/*

 * krbauth.c: Check a username/password pair against krb5 by temporarily

 *            obtaining a short-lived ticket for the corresponding

 *            principal. Returns 1 in case of successful verification,

 *            0 otherwise.

 *

 * Nickolai Zeldovich <kolya@MIT.EDU>

 *

 */

#include <stddef.h>

#include <krb5.h>

#include <com_err.h>

#include <string.h>

#define KRB5_LIFETIME 5

int krbauth(char *user, char *pass) {

 krb5_data tgtname = { 0, KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME };

 krb5_context kcontext;

 krb5_error_code code;

 krb5_principal me;

 krb5_principal server;

 krb5_creds my_creds;

 krb5_timestamp now;

 char *client_name;

 if((code=krb5_init_context (&kcontext))) {

#ifdef DEBUG

  com_err("krbauth", code, "while initializing krb5");

#endif

  return 0; }

 if((code=krb5_timeofday(kcontext,&now))) {

#ifdef DEBUG

  com_err("krbauth", code, "while getting time of day");

#endif

  return 0; }

 if((code=krb5_parse_name(kcontext, user, &me))) {

#ifdef DEBUG

  com_err("krbauth", code, "while parsing name %s", user);

#endif

  return 0; }

 if((code=krb5_unparse_name(kcontext, me, &client_name))) {

#ifdef DEBUG

  com_err("krbauth", code, "when unparsing name");

#endif

  return 0; }

 memset((char *)&my_creds, 0, sizeof(my_creds));

 my_creds.client = me;

 if((code=krb5_build_principal_ext(kcontext, &server,

	krb5_princ_realm(kcontext, me)->length,

	krb5_princ_realm(kcontext, me)->data,

	tgtname.length, tgtname.data,

	krb5_princ_realm(kcontext, me)->length,

	krb5_princ_realm(kcontext, me)->data,

	0))) {

#ifdef DEBUG

  com_err("krbauth", code, "while building server name");

#endif

  return 0; }

 my_creds.server = server;

 my_creds.times.starttime = 0;

 my_creds.times.endtime = now + KRB5_LIFETIME;

 if((code=krb5_get_in_tkt_with_password(kcontext, 0, 0,

	NULL, NULL, pass, 0, &my_creds, 0))) {

#ifdef DEBUG

  if(code==KRB5KRB_AP_ERR_BAD_INTEGRITY)

   com_err("krbauth", code, "incorrect password");

  else

   com_err("krbauth", code, "while getting initial credentials");

#endif

  return 0;

 }

 return 1;

}