/*

 * adcli

 *

 * Copyright (C) 2012 Red Hat Inc.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as

 * published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

 * MA 02110-1301 USA

 *

 * Author: Stef Walter <stefw@gnome.org>

 */

#include "config.h"

#include "adenroll.h"

#include "adprivate.h"

#include "seq.h"

#include <gssapi/gssapi_krb5.h>

#include <krb5/krb5.h>

#include <ldap.h>

#include <sasl/sasl.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <assert.h>

#include <ctype.h>

#include <errno.h>

#include <netdb.h>

#include <stdio.h>

#include <unistd.h>

static krb5_enctype v60_later_enctypes[] = {

	ENCTYPE_AES256_CTS_HMAC_SHA1_96,

	ENCTYPE_AES128_CTS_HMAC_SHA1_96,

	ENCTYPE_DES3_CBC_SHA1,

	ENCTYPE_ARCFOUR_HMAC,

	ENCTYPE_DES_CBC_MD5,

	ENCTYPE_DES_CBC_CRC,

	0

};

static krb5_enctype v51_earlier_enctypes[] = {

	ENCTYPE_DES_CBC_CRC,

	ENCTYPE_DES_CBC_MD5,

	ENCTYPE_ARCFOUR_HMAC,

	0

};

struct _adcli_enroll {

	int refs;

	adcli_conn *conn;

	char *host_fqdn;

	int host_fqdn_explicit;

	char *computer_name;

	int computer_name_explicit;

	char *computer_sam;

	char *computer_password;

	int computer_password_explicit;

	int reset_password;

	krb5_principal computer_principal;

	char *domain_ou;

	int domain_ou_validated;

	int domain_ou_explicit;

	char *computer_dn;

	char *computer_container;

	LDAPMessage *computer_attributes;

	char **service_names;

	char **service_principals;

	int service_principals_explicit;

	char *user_principal;

	int user_princpal_generate;

	char *os_name;

	char *os_version;

	char *os_service_pack;

	krb5_kvno kvno;

	char *keytab_name;

	int keytab_name_is_krb5;

	krb5_keytab keytab;

	krb5_principal *keytab_principals;

	krb5_enctype *keytab_enctypes;

	int keytab_enctypes_explicit;

	unsigned int computer_password_lifetime;

	int computer_password_lifetime_explicit;

};

static adcli_result

ensure_host_fqdn (adcli_result res,

                  adcli_enroll *enroll)

{

	const char *fqdn;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->host_fqdn) {

		_adcli_info ("Using fully qualified name: %s",

		             enroll->host_fqdn);

		return ADCLI_SUCCESS;

	}

	if (enroll->host_fqdn_explicit) {

		_adcli_info ("Not setting fully qualified name");

		return ADCLI_SUCCESS;

	}

	/* By default use our actual host name discovered during connecting */

	fqdn = adcli_conn_get_host_fqdn (enroll->conn);

	_adcli_str_set (&enroll->host_fqdn, fqdn);

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_computer_name (adcli_result res,

                      adcli_enroll *enroll)

{

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->computer_name) {

		_adcli_info ("Enrolling computer name: %s",

		             enroll->computer_name);

		return ADCLI_SUCCESS;

	}

	if (!enroll->host_fqdn) {

		_adcli_err ("No host name from which to determine the computer name");

		return ADCLI_ERR_CONFIG;

	}

	enroll->computer_name = _adcli_calc_netbios_name (enroll->host_fqdn);

	if (enroll->computer_name == NULL)

		return ADCLI_ERR_CONFIG;

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_computer_sam (adcli_result res,

                     adcli_enroll *enroll)

{

	krb5_error_code code;

	krb5_context k5;

	if (res != ADCLI_SUCCESS)

		return res;

	free (enroll->computer_sam);

	enroll->computer_sam = NULL;

	if (asprintf (&enroll->computer_sam, "%s$", enroll->computer_name) < 0)

		return_unexpected_if_fail (enroll->computer_sam != NULL);

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_unexpected_if_fail (k5 != NULL);

	if (enroll->computer_principal)

		krb5_free_principal (k5, enroll->computer_principal);

	enroll->computer_principal = NULL;

	code = _adcli_krb5_build_principal (k5, enroll->computer_sam,

	                                    adcli_conn_get_domain_realm (enroll->conn),

	                                    &enroll->computer_principal);

	return_unexpected_if_fail (code == 0);

	return ADCLI_SUCCESS;

}

static int

filter_password_chars (char *password,

                       int length)

{

	int i, j;

	/*

	 * The MS documentation says their servers only use ASCII characters

	 * between 32 and 122 inclusive. We do that as well, and filter out

	 * all other random characters. We also remove certain characters

	 * special for use in a shell.

	 */

	for (i = 0, j = 0; i < length; i++) {

		if (password[i] >= 32 && password[i] <= 122 &&

		    strchr (" !'\"$`", password[i]) == NULL)

			password[j++] = password[i];

	}

	/* return the number of valid characters remaining */

	return j;

}

static char *

generate_host_password  (adcli_enroll *enroll,

                         size_t length)

{

	char *password;

	krb5_context k5;

	krb5_error_code code;

	krb5_data buffer;

	int at;

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_val_if_fail (k5 != NULL, NULL);

	password = malloc (length + 1);

	return_val_if_fail (password != NULL, NULL);

	at = 0;

	while (at != length) {

		buffer.length = length - at;

		buffer.data = password + at;

		code = krb5_c_random_make_octets (k5, &buffer);

		return_val_if_fail (code == 0, NULL);

		at += filter_password_chars (buffer.data, buffer.length);

		assert (at <= length);

	}

	/* This null termination works around a bug in krb5 */

	password[length] = '\0';

	return password;

}

static adcli_result

ensure_computer_password (adcli_result res,

                      adcli_enroll *enroll)

{

	const int length = 120;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->computer_password)

		return ADCLI_SUCCESS;

	if (enroll->reset_password) {

		assert (enroll->computer_name != NULL);

		enroll->computer_password = _adcli_calc_reset_password (enroll->computer_name);

		return_unexpected_if_fail (enroll->computer_password != NULL);

		_adcli_info ("Using default reset computer password");

	} else {

		enroll->computer_password = generate_host_password (enroll, length);

		return_unexpected_if_fail (enroll->computer_password != NULL);

		_adcli_info ("Generated %d character computer password", length);

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_service_names (adcli_result res,

                      adcli_enroll *enroll)

{

	int length = 0;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->service_names || enroll->service_principals)

		return ADCLI_SUCCESS;

	/* The default ones specified by MS */

	enroll->service_names = _adcli_strv_add (enroll->service_names,

	                                         strdup ("host"), &length);

	enroll->service_names = _adcli_strv_add (enroll->service_names,

	                                         strdup ("RestrictedKrbHost"), &length);

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_service_principals (adcli_result res,

                           adcli_enroll *enroll)

{

	char *name;

	int length = 0;

	int i;

	if (res != ADCLI_SUCCESS)

		return res;

	assert (enroll->keytab_principals == NULL);

	if (!enroll->service_principals) {

		assert (enroll->service_names != NULL);

		for (i = 0; enroll->service_names[i] != NULL; i++) {

			if (asprintf (&name, "%s/%s", enroll->service_names[i], enroll->computer_name) < 0)

				return_unexpected_if_reached ();

			enroll->service_principals = _adcli_strv_add (enroll->service_principals,

			                                              name, &length);

			if (enroll->host_fqdn) {

				if (asprintf (&name, "%s/%s", enroll->service_names[i], enroll->host_fqdn) < 0)

					return_unexpected_if_reached ();

				enroll->service_principals = _adcli_strv_add (enroll->service_principals,

				                                              name, &length);

			}

		}

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_keytab_principals (adcli_result res,

                          adcli_enroll *enroll)

{

	krb5_context k5;

	krb5_error_code code;

	int count;

	int at, i;

	/* Prepare the principals we're going to add to the keytab */

	return_unexpected_if_fail (enroll->service_principals);

	count = _adcli_strv_len (enroll->service_principals);

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_unexpected_if_fail (k5 != NULL);

	enroll->keytab_principals = calloc (count + 3, sizeof (krb5_principal));

	at = 0;

	/* First add the principal for the computer account name */

	code = krb5_copy_principal (k5, enroll->computer_principal,

	                            &enroll->keytab_principals[at++]);

	return_unexpected_if_fail (code == 0);

	/* Next, optionally add the user principal */

	if (enroll->user_principal) {

		code = krb5_parse_name (k5, enroll->user_principal,

		                        &enroll->keytab_principals[at++]);

		if (code != 0) {

			if (code != 0) {

				_adcli_err ("Couldn't parse kerberos user principal: %s: %s",

				            enroll->user_principal,

				            krb5_get_error_message (k5, code));

				return ADCLI_ERR_CONFIG;

			}

		}

	}

	/* Now add the principals for all the various services */

	for (i = 0; i < count; i++) {

		code = _adcli_krb5_build_principal (k5, enroll->service_principals[i],

		                                    adcli_conn_get_domain_realm (enroll->conn),

		                                    &enroll->keytab_principals[at++]);

		if (code != 0) {

			_adcli_err ("Couldn't parse kerberos service principal: %s: %s",

			            enroll->service_principals[i],

			            krb5_get_error_message (k5, code));

			return ADCLI_ERR_CONFIG;

		}

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_user_principal (adcli_result res,

                       adcli_enroll *enroll)

{

	char *name;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->user_princpal_generate) {

		name = strdup (enroll->computer_name);

		return_unexpected_if_fail (name != NULL);

		_adcli_str_down (name);

		assert (enroll->user_principal == NULL);

		if (asprintf (&enroll->user_principal, "host/%s@%s",

		              name, adcli_conn_get_domain_realm (enroll->conn)) < 0)

			return_unexpected_if_reached ();

		free (name);

	}

	if (enroll->user_principal)

		_adcli_info ("With user principal: %s", enroll->user_principal);

	return ADCLI_SUCCESS;

}

static adcli_result

lookup_computer_container (adcli_enroll *enroll,

                           LDAP *ldap)

{

	char *attrs[] = { "wellKnownObjects", NULL };

	char *prefix = "B:32:AA312825768811D1ADED00C04FD8D5CD:";

	int prefix_len;

	LDAPMessage *results;

	const char *base;

	char **values;

	int ret;

	int i;

	if (enroll->computer_container)

		return ADCLI_SUCCESS;

	base = enroll->domain_ou;

	if (base == NULL)

		base = adcli_conn_get_default_naming_context (enroll->conn);

	assert (base != NULL);

	ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE,

	                         "(objectClass=*)", attrs, 0, NULL, NULL,

	                         NULL, -1, &results);

	if (ret == LDAP_NO_SUCH_OBJECT && enroll->domain_ou) {

		_adcli_err ("The organizational unit does not exist: %s", enroll->domain_ou);

		return enroll->domain_ou_explicit ? ADCLI_ERR_CONFIG : ADCLI_ERR_DIRECTORY;

	} else if (ret != LDAP_SUCCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't lookup computer container: %s", base);

	}

	values = _adcli_ldap_parse_values (ldap, results, "wellKnownObjects");

	ldap_msgfree (results);

	prefix_len = strlen (prefix);

	for (i = 0; values && values[i]; i++) {

		if (strncmp (values[i], prefix, prefix_len) == 0) {

			enroll->computer_container = strdup (values[i] + prefix_len);

			return_unexpected_if_fail (enroll->computer_container != NULL);

			_adcli_info ("Found well known computer container at: %s",

			             enroll->computer_container);

			break;

		}

	}

	_adcli_strv_free (values);

	/* Try harder */

	if (!enroll->computer_container) {

		ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE,

		                         "(&(objectClass=container)(cn=Computers))",

		                         attrs, 0, NULL, NULL, NULL, -1, &results);

		if (ret == LDAP_SUCCESS) {

			enroll->computer_container = _adcli_ldap_parse_dn (ldap, results);

			if (enroll->computer_container) {

				_adcli_info ("Well known computer container not "

				             "found, but found suitable one at: %s",

				             enroll->computer_container);

			}

		}

		ldap_msgfree (results);

	}

	if (!enroll->computer_container && enroll->domain_ou) {

		_adcli_warn ("Couldn't find a computer container in the ou, "

		             "creating computer account directly in: %s", enroll->domain_ou);

		enroll->computer_container = strdup (enroll->domain_ou);

		return_unexpected_if_fail (enroll->computer_container != NULL);

	}

	if (!enroll->computer_container) {

		_adcli_err ("Couldn't find location to create computer accounts");

		return ADCLI_ERR_DIRECTORY;

	}

	return ADCLI_SUCCESS;

}

static adcli_result

calculate_computer_account (adcli_enroll *enroll,

                            LDAP *ldap)

{

	adcli_result res;

	assert (enroll->computer_dn == NULL);

	/* Now need to find or validate the computer container */

	res = lookup_computer_container (enroll, ldap);

	if (res != ADCLI_SUCCESS)

		return res;

	assert (enroll->computer_container);

	free (enroll->computer_dn);

	enroll->computer_dn = NULL;

	if (asprintf (&enroll->computer_dn, "CN=%s,%s", enroll->computer_name, enroll->computer_container) < 0)

		return_unexpected_if_reached ();

	_adcli_info ("Calculated computer account: %s", enroll->computer_dn);

	return ADCLI_SUCCESS;

}

static adcli_result

create_computer_account (adcli_enroll *enroll,

                         LDAP *ldap)

{

	char *vals_objectClass[] = { "computer", NULL };

	LDAPMod objectClass = { LDAP_MOD_ADD, "objectClass", { vals_objectClass, } };

	char *vals_sAMAccountName[] = { enroll->computer_sam, NULL };

	LDAPMod sAMAccountName = { LDAP_MOD_ADD, "sAMAccountName", { vals_sAMAccountName, } };

	char *vals_userAccountControl[] = { "69632", NULL }; /* WORKSTATION_TRUST_ACCOUNT | DONT_EXPIRE_PASSWD */

	LDAPMod userAccountControl = { LDAP_MOD_REPLACE, "userAccountControl", { vals_userAccountControl, } };

	int ret;

	LDAPMod *mods[] = {

		&objectClass,

		&sAMAccountName,

		&userAccountControl,

		NULL,

	};

	ret = ldap_add_ext_s (ldap, enroll->computer_dn, mods, NULL, NULL);

	/*

	 * Hand to head. This is really dumb... AD returns

	 * OBJECT_CLASS_VIOLATION when the 'admin' account doesn't have

	 * enough permission to create this computer account.

	 *

	 * Additionally LDAP_UNWILLING_TO_PERFORM and LDAP_CONSTRAINT_VIOLATION

	 * are seen on various Windows Servers as responses to this case.

	 *

	 * TODO: Perhaps some missing attributes are auto-generated when

	 * the administrative credentials have sufficient permissions, and

	 * those missing attributes cause the object class violation. However

	 * I've tried to screw around with this, and can't find the missing

	 * attributes. They may be hidden, like unicodePwd.

	 */

	if (ret == LDAP_INSUFFICIENT_ACCESS || ret == LDAP_OBJECT_CLASS_VIOLATION ||

	    ret == LDAP_UNWILLING_TO_PERFORM || ret == LDAP_CONSTRAINT_VIOLATION) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_CREDENTIALS,

		                                   "Insufficient permissions to modify computer account: %s",

		                                   enroll->computer_dn);

	} else if (ret != LDAP_SUCCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't create computer account: %s",

		                                   enroll->computer_dn);

	}

	_adcli_info ("Created computer account: %s", enroll->computer_dn);

	return ADCLI_SUCCESS;

}

static int

filter_for_necessary_updates (adcli_enroll *enroll,

                              LDAP *ldap,

                              LDAPMessage *entry,

                              LDAPMod **mods)

{

	struct berval **vals;

	int match;

	int out;

	int in;

	for (in = 0, out = 0; mods[in] != NULL; in++) {

		match = 0;

		/* Never update these attributes */

		if (strcasecmp (mods[in]->mod_type, "objectClass") == 0)

			continue;

		/* If no entry, then no filtering */

		if (entry != NULL) {

			vals = ldap_get_values_len (ldap, entry, mods[in]->mod_type);

			if (vals != NULL) {

				match = _adcli_ldap_have_in_mod (mods[in], vals);

				ldap_value_free_len (vals);

			}

		}

		if (!match)

			mods[out++] = mods[in];

	}

	mods[out] = NULL;

	return out;

}

static adcli_result

validate_computer_account (adcli_enroll *enroll,

                           int allow_overwrite,

                           int already_exists)

{

	assert (enroll->computer_dn != NULL);

	if (already_exists && !allow_overwrite) {

		_adcli_err ("The computer account %s already exists",

		            enroll->computer_name);

		return ADCLI_ERR_CONFIG;

	}

	/* Do we have an explicitly requested ou? */

	if (enroll->domain_ou && enroll->domain_ou_explicit && already_exists) {

		if (!_adcli_ldap_dn_has_ancestor (enroll->computer_dn, enroll->domain_ou)) {

			_adcli_err ("The computer account %s already exists, "

			            "but is not in the desired organizational unit.",

			            enroll->computer_name);

			return ADCLI_ERR_CONFIG;

		}

	}

	return ADCLI_SUCCESS;

}

static adcli_result

delete_computer_account (adcli_enroll *enroll,

                         LDAP *ldap)

{

	int ret;

	ret = ldap_delete_ext_s (ldap, enroll->computer_dn, NULL, NULL);

	if (ret == LDAP_INSUFFICIENT_ACCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_CREDENTIALS,

		                                   "Insufficient permissions to delete computer account: %s",

		                                   enroll->computer_dn);

	} else if (ret != LDAP_SUCCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't delete computer account: %s",

		                                   enroll->computer_dn);

	} else {

		_adcli_info ("Deleted computer account at: %s", enroll->computer_dn);

	}

	return ADCLI_SUCCESS;

}

static adcli_result

locate_computer_account (adcli_enroll *enroll,

                         LDAP *ldap,

                         LDAPMessage **rresults,

                         LDAPMessage **rentry)

{

	char *attrs[] = { "1.1", NULL };

	LDAPMessage *results = NULL;

	LDAPMessage *entry = NULL;

	const char *base;

	char *value;

	char *filter;

	char *dn;

	int ret = 0;

	/* If we don't yet know our computer dn, then try and find it */

	value = _adcli_ldap_escape_filter (enroll->computer_sam);

	return_unexpected_if_fail (value != NULL);

	if (asprintf (&filter, "(&(objectClass=computer)(sAMAccountName=%s))", value) < 0)

		return_unexpected_if_reached ();

	free (value);

	base = adcli_conn_get_default_naming_context (enroll->conn);

	ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_SUB, filter, attrs, 0,

	                         NULL, NULL, NULL, 1, &results);

	free (filter);

	/* ldap_search_ext_s() can return results *and* an error. */

	if (ret == LDAP_SUCCESS) {

		entry = ldap_first_entry (ldap, results);

		/* If we found a computer account, make note of dn */

		if (entry) {

			dn = ldap_get_dn (ldap, entry);

			free (enroll->computer_dn);

			enroll->computer_dn = strdup (dn);

			return_unexpected_if_fail (enroll->computer_dn != NULL);

			_adcli_info ("Found computer account for %s at: %s",

			             enroll->computer_sam, dn);

			ldap_memfree (dn);

		} else {

			ldap_msgfree (results);

			results = NULL;

			_adcli_info ("Computer account for %s does not exist",

			             enroll->computer_sam);

		}

	} else {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't lookup computer account: %s",

		                                   enroll->computer_sam);

	}

	if (rresults)

		*rresults = results;

	else

		ldap_msgfree (results);

	if (rentry) {

		assert (rresults != NULL);

		*rentry = entry;

	}

	return ADCLI_SUCCESS;

}

static adcli_result

load_computer_account (adcli_enroll *enroll,

                       LDAP *ldap,

                       LDAPMessage **rresults,

                       LDAPMessage **rentry)

{

	char *attrs[] = { "1.1", NULL };

	LDAPMessage *results = NULL;

	LDAPMessage *entry = NULL;

	int ret;

	ret = ldap_search_ext_s (ldap, enroll->computer_dn, LDAP_SCOPE_BASE,

	                         "(objectClass=computer)", attrs, 0,

	                         NULL, NULL, NULL, -1, &results);

	if (ret == LDAP_SUCCESS) {

		entry = ldap_first_entry (ldap, results);

		if (entry) {

			_adcli_info ("Found computer account for %s at: %s",

			             enroll->computer_sam, enroll->computer_dn);

		}

	} else if (ret == LDAP_NO_SUCH_OBJECT) {

		results = entry = NULL;

	} else {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't check computer account: %s",

		                                   enroll->computer_dn);

	}

	if (rresults)

		*rresults = results;

	else

		ldap_msgfree (results);

	if (rentry) {

		assert (rresults != NULL);

		*rentry = entry;

	}

	return ADCLI_SUCCESS;

}

static adcli_result

locate_or_create_computer_account (adcli_enroll *enroll,

                                   int allow_overwrite)

{

	LDAPMessage *results = NULL;

	LDAPMessage *entry = NULL;

	adcli_result res;

	int searched = 0;

	LDAP *ldap;

	ldap = adcli_conn_get_ldap_connection (enroll->conn);

	assert (ldap != NULL);

	/* Try to find the computer account */

	if (!enroll->computer_dn) {

		res = locate_computer_account (enroll, ldap, &results, &entry);

		if (res != ADCLI_SUCCESS)

			return res;

		searched = 1;

	}

	/* Next try and come up with where we think it should be */

	if (enroll->computer_dn == NULL) {

		res = calculate_computer_account (enroll, ldap);

		if (res != ADCLI_SUCCESS)

			return res;

	}

	assert (enroll->computer_dn != NULL);

	/* Have we seen an account yet? */

	if (!searched) {

		res = load_computer_account (enroll, ldap, &results, &entry);

		if (res != ADCLI_SUCCESS)

			return res;

	}

	res = validate_computer_account (enroll, allow_overwrite, entry != NULL);

	if (res == ADCLI_SUCCESS && entry == NULL)

		res = create_computer_account (enroll, ldap);

	if (results)

		ldap_msgfree (results);

	return res;

}

static adcli_result

set_password_with_user_creds (adcli_enroll *enroll)

{

	krb5_error_code code;

	krb5_ccache ccache;

	krb5_context k5;

	krb5_data result_string = { 0, };

	krb5_data result_code_string = { 0, };

	adcli_result res;

	int result_code;

	char *message;

	assert (enroll->computer_password != NULL);

	assert (enroll->computer_principal != NULL);

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_unexpected_if_fail (k5 != NULL);

	ccache = adcli_conn_get_login_ccache (enroll->conn);

	return_unexpected_if_fail (ccache != NULL);

	memset (&result_string, 0, sizeof (result_string));

	memset (&result_code_string, 0, sizeof (result_code_string));

	code = krb5_set_password_using_ccache (k5, ccache, enroll->computer_password,

	                                       enroll->computer_principal, &result_code,

	                                       &result_code_string, &result_string);

	if (code != 0) {

		_adcli_err ("Couldn't set password for computer account: %s: %s",

		            enroll->computer_sam, krb5_get_error_message (k5, code));

		/* TODO: Parse out these values */

		res = ADCLI_ERR_DIRECTORY;

	} else if (result_code != 0) {

#ifdef HAVE_KRB5_CHPW_MESSAGE

		if (krb5_chpw_message (k5, &result_string, &message) != 0)

			message = NULL;

#else

		message = NULL;

		if (result_string.length)

			message = _adcli_str_dupn (result_string.data, result_string.length);

#endif

		_adcli_err ("Cannot set computer password: %.*s%s%s",

		            (int)result_code_string.length, result_code_string.data,

		            message ? ": " : "", message ? message : "");

		res = ADCLI_ERR_CREDENTIALS;

#ifdef HAVE_KRB5_CHPW_MESSAGE

		krb5_free_string (k5, message);

#else

		free (message);

#endif

	} else {

		_adcli_info ("Set computer password");

		res = ADCLI_SUCCESS;

	}

	krb5_free_data_contents (k5, &result_string);

	krb5_free_data_contents (k5, &result_code_string);

	return res;

}

static adcli_result

set_password_with_computer_creds (adcli_enroll *enroll)

{

	krb5_error_code code;

	krb5_creds creds;

	krb5_data result_string = { 0, };

	krb5_data result_code_string = { 0, };

	krb5_context k5;