Add entry modification and setting password expiration

The optional parameter can be used to set the password expriation
in the entry, and there is a new modify() method that will write
back all modified entries in the principal entry.

diff --git a/lib/Authen/Kerberos/Kadmin.pm b/lib/Authen/Kerberos/Kadmin.pm
index 71a41016608650dc75d727c1d579da8b7241cba8..29d463ee7a72822a173a46c989b6d206261f8773 100644 (file)
--- a/lib/Authen/Kerberos/Kadmin.pm
+++ b/lib/Authen/Kerberos/Kadmin.pm
@@ -181,6 +181,13 @@ on any password quality check failure.
 Retrieve the Kerberos database entry for the given principal.  The result
 will be an Authen::Kerberos::Kadmin::Entry object.
 
+=item modify(ENTRY)
+
+Given an Authen::Kerberos::Kadmin::Entry object, write any changes in that
+object back to the Kerberos KDC database.  Only those fields that have
+been modified via the Authen::Kerberos::Kadmin::Entry object methods will
+be written back, and all modified fields will be written.
+
 =back
 
 =head1 AUTHOR

diff --git a/lib/Authen/Kerberos/Kadmin.xs b/lib/Authen/Kerberos/Kadmin.xs
index 499e667c90849a85ac2d3fcfe4e02eff552db015..f172b6b70769f7fc834c6fba14d32d52c71def94 100644 (file)
--- a/lib/Authen/Kerberos/Kadmin.xs
+++ b/lib/Authen/Kerberos/Kadmin.xs
@@ -61,7 +61,7 @@ typedef struct {
  * principal, and the mask, which stores which parameters we modified.
  */
 typedef struct {
-    void *handle;
+    SV *handle;
     SV *ctx;
     uint32_t mask;
     kadm5_principal_ent_t ent;
@@ -270,7 +270,7 @@ get(self, principal)
     code = kadm5_get_principal(self->handle, princ, ent, mask);
     krb5_free_principal(ctx, princ);
     if (code != 0)
-        krb5_croak(ctx, code, "kadm5_get_principal", TRUE);
+        krb5_croak(ctx, code, "kadm5_get_principal", FALSE);
 
     /* Build our internal representation. */
     entry = calloc(1, sizeof(*entry));
@@ -287,6 +287,26 @@ get(self, principal)
     RETVAL
 
 
+void
+modify(self, entry)
+    Authen::Kerberos::Kadmin self
+    Authen::Kerberos::Kadmin::Entry entry
+  PREINIT:
+    void *handle;
+    krb5_context ctx;
+    krb5_error_code code;
+  CODE:
+{
+    CROAK_NULL_SELF(self, "Authen::Kerberos::Kadmin", "modify");
+    CROAK_NULL(entry, "Authen::Kerberos::Kadmin::Entry",
+               "Authen::Kerberos::Kadmin::modify");
+    ctx = krb5_context_from_sv(self->ctx, "Authen::Kerberos::Kadmin");
+    code = kadm5_modify_principal(self->handle, entry->ent, entry->mask);
+    if (code != 0)
+        krb5_croak(ctx, code, "kadm5_modify_principal", FALSE);
+    XSRETURN_YES;
+}
+
 
 MODULE = Authen::Kerberos::Kadmin    PACKAGE = Authen::Kerberos::Kadmin::Entry
 
@@ -321,12 +341,17 @@ last_password_change(self)
 
 
 krb5_timestamp
-password_expiration(self)
+password_expiration(self, expiration = 0)
     Authen::Kerberos::Kadmin::Entry self
+    krb5_timestamp expiration
   CODE:
 {
     CROAK_NULL_SELF(self, "Authen::Kerberos::Kadmin::Entry",
                     "password_expiration");
+    if (items > 1) {
+        self->ent->pw_expiration = expiration;
+        self->mask |= KADM5_PW_EXPIRATION;
+    }
     RETVAL = self->ent->pw_expiration;
 }
   OUTPUT:

diff --git a/lib/Authen/Kerberos/Kadmin/Entry.pm b/lib/Authen/Kerberos/Kadmin/Entry.pm
index faac2d9b08335f5053449997df39bb1d95413ee8..107809d41e1526e0f908172011a434a49fbc732c 100644 (file)
--- a/lib/Authen/Kerberos/Kadmin/Entry.pm
+++ b/lib/Authen/Kerberos/Kadmin/Entry.pm
@@ -83,22 +83,33 @@ database.
 
 =head1 INSTANCE METHODS
 
+Many of these methods either return information from the Kerberos KDC
+database (KDB) entry or set data if an argument to the method was given.
+Any changes made this way only appear in the local object, not in the
+actual KDC database, until this object is stored back in the database using
+the modify() method of the Authen::Kerberos::Kadmin object.  That's also
+when most errors will be reported.  When this object is passed to
+modify(), everything that was updated in the object will be written to the
+KDC database at the same time.
+
 As with all Authen::Kerberos methods, an Authen::Kerberos::Exception
 object will be thrown on any Kerberos error.
 
 =over 4
 
-=item last_password_change
+=item last_password_change()
 
 Returns the last password change time for this database entry in seconds
 since UNIX epoch, or C<0> if there is no password change information
 available.
 
-=item password_expiration
+=item password_expiration([TIME])
 
 Returns the password expiration time for this database entry in seconds
 since UNIX epoch, or C<0> if this principal does not have a password
-expiration set.
+expiration set.  If the TIME argument is given, sets the password
+expiration time to TIME, which is in the same format, and returns the
+value that was set.
 
 =back
 

diff --git a/t/kadmin/heimdal.t b/t/kadmin/heimdal.t
index a1ffc0938a995f462468dd031ae74a327e0604f5..c3854de57892c1c17e87c5d6a4a580bb9580481f 100755 (executable)
--- a/t/kadmin/heimdal.t
+++ b/t/kadmin/heimdal.t
@@ -31,7 +31,7 @@ use warnings;
 
 use File::Copy qw(copy);
 
-use Test::More tests => 14;
+use Test::More tests => 18;
 
 BEGIN {
     use_ok('Authen::Kerberos::Kadmin');
@@ -78,6 +78,15 @@ is($@, q{}, '...with no exception');
 $entry = $kadmin->get('test@TEST.EXAMPLE.COM');
 ok(time - $entry->last_password_change < 10, 'Last password change updated');
 
+# Set the password expiration for this entry and confirm that it changed.
+my $expires = time + 10;
+is($entry->password_expiration($expires),
+    $expires, 'Setting password expiration returns the correct value');
+ok(eval { $kadmin->modify($entry) }, 'Modify password expiration');
+is($@, q{}, '...with no exception');
+$entry = $kadmin->get('test@TEST.EXAMPLE.COM');
+is($entry->password_expiration, $expires, '...and expiration changed');
+
 # Test password change to something that should be rejected by the password
 # quality check.
 ok(