license from the United States Government.  It is the
 * responsibility of any person or organization contemplating export to
 * obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of FundsXpress. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  FundsXpress makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

#include <stdio.h>
#include <netdb.h>
#include "autoconf.h"
#ifdef HAVE_MEMORY_H
#include <memory.h>
#endif
#include <string.h>
#include <com_err.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <k5-int.h> /* for KRB5_ADM_DEFAULT_PORT */
#include <krb5.h>
#ifdef __STDC__
#include <stdlib.h>
#endif
#include <libintl.h>

#include <kadm5/admin.h>
#include <kadm5/kadm_rpc.h>
#include "client_internal.h"

#include <syslog.h>
#include <gssapi/gssapi.h>
#include <gssapi_krb5.h>
#include <gssapiP_krb5.h>
#include <rpc/clnt.h>

#include <iprop_hdr.h>
#include "iprop.h"

#define	ADM_CCACHE  "/tmp/ovsec_adm.XXXXXX"

static int old_auth_gssapi = 0;
/* connection timeout to kadmind in seconds */
#define		KADMIND_CONNECT_TIMEOUT	25

int _kadm5_check_handle();

enum init_type { INIT_PASS, INIT_SKEY, INIT_CREDS };

static kadm5_ret_t _kadm5_init_any(char *client_name,
				   enum init_type init_type,
				   char *pass,
				   krb5_ccache ccache_in,
				   char *service_name,
				   kadm5_config_params *params,
				   krb5_ui_4 struct_version,
				   krb5_ui_4 api_version,
				   char **db_args,
				   void **server_handle);

kadm5_ret_t kadm5_init_with_creds(char *client_name,
				  krb5_ccache ccache,
				  char *service_name,
				  kadm5_config_params *params,
				  krb5_ui_4 struct_version,
				  krb5_ui_4 api_version,
				  char **db_args,
				  void **server_handle)
{
     return _kadm5_init_any(client_name, INIT_CREDS, NULL, ccache,
			    service_name, params,
			    struct_version, api_version, db_args,
			    server_handle);
}


kadm5_ret_t kadm5_init_with_password(char *client_name, char *pass,
				     char *service_name,
				     kadm5_config_params *params,
				     krb5_ui_4 struct_version,
				     krb5_ui_4 api_version,
				     char **db_args,
				     void **server_handle)
{
     return _kadm5_init_any(client_name, INIT_PASS, pass, NULL,
			    service_name, params, struct_version,
			    api_version, db_args, server_handle);
}

kadm5_ret_t kadm5_init(char *client_name, char *pass,
		       char *service_name,
		       kadm5_config_params *params,
		       krb5_ui_4 struct_version,
		       krb5_ui_4 api_version,
		       char **db_args,
		       void **server_handle)
{
     return _kadm5_init_any(client_name, INIT_PASS, pass, NULL,
			    service_name, params, struct_version,
			    api_version, db_args, server_handle);
}

kadm5_ret_t kadm5_init_with_skey(char *client_name, char *keytab,
				 char *service_name,
				 kadm5_config_params *params,
				 krb5_ui_4 struct_version,
				 krb5_ui_4 api_version,
				 char **db_args,
				 void **server_handle)
{
     return _kadm5_init_any(client_name, INIT_SKEY, keytab, NULL,
			    service_name, params, struct_version,
			    api_version, db_args, server_handle);
}

krb5_error_code  kadm5_free_config_params();

static void
display_status_1(m, code, type, mech)
char *m;
OM_uint32 code;
int type;
const gss_OID mech;
{
	OM_uint32 maj_stat, min_stat;
	gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
	OM_uint32 msg_ctx;

	msg_ctx = 0;
	ADMIN_LOG(LOG_ERR, "%s\n", m);
	/* LINTED */
	while (1) {
		maj_stat = gss_display_status(&min_stat, code,
					    type, mech,
					    &msg_ctx, &msg);
		if (maj_stat != GSS_S_COMPLETE) {
			syslog(LOG_ERR,
			    dgettext(TEXT_DOMAIN,
				    "error in gss_display_status"
				    " called from <%s>\n"), m);
			break;
		} else
			syslog(LOG_ERR, dgettext(TEXT_DOMAIN,
						"GSS-API error : %s\n"),
			    m);
		syslog(LOG_ERR, dgettext(TEXT_DOMAIN,
					"GSS-API error : %s\n"),
		    (char *)msg.value);
		if (msg.length != 0)
			(void) gss_release_buffer(&min_stat, &msg);

		if (!msg_ctx)
			break;
	}
}

/*
 * Function: display_status
 *
 * Purpose: displays GSS-API messages
 *
 * Arguments:
 *
 * 	msg		a string to be displayed with the message
 * 	maj_stat	the GSS-API major status code
 * 	min_stat	the GSS-API minor status code
 *	mech		kerberos mech
 * Effects:
 *
 * The GSS-API messages associated with maj_stat and min_stat are
 * displayed on stderr, each preceeded by "GSS-API error <msg>: " and
 * followed by a newline.
 */
void
display_status(msg, maj_stat, min_stat, mech)
char *msg;
OM_uint32 maj_stat;
OM_uint32 min_stat;
char *mech;
{
	gss_OID mech_oid;

	if (!rpc_gss_mech_to_oid(mech, (rpc_gss_OID *)&mech_oid)) {
		ADMIN_LOG(LOG_ERR,
			dgettext(TEXT_DOMAIN,
				"Invalid mechanism oid <%s>"), mech);
		return;
	}

	display_status_1(msg, maj_stat, GSS_C_GSS_CODE, mech_oid);
	display_status_1(msg, min_stat, GSS_C_MECH_CODE, mech_oid);
}

/*
 * Open an fd for the given address and connect asynchronously. Wait
 * KADMIND_CONNECT_TIMEOUT seconds or till it succeeds. If it succeeds
 * change fd to blocking and return it, else return -1.
 */
static int
get_connection(struct netconfig *nconf, struct netbuf netaddr)
{
	struct t_info tinfo;
	struct t_call sndcall;
	struct t_call *rcvcall = NULL;
	int connect_time;
	int flags;
	int fd;

	(void) memset(&tinfo, 0, sizeof (tinfo));

	/* we'l open with O_NONBLOCK and avoid an fcntl */
	fd = t_open(nconf->nc_device, O_RDWR | O_NONBLOCK, &tinfo);
	if (fd == -1) {
		return (-1);
	}

	if (t_bind(fd, (struct t_bind *)NULL, (struct t_bind *)NULL) == -1) {
		(void) close(fd);
		return (-1);
	}

	/* we can't connect unless fd is in IDLE state */
	if (t_getstate(fd) != T_IDLE) {
		(void) close(fd);
		return (-1);
	}

	/* setup connect parameters */
	netaddr.len = netaddr.maxlen = __rpc_get_a_size(tinfo.addr);
	sndcall.addr = netaddr;
	sndcall.opt.len = sndcall.udata.len = 0;

	/* we wait for KADMIND_CONNECT_TIMEOUT seconds from now */
	connect_time = time(NULL) + KADMIND_CONNECT_TIMEOUT;
	if (t_connect(fd, &sndcall, rcvcall) != 0) {
		if (t_errno != TNODATA) {
			(void) close(fd);
			return (-1);
		}
	}

	/* loop till success or timeout */
	for (;;) {
		if (t_rcvconnect(fd, rcvcall) == 0)
			break;

		if (t_errno != TNODATA || time(NULL) > connect_time) {
			/* we have either timed out or caught an error */
			(void) close(fd);
			if (rcvcall != NULL)
				t_free((char *)rcvcall, T_CALL);
			return (-1);
		}
		sleep(1);
	}

	/* make the fd blocking (synchronous) */
	flags = fcntl(fd, F_GETFL, 0);
	(void) fcntl(fd, F_SETFL, flags & ~O_NONBLOCK);
	if (rcvcall != NULL)
		t_free((char *)rcvcall, T_CALL);
	return (fd);
}

/*
 * Open an RPCSEC_GSS connection and
 * get a client handle to use for future RPCSEC calls.
 *
 * This function is only used when changing passwords and
 * the kpasswd_protocol is RPCSEC_GSS
 */
static int
_kadm5_initialize_rpcsec_gss_handle(kadm5_server_handle_t handle,
				    char *client_name,
				    char *service_name)
{
	struct netbuf netaddr;
	struct hostent *hp;
	int fd;
	struct sockaddr_in addr;
	struct sockaddr_in *sin;
	struct netconfig *nconf;
	int code = 0;
	generic_ret *r;
	char *ccname_orig;
	char *iprop_svc;
	boolean_t iprop_enable = B_FALSE;
	char mech[] = "kerberos_v5";
	gss_OID mech_oid;
	gss_OID_set_desc oid_set;
	gss_name_t gss_client;
	gss_buffer_desc input_name;
	gss_cred_id_t gss_client_creds = GSS_C_NO_CREDENTIAL;
	rpc_gss_options_req_t   options_req;
	rpc_gss_options_ret_t   options_ret;
	rpc_gss_service_t service = rpc_gss_svc_privacy;
	OM_uint32 gssstat, minor_stat;
	void *handlep;
	enum clnt_stat rpc_err_code;
	char *server = handle->params.admin_server;

	/*
	 * Try to find the kpasswd_server first if this is for the changepw
	 * service.  If defined then it should be resolvable else return error.
	 */
	if (strncmp(service_name, KADM5_CHANGEPW_HOST_SERVICE,
	    strlen(KADM5_CHANGEPW_HOST_SERVICE)) == 0) {
		if (handle->params.kpasswd_server != NULL)
			server = handle->params.kpasswd_server;
	}
	hp = gethostbyname(server);
	if (hp == (struct hostent *)NULL) {
		code = KADM5_BAD_SERVER_NAME;
		ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
					    "bad server name\n"));
		goto cleanup;
	}

	memset(&addr, 0, sizeof (addr));
	addr.sin_family = hp->h_addrtype;
	(void) memcpy((char *)&addr.sin_addr, (char *)hp->h_addr,
		    sizeof (addr.sin_addr));
	addr.sin_port = htons((ushort_t)handle->params.kadmind_port);
	sin = &addr;
#ifdef DEBUG
	printf("kadmin_port %d\n", handle->params.kadmind_port);
	printf("addr: sin_port: %d, sin_family: %d, sin_zero %s\n",
	    addr.sin_port, addr.sin_family, addr.sin_zero);
	printf("sin_addr %d:%d\n", addr.sin_addr.S_un.S_un_w.s_w1,
	    addr.sin_addr.S_un.S_un_w.s_w2);
#endif
	if ((handlep = setnetconfig()) == (void *) NULL) {
		(void) syslog(LOG_ERR,
			    dgettext(TEXT_DOMAIN,
				    "cannot get any transport information"));
		goto error;
	}

	while (nconf = getnetconfig(handlep)) {
		if ((nconf->nc_semantics == NC_TPI_COTS_ORD) &&
		    (strcmp(nconf->nc_protofmly, NC_INET) == 0) &&
		    (strcmp(nconf->nc_proto, NC_TCP) == 0))
			break;
	}

	if (nconf == (struct netconfig *)NULL)
		goto error;

	/* Transform addr to netbuf */
	(void) memset(&netaddr, 0, sizeof (netaddr));
	netaddr.buf = (char *)sin;

	/* get an fd connected to the given address */
	fd =  get_connection(nconf, netaddr);
	if (fd == -1) {
		syslog(LOG_ERR, dgettext(TEXT_DOMAIN,
			"unable to open connection to ADMIN server "
			"(t_error %i)"), t_errno);
		code = KADM5_RPC_ERROR;
		goto error;
	}

#ifdef DEBUG
	printf("fd: %d, KADM: %d, KADMVERS %d\n", fd, KADM, KADMVERS);
	printf("nconf: nc_netid: %s, nc_semantics: %d, nc_flag: %d, "
	    "nc_protofmly: %s\n",
	    nconf->nc_netid, nconf->nc_semantics, nconf->nc_flag,
	    nconf->nc_protofmly);
	printf("nc_proto: %s, nc_device: %s, nc_nlookups: %d, nc_used: %d\n",
	    nconf->nc_proto, nconf->nc_device, nconf->nc_nlookups,
	    nconf->nc_unused);
	printf("netaddr: maxlen %d, buf: %s, len: %d\n", netaddr.maxlen,
	    netaddr.buf, netaddr.len);
#endif
 	/*
	 * Tell clnt_tli_create that given fd is already connected
	 *
	 * If the service_name and client_name are iprop-centric,
	 * we need to clnt_tli_create to the appropriate RPC prog
	 */
	iprop_svc = strdup(KIPROP_SVC_NAME);
	if (iprop_svc == NULL)
		return (ENOMEM);

	if ((strstr(service_name, iprop_svc) != NULL) &&
	    (strstr(client_name, iprop_svc) != NULL)) {
		iprop_enable = B_TRUE;
		handle->clnt = clnt_tli_create(fd, nconf, NULL,
				    KRB5_IPROP_PROG, KRB5_IPROP_VERS, 0, 0);
	}
	else
		handle->clnt = clnt_tli_create(fd, nconf, NULL,
				    KADM, KADMVERS, 0, 0);

	if (iprop_svc)
		free(iprop_svc);

	if (handle->clnt == NULL) {
		syslog(LOG_ERR, dgettext(TEXT_DOMAIN,
					"clnt_tli_create failed\n"));
		code = KADM5_RPC_ERROR;
		(void) close(fd);
		goto error;
	}
	/*
	 * The rpc-handle was created on an fd opened and connected
	 * by us, so we have to explicitly tell rpc to close it.
	 */
	if (clnt_control(handle->clnt, CLSET_FD_CLOSE, NULL) != TRUE) {
		clnt_pcreateerror("ERROR:");
		syslog(LOG_ERR, dgettext(TEXT_DOMAIN,
			"clnt_control failed to set CLSET_FD_CLOSE"));
		code = KADM5_RPC_ERROR;
		(void) close(fd);
		goto error;
	}

	handle->lhandle->clnt = handle->clnt;

	/* now that handle->clnt is set, we can check the handle */
	if (code = _kadm5_check_handle((void *) handle))
		goto error;

	/*
	 * The RPC connection is open; establish the GSS-API
	 * authentication context.
	 */
	ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
				    "have an rpc connection open\n"));
	/* use the kadm5 cache */
	ccname_orig = getenv("KRB5CCNAME");
	if (ccname_orig)
		ccname_orig = strdup(ccname_orig);

	(void) krb5_setenv("KRB5CCNAME", handle->cache_name, 1);

	ADMIN_LOG(LOG_ERR,
		dgettext(TEXT_DOMAIN,
			"current credential cache: %s"), handle->cache_name);
	input_name.value = client_name;
	input_name.length = strlen((char *)input_name.value) + 1;
	gssstat = gss_import_name(&minor_stat, &input_name,
				(gss_OID)gss_nt_krb5_name, &gss_client);
	if (gssstat != GSS_S_COMPLETE) {
		code = KADM5_GSS_ERROR;
		ADMIN_LOGO(LOG_ERR,
			dgettext(TEXT_DOMAIN,
				"gss_import_name failed for client name\n"));
		goto error;
	}

	if (!rpc_gss_mech_to_oid(mech, (rpc_gss_OID *)&mech_oid)) {
		ADMIN_LOG(LOG_ERR,
			dgettext(TEXT_DOMAIN,
				"Invalid mechanism oid <%s>"), mech);
		goto error;
	}

	oid_set.count = 1;
	oid_set.elements = mech_oid;

	gssstat = gss_acquire_cred(&minor_stat, gss_client, 0,
				&oid_set, GSS_C_INITIATE,
				&gss_client_creds, NULL, NULL);
	(void) gss_release_name(&minor_stat, &gss_client);
	if (gssstat != GSS_S_COMPLETE) {
		code = KADM5_GSS_ERROR;
		ADMIN_LOG(LOG_ERR,
			dgettext(TEXT_DOMAIN,
				"could not acquire credentials, "
				"major error code: %d\n"), gssstat);
		goto error;
	}
	handle->my_cred = gss_client_creds;
	options_req.my_cred = gss_client_creds;
	options_req.req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG;
	options_req.time_req = 0;
	options_req.input_channel_bindings = NULL;
#ifndef INIT_TEST
	handle->clnt->cl_auth = rpc_gss_seccreate(handle->clnt,
						service_name,
						mech,
						service,
						NULL,
						&options_req,
						&options_ret);
#endif /* ! INIT_TEST */

	if (ccname_orig) {
		(void) krb5_setenv("KRB5CCNAME", ccname_orig, 1);
		free(ccname_orig);
	} else
		(void) krb5_unsetenv("KRB5CCNAME");

	if (handle->clnt->cl_auth == NULL) {
		code = KADM5_GSS_ERROR;
		display_status(dgettext(TEXT_DOMAIN,
					"rpc_gss_seccreate failed\n"),
			    options_ret.major_status,
			    options_ret.minor_status,
			    mech);
		goto error;
	}

	/*
	 * Bypass the remainder of the code and return straightaway
	 * if the gss service requested is kiprop
	 */
	if (iprop_enable == B_TRUE) {
		code = 0;
		goto cleanup;
	}

	r = init_2(&handle->api_version, handle->clnt);
	/* Solaris Kerberos: 163 resync */
	if (r == NULL) {
		ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
			"error during admin api initialization\n"));
		code = KADM5_RPC_ERROR;
		goto error;
	}

	if (r->code) {
		code = r->code;
		ADMIN_LOG(LOG_ERR,
			dgettext(TEXT_DOMAIN,
				"error during admin api initialization: %d\n"),
			r->code);
		goto error;
	}
error:
cleanup:

	if (handlep != (void *) NULL)
		(void) endnetconfig(handlep);
	/*
	 * gss_client_creds is freed only when there is an error condition,
	 * given that rpc_gss_seccreate() will assign the cred pointer to the
	 * my_cred member in the auth handle's private data structure.
	 */
	if (code && (gss_client_creds != GSS_C_NO_CREDENTIAL))
		(void) gss_release_cred(&minor_stat, &gss_client_creds);

	return (code);
}

static kadm5_ret_t _kadm5_init_any(char *client_name,
				   enum init_type init_type,
				   char *pass,
				   krb5_ccache ccache_in,
				   char *service_name,
				   kadm5_config_params *params_in,
				   krb5_ui_4 struct_version,
				   krb5_ui_4 api_version,
				   char **db_args,
				   void **server_handle)
{
     int i;
     krb5_creds	creds;
     krb5_ccache ccache = NULL;
     krb5_timestamp  now;
     OM_uint32 gssstat, minor_stat;
     kadm5_server_handle_t handle;
     kadm5_config_params params_local;
     int code = 0;
     krb5_get_init_creds_opt opt;
     gss_buffer_desc input_name;
     krb5_error_code kret;
     krb5_int32 starttime;
     char *server = NULL;
     krb5_principal serverp = NULL, clientp = NULL;
     krb5_principal saved_server = NULL;
     bool_t cpw = FALSE;

	ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
		"entering kadm5_init_any\n"));
     if (! server_handle) {
	 return EINVAL;
     }

     if (! (handle = malloc(sizeof(*handle)))) {
	  return ENOMEM;
     }
     if (! (handle->lhandle = malloc(sizeof(*handle)))) {
	  free(handle);
	  return ENOMEM;
     }

     handle->magic_number = KADM5_SERVER_HANDLE_MAGIC;
     handle->struct_version = struct_version;
     handle->api_version = api_version;
     handle->clnt = 0;
     handle->cache_name = 0;
     handle->destroy_cache = 0;
     *handle->lhandle = *handle;
     handle->lhandle->api_version = KADM5_API_VERSION_2;
     handle->lhandle->struct_version = KADM5_STRUCT_VERSION;
     handle->lhandle->lhandle = handle->lhandle;

    kret = krb5_init_context(&handle->context);
	if (kret) {
		free(handle->lhandle);
		free(handle);
		return (kret);
	}

     if(service_name == NULL || client_name == NULL) {
	krb5_free_context(handle->context);
	free(handle->lhandle);
	free(handle);
	return EINVAL;
     }
     memset((char *) &creds, 0, sizeof(creds));

     /*
      * Verify the version numbers before proceeding; we can't use
      * CHECK_HANDLE because not all fields are set yet.
      */
     GENERIC_CHECK_HANDLE(handle, KADM5_OLD_LIB_API_VERSION,
			  KADM5_NEW_LIB_API_VERSION);

     /*
      * Acquire relevant profile entries.  In version 2, merge values
      * in params_in with values from profile, based on
      * params_in->mask.
      *
      * In version 1, we've given a realm (which may be NULL) instead
      * of params_in.  So use that realm, make params_in contain an
      * empty mask, and behave like version 2.
      */
     memset((char *) &params_local, 0, sizeof(params_local));
     if (api_version == KADM5_API_VERSION_1) {
	  if (params_in)
	       params_local.mask = KADM5_CONFIG_REALM;
	  params_in = &params_local;
	}

#define ILLEGAL_PARAMS ( \
		KADM5_CONFIG_ACL_FILE	| KADM5_CONFIG_ADB_LOCKFILE | \
		KADM5_CONFIG_DBNAME	| KADM5_CONFIG_ADBNAME | \
		KADM5_CONFIG_DICT_FILE	| KADM5_CONFIG_ADMIN_KEYTAB | \
			KADM5_CONFIG_STASH_FILE | KADM5_CONFIG_MKEY_NAME | \
			KADM5_CONFIG_ENCTYPE	| KADM5_CONFIG_MAX_LIFE	| \
			KADM5_CONFIG_MAX_RLIFE	| KADM5_CONFIG_EXPIRATION | \
			KADM5_CONFIG_FLAGS	| KADM5_CONFIG_ENCTYPES	| \
			KADM5_CONFIG_MKEY_FROM_KBD)

     if (params_in && params_in->mask & ILLEGAL_PARAMS) {
		krb5_free_context(handle->context);
		free(handle->lhandle);
	  free(handle);
		ADMIN_LOG(LOG_ERR, dgettext(TEXT_DOMAIN,
			"bad client parameters, returning %d"),
			KADM5_BAD_CLIENT_PARAMS);
	  return KADM5_BAD_CLIENT_PARAMS;
     }

     if ((code = kadm5_get_config_params(handle->context, 0,
					 params_in, &handle->params))) {
	  krb5_free_context(handle->context);
	  free(handle->lhandle);
	  free(handle);
		ADMIN_LOG(LOG_ERR, dgettext(TEXT_DOMAIN,
			"failed to get config_params, return: %d\n"), code);
	  return(code);
     }

#define REQUIRED_PARAMS (KADM5_CONFIG_REALM | \
			 KADM5_CONFIG_ADMIN_SERVER | \
			 KADM5_CONFIG_KADMIND_PORT)
#define KPW_REQUIRED_PARAMS (KADM5_CONFIG_REALM | \
			 KADM5_CONFIG_KPASSWD_SERVER | \
			 KADM5_CONFIG_KPASSWD_PORT)

     if (((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) &&
	 ((handle->params.mask & KPW_REQUIRED_PARAMS) != KPW_REQUIRED_PARAMS)) {
		(void) kadm5_free_config_params(handle->context,
						&handle->params);
	  krb5_free_context(handle->context);
		free(handle->lhandle);
	  free(handle);
		ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
			"missing config parameters\n"));
	  return KADM5_MISSING_KRB5_CONF_PARAMS;
     }

	/*
	 * Acquire a service ticket for service_name@realm in the name of
	 * client_name, using password pass (which could be NULL), and
	 * create a ccache to store them in.  If INIT_CREDS, use the
	 * ccache we were provided instead.
	 */
	if ((code = krb5_parse_name(handle->context, client_name,
			    &creds.client))) {
		ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
			    "could not parse client name\n"));
		goto error;
	}
	clientp = creds.client;

	if (strncmp(service_name, KADM5_CHANGEPW_HOST_SERVICE,
	    strlen(KADM5_CHANGEPW_HOST_SERVICE)) == 0)
		cpw = TRUE;

	if (init_type == INIT_PASS &&
	    handle->params.kpasswd_protocol == KRB5_CHGPWD_CHANGEPW_V2 &&
	    cpw == TRUE) {
		/*
		 * The 'service_name' is constructed by the caller
		 * but its done before the parameter which determines
		 * the kpasswd_protocol is found.  The servers that
		 * support the SET/CHANGE password protocol expect
		 * a slightly different service principal than
		 * the normal SEAM kadmind so construct the correct
		 * name here and then forget it.
		 */
		char *newsvcname = NULL;
		newsvcname = malloc(strlen(KADM5_CHANGEPW_SERVICE) +
				    strlen(handle->params.realm) + 2);
		if (newsvcname == NULL) {
			ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
					    "could not malloc\n"));
			code = ENOMEM;
			goto error;
		}
		sprintf(newsvcname, "%s@%s", KADM5_CHANGEPW_SERVICE,
			handle->params.realm);

		if ((code = krb5_parse_name(handle->context, newsvcname,
					    &creds.server))) {
			ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
					    "could not parse server "
					    "name\n"));
			free(newsvcname);
			goto error;
		}
		free(newsvcname);
	} else {
		input_name.value = service_name;
		input_name.length = strlen((char *)input_name.value) + 1;
		gssstat = krb5_gss_import_name(&minor_stat,
				    &input_name,
				    (gss_OID)GSS_C_NT_HOSTBASED_SERVICE,
				    (gss_name_t *)&creds.server);

		if (gssstat != GSS_S_COMPLETE) {
			code = KADM5_GSS_ERROR;
			ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
				"gss_import_name failed for client name\n"));
			goto error;
		}
	}
	serverp = creds.server;

	/* XXX temporarily fix a bug in krb5_cc_get_type */
#undef krb5_cc_get_type
#define krb5_cc_get_type(context, cache) ((cache)->ops->prefix)


     if (init_type == INIT_CREDS) {
	  ccache = ccache_in;
	  handle->cache_name = (char *)
	       malloc(strlen(krb5_cc_get_type(handle->context, ccache)) +
		      strlen(krb5_cc_get_name(handle->context, ccache)) + 2);
	  if (handle->cache_name == NULL) {
	       code = ENOMEM;
	       goto error;
	  }
	  sprintf(handle->cache_name, "%s:%s",
		  krb5_cc_get_type(handle->context, ccache),
		  krb5_cc_get_name(handle->context, ccache));
     } else {
#if 0
	  handle->cache_name =
	       (char *) malloc(strlen(ADM_CCACHE)+strlen("FILE:")+1);
	  if (handle->cache_name == NULL) {
	       code = ENOMEM;
	       goto error;
	  }
	  sprintf(handle->cache_name, "FILE:%s", ADM_CCACHE);
	  mktemp(handle->cache_name + strlen("FILE:"));
#endif
	  {
	      static int counter = 0;
	      handle->cache_name = malloc(sizeof("MEMORY:kadm5_")
					  + 3*sizeof(counter));
	      sprintf(handle->cache_name, "MEMORY:kadm5_%u", counter++);
	  }

	  if ((code = krb5_cc_resolve(handle->context, handle->cache_name,
				      &ccache)))
	       goto error;

	  if ((code = krb5_cc_initialize (handle->context, ccache,
					  creds.client)))
	       goto error;

	  handle->destroy_cache = 1;
     }
     handle->lhandle->cache_name = handle->cache_name;
	ADMIN_LOG(LOG_ERR, dgettext(TEXT_DOMAIN,
		"cache created: %s\n"), handle->cache_name);

     if ((code = krb5_timeofday(handle->context, &now)))
	  goto error;

     /*
      * Get a ticket, use the method specified in init_type.
      */

     creds.times.starttime = 0; /* start timer at KDC */
     creds.times.endtime = 0; /* endtime will be limited by service */

	memset(&opt, 0, sizeof (opt));
	krb5_get_init_creds_opt_init(&opt);

	if (creds.times.endtime) {
		if (creds.times.starttime)
			starttime = creds.times.starttime;
		else
			starttime = now;

		krb5_get_init_creds_opt_set_tkt_life(&opt,
			creds.times.endtime - starttime);
	}
	code = krb5_unparse_name(handle->context, creds.server, &server);
	if (code)
		goto error;

	/*
	 * Solaris Kerberos:
	 * Save the original creds.server as krb5_get_init_creds*() always
	 * sets the realm of the server to the client realm.
	 */
	code = krb5_copy_principal(handle->context, creds.server, &saved_server);
	if (code)
		goto error;

	if (init_type == INIT_PASS) {
		code = krb5_get_init_creds_password(handle->context,
			&creds, creds.client, pass, NULL,
			NULL, creds.times.starttime,
			server, &opt);
	} else if (init_type == INIT_SKEY) {
		krb5_keytab kt = NULL;

		if (!(pass && (code = krb5_kt_resolve(handle->context,
					pass, &kt)))) {
			code = krb5_get_init_creds_keytab(
					handle->context,
					&creds, creds.client, kt,
					creds.times.starttime,
					server, &opt);

	       if (pass) krb5_kt_close(handle->context, kt);
	  }
     }

     /* Improved error messages */
     if (code == KRB5KRB_AP_ERR_BAD_INTEGRITY) code = KADM5_BAD_PASSWORD;
     if (code == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN)
	  code = KADM5_SECURE_PRINC_MISSING;

     if (code != 0) {
		ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN,
			"failed to obtain credentials cache\n"));
		krb5_free_principal(handle->context, saved_server);
		goto error;
	}

	/*
	 * Solaris Kerberos:
	 * If the server principal had an empty realm then store that in
	 * the cred cache and not the server realm as returned by
	 * krb5_get_init_creds_{keytab|password}(). This ensures that rpcsec_gss
	 * will find the credential in the cred cache even if a "fallback"
	 * method is being used to determine the realm.
	 */
	if (init_type != INIT_CREDS) {
		krb5_free_principal(handle->context, creds.server);
	}
	creds.server = saved_server;

	/*
	 * If we got this far, save the creds in the cache.
	 */
	if (ccache) {
		code = krb5_cc_store_cred(handle->context, ccache, &creds);
	}

	ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, "obtained credentials cache\n"));

#ifdef ZEROPASSWD
     if (pass != NULL)
	  memset(pass, 0, strlen(pass));
#endif

	if (init_type != INIT_PASS ||
	    handle->params.kpasswd_protocol == KRB5_CHGPWD_RPCSEC ||
	    cpw == FALSE) {
		code = _kadm5_initialize_rpcsec_gss_handle(handle,
					client_name, service_name);

		/*
		 * Solaris Kerberos:
		 * If _kadm5_initialize_rpcsec_gss_handle() fails it will have
		 * called krb5_gss_release_cred(). If the credential cache is a
		 * MEMORY cred cache krb5_gss_release_cred() destroys the
		 * cred cache data. Make sure that the cred-cache is closed
		 * to prevent a double free in the "error" code.
		 */
		if (code != 0) {
			if (init_type != INIT_CREDS) {
				krb5_cc_close(handle->context, ccache);
				ccache = NULL;
			}
			goto error;
		}
	}

	*server_handle = (void *) handle;

	if (init_type != INIT_CREDS)
		krb5_cc_close(handle->context, ccache);

	goto cleanup;

error:
     /*
      * Note that it is illegal for this code to execute if "handle"
      * has not been allocated and initialized.  I.e., don't use "goto
      * error" before the block of code at the top of the function
      * that allocates and initializes "handle".
      */
     if (handle->cache_name)
	 free(handle->cache_name);
     if (handle->destroy_cache && ccache)
	 krb5_cc_destroy(handle->context, ccache);
     if(handle->clnt && handle->clnt->cl_auth)
	  AUTH_DESTROY(handle->clnt->cl_auth);
     if(handle->clnt)
	  clnt_destroy(handle->clnt);
	(void) kadm5_free_config_params(handle->context, &handle->params);

cleanup:
	if (server)
		free(server);

	/*
	 * cred's server and client pointers could have been overwritten
	 * by the krb5_get_init_* functions.  If the addresses are different
	 * before and after the calls then we must free the memory that
	 * was allocated before the call.
	 */
	if (clientp && clientp != creds.client)
		krb5_free_principal(handle->context, clientp);

	if (serverp && serverp != creds.server)
		krb5_free_principal(handle->context, serverp);

     krb5_free_cred_contents(handle->context, &creds);

	/*
	 * Dont clean up the handle if the code is OK (code==0)
	 * because it is returned to the caller in the 'server_handle'
	 * ptr.
	 */
     if (code) {
		krb5_free_context(handle->context);
		free(handle->lhandle);
	  free(handle);
	}

     return code;
}

kadm5_ret_t
kadm5_destroy(void *server_handle)
{
     krb5_ccache	    ccache = NULL;
     int		    code = KADM5_OK;
     kadm5_server_handle_t	handle =
	  (kadm5_server_handle_t) server_handle;
	OM_uint32 min_stat;

     CHECK_HANDLE(server_handle);
/* SUNW14resync:
 * krb5_cc_resolve() will resolve a ccache with the same data that
 * handle->my_cred points to. If the ccache is a MEMORY ccache then
 * gss_release_cred() will free that data (it doesn't do this when ccache
 * is a FILE ccache).
 * if'ed out to avoid the double free.
 */
#if 0
     if (handle->destroy_cache && handle->cache_name) {
	 if ((code = krb5_cc_resolve(handle->context,
				     handle->cache_name, &ccache)) == 0)
	     code = krb5_cc_destroy (handle->context, ccache);
     }
#endif
     if (handle->cache_name)
	 free(handle->cache_name);
     if (handle->clnt && handle->clnt->cl_auth) {
		/*
		 * Since kadm5 doesn't use the default credentials we
		 * must clean this up manually.
		 */
		if (handle->my_cred != GSS_C_NO_CREDENTIAL)
			(void) gss_release_cred(&min_stat, &handle->my_cred);
	  AUTH_DESTROY(handle->clnt->cl_auth);
	}
     if (handle->clnt)
	  clnt_destroy(handle->clnt);
     if (handle->lhandle)
          free (handle->lhandle);

     kadm5_free_config_params(handle->context, &handle->params);
     krb5_free_context(handle->context);

     handle->magic_number = 0;
     free(handle);

     return code;
}
/* not supported on client */
kadm5_ret_t kadm5_lock(void *server_handle)
{
    return EINVAL;
}

/* not supported on client */
kadm5_ret_t kadm5_unlock(void *server_handle)
{
    return EINVAL;
}

kadm5_ret_t kadm5_flush(void *server_handle)
{
     return KADM5_OK;
}

int _kadm5_check_handle(void *handle)
{
     CHECK_HANDLE(handle);
     return 0;
}

krb5_error_code kadm5_init_krb5_context (krb5_context *ctx)
{
    return krb5_init_context(ctx);
}

/*
 * Stub function for kadmin.  It was created to eliminate the dependency on
 * libkdb's ulog functions.  The srv equivalent makes the actual calls.
 */
krb5_error_code
kadm5_init_iprop(void *handle)
{
	return (0);
}