Remove the domain parameter from queuing

We keep it in the file format, but just hard-code it to "ad" for
right now, since we don't support any other domains at the moment.

diff --git a/plugin/api.c b/plugin/api.c
index 21aca945394718845c607c77a48c748427a0adb0..a2c5c7f892dfb5c40d3db9bf1de65a4a83d6a861 100644 (file)
--- a/plugin/api.c
+++ b/plugin/api.c
@@ -239,8 +239,7 @@ sync_chpass(kadm5_hook_modinfo *config, krb5_context ctx,
     }
     if (!allowed)
         return 0;
-    code = sync_queue_conflict(config, ctx, principal, "ad", "enable",
-                               &conflict);
+    code = sync_queue_conflict(config, ctx, principal, "enable", &conflict);
     if (code != 0) {
         message = krb5_get_error_message(ctx, code);
         syslog(LOG_WARNING, "krb5-sync: cannot check for queue conflicts: %s",
@@ -263,8 +262,7 @@ sync_chpass(kadm5_hook_modinfo *config, krb5_context ctx,
     return 0;
 
 queue:
-    return sync_queue_write(config, ctx, principal, "ad", "password",
-                            password);
+    return sync_queue_write(config, ctx, principal, "password", password);
 }
 
 
@@ -302,8 +300,7 @@ sync_status(kadm5_hook_modinfo *config, krb5_context ctx,
     }
     if (!allowed)
         return 0;
-    code = sync_queue_conflict(config, ctx, principal, "ad", "enable",
-                               &conflict);
+    code = sync_queue_conflict(config, ctx, principal, "enable", &conflict);
     if (code != 0) {
         message = krb5_get_error_message(ctx, code);
         syslog(LOG_WARNING, "krb5-sync: cannot check for queue conflicts: %s",
@@ -321,6 +318,6 @@ sync_status(kadm5_hook_modinfo *config, krb5_context ctx,
     return 0;
 
 queue:
-    return sync_queue_write(config, ctx, principal, "ad",
+    return sync_queue_write(config, ctx, principal,
                             enabled ? "enable" : "disable", NULL);
 }

diff --git a/plugin/internal.h b/plugin/internal.h
index 8f7b9934a9cd37bdb179284b071a2effb69a0576..ce94a1ec96ae099e3793b0211d1dad123bc2b2e0 100644 (file)
--- a/plugin/internal.h
+++ b/plugin/internal.h
@@ -83,13 +83,13 @@ krb5_error_code sync_instance_exists(krb5_context, krb5_principal,
 
 /* Returns true if there is a queue conflict for this operation. */
 krb5_error_code sync_queue_conflict(kadm5_hook_modinfo *, krb5_context,
-                                    krb5_principal, const char *domain,
-                                    const char *operation, bool *conflict);
+                                    krb5_principal, const char *operation,
+                                    bool *conflict);
 
 /* Writes an operation to the queue. */
 krb5_error_code sync_queue_write(kadm5_hook_modinfo *, krb5_context,
-                                 krb5_principal, const char *domain,
-                                 const char *operation, const char *password);
+                                 krb5_principal, const char *operation,
+                                 const char *password);
 
 /*
  * Obtain configuration settings from krb5.conf.  These are wrappers around

diff --git a/plugin/queue.c b/plugin/queue.c
index 48f33521b3e0f7d18dba97dddd77999ec55e94e8..2adecf5231758f5be692c135e7bb396ea92f4e6d 100644 (file)
--- a/plugin/queue.c
+++ b/plugin/queue.c
@@ -97,12 +97,12 @@ unlock_queue(int fd)
 
 
 /*
- * Given a Kerberos principal, a context, a domain, and an operation, generate
- * the prefix for queue files as a newly allocated string.  Returns a Kerberos
+ * Given a Kerberos principal, a context, and an operation, generate the
+ * prefix for queue files as a newly allocated string.  Returns a Kerberos
  * status code.
  */
 static krb5_error_code
-queue_prefix(krb5_context ctx, krb5_principal principal, const char *domain,
+queue_prefix(krb5_context ctx, krb5_principal principal,
              const char *operation, char **prefix)
 {
     char *user = NULL;
@@ -113,6 +113,11 @@ queue_prefix(krb5_context ctx, krb5_principal principal, const char *domain,
     /* Enable and disable should go into the same queue. */
     if (strcmp(operation, "disable") == 0)
         operation = "enable";
+
+    /*
+     * The first part of the queue file is the principal with the realm
+     * stripped and any slashes converted to periods.
+     */
     code = krb5_unparse_name(ctx, principal, &user);
     if (code != 0)
         return code;
@@ -121,7 +126,13 @@ queue_prefix(krb5_context ctx, krb5_principal principal, const char *domain,
         *p = '\0';
     while ((p = strchr(user, '/')) != NULL)
         *p = '.';
-    if (asprintf(prefix, "%s-%s-%s-", user, domain, operation) < 0) {
+
+    /*
+     * Add to that the domain and operation.  The domain is currently always
+     * forced to ad (afs used to be possible, but that support was dropped),
+     * but retained for possible future use.
+     */
+    if (asprintf(prefix, "%s-ad-%s-", user, operation) < 0) {
         oerrno = errno;
         krb5_free_unparsed_name(ctx, user);
         errno = oerrno;
@@ -161,15 +172,15 @@ queue_timestamp(krb5_context ctx, char **timestamp)
 
 
 /*
- * Given a Kerberos context, a principal (assumed to have no instance), a
- * domain (currently always "ad"), and an operation, check whether there are
- * any existing queued actions for that combination, storing the result in the
- * final boolean variable.  Returns a Kerberos status code.
+ * Given a Kerberos context, a principal (assumed to have no instance), and an
+ * operation, check whether there are any existing queued actions for that
+ * combination, storing the result in the final boolean variable.  Returns a
+ * Kerberos status code.
  */
 krb5_error_code
 sync_queue_conflict(kadm5_hook_modinfo *config, krb5_context ctx,
-                    krb5_principal principal, const char *domain,
-                    const char *operation, bool *conflict)
+                    krb5_principal principal, const char *operation,
+                    bool *conflict)
 {
     int lock = -1;
     char *prefix = NULL;
@@ -178,10 +189,11 @@ sync_queue_conflict(kadm5_hook_modinfo *config, krb5_context ctx,
     krb5_error_code code;
 
     if (config->queue_dir == NULL)
-        return -1;
-    code = queue_prefix(ctx, principal, domain, operation, &prefix);
+        return sync_error_config(ctx, "configuration setting queue_dir"
+                                 " missing");
+    code = queue_prefix(ctx, principal, operation, &prefix);
     if (code != 0)
-        goto fail;
+        return code;
     code = lock_queue(config, ctx, &lock);
     if (code != 0)
         goto fail;
@@ -214,13 +226,13 @@ fail:
 
 /*
  * Queue an action.  Takes the plugin configuration, the Kerberos context, the
- * principal, the domain, the operation, and a password (which may be NULL for
- * enable and disable).  Returns a Kerberos error code.
+ * principal, the operation, and a password (which may be NULL for enable and
+ * disable).  Returns a Kerberos error code.
  */
 krb5_error_code
 sync_queue_write(kadm5_hook_modinfo *config, krb5_context ctx,
-                 krb5_principal principal, const char *domain,
-                 const char *operation, const char *password)
+                 krb5_principal principal, const char *operation,
+                 const char *password)
 {
     char *prefix = NULL, *timestamp = NULL, *path = NULL, *user = NULL;
     char *p;
@@ -231,7 +243,7 @@ sync_queue_write(kadm5_hook_modinfo *config, krb5_context ctx,
     if (config->queue_dir == NULL)
         return sync_error_config(ctx, "configuration setting queue_dir"
                                  " missing");
-    code = queue_prefix(ctx, principal, domain, operation, &prefix);
+    code = queue_prefix(ctx, principal, operation, &prefix);
     if (code != 0)
         return code;
 
@@ -277,11 +289,9 @@ sync_queue_write(kadm5_hook_modinfo *config, krb5_context ctx,
         }
     }
 
-    /* Write out the queue data. */
+    /* Write out the queue data (with hard-coded "ad" domain). */
     WRITE_CHECK(fd, user);
-    WRITE_CHECK(fd, "\n");
-    WRITE_CHECK(fd, domain);
-    WRITE_CHECK(fd, "\n");
+    WRITE_CHECK(fd, "\nad\n");
     WRITE_CHECK(fd, operation);
     WRITE_CHECK(fd, "\n");
     if (password != NULL) {