/*
* @Description: get a kerberos5 ticket for the given service (get session key)
* @Param: time offset, time expire, and principal name
* @return: 0 if success, otherwise -1
* @refer: lib/krb5_wrap/krb5_samba.c
*/
int cli_krb5_get_ticket(){
/*step1: init encrypt type*/
/*step 2: Initializes the context structure and reads the configuration file /etc/krb5.conf.
*refer: source4/heimdal/lib/krb5/context.c*/
krb5_init_context();
/*step3: set time offset refer: source4/heimdal/lib/krb5/time.c*/
krb5_set_real_time();
/*step4: make TGS_REQ refer */
ads_krb5_mk_req();
/*step5: get session key from TGS_REP */
get_krb5_smb_session_key();
}
/*
get a kerberos5 ticket for the given service
*/
int cli_krb5_get_ticket(const char *principal, time_t time_offset,
DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
uint32 extra_ap_opts, const char *ccname,
time_t *tgs_expire)
{
krb5_error_code retval;
krb5_data packet;
krb5_context context = NULL;
krb5_ccache ccdef = NULL;
krb5_auth_context auth_context = NULL;
krb5_enctype enc_types[] = {
#ifdef ENCTYPE_ARCFOUR_HMAC
ENCTYPE_ARCFOUR_HMAC,
#endif
ENCTYPE_DES_CBC_MD5,
ENCTYPE_DES_CBC_CRC,
ENCTYPE_NULL};
initialize_krb5_error_table();
retval = krb5_init_context(&context);
if (retval) {
DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
error_message(retval)));
goto failed;
}
if (time_offset != 0) {
krb5_set_real_time(context, time(NULL) + time_offset, 0);
}
if ((retval = krb5_cc_resolve(context, ccname ?
ccname : krb5_cc_default_name(context), &ccdef))) {
DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
error_message(retval)));
goto failed;
}
if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
error_message(retval)));
goto failed;
}
if ((retval = ads_krb5_mk_req(context,
&auth_context,
AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
principal,
ccdef, &packet,
tgs_expire))) {
goto failed;
}
get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
*ticket = data_blob(packet.data, packet.length);
kerberos_free_data_contents(context, &packet);
failed:
if ( context ) {
if (ccdef)
krb5_cc_close(context, ccdef);
if (auth_context)
krb5_auth_con_free(context, auth_context);
krb5_free_context(context);
}
return retval;
}
