Bug Summary

File:uss/uss_kauth.c
Location:line 540, column 5
Description:Value stored to 'code' is never read

Annotated Source Code

1/*
2 * Copyright 2000, International Business Machines Corporation and others.
3 * All Rights Reserved.
4 *
5 * This software has been released under the terms of the IBM Public
6 * License. For details, see the LICENSE file in the top-level source
7 * directory or online at http://www.openafs.org/dl/license10.html
8 */
9
10/*
11 * Implementation of basic procedures for the AFS user account
12 * facility.
13 */
14
15/*
16 * --------------------- Required definitions ---------------------
17 */
18#include <afsconfig.h>
19#include <afs/param.h>
20
21#include <roken.h>
22
23#include <afs/com_err.h>
24#include <afs/kautils.h> /*MAXKTCREALMLEN*/
25#include <afs/kaport.h> /* pack_long */
26#include <afs/kauth.h>
27
28#include "uss_kauth.h" /*Module interface */
29#include "uss_common.h" /*Common defs & operations */
30
31#define uss_kauth_MAX_SIZE2048 2048
32#undef USS_KAUTH_DB
33/*
34 * ---------------------- Exported variables ----------------------
35 */
36struct ubik_client *uconn_kauthP; /*Ubik connections
37 * to AuthServers */
38
39/*
40 * ------------------------ Private globals -----------------------
41 */
42static int initDone = 0; /*Module initialized? */
43static char CreatorInstance[MAXKTCNAMELEN64]; /*Instance string */
44static char UserPrincipal[MAXKTCNAMELEN64]; /*Parsed user principal */
45static char UserInstance[MAXKTCNAMELEN64]; /*Parsed user instance */
46static char UserCell[MAXKTCREALMLEN64]; /*Parsed user cell */
47int doUnlog = 0;
48
49/*-----------------------------------------------------------------------
50 * EXPORTED uss_kauth_InitAccountCreator
51 *
52 * Environment:
53 * The command line must have been parsed.
54 *
55 * Side Effects:
56 * As advertised.
57 *-----------------------------------------------------------------------*/
58
59afs_int32
60uss_kauth_InitAccountCreator(void)
61{ /*uss_kauth_InitAccountCreator */
62
63 char *name;
64 struct passwd *pw;
65 int dotPosition;
66
67 /*
68 * Set up the identity of the principal performing the account
69 * creation (uss_AccountCreator). It's either the administrator
70 * name provided at the call or the identity of the caller as
71 * gleaned from the password info.
72 */
73 if (uss_Administrator[0] != '\0') {
74 name = uss_Administrator;
75 } else { /* Administrator name not passed in */
76 pw = getpwuid(getuid());
77 if (pw == 0) {
78 fprintf(stderr__stderrp,
79 "%s: Can't figure out your name from your user id.\n",
80 uss_whoami);
81 return (1);
82 }
83 name = pw->pw_name;
84 }
85
86 /* Break the *name into principal and instance */
87 dotPosition = strcspn(name, ".");
88 if (dotPosition >= MAXKTCNAMELEN64) {
89 fprintf(stderr__stderrp, "Admin principal name too long.\n");
90 return (1);
91 }
92 strncpy(uss_AccountCreator, name, dotPosition);
93 uss_AccountCreator[dotPosition] = '\0';
94
95 name += dotPosition;
96 if (name[0] == '.') {
97 name++;
98 if (strlen(name) >= MAXKTCNAMELEN64) {
99 fprintf(stderr__stderrp, "Admin instance name too long.\n");
100 return (1);
101 }
102 strcpy(CreatorInstance, name);
103 } else {
104 CreatorInstance[0] = '\0';
105 }
106
107#ifdef USS_KAUTH_DB_INSTANCE
108 fprintf(stderr__stderrp, "%s: Starting CreatorInstance is '%s', %d bytes\n",
109 uss_whoami, CreatorInstance, strlen(CreatorInstance));
110#endif /* USS_KAUTH_DB_INSTANCE */
111
112 return (0);
113}
114
115/*-----------------------------------------------------------------------
116 * static InitThisModule
117 *
118 * Description:
119 * Set up this module, namely set up all the client state for
120 * dealing with the Volume Location Server(s), including
121 * network connections.
122 *
123 * Arguments:
124 * a_noAuthFlag : Do we need authentication?
125 * a_confDir : Configuration directory to use.
126 * a_cellName : Cell we want to talk to.
127 *
128 * Returns:
129 * 0 if everything went fine, or
130 * lower-level error code otherwise.
131 *
132 * Environment:
133 * This routine will only be called once.
134 *
135 * Side Effects:
136 * As advertised.
137 *------------------------------------------------------------------------*/
138
139int Pipe = 0;
140static char *
141getpipepass(void)
142{
143 static char gpbuf[BUFSIZ1024];
144 /* read a password from stdin, stop on \n or eof */
145 int i, tc;
146 memset(gpbuf, 0, sizeof(gpbuf));
147 for (i = 0; i < (sizeof(gpbuf) - 1); i++) {
148 tc = fgetc(stdin__stdinp);
149 if (tc == '\n' || tc == EOF(-1))
150 break;
151 gpbuf[i] = tc;
152 }
153 return gpbuf;
154}
155
156
157afs_int32
158InitThisModule(void)
159{ /*InitThisModule */
160#ifdef USS_KAUTH_DB
161 static char rn[] = "uss_kauth:InitThisModule";
162#endif
163 afs_int32 code;
164 char prompt[2 * MAXKTCNAMELEN64 + 20];
165 char *reasonString, longPassBuff[1024], shortPassBuff[9];
166 struct ktc_encryptionKey key;
167 struct ktc_token token;
168 struct ktc_principal Name, tok;
169
170 /*
171 * Only call this routine once.
172 */
173 if (initDone)
174 return (0);
175
176
177 /*
178 * Pull out the caller's administrator token if they have one.
179 */
180 code =
181 ka_GetAdminToken(0, 0, uss_Cell, 0, 10 * 60 * 60, &token,
182 0 /*new */ );
183 if (code) {
184 if (Pipe) {
185 strncpy(longPassBuff, getpipepass(), sizeof(longPassBuff));
186 } else {
187 /*
188 * Nope, no admin tokens available. Get the key based on the
189 * full password and try again.
190 */
191 sprintf(prompt, "Password for '%s", uss_AccountCreator);
192 if (CreatorInstance[0])
193 sprintf(prompt + strlen(prompt), ".%s", CreatorInstance);
194 strcat(prompt, "': ");
195 code = ka_UserReadPassword(prompt, /*Prompt to use */
196 longPassBuff, /*Long pwd buffer */
197 sizeof(longPassBuff), /*Size of above */
198 &reasonString);
199 if (code) {
200 afs_com_err(uss_whoami, code, "while getting password ");
201#ifdef USS_KAUTH_DB
202 printf("%s: Error code from ka_UserReadPassword(): %d\n", rn,
203 code);
204#endif /* USS_KAUTH_DB */
205 return (code);
206 }
207 }
208 ka_StringToKey(longPassBuff, uss_Cell, &key);
209 code =
210 ka_GetAdminToken(uss_AccountCreator, CreatorInstance, uss_Cell,
211 &key, 24 * 60 * 60, &token, 0 /*new */ );
212 if (code) {
213 if ((code == KABADREQUEST(180490L)) && (strlen(longPassBuff) > 8)) {
214 /*
215 * The key we provided just doesn't work, yet we
216 * suspect that since the password is greater than 8
217 * chars, it might be the case that we really need
218 * to truncate the password to generate the appropriate
219 * key.
220 */
221 afs_com_err(uss_whoami, code,
222 "while getting administrator token (trying shortened password next...)");
223#ifdef USS_KAUTH_DB
224 printf("%s: Error code from ka_GetAdminToken: %d\n", rn,
225 code);
226#endif /* USS_KAUTH_DB */
227 strncpy(shortPassBuff, longPassBuff, 8);
228 shortPassBuff[8] = 0;
229 ka_StringToKey(shortPassBuff, uss_Cell, &key);
230 code =
231 ka_GetAdminToken(uss_AccountCreator, CreatorInstance,
232 uss_Cell, &key, 24 * 60 * 60, &token,
233 0 /*new */ );
234 if (code) {
235 afs_com_err(uss_whoami, code,
236 "while getting administrator token (possibly wrong password, or not an administrative account)");
237#ifdef USS_KAUTH_DB
238 printf("%s: Error code from ka_GetAdminToken: %d\n", rn,
239 code);
240#endif /* USS_KAUTH_DB */
241 return (code);
242 } else {
243 /*
244 * The silly administrator has a long password! Tell
245 * him or her off in a polite way.
246 */
247 printf
248 ("%s: Shortened password accepted by the Authentication Server\n",
249 uss_whoami);
250 }
251 } /*Try a shorter password */
252 else {
253 /*
254 * We failed to get an admin token, but the password is
255 * of a reasonable length, so we're just hosed.
256 */
257 afs_com_err(uss_whoami, code,
258 "while getting administrator token (possibly wrong password, or not an administrative account)");
259#ifdef USS_KAUTH_DB
260 printf("%s: Error code from ka_GetAdminToken: %d\n", rn,
261 code);
262#endif /* USS_KAUTH_DB */
263 return (code);
264 } /*Even the shorter password didn't work */
265 } /*Key from given password didn't work */
266 }
267
268 /*First attempt to get admin token failed */
269 /*
270 * At this point, we have acquired an administrator token. Let's
271 * proceed to set up a connection to the AuthServer.
272 */
273#ifdef USS_KAUTH_DB_INSTANCE
274 fprintf(stderr__stderrp,
275 "%s: CreatorInstance after ka_GetAdminToken(): '%s', %d bytes\n",
276 rn, CreatorInstance, strlen(CreatorInstance));
277#endif /* USS_KAUTH_DB_INSTANCE */
278
279 /*
280 * Set up the connection to the AuthServer read/write site.
281 */
282 code =
283 ka_AuthServerConn(uss_Cell, KA_MAINTENANCE_SERVICE733, &token,
284 &uconn_kauthP);
285 if (code) {
286 afs_com_err(uss_whoami, code,
287 "while establishing Authentication Server connection");
288#ifdef USS_KAUTH_DB
289 printf("%s: Error code from ka_AuthServerConn: %d\n", rn, code);
290#endif /* USS_KAUTH_DB */
291 return (code);
292 }
293
294 if (uss_Administrator[0]) {
295 /*
296 * We must check to see if we have local tokens for admin since he'll may do
297 * various pioctl or calls to protection server that require tokens. Remember
298 * to remove this tokens at the end of the program...
299 */
300 strcpy(Name.name, "afs");
301 Name.instance[0] = '\0';
302 strncpy(Name.cell, uss_Cell, sizeof(Name.cell));
303 if ((code =
304 ktc_GetToken(&Name, &token, sizeof(struct ktc_token), &tok))) {
305 code =
306 ka_UserAuthenticateLife(0, uss_AccountCreator,ka_UserAuthenticateGeneral (1 + (0), uss_AccountCreator,CreatorInstance
,uss_Cell,longPassBuff,10 * 60 * 60, 0,0, &reasonString)
307 CreatorInstance, uss_Cell,ka_UserAuthenticateGeneral (1 + (0), uss_AccountCreator,CreatorInstance
,uss_Cell,longPassBuff,10 * 60 * 60, 0,0, &reasonString)
308 longPassBuff, 10 * 60 * 60,ka_UserAuthenticateGeneral (1 + (0), uss_AccountCreator,CreatorInstance
,uss_Cell,longPassBuff,10 * 60 * 60, 0,0, &reasonString)
309 &reasonString)ka_UserAuthenticateGeneral (1 + (0), uss_AccountCreator,CreatorInstance
,uss_Cell,longPassBuff,10 * 60 * 60, 0,0, &reasonString);
310 if (!code)
311 doUnlog = 1;
312 }
313 }
314
315 /*
316 * Declare our success.
317 */
318 initDone = 1;
319 return (0);
320
321} /*InitThisModule */
322
323
324/*-----------------------------------------------------------------------
325 * EXPORTED uss_kauth_AddUser
326 *
327 * Environment:
328 * The uconn_kauthP variable may already be set to an AuthServer
329 * connection.
330 *
331 * Side Effects:
332 * As advertised.
333 *------------------------------------------------------------------------*/
334
335afs_int32
336uss_kauth_AddUser(char *a_user, char *a_passwd)
337{ /*uss_kauth_AddUser */
338#ifdef USS_KAUTH_DB
339 static char rn[] = "uss_kauth_AddUser"; /*Routine name */
340#endif
341 struct ktc_encryptionKey ktc_key;
342 EncryptionKey key;
343 afs_int32 code;
344
345 if (uss_SkipKaserver) {
346 /*
347 * Don't talk to the kaserver; assume calls succeded and simply return.
348 * Amasingly people want to update it (most likely kerberos) themselves...
349 */
350 if (uss_verbose)
351 printf
352 ("[Skip Kaserver option - Adding of user %s in Authentication DB not done]\n",
353 a_user);
354 return 0;
355 }
356
357
358 /*
359 * Make sure the module has been initialized before we start trying
360 * to talk to AuthServers.
361 */
362 if (!initDone) {
363 code = InitThisModule();
364 if (code)
365 exit(code);
366 }
367
368 /*
369 * Given the (unencrypted) password and cell, generate a key to
370 * pass to the AuthServer.
371 */
372 ka_StringToKey(a_passwd, uss_Cell, &ktc_key);
373
374 memcpy(&key, &ktc_key, sizeof(key)); /* XXX - we could just cast */
375
376 if (!uss_DryRun) {
377 if (uss_verbose)
378 fprintf(stderr__stderrp, "Adding user '%s' to the Authentication DB\n",
379 a_user);
380
381#ifdef USS_KAUTH_DB_INSTANCE
382 fprintf(stderr__stderrp,
383 "%s: KAM_CreateUser: user='%s', CreatorInstance='%s', %d bytes\n",
384 rn, a_user, CreatorInstance, strlen(CreatorInstance));
385#endif /* USS_KAUTH_DB_INSTANCE */
386 code = ubik_KAM_CreateUser(uconn_kauthP, 0, a_user,
387 UserInstance, /*set by CheckUsername() */
388 key);
389 if (code) {
390 if (code == KAEXIST(180481L)) {
391 if (uss_verbose)
392 fprintf(stderr__stderrp,
393 "%s: Warning: User '%s' already in Authentication DB\n",
394 uss_whoami, a_user);
395 } else {
396 afs_com_err(uss_whoami, code,
397 "while adding user '%s' to Authentication DB",
398 a_user);
399#ifdef USS_KAUTH_DB
400 printf("%s: Error code from KAM_CreateUser: %d\n", rn, code);
401#endif /* USS_KAUTH_DB */
402 return (code);
403 }
404 } /*KAM_CreateUser failed */
405 } /*Not a dry run */
406 else
407 fprintf(stderr__stderrp,
408 "\t[Dry run - user '%s' NOT added to Authentication DB]\n",
409 a_user);
410
411 return (0);
412
413} /*uss_kauth_AddUser */
414
415
416/*-----------------------------------------------------------------------
417 * EXPORTED uss_kauth_DelUser
418 *
419 * Environment:
420 * The uconn_kauthP variable may already be set to an AuthServer
421 * connection.
422 *
423 * Side Effects:
424 * As advertised.
425 *------------------------------------------------------------------------*/
426
427afs_int32
428uss_kauth_DelUser(char *a_user)
429{ /*uss_kauth_DelUser */
430#ifdef USS_KAUTH_DB
431 static char rn[] = "uss_kauth_DelUser"; /*Routine name */
432#endif
433 afs_int32 code; /*Return code */
434
435 if (uss_SkipKaserver) {
436 /*
437 * Don't talk to the kaserver; assume calls succeded and simply return.
438 * Amasingly people want to update it (most likely kerberos) themselves...
439 */
440 if (uss_verbose)
441 printf
442 ("[Skip Kaserver option - Deleting of user %s in Authentication DB not done]\n",
443 a_user);
444 return 0;
445 }
446
447 /*
448 * Make sure the module has been initialized before we start trying
449 * to talk to AuthServers.
450 */
451 if (!initDone) {
452 code = InitThisModule();
453 if (code)
454 exit(code);
455 }
456
457 if (!uss_DryRun) {
458#ifdef USS_KAUTH_DB_INSTANCE
459 printf("%s: KAM_DeleteUser: user='%s', CreatorInstance='%s'\n",
460 uss_whoami, a_user, CreatorInstance);
461#endif /* USS_KAUTH_DB_INSTANCE */
462 if (uss_verbose)
463 printf("Deleting user '%s' from Authentication DB\n", a_user);
464 code = ubik_KAM_DeleteUser(
465 uconn_kauthP, /*Ubik client connection struct */
466 0, /*Flags */
467 a_user, /*User name to delete */
468 UserInstance); /*set in CheckUserName() */
469 if (code) {
470 if (code == KANOENT(180484L)) {
471 if (uss_verbose)
472 printf
473 ("%s: No entry for user '%s' in Authentication DB\n",
474 uss_whoami, a_user);
475 return (0);
476 } else {
477 afs_com_err(uss_whoami, code,
478 "while deleting entry in Authentication DB\n");
479#ifdef USS_KAUTH_DB
480 printf("%s: Error code from KAM_DeleteUser: %d\n", rn, code);
481#endif /* USS_KAUTH_DB */
482 return (code);
483 }
484 } /*KAM_DeleteUser failed */
485 } /*Not a dry run */
486 else
487 printf("\t[Dry run - user '%s' NOT deleted from Authentication DB]\n",
488 a_user);
489
490 return (0);
491
492} /*uss_kauth_DelUser */
493
494
495/*-----------------------------------------------------------------------
496 * EXPORTED uss_kauth_CheckUserName
497 *
498 * Environment:
499 * The user name has already been parsed and placed into
500 * uss_User.
501 *
502 * Side Effects:
503 * As advertised.
504 *------------------------------------------------------------------------*/
505
506afs_int32
507uss_kauth_CheckUserName(void)
508{ /*uss_kauth_CheckUserName */
509#ifdef USS_KAUTH_DB
510 static char rn[] = "uss_kauth_CheckUserName"; /*Routine name */
511#endif
512 afs_int32 code; /*Return code */
513
514 if (uss_SkipKaserver) {
515 /*
516 * Don't talk to the kaserver; assume calls succeded and simply return.
517 * Amasingly people want to update it (most likely kerberos) themselves...
518 */
519 if (uss_verbose)
520 printf
521 ("[Skip Kaserver option - Checking of user name in Authentication DB not done]\n");
522 return 0;
523 }
524
525 /*
526 * Make sure the module has been initialized before we start trying
527 * to talk to AuthServers.
528 */
529 if (!initDone) {
530 code = InitThisModule();
531 if (code)
532 exit(code);
533 }
534
535 /*
536 * Use the AuthServer's own routine to decide if the parsed user name
537 * is legal. Specifically, it can't have any weird characters or
538 * embedded instance or cell names.
539 */
540 code = ka_ParseLoginName(uss_User, UserPrincipal, UserInstance, UserCell);
Value stored to 'code' is never read
541 if (strlen(UserInstance) > 0) {
542 fprintf(stderr__stderrp,
543 "%s: User name can't have an instance string ('%s')\n",
544 uss_whoami, UserInstance);
545 return (-1);
546 }
547 if (strlen(UserCell) > 0) {
548 fprintf(stderr__stderrp, "%s: User name can't have a cell string ('%s')\n",
549 uss_whoami, UserCell);
550 return (-1);
551 }
552 if (strchr(UserPrincipal, ':') != NULL((void *)0)) {
553 fprintf(stderr__stderrp, "%s: User name '%s' can't have a colon\n", uss_whoami,
554 UserPrincipal);
555 return (-1);
556 }
557 if (strlen(UserPrincipal) > 8) {
558 fprintf(stderr__stderrp,
559 "%s: User name '%s' must have 8 or fewer characters\n",
560 uss_whoami, UserPrincipal);
561 return (-1);
562 }
563
564 /*
565 * The name's OK in my book. Replace the user name with the parsed
566 * value.
567 */
568 strcpy(uss_User, UserPrincipal);
569 return (0);
570
571} /*uss_kauth_CheckUserName */
572
573
574/*
575 * EXPORTED uss_kauth_SetFields
576 *
577 * Environment:
578 * The uconn_kauthP variable may already be set to an AuthServer
579 * connection.
580 *
581 * Side Effects:
582 * As advertised.
583 */
584
585afs_int32
586uss_kauth_SetFields(char *username, char *expirestring, char *reuse,
587 char *failures, char *lockout)
588{
589#ifdef USS_KAUTH_DB
590 static char rn[] = "uss_kauth_SetFields";
591#endif
592 afs_int32 code;
593 char misc_auth_bytes[4];
594 int i;
595 afs_int32 flags = 0;
596 Dateafs_uint32 expiration = 0;
597 afs_int32 lifetime = 0;
598 afs_int32 maxAssociates = -1;
599 afs_int32 was_spare = 0;
600 char instance = '\0';
601 int pwexpiry;
602 int nfailures, locktime, hrs, mins;
603
604 if (strlen(username) > uss_UserLen8) {
605 fprintf(stderr__stderrp,
606 "%s: * User field in add cmd too long (max is %d chars; truncated value is '%s')\n",
607 uss_whoami, uss_UserLen8, uss_User);
608 return (-1);
609 }
610
611 strcpy(uss_User, username);
612 code = uss_kauth_CheckUserName();
613 if (code)
614 return (code);
615
616 /* no point in doing this any sooner than necessary */
617 for (i = 0; i < 4; misc_auth_bytes[i++] = 0);
618
619 pwexpiry = atoi(expirestring);
620 if (pwexpiry < 0 || pwexpiry > 254) {
621 fprintf(stderr__stderrp, "Password lifetime range must be [0..254] days.\n");
622 fprintf(stderr__stderrp, "Zero represents an unlimited lifetime.\n");
623 fprintf(stderr__stderrp,
624 "Continuing with default lifetime == 0 for user %s.\n",
625 username);
626 pwexpiry = 0;
627 }
628 misc_auth_bytes[0] = pwexpiry + 1;
629
630 if (!strcmp(reuse, "noreuse")) {
631 misc_auth_bytes[1] = KA_NOREUSEPW2;
632 } else {
633 misc_auth_bytes[1] = KA_REUSEPW1;
634 if (strcmp(reuse, "reuse"))
635 fprintf(stderr__stderrp, "must specify \"reuse\" or \"noreuse\": \"reuse\" assumed\n");
636 }
637
638 nfailures = atoi(failures);
639 if (nfailures < 0 || nfailures > 254) {
640 fprintf(stderr__stderrp, "Failure limit must be in [0..254].\n");
641 fprintf(stderr__stderrp, "Zero represents unlimited login attempts.\n");
642 fprintf(stderr__stderrp, "Continuing with limit == 254 for user %s.\n",
643 username);
644 misc_auth_bytes[2] = 255;
645 } else
646 misc_auth_bytes[2] = nfailures + 1;
647
648 hrs = 0;
649 if (strchr(lockout, ':'))
650 sscanf(lockout, "%d:%d", &hrs, &mins);
651 else
652 sscanf(lockout, "%d", &mins);
653
654 locktime = hrs*60 + mins;
655 if (hrs < 0 || hrs > 36 || mins < 0) {
656 fprintf(stderr__stderrp,"Lockout times must be either minutes or hh:mm.\n");
657 fprintf(stderr__stderrp,"Lockout times must be less than 36 hours.\n");
658 return KABADCMD(180493L);
659 } else if (locktime > 36*60) {
660 fprintf(stderr__stderrp, "Lockout times must be either minutes or hh:mm.\n");
661 fprintf(stderr__stderrp, "Lockout times must be less than 36 hours.\n");
662 fprintf(stderr__stderrp, "Continuing with lock time == forever for user %s.\n",
663 username);
664 misc_auth_bytes[3] = 1;
665 } else {
666 locktime = (locktime * 60 + 511) >> 9; /* ceil(l*60/512) */
667 misc_auth_bytes[3] = locktime + 1;
668 }
669
670 if (uss_SkipKaserver) {
671 if (uss_verbose)
672 printf("[Skipping Kaserver as requested]\n");
673 return 0;
674 }
675
676 /*
677 * Make sure the module has been initialized before we start trying
678 * to talk to AuthServers.
679 */
680 if (!initDone) {
681 code = InitThisModule();
682 if (code)
683 exit(code);
684 }
685
686 if (!uss_DryRun) {
687 if (uss_verbose)
688 fprintf(stderr__stderrp, "Setting options for '%s' in database.\n",
689 username);
690
691 was_spare = pack_long(misc_auth_bytes)( (afs_uint32) ( ((afs_uint32) ((misc_auth_bytes)[0] & 0xff
) << 24) | ((afs_uint32) ((misc_auth_bytes)[1] & 0xff
) << 16) | ((afs_uint32) ((misc_auth_bytes)[2] & 0xff
) << 8) | ((afs_uint32) ((misc_auth_bytes)[3] & 0xff
) << 0) ) );
692
693 if (was_spare || flags || expiration || lifetime
694 || (maxAssociates >= 0)) {
695
696 if (!expiration)
697 expiration = uss_Expires;
698 code =
699 ubik_KAM_SetFields(uconn_kauthP, 0, username, &instance,
700 flags, expiration, lifetime, maxAssociates,
701 was_spare, /* spare */ 0);
702 } else
703 fprintf(stderr__stderrp,
704 "Must specify one of the optional parameters. Continuing...\n");
705
706 if (code) {
707 afs_com_err(uss_whoami, code, "calling KAM_SetFields for %s",
708 username);
709
710 return (code);
711 }
712 } /*Not a dry run */
713 else
714 fprintf(stderr__stderrp, "\t[Dry run - user '%s' NOT changed.]\n", username);
715
716 return (0);
717
718} /*uss_kauth_SetFields */