responder/kcm/kcmsrv_ccache_json.c

cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/*
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   SSSD
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   KCM Server - ccache JSON (un)marshalling for storing ccaches in
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                sssd-secrets
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   Copyright (C) Red Hat, 2017
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   This program is free software; you can redistribute it and/or modify
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   it under the terms of the GNU General Public License as published by
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   the Free Software Foundation; either version 3 of the License, or
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   (at your option) any later version.
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   This program is distributed in the hope that it will be useful,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   but WITHOUT ANY WARRANTY; without even the implied warranty of
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   GNU General Public License for more details.
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   You should have received a copy of the GNU General Public License
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek   along with this program.  If not, see <http://www.gnu.org/licenses/>.
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek*/
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#include "config.h"
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#include <stdio.h>
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#include <talloc.h>
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#include <jansson.h>
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#include "util/util.h"
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#include "util/util_creds.h"
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#include "util/crypto/sss_crypto.h"
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#include "responder/kcm/kcmsrv_ccache_pvt.h"
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/* The base for storing secrets is:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *  http://localhost/kcm/persistent/$uid
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * Under $base, there are two containers:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *  /ccache     - stores the ccaches
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *  /ntlm       - stores NTLM creds [Not implement yet]
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * There is also a special entry that contains the UUID of the default
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * cache for this UID:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *  /default    - stores the UUID of the default ccache for this UID
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * Each ccache has a name and an UUID. On the secrets level, the 'secret'
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * is a concatenation of the stringified UUID and the name separated
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * by a plus-sign.
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#define KCM_SEC_URL        "http://localhost/kcm/persistent"
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#define KCM_SEC_BASE_FMT    KCM_SEC_URL"/%"SPRIuid"/"
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#define KCM_SEC_CCACHE_FMT  KCM_SEC_BASE_FMT"ccache/"
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#define KCM_SEC_DFL_FMT     KCM_SEC_BASE_FMT"default"
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/*
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * We keep the JSON representation of the ccache versioned to allow
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * us to modify the format in a future version
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#define KS_JSON_VERSION     1
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/*
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * The secrets store is a key-value store at heart. We store the UUID
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * and the name in the key to allow easy lookups be either key
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#define SEC_KEY_SEPARATOR   '-'
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/* Compat definition of json_array_foreach for older systems */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#ifndef json_array_foreach
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#define json_array_foreach(array, idx, value) \
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    for(idx = 0; \
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            idx < json_array_size(array) && (value = json_array_get(array, idx)); \
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            idx++)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek#endif
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekconst char *sec_container_url_create(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                     struct cli_creds *client)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return talloc_asprintf(mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                           KCM_SEC_CCACHE_FMT,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                           cli_creds_get_uid(client));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekconst char *sec_cc_url_create(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                              struct cli_creds *client,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                              const char *sec_key)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return talloc_asprintf(mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                           KCM_SEC_CCACHE_FMT"%s",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                           cli_creds_get_uid(client),
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                           sec_key);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekconst char *sec_dfl_url_create(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                               struct cli_creds *client)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return talloc_asprintf(mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                           KCM_SEC_DFL_FMT,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                           cli_creds_get_uid(client));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic const char *sec_key_create(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                  const char *name,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                  uuid_t uuid)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char uuid_str[UUID_STR_SIZE];
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uuid_unparse(uuid, uuid_str);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return talloc_asprintf(mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                           "%s%c%s", uuid_str, SEC_KEY_SEPARATOR, name);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozekstatic bool sec_key_valid(const char *sec_key)
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek{
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    if (sec_key == NULL) {
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek        return false;
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    }
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    if (strlen(sec_key) < UUID_STR_SIZE + 1) {
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek        /* One char for separator (at UUID_STR_SIZE, because strlen doesn't
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek         * include the '\0', but UUID_STR_SIZE does) and at least one for
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek         * the name */
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, "Key %s is too short\n", sec_key);
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek        return false;
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    }
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    if (sec_key[UUID_STR_SIZE - 1] != SEC_KEY_SEPARATOR) {
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, "Key doesn't contain the separator\n");
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek        return false;
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    }
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    return true;
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek}
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic errno_t sec_key_parse(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                             const char *sec_key,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                             const char **_name,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                             uuid_t uuid)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char uuid_str[UUID_STR_SIZE];
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    if (!sec_key_valid(sec_key)) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return EINVAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    strncpy(uuid_str, sec_key, sizeof(uuid_str)-1);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (sec_key[UUID_STR_SIZE - 1] != SEC_KEY_SEPARATOR) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, "Key doesn't contain the separator\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return EINVAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uuid_str[UUID_STR_SIZE-1] = '\0';
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_name = talloc_strdup(mem_ctx, sec_key + UUID_STR_SIZE);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (*_name == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uuid_parse(uuid_str, uuid);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekerrno_t sec_key_get_uuid(const char *sec_key,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         uuid_t uuid)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char uuid_str[UUID_STR_SIZE];
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    if (!sec_key_valid(sec_key)) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return EINVAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    strncpy(uuid_str, sec_key, UUID_STR_SIZE-1);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uuid_str[UUID_STR_SIZE-1] = '\0';
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uuid_parse(uuid_str, uuid);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekconst char *sec_key_get_name(const char *sec_key)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    if (!sec_key_valid(sec_key)) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return sec_key + UUID_STR_SIZE;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekbool sec_key_match_name(const char *sec_key,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                        const char *name)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
7d73049884e3a96ca3b00b5bd4104f4edd6287abJakub Hrozek    if (!sec_key_valid(sec_key) || name == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return false;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return strcmp(sec_key + UUID_STR_SIZE, name) == 0;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekbool sec_key_match_uuid(const char *sec_key,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                        uuid_t uuid)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    errno_t ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uuid_t key_uuid;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = sec_key_get_uuid(sec_key, key_uuid);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_MINOR_FAILURE, "Cannot convert key to UUID\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return false;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return uuid_compare(key_uuid, uuid) == 0;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/*
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * Creates an array of principal elements that will be used later
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * in the form of:
a02a5ed51178b2cbede0396d66aed716b8898096René Genz *          "components": [ "elem1", "elem2", ...]
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic json_t *princ_data_to_json(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                  krb5_principal princ)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *jdata = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *data_array = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    int ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char *str_princ_data;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    data_array = json_array();
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (data_array == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    for (ssize_t i = 0; i < princ->length; i++) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        /* FIXME - it might be cleaner to use stringn here, but the libjansson
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek         * version on RHEL-7 doesn't support that
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek         */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        str_princ_data = talloc_zero_array(mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                           char,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                           princ->data[i].length + 1);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        if (str_princ_data == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        memcpy(str_princ_data, princ->data[i].data, princ->data[i].length);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        str_princ_data[princ->data[i].length] = '\0';
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        jdata = json_string(str_princ_data);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        talloc_free(str_princ_data);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        if (jdata == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                  "Cannot convert principal data to string\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            json_decref(data_array);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = json_array_append_new(data_array, jdata);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        if (ret != 0) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                  "Cannot append principal data to array\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            json_decref(jdata);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            json_decref(data_array);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        /* data_array now owns the reference to jdata */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return data_array;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/* Creates:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *          "type": "number",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *          "realm": "string",
90503ff5aa1b2ba9f265ec5f9526539c9c377ca7Lukas Slebodnik *          "components": [ "elem1", "elem2", ...]
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic json_t *princ_to_json(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                             krb5_principal princ)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *jprinc = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *components = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_error_t error;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char *str_realm_data;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    components = princ_data_to_json(mem_ctx, princ);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (components == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot convert principal data to JSON\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    /* FIXME - it might be cleaner to use the s% specifier here, but the libjansson
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     * version on RHEL-7 doesn't support that
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    str_realm_data = talloc_zero_array(mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                        char,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                        princ->realm.length + 1);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (str_realm_data == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    memcpy(str_realm_data, princ->realm.data, princ->realm.length);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    str_realm_data[princ->realm.length] = '\0';
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    jprinc = json_pack_ex(&error,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                          JSON_STRICT,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                          "{s:i, s:s, s:o}",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                          "type", princ->type,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                          "realm", str_realm_data,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                          "components", components);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    talloc_free(str_realm_data);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (jprinc == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Failed to pack JSON princ structure on line %d: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              error.line, error.text);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        json_decref(components);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return jprinc;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/* Creates:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *          {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *              "uuid": <data>,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *              "payload": <data>,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *          },
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic json_t *cred_to_json(struct kcm_cred *crd)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char uuid_str[UUID_STR_SIZE];
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uint8_t *cred_blob_data;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    size_t cred_blob_size;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *jcred;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_error_t error;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char *base64_cred_blob;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uuid_unparse(crd->uuid, uuid_str);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    cred_blob_data = sss_iobuf_get_data(crd->cred_blob);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    cred_blob_size = sss_iobuf_get_size(crd->cred_blob);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    base64_cred_blob = sss_base64_encode(crd, cred_blob_data, cred_blob_size);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (base64_cred_blob == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot base64 encode the certificate blob\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    jcred = json_pack_ex(&error,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         JSON_STRICT,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "{s:s, s:s}",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "uuid", uuid_str,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "payload", base64_cred_blob);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    talloc_free(base64_cred_blob);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (jcred == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Failed to pack JSON cred structure on line %d: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              error.line, error.text);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return jcred;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/*
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * Creates:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      [
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *          {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *              "uuid": <data>,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *              "payload": <data>,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *          },
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *          ...
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      ]
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic json_t *creds_to_json_array(struct kcm_cred *creds)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    struct kcm_cred *crd;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *array;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *jcred;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    array = json_array();
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (array == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    DLIST_FOR_EACH(crd, creds) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        jcred = cred_to_json(crd);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        if (jcred == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                  "Cannot convert credentials to JSON\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            json_decref(array);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        json_array_append_new(array, jcred);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        /* array now owns jcred */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        jcred = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return array;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/*
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * The ccache is formatted in JSON as:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      version: number
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      kdc_offset: number
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      principal : {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *          "type": "number",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *          "realm": "string",
90503ff5aa1b2ba9f265ec5f9526539c9c377ca7Lukas Slebodnik *          "components": [ "elem1", "elem2", ...]
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      creds : [
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *                  {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *                      "uuid": <data>,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *                      "payload": <data>,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *                  },
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *                  {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *                      ...
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *                  }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *             ]
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek *      }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic json_t *ccache_to_json(struct kcm_ccache *cc)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *princ = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *creds = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *jcc = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_error_t error;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    princ = princ_to_json(cc, cc->client);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (princ == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot convert princ to JSON\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    creds = creds_to_json_array(cc->creds);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (creds == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot convert creds to JSON array\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        json_decref(princ);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    jcc = json_pack_ex(&error,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                       JSON_STRICT,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                       "{s:i, s:i, s:o, s:o}",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                       "version", KS_JSON_VERSION,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                       "kdc_offset", cc->kdc_offset,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                       "principal", princ,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                       "creds", creds);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (jcc == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Failed to pack JSON ccache structure on line %d: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              error.line, error.text);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        json_decref(creds);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        json_decref(princ);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return jcc;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic errno_t ccache_to_sec_kv(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                struct kcm_ccache *cc,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                const char **_sec_key,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                const char **_sec_value)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *jcc = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char *jdump;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    jcc = ccache_to_json(cc);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (jcc == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot convert ccache to JSON\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ERR_JSON_ENCODING;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    /* it would be more efficient to learn the size with json_dumpb and
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     * a NULL buffer, but that's only available since 2.10
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    jdump = json_dumps(jcc, JSON_INDENT(4) | JSON_ENSURE_ASCII);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (jdump == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot dump JSON\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ERR_JSON_ENCODING;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_sec_key = sec_key_create(mem_ctx, cc->name, cc->uuid);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_sec_value = talloc_strdup(mem_ctx, jdump);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    free(jdump);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_decref(jcc);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (*_sec_key == NULL || *_sec_value == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekerrno_t kcm_ccache_to_sec_input(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                struct kcm_ccache *cc,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                struct cli_creds *client,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                const char **_url,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                struct sss_iobuf **_payload)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    errno_t ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    const char *key;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    const char *value;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    const char *url;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    struct sss_iobuf *payload;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    TALLOC_CTX *tmp_ctx;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    tmp_ctx = talloc_new(mem_ctx);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (tmp_ctx == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = ccache_to_sec_kv(mem_ctx, cc, &key, &value);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot convert cache %s to JSON [%d]: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              cc->name, ret, sss_strerror(ret));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    url = sec_cc_url_create(tmp_ctx, client, key);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (url == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    payload = sss_iobuf_init_readonly(tmp_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                      (const uint8_t *) value,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                      strlen(value)+1);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot create payload buffer\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_url = talloc_steal(mem_ctx, url);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_payload = talloc_steal(mem_ctx, payload);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekdone:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    talloc_free(tmp_ctx);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic errno_t sec_value_to_json(const char *input,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                 json_t **_root)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *root = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_error_t error;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    int ok;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    root = json_loads(input, 0, &error);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (root == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Failed to parse JSON payload on line %d: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              error.line, error.text);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ERR_JSON_DECODING;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ok = json_is_object(root);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (!ok) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, "Json data is not an object.\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        json_decref(root);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ERR_JSON_DECODING;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_root = root;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/*
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * ccache unmarshalling from JSON
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic errno_t json_element_to_krb5_data(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                         json_t *element,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                         krb5_data *data)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    const char *str_value;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    size_t str_len;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    /* FIXME - it might be cleaner to use stringn here, but the libjansson
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     * version on RHEL-7 doesn't support that
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    str_value = json_string_value(element);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (str_value == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, "JSON element not a string\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return EINVAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    str_len = strlen(str_value);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    data->data = talloc_strndup(mem_ctx, str_value, str_len);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (data->data == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    data->length = str_len;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic errno_t json_array_to_krb5_data(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                       json_t *array,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                       krb5_data **_data,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                       size_t *_len)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    errno_t ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    int ok;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    size_t len;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    size_t idx;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *element;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    krb5_data *data;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ok = json_is_array(array);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (!ok) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, "Json object is not an array.\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ERR_JSON_DECODING;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    len = json_array_size(array);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (len == 0) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        *_data = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        *_len = 0;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    data = talloc_zero_array(mem_ctx, krb5_data, len);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (data == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_array_foreach(array, idx, element) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = json_element_to_krb5_data(data, element, &data[idx]);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                  "Cannot convert krb5 data element from JSON");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            talloc_free(data);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            return ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_data = data;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_len = len;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic errno_t json_to_princ(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                             json_t *js_princ,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                             krb5_principal *_princ)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    errno_t ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *components = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    int ok;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    krb5_principal princ = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    TALLOC_CTX *tmp_ctx = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char *realm_str;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    size_t realm_size;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_error_t error;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ok = json_is_object(js_princ);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (!ok) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, "Json principal is not an object.\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = ERR_JSON_DECODING;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    tmp_ctx = talloc_new(mem_ctx);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (tmp_ctx == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    princ = talloc_zero(tmp_ctx, struct krb5_principal_data);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (princ == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    princ->magic = KV5M_PRINCIPAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    /* FIXME - it might be cleaner to use the s% specifier here, but the libjansson
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     * version on RHEL-7 doesn't support that
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = json_unpack_ex(js_princ,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         &error,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         JSON_STRICT,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "{s:i, s:s, s:o}",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "type", &princ->type,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "realm", &realm_str,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "components", &components);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != 0) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Failed to unpack JSON princ structure on line %d: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              error.line, error.text);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = EINVAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    realm_size = strlen(realm_str);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    princ->realm.data = talloc_strndup(mem_ctx, realm_str, realm_size);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (princ->realm.data == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    princ->realm.length = realm_size;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    princ->realm.magic = 0;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = json_array_to_krb5_data(princ, components,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                  &princ->data,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                  (size_t *) &princ->length);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                  "Cannot convert principal from JSON");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = EINVAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_princ = talloc_steal(mem_ctx, princ);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekdone:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    talloc_free(tmp_ctx);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic errno_t json_elem_to_cred(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                 json_t *element,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                 struct kcm_cred **_crd)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    errno_t ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    char *uuid_str;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_error_t error;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uuid_t uuid;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    struct sss_iobuf *cred_blob;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    const char *base64_cred_blob;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    struct kcm_cred *crd;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uint8_t *outbuf;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    size_t outbuf_size;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    TALLOC_CTX *tmp_ctx = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = json_unpack_ex(element,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         &error,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         JSON_STRICT,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "{s:s, s:s}",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "uuid", &uuid_str,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "payload", &base64_cred_blob);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != 0) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Failed to unpack JSON cred structure on line %d: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              error.line, error.text);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return EINVAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    uuid_parse(uuid_str, uuid);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    tmp_ctx = talloc_new(mem_ctx);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (tmp_ctx == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    outbuf = sss_base64_decode(tmp_ctx, base64_cred_blob, &outbuf_size);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (outbuf == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot decode cred blob\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = EIO;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    cred_blob = sss_iobuf_init_readonly(tmp_ctx, outbuf, outbuf_size);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (cred_blob == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    crd = kcm_cred_new(tmp_ctx, uuid, cred_blob);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (crd == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_crd = talloc_steal(mem_ctx, crd);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekdone:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    talloc_free(tmp_ctx);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic errno_t json_to_creds(struct kcm_ccache *cc,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                             json_t *jcreds)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    errno_t ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    int ok;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    size_t idx;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *value;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    struct kcm_cred *crd;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ok = json_is_array(jcreds);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (!ok) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, "Json creds object is not an array.\n");
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ERR_JSON_DECODING;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_array_foreach(jcreds, idx, value) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = json_elem_to_cred(cc, value, &crd);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                  "Cannot convert JSON cred element [%d]: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                  ret, sss_strerror(ret));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            return ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = kcm_cc_store_creds(cc, crd);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                  "Cannot store creds in ccache [%d]: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                  ret, sss_strerror(ret));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek            return ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekstatic errno_t sec_json_value_to_ccache(struct kcm_ccache *cc,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                                        json_t *root)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    errno_t ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *princ = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *creds = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_error_t error;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    int version;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = json_unpack_ex(root,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         &error,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         JSON_STRICT,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "{s:i, s:i, s:o, s:o}",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "version", &version,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "kdc_offset", &cc->kdc_offset,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "principal", &princ,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         "creds", &creds);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != 0) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Failed to unpack JSON creds structure on line %d: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              error.line, error.text);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return EINVAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (version != KS_JSON_VERSION) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Expected version %d, received version %d\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              KS_JSON_VERSION, version);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return EINVAL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = json_to_princ(cc, princ, &cc->client);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot store JSON to principal [%d]: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              ret, sss_strerror(ret));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = json_to_creds(cc, creds);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot store JSON to creds [%d]: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              ret, sss_strerror(ret));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek/*
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * sec_key is a concatenation of the ccache's UUID and name
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek * sec_value is the JSON dump of the ccache contents
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekerrno_t sec_kv_to_ccache(TALLOC_CTX *mem_ctx,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         const char *sec_key,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         const char *sec_value,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         struct cli_creds *client,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek                         struct kcm_ccache **_cc)
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek{
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    errno_t ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_t *root = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    struct kcm_ccache *cc = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    TALLOC_CTX *tmp_ctx = NULL;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = sec_value_to_json(sec_value, &root);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannot store secret to JSN [%d]: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              ret, sss_strerror(ret));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    tmp_ctx = talloc_new(mem_ctx);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (tmp_ctx == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    cc = talloc_zero(tmp_ctx, struct kcm_ccache);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (cc == NULL) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        ret = ENOMEM;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    /* We rely on sssd-secrets only searching the user's subtree so we
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     * set the ownership to the client
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek     */
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    cc->owner.uid = cli_creds_get_uid(client);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    cc->owner.gid = cli_creds_get_gid(client);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = sec_key_parse(cc, sec_key, &cc->name, cc->uuid);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannt parse secret key [%d]: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              ret, sss_strerror(ret));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = sec_json_value_to_ccache(cc, root);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    if (ret != EOK) {
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              "Cannt parse secret value [%d]: %s\n",
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek              ret, sss_strerror(ret));
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek        goto done;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    }
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    ret = EOK;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    *_cc = talloc_steal(mem_ctx, cc);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozekdone:
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    talloc_free(tmp_ctx);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    json_decref(root);
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek    return ret;
cac0db2f8004ae88b9263dc3888a11a2d3d3d114Jakub Hrozek}