<?php

if ( !extension_loaded('kadm5') )

	die('kadm5 extension is not loaded');

function get_default_kerberos_realm()

{

	$fp = @fopen('/etc/krb5.conf', 'r');

	if ( !$fp )

		return false;

	$found_libdefaults = true;

	$found_realm = false;

	while ( !feof($fp) )

	{

		$line = trim(fgets($fp, 1024));

		if ( $found_libdefaults )

		{

			if ( !strstr($line, '=') )

				continue;

			list($key, $value) = explode('=', $line);

			if ( trim($key) === 'default_realm' )

			{

				$found_realm = trim($value);

				break;

			}

		}

		else if ( $line === '[libdefaults]' )

		{

			$found_libdefaults = true;

		}

	}

	fclose($fp);

	return $found_realm;

}

function get_kerberos_admin_server($realm = false)

{

	if ( !$realm )

		$realm = get_default_kerberos_realm();

	$dns_result = dns_get_record("_kerberos-adm._tcp.$realm", DNS_SRV);

	if ( isset($dns_result[0]['target']) )

		return "{$dns_result[0]['target']}:{$dns_result[0]['port']}";

	// try using the config

	$fp = @fopen('/etc/krb5.conf', 'r');

	if ( !$fp )

		return false;

	$found_realms = false;

	$found_realm = false;

	$found_admin_server = false;

	while ( !feof($fp) )

	{

		$line = trim(fgets($fp, 1024));

		if ( $found_realm )

		{

			if ( !strstr($line, '=') )

				continue;

			list($key, $value) = explode('=', $line);

			if ( trim($key) === 'admin_server' )

			{

				$found_admin_server = trim($value);

				break;

			}

		}

		else if ( $found_realms && trim($line) == "$realm = {" )

		{

			$found_realm = true;

		}

		else if ( $line === '[realms]' )

		{

			$found_realms = true;

		}

	}

	fclose($fp);

	return $found_admin_server;

}

function get_kerberos_connection()

{

	global $kerberos_admin;

	static $khandle = false;

	if ( $khandle )

		return $khandle;

	$realm = get_default_kerberos_realm();

	$admin_server = get_kerberos_admin_server();

	if ( !$realm || !$admin_server )

		throw new Exception("Kerberos realm ($realm) or admin server ($admin_server) came back bad");

	$admin_server = preg_replace('/:[0-9]+$/', '', $admin_server);

	$khandle = kadm5_init_with_password($admin_server, $realm, $kerberos_admin['principal'], $kerberos_admin['password']);

	if ( !$khandle )

		throw new Exception("Failed to connect to Kerberos admin server");

	register_shutdown_function(function() use ($khandle)

		{

			kadm5_destroy($khandle);

		});

	return $khandle;

}

function kadm5_disable_user($user)

{

	$kh = get_kerberos_connection();

	return kadm5_modify_principal($kh, $user, array(

			KADM5_PRINC_EXPIRE_TIME => time()

			, KADM5_PW_EXPIRATION => time()

		));

}

function kadm5_enable_user($user)

{

	$kh = get_kerberos_connection();

	return kadm5_modify_principal($kh, $user, array(

			KADM5_PRINC_EXPIRE_TIME => 0

			, KADM5_PW_EXPIRATION => 0

		));

}

function kadm5_is_user_unexpired($user)

{

	$kh = get_kerberos_connection();

	$princ = @kadm5_get_principal($kh, $user);

	if ( !is_array($princ) )

		return false;

	$pr_good = $princ[KADM5_PRINC_EXPIRE_TIME] > time() || $princ[KADM5_PRINC_EXPIRE_TIME] == 0;

	$pw_good = $princ[KADM5_PW_EXPIRATION] > time() || $princ[KADM5_PW_EXPIRATION] == 0;

	return $pr_good && $pw_good;

}

function kadm5_delete_user($user)

{

	$kh = get_kerberos_connection();

	return kadm5_delete_principal($kh, $user);

}

function kadm5_create_user($user, $pass)

{

	$kh = get_kerberos_connection();

	return @kadm5_create_principal($kh, $user, $pass);

}

function kadm5_reset_password($princ, $pw)

{

	$kh = get_kerberos_connection();

	return kadm5_chpass_principal($kh, $princ, $pw);

}