rkerberos 0.2.2 → 0.3.0

data/ext/rkerberos/kadm5.c

@@ -9,6 +9,7 @@ VALUE cKadm5PrincipalNotFoundException;
 // Prototype
 static VALUE rkadm5_close(VALUE);
 static void free_tl_data(krb5_tl_data *);
+static void free_db_args(char**);
 char** parse_db_args(VALUE v_db_args);
 void add_db_args(kadm5_principal_ent_rec*, char**);
 void add_tl_data(krb5_int16 *, krb5_tl_data **,
@@ -16,6 +17,13 @@ void add_tl_data(krb5_int16 *, krb5_tl_data **,
 
 
 // TypedData functions for RUBY_KADM5
+static void rkadm5_typed_mark(void *ptr) {
+  if (!ptr) return;
+  RUBY_KADM5 *k = (RUBY_KADM5 *)ptr;
+  if (k->rb_context != Qnil)
+    rb_gc_mark(k->rb_context);
+}
+
 static void rkadm5_typed_free(void *ptr) {
   if (!ptr) return;
   RUBY_KADM5 *k = (RUBY_KADM5 *)ptr;
@@ -23,9 +31,9 @@ static void rkadm5_typed_free(void *ptr) {
     kadm5_destroy(k->handle);
   if (k->princ)
     krb5_free_principal(k->ctx, k->princ);
-  if (k->ctx)
+  if (k->ctx && k->rb_context == Qnil)
     krb5_free_context(k->ctx);
-  free(k->db_args);
+  free_db_args(k->db_args);
   free(k);
 }
 
@@ -35,7 +43,7 @@ static size_t rkadm5_typed_size(const void *ptr) {
 
 static const rb_data_type_t rkadm5_data_type = {
   "RUBY_KADM5",
-  {NULL, rkadm5_typed_free, rkadm5_typed_size,},
+  {rkadm5_typed_mark, rkadm5_typed_free, rkadm5_typed_size,},
   NULL, NULL, RUBY_TYPED_FREE_IMMEDIATELY
 };
 
@@ -43,34 +51,48 @@ static const rb_data_type_t rkadm5_data_type = {
 static VALUE rkadm5_allocate(VALUE klass){
   RUBY_KADM5* ptr = ALLOC(RUBY_KADM5);
   memset(ptr, 0, sizeof(RUBY_KADM5));
+  ptr->rb_context = Qnil;
   return TypedData_Wrap_Struct(klass, &rkadm5_data_type, ptr);
 }
 
 /*
  * call-seq:
- *   Kerberos::Kadm5.new(:principal => 'name', :password => 'xxxxx')
- *   Kerberos::Kadm5.new(:principal => 'name', :keytab => '/path/to/your/keytab')
- *   Kerberos::Kadm5.new(:principal => 'name', :keytab => true)
+ *   Kerberos::Kadm5.new(principal: 'name', password: 'xxxxx')
+ *   Kerberos::Kadm5.new(principal: 'name', keytab: '/path/to/your/keytab')
+ *   Kerberos::Kadm5.new(principal: 'name', keytab: true)
+ *   Kerberos::Kadm5.new(principal: 'name', ccache: ccache_object)
  *
- * Creates and returns a new Kerberos::Kadm5 object. A hash argument is
- * accepted that allows you to specify a principal and a password, or
- * a keytab file.
+ * Creates and returns a new Kerberos::Kadm5 object. Keyword arguments allow
+ * you to specify a principal and a password, a keytab file, or a credentials
+ * cache.
  *
  * If you pass a string as the :keytab value it will attempt to use that file
  * for the keytab. If you pass true as the value it will attempt to use the
  * default keytab file, typically /etc/krb5.keytab.
  *
+ * If you pass a Kerberos::Krb5::CredentialsCache object as the :ccache value,
+ * it will authenticate using the credentials stored in that cache via
+ * kadm5_init_with_creds.
+ *
  * You may also pass the :service option to specify the service name. The
  * default is kadmin/admin.
  *
  * There is also a :db_args option, which is a single string or array of strings
  * containing options usually passed to kadmin with the -x switch. For a list of
- * available options, see the kadmin manpage
+ * available options, see the kadmin manpage.
+ *
+ * Only one of :password, :keytab, or :ccache may be specified.
  *
  */
-static VALUE rkadm5_initialize(VALUE self, VALUE v_opts){
+static VALUE rkadm5_initialize(int argc, VALUE* argv, VALUE self){
   RUBY_KADM5* ptr;
-  VALUE v_principal, v_password, v_keytab, v_service, v_db_args;
+  VALUE v_opts, v_principal, v_password, v_keytab, v_service, v_db_args, v_context, v_ccache;
+  ID kw_table[7] = {
+    rb_intern("principal"), rb_intern("password"), rb_intern("keytab"),
+    rb_intern("ccache"), rb_intern("service"), rb_intern("db_args"),
+    rb_intern("context")
+  };
+  VALUE kw_vals[7];
   char* user;
   char* pass = NULL;
   char* keytab = NULL;
@@ -79,35 +101,59 @@ static VALUE rkadm5_initialize(VALUE self, VALUE v_opts){
   krb5_error_code kerror;
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
-  Check_Type(v_opts, T_HASH);
-
-  // Accept both string and symbol keys
-  v_principal = rb_hash_aref2(v_opts, rb_str_new_cstr("principal"));
-  if (NIL_P(v_principal)) v_principal = rb_hash_aref2(v_opts, ID2SYM(rb_intern("principal")));
-
-  // Principal must be specified
-  if(NIL_P(v_principal))
-    rb_raise(rb_eArgError, "principal must be specified");
-
-  Check_Type(v_principal, T_STRING);
-  user = StringValueCStr(v_principal);
-
-  v_password = rb_hash_aref2(v_opts, rb_str_new_cstr("password"));
-  if (NIL_P(v_password)) v_password = rb_hash_aref2(v_opts, ID2SYM(rb_intern("password")));
-  v_keytab = rb_hash_aref2(v_opts, rb_str_new_cstr("keytab"));
-  if (NIL_P(v_keytab)) v_keytab = rb_hash_aref2(v_opts, ID2SYM(rb_intern("keytab")));
-
-  if(RTEST(v_password) && RTEST(v_keytab))
-    rb_raise(rb_eArgError, "cannot use both a password and a keytab");
+  rb_scan_args(argc, argv, "0:", &v_opts);
+
+  if(NIL_P(v_opts))
+    v_opts = rb_hash_new();
+
+  rb_get_kwargs(v_opts, kw_table, 0, 7, kw_vals);
+  v_principal = kw_vals[0] == Qundef ? Qnil : kw_vals[0];
+  v_password = kw_vals[1] == Qundef ? Qnil : kw_vals[1];
+  v_keytab = kw_vals[2] == Qundef ? Qnil : kw_vals[2];
+  v_ccache = kw_vals[3] == Qundef ? Qnil : kw_vals[3];
+  v_service = kw_vals[4] == Qundef ? Qnil : kw_vals[4];
+  v_db_args = kw_vals[5] == Qundef ? Qnil : kw_vals[5];
+  v_context = kw_vals[6] == Qundef ? Qnil : kw_vals[6];
+
+  // Validate mutual exclusivity
+  {
+    int auth_count = 0;
+    if(RTEST(v_password)) auth_count++;
+    if(RTEST(v_keytab))   auth_count++;
+    if(RTEST(v_ccache))   auth_count++;
+
+    if(auth_count > 1)
+      rb_raise(rb_eArgError, "only one of password, keytab, or ccache may be specified");
+
+    if(auth_count == 0)
+      rb_raise(rb_eArgError, "one of password, keytab, or ccache must be specified");
+  }
 
+  // Principal must be specified if using a password
   if(RTEST(v_password)){
+    if(NIL_P(v_principal))
+      rb_raise(rb_eArgError, "principal must be specified");
+
     Check_Type(v_password, T_STRING);
+    Check_Type(v_principal, T_STRING);
+
     pass = StringValueCStr(v_password);
   }
 
-  v_service = rb_hash_aref2(v_opts, rb_str_new_cstr("service"));
-  if (NIL_P(v_service)) v_service = rb_hash_aref2(v_opts, ID2SYM(rb_intern("service")));
+  if(RTEST(v_ccache) && NIL_P(v_principal)){
+    if(NIL_P(v_principal))
+      v_principal = rb_funcall(v_ccache, rb_intern("principal"), 0);
+  }
 
+  // For a keytab use the first entry's principal
+  if(RTEST(v_keytab) && NIL_P(v_principal)) {
+    VALUE v_enum, v_first;
+    v_enum = rb_funcall(v_keytab, rb_intern("each"), 0);
+    v_first = rb_funcall(v_enum, rb_intern("first"), 0);
+    v_principal = rb_iv_get(v_first, "@principal");
+  }
+
+  user = StringValueCStr(v_principal);
   if(NIL_P(v_service)){
     service = (char *) "kadmin/admin";
   }
@@ -116,16 +162,31 @@ static VALUE rkadm5_initialize(VALUE self, VALUE v_opts){
     service = StringValueCStr(v_service);
   }
 
-  v_db_args = rb_hash_aref2(v_opts, rb_str_new_cstr("db_args"));
-  if (NIL_P(v_db_args)) v_db_args = rb_hash_aref2(v_opts, ID2SYM(rb_intern("db_args")));
   ptr->db_args = parse_db_args(v_db_args);
 
-  // Normally I would wait to initialize the context, but we might need it
-  // to get the default keytab file name.
-  kerror = krb5_init_context(&ptr->ctx);
+  // Initialize or borrow the context
+  if(!NIL_P(v_context)){
+    RUBY_KRB5_CONTEXT* ctx_ptr;
 
-  if(kerror)
-    rb_raise(cKadm5Exception, "krb5_init_context: %s", error_message(kerror));
+    if(!rb_obj_is_kind_of(v_context, cKrb5Context))
+      rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");
+
+    TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ctx_ptr);
+
+    if(!ctx_ptr->ctx)
+      rb_raise(cKrb5Exception, "context is closed");
+
+    ptr->ctx = ctx_ptr->ctx;
+    ptr->rb_context = v_context;
+  }
+  else{
+    kerror = krb5_init_context(&ptr->ctx);
+
+    if(kerror)
+      rb_raise(cKadm5Exception, "krb5_init_context: %s", error_message(kerror));
+
+    ptr->rb_context = Qnil;
+  }
 
   // The docs say I can use NULL to get the default, but reality appears to be otherwise.
   if(RTEST(v_keytab)){
@@ -175,8 +236,31 @@ static VALUE rkadm5_initialize(VALUE self, VALUE v_opts){
     if(kerror)
       rb_raise(cKadm5Exception, "kadm5_init_with_skey: %s", error_message(kerror));
   }
-  else{
-    // TODO: Credentials cache.
+  else if(RTEST(v_ccache)){
+    RUBY_KRB5_CCACHE* cc_ptr;
+
+    if(!rb_obj_is_kind_of(v_ccache, cKrb5CCache))
+      rb_raise(rb_eTypeError, "ccache must be a Kerberos::Krb5::CredentialsCache object");
+
+    TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, cc_ptr);
+
+    if(!cc_ptr->ccache)
+      rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");
+
+    kerror = kadm5_init_with_creds(
+      ptr->ctx,
+      user,
+      cc_ptr->ccache,
+      service,
+      NULL,
+      KADM5_STRUCT_VERSION,
+      KADM5_API_VERSION_3,
+      ptr->db_args,
+      &ptr->handle
+    );
+
+    if(kerror)
+      rb_raise(cKadm5Exception, "kadm5_init_with_creds: %s", error_message(kerror));
   }
 
   if(rb_block_given_p()){
@@ -280,50 +364,148 @@ static VALUE rkadm5_set_pwexpire(VALUE self, VALUE v_user, VALUE v_pwexpire){
 
 /*
  * call-seq:
- *   kadm5.create_principal(name, password, db_args=nil)
- *   kadm5.create_principal(principal)
+ *   kadm5.create_principal(name:, password:, db_args: nil)
+ *   kadm5.create_principal(principal:, password:, db_args: nil)
+ *
+ * Creates a new principal with an initial password of +password+.
  *
- * Creates a new principal +name+ with an initial password of +password+.
- * +db_args+ is an optional string or array of strings containing options that are usually
- * passed to add_principal with the -x option. For a list of options, see the kadmin manpage,
- * in the add_principal section.
- *--
- * TODO: Allow a Principal object to be passed in as an argument.
+ * The principal may be specified either as a +name+ string or as a
+ * +principal+ object (a Kerberos::Krb5::Principal). When a Principal
+ * object is provided, any non-nil writable attributes on that object
+ * are forwarded to the KDC:
+ *
+ *   * +policy+
+ *   * +expire_time+
+ *   * +password_expiration+
+ *   * +max_life+
+ *   * +max_renewable_life+
+ *   * +attributes+
+ *
+ * +db_args+ is an optional string or array of strings containing options
+ * that are usually passed to add_principal with the -x option. For a
+ * list of options, see the kadmin manpage, in the add_principal section.
  */
 static VALUE rkadm5_create_principal(int argc, VALUE* argv, VALUE self){
   RUBY_KADM5* ptr;
-  char* user;
   char* pass;
   char** db_args;
   int mask;
   kadm5_principal_ent_rec princ;
   krb5_error_code kerror;
-  VALUE v_user, v_pass, v_db_args;
+  VALUE v_opts, v_name, v_principal, v_pass, v_db_args;
+  ID kw_table[4] = { rb_intern("name"), rb_intern("principal"), rb_intern("password"), rb_intern("db_args") };
+  VALUE kw_vals[4];
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
-  rb_scan_args(argc, argv, "21", &v_user, &v_pass, &v_db_args);
-  Check_Type(v_user, T_STRING);
+  rb_scan_args(argc, argv, "0:", &v_opts);
+
+  if(NIL_P(v_opts))
+    v_opts = rb_hash_new();
+
+  rb_get_kwargs(v_opts, kw_table, 0, 4, kw_vals);
+  v_name = kw_vals[0] == Qundef ? Qnil : kw_vals[0];
+  v_principal = kw_vals[1] == Qundef ? Qnil : kw_vals[1];
+  v_pass = kw_vals[2] == Qundef ? Qnil : kw_vals[2];
+  v_db_args = kw_vals[3] == Qundef ? Qnil : kw_vals[3];
+
+  if(NIL_P(v_pass))
+    rb_raise(rb_eArgError, "password: is required");
+
   Check_Type(v_pass, T_STRING);
 
+  if(NIL_P(v_name) && NIL_P(v_principal))
+    rb_raise(rb_eArgError, "name: or principal: is required");
+
+  if(RTEST(v_name) && RTEST(v_principal))
+    rb_raise(rb_eArgError, "name: and principal: are mutually exclusive");
+
   memset(&princ, 0, sizeof(princ));
 
   mask = KADM5_PRINCIPAL | KADM5_TL_DATA;
-  user = StringValueCStr(v_user);
   pass = StringValueCStr(v_pass);
 
   db_args = parse_db_args(v_db_args);
   add_db_args(&princ, db_args);
-  free(db_args);
+  free_db_args(db_args);
 
   if(!ptr->ctx)
     rb_raise(cKadm5Exception, "no context has been established");
 
-  kerror = krb5_parse_name(ptr->ctx, user, &princ.principal);
+  // Determine the principal name and populate mask from the principal object
+  if(RTEST(v_principal)){
+    VALUE v_princ_name, v_policy, v_expire, v_pw_expire, v_max_life, v_max_renew, v_attrs;
 
-  if(kerror){
-    free_tl_data(princ.tl_data);
-    rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));
+    if(!rb_obj_is_kind_of(v_principal, cKrb5Principal))
+      rb_raise(rb_eTypeError, "principal: must be a Kerberos::Krb5::Principal object");
+
+    v_princ_name = rb_iv_get(v_principal, "@principal");
+
+    if(NIL_P(v_princ_name))
+      rb_raise(rb_eArgError, "principal object has no name set");
+
+    Check_Type(v_princ_name, T_STRING);
+
+    kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_princ_name), &princ.principal);
+
+    if(kerror){
+      free_tl_data(princ.tl_data);
+      rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));
+    }
+
+    // Forward optional attributes from the Principal object
+    v_policy = rb_iv_get(v_principal, "@policy");
+
+    if(RTEST(v_policy)){
+      Check_Type(v_policy, T_STRING);
+      princ.policy = StringValueCStr(v_policy);
+      mask |= KADM5_POLICY;
+    }
+
+    v_expire = rb_iv_get(v_principal, "@expire_time");
+
+    if(RTEST(v_expire)){
+      princ.princ_expire_time = (krb5_timestamp)NUM2LONG(rb_funcall(v_expire, rb_intern("to_i"), 0));
+      mask |= KADM5_PRINC_EXPIRE_TIME;
+    }
+
+    v_pw_expire = rb_iv_get(v_principal, "@password_expiration");
+
+    if(RTEST(v_pw_expire)){
+      princ.pw_expiration = (krb5_timestamp)NUM2LONG(rb_funcall(v_pw_expire, rb_intern("to_i"), 0));
+      mask |= KADM5_PW_EXPIRATION;
+    }
+
+    v_max_life = rb_iv_get(v_principal, "@max_life");
+
+    if(RTEST(v_max_life)){
+      princ.max_life = NUM2LONG(v_max_life);
+      mask |= KADM5_MAX_LIFE;
+    }
+
+    v_max_renew = rb_iv_get(v_principal, "@max_renewable_life");
+
+    if(RTEST(v_max_renew)){
+      princ.max_renewable_life = NUM2LONG(v_max_renew);
+      mask |= KADM5_MAX_RLIFE;
+    }
+
+    v_attrs = rb_iv_get(v_principal, "@attributes");
+
+    if(RTEST(v_attrs)){
+      princ.attributes = NUM2LONG(v_attrs);
+      mask |= KADM5_ATTRIBUTES;
+    }
+  }
+  else{
+    Check_Type(v_name, T_STRING);
+
+    kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_name), &princ.principal);
+
+    if(kerror){
+      free_tl_data(princ.tl_data);
+      rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));
+    }
   }
 
   kerror = kadm5_create_principal(ptr->handle, &princ, mask, pass);
@@ -395,15 +577,16 @@ static VALUE rkadm5_close(VALUE self){
   if(ptr->princ)
     krb5_free_principal(ptr->ctx, ptr->princ);
 
-  if(ptr->ctx)
+  if(ptr->ctx && ptr->rb_context == Qnil)
     krb5_free_context(ptr->ctx);
 
-  free(ptr->db_args);
+  free_db_args(ptr->db_args);
 
   ptr->db_args = NULL;
   ptr->ctx    = NULL;
   ptr->princ  = NULL;
   ptr->handle = NULL;
+  ptr->rb_context = Qnil;
 
   return self;
 }
@@ -412,11 +595,11 @@ static VALUE rkadm5_close(VALUE self){
 static VALUE create_principal_from_entry(VALUE v_name, RUBY_KADM5* ptr, kadm5_principal_ent_rec* ent){
   krb5_error_code kerror;
   VALUE v_principal;
-  VALUE v_args[1];
+  VALUE v_opts = rb_hash_new();
 
-  v_args[0] = v_name;
+  rb_hash_aset(v_opts, ID2SYM(rb_intern("name")), v_name);
 
-  v_principal = rb_class_new_instance(1, v_args, cKrb5Principal);
+  v_principal = rb_class_new_instance_kw(1, &v_opts, cKrb5Principal, RB_PASS_KEYWORDS);
 
   rb_iv_set(v_principal, "@attributes", LONG2FIX(ent->attributes));
   rb_iv_set(v_principal, "@aux_attributes", INT2FIX(ent->aux_attributes));
@@ -446,8 +629,10 @@ static VALUE create_principal_from_entry(VALUE v_name, RUBY_KADM5* ptr, kadm5_pr
     char* mod_name;
     kerror = krb5_unparse_name(ptr->ctx, ent->mod_name, &mod_name);
 
-    if(kerror)
+    if(kerror){
+      kadm5_free_principal_ent(ptr->handle, ent);
       rb_raise(cKadm5Exception, "krb5_unparse_name: %s", error_message(kerror));
+    }
 
     rb_iv_set(v_principal, "@mod_name", rb_str_new2(mod_name));
     krb5_free_unparsed_name(ptr->ctx, mod_name);
@@ -459,6 +644,8 @@ static VALUE create_principal_from_entry(VALUE v_name, RUBY_KADM5* ptr, kadm5_pr
   if(ent->policy)
     rb_iv_set(v_principal, "@policy", rb_str_new2(ent->policy));
 
+  kadm5_free_principal_ent(ptr->handle, ent);
+
   return v_principal;
 }
 
@@ -518,7 +705,6 @@ static VALUE rkadm5_find_principal(VALUE self, VALUE v_user){
   }
   else{
     v_principal = create_principal_from_entry(v_user, ptr, &ent);
-    kadm5_free_principal_ent(ptr->handle, &ent);
   }
 
   return v_principal;
@@ -580,8 +766,6 @@ static VALUE rkadm5_get_principal(VALUE self, VALUE v_user){
 
   v_principal = create_principal_from_entry(v_user, ptr, &ent);
 
-  kadm5_free_principal_ent(ptr->handle, &ent);
-
   return v_principal;
 }
 
@@ -594,28 +778,39 @@ static VALUE rkadm5_get_principal(VALUE self, VALUE v_user){
  * Example:
  *
  *   # Using a Policy object
- *   policy = Kerberos::Kadm5::Policy.new(:name => 'test', :min_length => 5)
+ *   policy = Kerberos::Kadm5::Policy.new(name: 'test', min_length: 5)
  *   kadm5.create_policy(policy)
  *
- *   # Using a hash
- *   kadm5.create_policy(:name => 'test', :min_length => 5)
+ *   # Using keywords
+ *   kadm5.create_policy(name: 'test', min_length: 5)
  */
-static VALUE rkadm5_create_policy(VALUE self, VALUE v_policy){
+static VALUE rkadm5_create_policy(int argc, VALUE* argv, VALUE self){
   RUBY_KADM5* ptr;
   kadm5_ret_t kerror;
   kadm5_policy_ent_rec ent;
   long mask = KADM5_POLICY;
+  VALUE v_policy, v_kwargs;
   VALUE v_name, v_min_classes, v_min_life, v_max_life, v_min_length, v_history_num;
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
-  // Allow a hash or a Policy object
-  if(rb_obj_is_kind_of(v_policy, rb_cHash)){
+  rb_scan_args(argc, argv, "01:", &v_policy, &v_kwargs);
+
+  if(!NIL_P(v_kwargs)){
     VALUE v_args[1];
-    v_args[0] = v_policy;
-    v_policy = rb_class_new_instance(1, v_args, cKadm5Policy);
+    if(!NIL_P(v_policy))
+      rb_raise(rb_eArgError, "provide a Policy object or keyword arguments, not both");
+
+    v_args[0] = v_kwargs;
+    v_policy = rb_class_new_instance_kw(1, v_args, cKadm5Policy, RB_PASS_KEYWORDS);
   }
 
+  if(NIL_P(v_policy))
+    rb_raise(rb_eArgError, "a Policy object or policy keywords are required");
+
+  if(!rb_obj_is_kind_of(v_policy, cKadm5Policy))
+    rb_raise(rb_eTypeError, "expected a Kerberos::Kadm5::Policy object or policy keywords");
+
   v_name        = rb_iv_get(v_policy, "@policy");
   v_min_classes = rb_iv_get(v_policy, "@min_classes");
   v_min_length  = rb_iv_get(v_policy, "@min_length");
@@ -723,16 +918,16 @@ static VALUE rkadm5_get_policy(VALUE self, VALUE v_name){
     VALUE v_arg[1];
     VALUE v_hash = rb_hash_new();
 
-    rb_hash_aset(v_hash, rb_str_new2("name"), rb_str_new2(ent.policy));
-    rb_hash_aset(v_hash, rb_str_new2("min_life"), LONG2FIX(ent.pw_min_life));
-    rb_hash_aset(v_hash, rb_str_new2("max_life"), LONG2FIX(ent.pw_max_life));
-    rb_hash_aset(v_hash, rb_str_new2("min_length"), LONG2FIX(ent.pw_min_length));
-    rb_hash_aset(v_hash, rb_str_new2("min_classes"), LONG2FIX(ent.pw_min_classes));
-    rb_hash_aset(v_hash, rb_str_new2("history_num"), LONG2FIX(ent.pw_history_num));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("name")), rb_str_new2(ent.policy));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_life")), LONG2FIX(ent.pw_min_life));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("max_life")), LONG2FIX(ent.pw_max_life));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_length")), LONG2FIX(ent.pw_min_length));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_classes")), LONG2FIX(ent.pw_min_classes));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("history_num")), LONG2FIX(ent.pw_history_num));
 
     v_arg[0] = v_hash;
 
-    v_policy = rb_class_new_instance(1, v_arg, cKadm5Policy);
+    v_policy = rb_class_new_instance_kw(1, v_arg, cKadm5Policy, RB_PASS_KEYWORDS);
 
     kadm5_free_policy_ent(ptr->handle, &ent);
   }
@@ -780,16 +975,16 @@ static VALUE rkadm5_find_policy(VALUE self, VALUE v_name){
     VALUE v_arg[1];
     VALUE v_hash = rb_hash_new();
 
-    rb_hash_aset(v_hash, rb_str_new2("name"), rb_str_new2(ent.policy));
-    rb_hash_aset(v_hash, rb_str_new2("min_life"), LONG2FIX(ent.pw_min_life));
-    rb_hash_aset(v_hash, rb_str_new2("max_life"), LONG2FIX(ent.pw_max_life));
-    rb_hash_aset(v_hash, rb_str_new2("min_length"), LONG2FIX(ent.pw_min_length));
-    rb_hash_aset(v_hash, rb_str_new2("min_classes"), LONG2FIX(ent.pw_min_classes));
-    rb_hash_aset(v_hash, rb_str_new2("history_num"), LONG2FIX(ent.pw_history_num));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("name")), rb_str_new2(ent.policy));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_life")), LONG2FIX(ent.pw_min_life));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("max_life")), LONG2FIX(ent.pw_max_life));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_length")), LONG2FIX(ent.pw_min_length));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_classes")), LONG2FIX(ent.pw_min_classes));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("history_num")), LONG2FIX(ent.pw_history_num));
 
     v_arg[0] = v_hash;
 
-    v_policy = rb_class_new_instance(1, v_arg, cKadm5Policy);
+    v_policy = rb_class_new_instance_kw(1, v_arg, cKadm5Policy, RB_PASS_KEYWORDS);
 
     kadm5_free_policy_ent(ptr->handle, &ent);
   }
@@ -1039,7 +1234,7 @@ char** parse_db_args(VALUE v_db_args){
   switch(TYPE(v_db_args)){
     case T_STRING:
       db_args = (char **) malloc(2 * sizeof(char *));
-      db_args[0] = StringValueCStr(v_db_args);
+      db_args[0] = strdup(StringValueCStr(v_db_args));
       db_args[1] = NULL;
       break;
     case T_ARRAY:
@@ -1049,7 +1244,7 @@ char** parse_db_args(VALUE v_db_args){
       for(long i = 0; i < array_length; ++i){
         VALUE elem = rb_ary_entry(v_db_args, i);
         Check_Type(elem, T_STRING);
-        db_args[i] = StringValueCStr(elem);
+        db_args[i] = strdup(StringValueCStr(elem));
       }
       db_args[array_length] = NULL;
       break;
@@ -1062,6 +1257,16 @@ char** parse_db_args(VALUE v_db_args){
   return db_args;
 }
 
+/**
+ * Free a NULL-terminated array of strings returned by parse_db_args.
+ */
+static void free_db_args(char** db_args){
+  if(!db_args) return;
+  for(int i = 0; db_args[i] != NULL; i++)
+    free(db_args[i]);
+  free(db_args);
+}
+
 /**
  * Add parsed db-args to principal entry
  */
@@ -1125,12 +1330,12 @@ void Init_kadm5(void){
 
   // Initialization Method
 
-  rb_define_method(cKadm5, "initialize", rkadm5_initialize, 1);
+  rb_define_method(cKadm5, "initialize", rkadm5_initialize, -1);
 
   // Instance Methods
 
   rb_define_method(cKadm5, "close", rkadm5_close, 0);
-  rb_define_method(cKadm5, "create_policy", rkadm5_create_policy, 1);
+  rb_define_method(cKadm5, "create_policy", rkadm5_create_policy, -1);
   rb_define_method(cKadm5, "create_principal", rkadm5_create_principal, -1);
   rb_define_method(cKadm5, "delete_policy", rkadm5_delete_policy, 1);
   rb_define_method(cKadm5, "delete_principal", rkadm5_delete_principal, 1);