rkerberos 0.2.3 → 0.3.0

data/ext/rkerberos/rkerberos.c

@@ -25,6 +25,13 @@ VALUE rb_hash_aref2(VALUE v_hash, VALUE v_key){
 
 
 // TypedData functions for RUBY_KRB5
+static void rkrb5_typed_mark(void *ptr) {
+  if (!ptr) return;
+  RUBY_KRB5 *r = (RUBY_KRB5 *)ptr;
+  if (r->rb_context != Qnil)
+    rb_gc_mark(r->rb_context);
+}
+
 static void rkrb5_typed_free(void *ptr) {
   if (!ptr) return;
   RUBY_KRB5 *r = (RUBY_KRB5 *)ptr;
@@ -34,7 +41,7 @@ static void rkrb5_typed_free(void *ptr) {
     krb5_free_cred_contents(r->ctx, &r->creds);
   if (r->princ)
     krb5_free_principal(r->ctx, r->princ);
-  if (r->ctx)
+  if (r->ctx && r->rb_context == Qnil)
     krb5_free_context(r->ctx);
   free(r);
 }
@@ -43,9 +50,9 @@ static size_t rkrb5_typed_size(const void *ptr) {
   return sizeof(RUBY_KRB5);
 }
 
-static const rb_data_type_t rkrb5_data_type = {
+const rb_data_type_t rkrb5_data_type = {
   "RUBY_KRB5",
-  {NULL, rkrb5_typed_free, rkrb5_typed_size,},
+  {rkrb5_typed_mark, rkrb5_typed_free, rkrb5_typed_size,},
   NULL, NULL, RUBY_TYPED_FREE_IMMEDIATELY
 };
 
@@ -53,26 +60,63 @@ static const rb_data_type_t rkrb5_data_type = {
 static VALUE rkrb5_allocate(VALUE klass){
   RUBY_KRB5* ptr = ALLOC(RUBY_KRB5);
   memset(ptr, 0, sizeof(RUBY_KRB5));
+  ptr->rb_context = Qnil;
   return TypedData_Wrap_Struct(klass, &rkrb5_data_type, ptr);
 }
 
 /*
  * call-seq:
- *   Kerberos::Krb5.new
+ *   Kerberos::Krb5.new(context: nil)
  *
  * Creates and returns a new Kerberos::Krb5 object. This initializes the
  * context for future method calls on that object.
+ *
+ * If a +context+ keyword argument is provided, it must be a
+ * Kerberos::Krb5::Context object. The context will be borrowed rather than
+ * creating a new one internally via krb5_init_context. The caller is
+ * responsible for keeping the Context object alive for the lifetime of
+ * this Krb5 instance.
+ *
+ * A block form is also supported. If a block is given, the object is
+ * yielded to the block and automatically closed when the block returns.
  */
-static VALUE rkrb5_initialize(VALUE self){
+static VALUE rkrb5_initialize(int argc, VALUE* argv, VALUE self){
   RUBY_KRB5* ptr;
+  VALUE v_opts, v_context;
+  ID kw_table[1] = { rb_intern("context") };
+  VALUE kw_vals[1];
   krb5_error_code kerror;
 
   TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);
 
-  kerror = krb5_init_context(&ptr->ctx);
+  rb_scan_args(argc, argv, "0:", &v_opts);
 
-  if(kerror)
-    rb_raise(cKrb5Exception, "krb5_init_context: %s", error_message(kerror));
+  if(NIL_P(v_opts))
+    v_opts = rb_hash_new();
+
+  rb_get_kwargs(v_opts, kw_table, 0, 1, kw_vals);
+  v_context = kw_vals[0] == Qundef ? Qnil : kw_vals[0];
+
+  if(!NIL_P(v_context)){
+    RUBY_KRB5_CONTEXT* ctx_ptr;
+
+    if(!rb_obj_is_kind_of(v_context, cKrb5Context))
+      rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");
+
+    TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ctx_ptr);
+
+    if(!ctx_ptr->ctx)
+      rb_raise(cKrb5Exception, "context is closed");
+
+    ptr->ctx = ctx_ptr->ctx;
+    ptr->rb_context = v_context;
+  }
+  else{
+    kerror = krb5_init_context(&ptr->ctx);
+
+    if(kerror)
+      rb_raise(cKrb5Exception, "krb5_init_context: %s", error_message(kerror));
+  }
 
   if(rb_block_given_p()){
     rb_ensure(rb_yield, self, rkrb5_close, self);
@@ -140,7 +184,7 @@ static VALUE rkrb5_set_default_realm(int argc, VALUE* argv, VALUE self){
 }
 
 /* call-seq:
- *   krb5.get_init_creds_keytab(principal = nil, keytab = nil, service = nil, ccache = nil)
+ *   krb5.get_init_creds_keytab(principal: nil, keytab: nil, service: nil, ccache: nil)
  *
  * Acquire credentials for +principal+ from +keytab+ using +service+. If
  * no principal is specified, then a principal is derived from the service
@@ -154,7 +198,10 @@ static VALUE rkrb5_set_default_realm(int argc, VALUE* argv, VALUE self){
  */
 static VALUE rkrb5_get_init_creds_keytab(int argc, VALUE* argv, VALUE self){
   RUBY_KRB5* ptr;
-  VALUE v_user, v_keytab_name, v_service, v_ccache;
+  VALUE v_user = Qnil, v_keytab_name = Qnil, v_service = Qnil, v_ccache = Qnil;
+  VALUE v_kwargs = Qnil;
+  ID kw_table[4] = { rb_intern("principal"), rb_intern("keytab"), rb_intern("service"), rb_intern("ccache") };
+  VALUE kw_vals[4];
   char* user;
   char* service;
   char keytab_name[MAX_KEYTAB_NAME_LEN];
@@ -181,7 +228,16 @@ static VALUE rkrb5_get_init_creds_keytab(int argc, VALUE* argv, VALUE self){
   krb5_free_cred_contents(ptr->ctx, &ptr->creds);
   memset(&ptr->creds, 0, sizeof(ptr->creds));
 
-  rb_scan_args(argc, argv, "04", &v_user, &v_keytab_name, &v_service, &v_ccache);
+  rb_scan_args(argc, argv, "0:", &v_kwargs);
+
+  if(NIL_P(v_kwargs))
+    v_kwargs = rb_hash_new();
+
+  rb_get_kwargs(v_kwargs, kw_table, 0, 4, kw_vals);
+  if(kw_vals[0] != Qundef) v_user = kw_vals[0];
+  if(kw_vals[1] != Qundef) v_keytab_name = kw_vals[1];
+  if(kw_vals[2] != Qundef) v_service = kw_vals[2];
+  if(kw_vals[3] != Qundef) v_ccache = kw_vals[3];
 
   // Validate argument types before allocating opt, so type errors don't leak it.
   if(!NIL_P(v_user))
@@ -300,7 +356,7 @@ static VALUE rkrb5_get_init_creds_keytab(int argc, VALUE* argv, VALUE self){
  *
  * Example:
  *
- * krb5.get_init_creds_password('foo', 'XXXXXX') # Authenticate 'foo' user
+ * krb5.get_init_creds_password(principal: 'foo', password: 'XXXXXX') # Authenticate 'foo' user
  * krb5.change_password('XXXXXX', 'YYYYYY')      # Change password for 'foo'
  */
 static VALUE rkrb5_change_password(VALUE self, VALUE v_old, VALUE v_new){
@@ -378,19 +434,26 @@ static VALUE rkrb5_change_password(VALUE self, VALUE v_old, VALUE v_new){
 
 /*
  * call-seq:
- *   krb5.get_init_creds_password(user, password, service = nil)
+ *   krb5.get_init_creds_password(principal: nil, password: nil, service: nil, ccache: nil)
  *
- * Authenticates the credentials of +user+ using +password+ against +service+,
+ * Authenticates the credentials of +principal+ using +password+ against +service+,
  * and has the effect of setting the principal and context internally. This method
  * must typically be called before using other methods.
+ *
+ * When +ccache+ is given, the acquired credentials will be written into the
+ * provided Kerberos::Krb5::CredentialsCache.
  */
 static VALUE rkrb5_get_init_creds_passwd(int argc, VALUE* argv, VALUE self){
   RUBY_KRB5* ptr;
-  VALUE v_user, v_pass, v_service;
+  VALUE v_user = Qnil, v_pass = Qnil, v_service = Qnil, v_ccache = Qnil;
+  VALUE v_kwargs = Qnil;
+  ID kw_table[4] = { rb_intern("principal"), rb_intern("password"), rb_intern("service"), rb_intern("ccache") };
+  VALUE kw_vals[4];
   char* user;
   char* pass;
   char* service;
   krb5_error_code kerror;
+  krb5_get_init_creds_opt* opt = NULL;
 
   TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);
 
@@ -406,7 +469,19 @@ static VALUE rkrb5_get_init_creds_passwd(int argc, VALUE* argv, VALUE self){
   krb5_free_cred_contents(ptr->ctx, &ptr->creds);
   memset(&ptr->creds, 0, sizeof(ptr->creds));
 
-  rb_scan_args(argc, argv, "21", &v_user, &v_pass, &v_service);
+  rb_scan_args(argc, argv, "0:", &v_kwargs);
+
+  if(NIL_P(v_kwargs))
+    v_kwargs = rb_hash_new();
+
+  rb_get_kwargs(v_kwargs, kw_table, 0, 4, kw_vals);
+  if(kw_vals[0] != Qundef) v_user = kw_vals[0];
+  if(kw_vals[1] != Qundef) v_pass = kw_vals[1];
+  if(kw_vals[2] != Qundef) v_service = kw_vals[2];
+  if(kw_vals[3] != Qundef) v_ccache = kw_vals[3];
+
+  if(NIL_P(v_user) || NIL_P(v_pass))
+    rb_raise(rb_eArgError, "principal and password are required");
 
   Check_Type(v_user, T_STRING);
   Check_Type(v_pass, T_STRING);
@@ -426,6 +501,21 @@ static VALUE rkrb5_get_init_creds_passwd(int argc, VALUE* argv, VALUE self){
   if(kerror)
     rb_raise(cKrb5Exception, "krb5_parse_name: %s", error_message(kerror));
 
+  if(!NIL_P(v_ccache)){
+    RUBY_KRB5_CCACHE* ccptr;
+    TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, ccptr);
+
+    kerror = krb5_get_init_creds_opt_alloc(ptr->ctx, &opt);
+    if(kerror)
+      rb_raise(cKrb5Exception, "krb5_get_init_creds_opt_alloc: %s", error_message(kerror));
+
+    kerror = krb5_get_init_creds_opt_set_out_ccache(ptr->ctx, opt, ccptr->ccache);
+    if(kerror){
+      krb5_get_init_creds_opt_free(ptr->ctx, opt);
+      rb_raise(cKrb5Exception, "krb5_get_init_creds_opt_set_out_ccache: %s", error_message(kerror));
+    }
+  }
+
   kerror = krb5_get_init_creds_password(
     ptr->ctx,
     &ptr->creds,
@@ -435,9 +525,12 @@ static VALUE rkrb5_get_init_creds_passwd(int argc, VALUE* argv, VALUE self){
     NULL,
     0,
     service,
-    NULL
+    opt
   );
 
+  if(opt)
+    krb5_get_init_creds_opt_free(ptr->ctx, opt);
+
   if(kerror)
     rb_raise(cKrb5Exception, "krb5_get_init_creds_password: %s", error_message(kerror));
 
@@ -446,7 +539,7 @@ static VALUE rkrb5_get_init_creds_passwd(int argc, VALUE* argv, VALUE self){
 
  /*
  * call-seq:
- *   krb5.authenticate!(user, password, service = nil)
+ *   krb5.authenticate!(principal:, password:, service: nil)
  *
  * Convenience method that: acquires initial credentials via password and
  * immediately verifies those credentials using `verify_init_creds` with
@@ -458,7 +551,9 @@ static VALUE rkrb5_get_init_creds_passwd(int argc, VALUE* argv, VALUE self){
  */
 static VALUE rkrb5_authenticate_bang(int argc, VALUE* argv, VALUE self){
   RUBY_KRB5* ptr;
-  VALUE v_user, v_pass, v_service;
+  VALUE v_kwargs, v_user, v_pass, v_service;
+  ID kw_table[3] = { rb_intern("principal"), rb_intern("password"), rb_intern("service") };
+  VALUE kw_vals[3];
   char* user;
   char* pass;
   char* service;
@@ -479,8 +574,15 @@ static VALUE rkrb5_authenticate_bang(int argc, VALUE* argv, VALUE self){
   krb5_free_cred_contents(ptr->ctx, &ptr->creds);
   memset(&ptr->creds, 0, sizeof(ptr->creds));
 
-  // Require user and password, optional service
-  rb_scan_args(argc, argv, "21", &v_user, &v_pass, &v_service);
+  rb_scan_args(argc, argv, "0:", &v_kwargs);
+
+  if(NIL_P(v_kwargs))
+    v_kwargs = rb_hash_new();
+
+  rb_get_kwargs(v_kwargs, kw_table, 2, 1, kw_vals);
+  v_user = kw_vals[0];
+  v_pass = kw_vals[1];
+  v_service = kw_vals[2] == Qundef ? Qnil : kw_vals[2];
 
   Check_Type(v_user, T_STRING);
   Check_Type(v_pass, T_STRING);
@@ -580,11 +682,12 @@ static VALUE rkrb5_close(VALUE self){
   if(ptr->princ)
     krb5_free_principal(ptr->ctx, ptr->princ);
 
-  if(ptr->ctx)
+  if(ptr->ctx && ptr->rb_context == Qnil)
     krb5_free_context(ptr->ctx);
 
   ptr->ctx = NULL;
   ptr->princ = NULL;
+  ptr->rb_context = Qnil;
 
   return Qtrue;
 }
@@ -701,7 +804,7 @@ static VALUE rkrb5_get_permitted_enctypes(VALUE self){
 
 /*
  * call-seq:
- *   krb5.verify_init_creds(server = nil, keytab = nil, ccache = nil)
+ *   krb5.verify_init_creds(server: nil, keytab: nil, ccache: nil)
  *
  * Verifies the initial credentials currently stored in the internal
  * credentials structure. Optionally a server principal string, a
@@ -711,7 +814,10 @@ static VALUE rkrb5_get_permitted_enctypes(VALUE self){
  */
 static VALUE rkrb5_verify_init_creds(int argc, VALUE* argv, VALUE self){
   RUBY_KRB5* ptr;
-  VALUE v_server, v_keytab, v_ccache;
+  VALUE v_server = Qnil, v_keytab = Qnil, v_ccache = Qnil;
+  VALUE v_kwargs = Qnil;
+  ID kw_table[3] = { rb_intern("server"), rb_intern("keytab"), rb_intern("ccache") };
+  VALUE kw_vals[3];
   krb5_error_code kerror;
   krb5_principal server_princ = NULL;
   RUBY_KRB5_KEYTAB* ktptr = NULL;
@@ -719,7 +825,15 @@ static VALUE rkrb5_verify_init_creds(int argc, VALUE* argv, VALUE self){
   krb5_keytab keytab = NULL;
   krb5_ccache *ccache_ptr = NULL;
 
-  rb_scan_args(argc, argv, "03", &v_server, &v_keytab, &v_ccache);
+  rb_scan_args(argc, argv, "0:", &v_kwargs);
+
+  if(NIL_P(v_kwargs))
+    v_kwargs = rb_hash_new();
+
+  rb_get_kwargs(v_kwargs, kw_table, 0, 3, kw_vals);
+  if(kw_vals[0] != Qundef) v_server = kw_vals[0];
+  if(kw_vals[1] != Qundef) v_keytab = kw_vals[1];
+  if(kw_vals[2] != Qundef) v_ccache = kw_vals[2];
 
   TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);
 
@@ -781,6 +895,83 @@ static VALUE rkrb5_verify_init_creds(int argc, VALUE* argv, VALUE self){
   return Qtrue;
 }
 
+/*
+ * call-seq:
+ *   krb5.get_host_realm(hostname) -> Array
+ *
+ * Returns an array of realm names associated with +hostname+.
+ * Uses the Kerberos library's host-to-realm mapping (krb5.conf
+ * [domain_realm] section, DNS lookups, etc.).
+ */
+static VALUE rkrb5_get_host_realm(VALUE self, VALUE v_host){
+  RUBY_KRB5* ptr;
+  char** realms;
+  char** p;
+  krb5_error_code kerror;
+
+  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);
+
+  if(!ptr->ctx)
+    rb_raise(cKrb5Exception, "no context has been established");
+
+  Check_Type(v_host, T_STRING);
+
+  kerror = krb5_get_host_realm(ptr->ctx, StringValueCStr(v_host), &realms);
+
+  if(kerror)
+    rb_raise(cKrb5Exception, "krb5_get_host_realm: %s", error_message(kerror));
+
+  VALUE v_array = rb_ary_new();
+
+  for(p = realms; p && *p; p++)
+    rb_ary_push(v_array, rb_str_new2(*p));
+
+  krb5_free_host_realm(ptr->ctx, realms);
+
+  return v_array;
+}
+
+/*
+ * call-seq:
+ *   krb5.expand_hostname(hostname) -> String
+ *
+ * Canonicalizes +hostname+ by performing a forward DNS lookup followed
+ * by a reverse lookup, returning the canonical hostname.
+ */
+static VALUE rkrb5_expand_hostname(VALUE self, VALUE v_host){
+  RUBY_KRB5* ptr;
+  char* canonical;
+  krb5_error_code kerror;
+
+  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);
+
+  if(!ptr->ctx)
+    rb_raise(cKrb5Exception, "no context has been established");
+
+  Check_Type(v_host, T_STRING);
+
+  kerror = krb5_expand_hostname(ptr->ctx, StringValueCStr(v_host), &canonical);
+
+  if(kerror)
+    rb_raise(cKrb5Exception, "krb5_expand_hostname: %s", error_message(kerror));
+
+  VALUE v_result = rb_str_new2(canonical);
+  krb5_free_string(ptr->ctx, canonical);
+
+  return v_result;
+}
+
+/*
+ * call-seq:
+ *   Kerberos::Krb5.thread_safe?
+ *
+ * Returns true if the Kerberos library was built with multithread support,
+ * false otherwise.
+ */
+static VALUE rkrb5_s_thread_safe(VALUE klass){
+  return krb5_is_thread_safe() ? Qtrue : Qfalse;
+}
+
 void Init_rkerberos(void){
   mKerberos      = rb_define_module("Kerberos");
   cKrb5          = rb_define_class_under(mKerberos, "Krb5", rb_cObject);
@@ -790,7 +981,10 @@ void Init_rkerberos(void){
   rb_define_alloc_func(cKrb5, rkrb5_allocate);
 
   // Initializers
-  rb_define_method(cKrb5, "initialize", rkrb5_initialize, 0);
+  rb_define_method(cKrb5, "initialize", rkrb5_initialize, -1);
+
+  // Singleton Methods
+  rb_define_singleton_method(cKrb5, "thread_safe?", rkrb5_s_thread_safe, 0);
 
   // Krb5 Methods
   rb_define_method(cKrb5, "authenticate!", rkrb5_authenticate_bang, -1);
@@ -803,13 +997,20 @@ void Init_rkerberos(void){
   rb_define_method(cKrb5, "get_permitted_enctypes", rkrb5_get_permitted_enctypes, 0);
   rb_define_method(cKrb5, "set_default_realm", rkrb5_set_default_realm, -1);
   rb_define_method(cKrb5, "verify_init_creds", rkrb5_verify_init_creds, -1);
+  rb_define_method(cKrb5, "get_host_realm", rkrb5_get_host_realm, 1);
+  rb_define_method(cKrb5, "expand_hostname", rkrb5_expand_hostname, 1);
 
   // Aliases
   rb_define_alias(cKrb5, "default_realm", "get_default_realm");
+  rb_define_alias(cKrb5, "default_realm=", "set_default_realm");
   rb_define_alias(cKrb5, "default_principal", "get_default_principal");
+  rb_define_alias(cKrb5, "host_realm", "get_host_realm");
+  rb_define_alias(cKrb5, "init_creds_password", "get_init_creds_password");
+  rb_define_alias(cKrb5, "init_creds_keytab", "get_init_creds_keytab");
+  rb_define_alias(cKrb5, "permitted_enctypes", "get_permitted_enctypes");
 
-  /* 0.2.3: The version of the custom rkerberos library */
-  rb_define_const(cKrb5, "VERSION", rb_str_new2("0.2.3"));
+  /* 0.3.0: The version of the custom rkerberos library */
+  rb_define_const(cKrb5, "VERSION", rb_str_new2("0.3.0"));
 
   // Encoding type constants
 

data/ext/rkerberos/rkerberos.h

@@ -8,6 +8,8 @@
 
 // Make the context data type visible to other C files
 extern const rb_data_type_t rkrb5_context_data_type;
+// Make the Krb5 data type visible to other C files
+extern const rb_data_type_t rkrb5_data_type;
 // Make the config data type visible to other C files
 extern const rb_data_type_t rkadm5_config_data_type;
 
@@ -67,6 +69,7 @@ typedef struct {
   krb5_creds creds;
   krb5_principal princ;
   krb5_keytab keytab;
+  VALUE rb_context;
 } RUBY_KRB5;
 
 // Kerberos::Context
@@ -81,6 +84,7 @@ typedef struct {
   krb5_principal princ;
   void* handle;
   char** db_args;
+  VALUE rb_context; // Ruby Context object when borrowed, Qnil if ctx is owned
 } RUBY_KADM5;
 
 // Kerberos::Krb5::Keytab::Entry
@@ -96,23 +100,27 @@ typedef struct {
   krb5_context ctx;
   krb5_creds creds;
   krb5_keytab keytab;
+  VALUE rb_context; // Ruby Context object when borrowed, Qnil if ctx is owned
 } RUBY_KRB5_KEYTAB;
 
 typedef struct {
   krb5_context ctx;
   krb5_principal principal;
+  VALUE rb_context; // Ruby Context object when borrowed, Qnil if ctx is owned
 } RUBY_KRB5_PRINC;
 
 typedef struct {
   krb5_context ctx;
   krb5_ccache ccache;
   krb5_principal principal;
+  VALUE rb_context; // Ruby Context object when borrowed, Qnil if ctx is owned
 } RUBY_KRB5_CCACHE;
 
 #ifdef HAVE_KADM5_ADMIN_H
 typedef struct {
   krb5_context ctx;
   kadm5_config_params config;
+  VALUE rb_context; // Ruby Context object when borrowed, Qnil if ctx is owned
 } RUBY_KADM5_CONFIG;
 
 typedef struct {

data/rkerberos.gemspec

@@ -2,15 +2,18 @@ require 'rubygems'
 
 Gem::Specification.new do |spec|
   spec.name       = 'rkerberos'
-  spec.version    = '0.2.3'
+  spec.version    = '0.3.0'
   spec.authors    = ['Daniel Berger', 'Dominic Cleal', 'Simon Levermann']
   spec.license    = 'Artistic-2.0'
   spec.email      = ['djberg96@gmail.com', 'dominic@cleal.org', 'simon-rubygems@slevermann.de']
-  spec.homepage   = 'http://github.com/rkerberos/rkerberos'
-  spec.summary    = 'A Ruby interface for the the Kerberos library'
+  spec.homepage   = 'https://github.com/rkerberos/rkerberos'
+  spec.summary    = 'A Ruby interface for the Kerberos library'
+  spec.required_ruby_version = '>= 3.2'
   spec.test_files = Dir['spec/**/*_spec.rb']
   spec.extensions = ['ext/rkerberos/extconf.rb']
-  spec.files      = Dir['**/*'].grep_v(%r{\A(?:\.git|docker|Dockerfile)})
+  spec.files      = Dir['**/*']
+    .select { |file| File.file?(file) }
+    .grep_v(%r{\A(?:\.git|docker|Dockerfile|Gemfile\.lock\z|tmp(?:/|\z))|\.gem\z})
 
   spec.add_development_dependency('rake-compiler')
   spec.add_development_dependency('rspec', '>= 3.0')
@@ -22,13 +25,13 @@ Gem::Specification.new do |spec|
   EOF
 
   spec.metadata = {
-    'homepage_uri'          => 'https://github.com/rkerberos/rkerberos',
     'bug_tracker_uri'       => 'https://github.com/rkerberos/rkerberos/issues',
-    'changelog_uri'         => 'https://github.com/rkerberos/rkerberos/blob/main/CHANGES.md',
+    'changelog_uri'         => 'https://github.com/rkerberos/rkerberos/blob/master/CHANGES.md',
     'documentation_uri'     => 'https://github.com/rkerberos/rkerberos/wiki',
+    'homepage_uri'          => 'https://github.com/rkerberos/rkerberos',
     'source_code_uri'       => 'https://github.com/rkerberos/rkerberos',
     'wiki_uri'              => 'https://github.com/rkerberos/rkerberos/wiki',
-    'github_repo'           => 'https://github.com/djberg96/rkerberos',
+    'github_repo'           => 'https://github.com/rkerberos/rkerberos',
     'funding_uri'           => 'https://github.com/sponsors/rkerberos',
     'rubygems_mfa_required' => 'true'
   }

data/spec/config_spec.rb

@@ -11,6 +11,39 @@ RSpec.describe 'Kerberos::Kadm5::Config', :kadm5 do
     expect(config).to be_frozen
   end
 
+  describe 'constructor' do
+    it 'can be called with no arguments' do
+      expect { klass.new }.not_to raise_error
+    end
+
+    it 'accepts a context option' do
+      ctx = Kerberos::Krb5::Context.new
+      expect { klass.new(context: ctx) }.not_to raise_error
+    end
+
+    it 'returns same realm with or without context' do
+      ctx = Kerberos::Krb5::Context.new
+      c1 = klass.new
+      c2 = klass.new(context: ctx)
+      expect(c2.realm).to eq(c1.realm)
+    end
+
+    it 'raises TypeError for non-Context context argument' do
+      expect { klass.new(context: "bad") }.to raise_error(TypeError)
+    end
+
+    it 'raises error for a closed context' do
+      ctx = Kerberos::Krb5::Context.new
+      ctx.close
+      expect { klass.new(context: ctx) }.to raise_error(Kerberos::Krb5::Exception)
+    end
+
+    it 'rejects positional option hashes and unknown keywords' do
+      expect { klass.new({context: nil}) }.to raise_error(ArgumentError)
+      expect { klass.new(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+  end
+
   describe 'realm' do
     it 'responds to realm' do
       expect(config).to respond_to(:realm)

data/spec/context_spec.rb

@@ -51,6 +51,57 @@ RSpec.describe Kerberos::Krb5::Context do
       expect(ctx).to be_a(described_class)
       expect { ctx.close }.not_to raise_error
     end
+
+    it 'rejects positional option hashes and unknown keywords' do
+      expect { described_class.new({secure: true}) }.to raise_error(ArgumentError)
+      expect { described_class.new(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+  end
+
+  describe '#default_realm' do
+    it 'responds to default_realm' do
+      expect(context).to respond_to(:default_realm)
+    end
+
+    it 'returns a string' do
+      expect(context.default_realm).to be_a(String)
+    end
+
+    it 'returns a non-empty realm' do
+      expect(context.default_realm.size).to be > 0
+    end
+
+    it 'raises when context is closed' do
+      context.close
+      expect { context.default_realm }.to raise_error(Kerberos::Krb5::Exception)
+    end
+  end
+
+  describe '#default_realm=' do
+    it 'responds to default_realm=' do
+      expect(context).to respond_to(:default_realm=)
+    end
+
+    it 'can set and read back a custom realm' do
+      context.default_realm = 'TEST.REALM'
+      expect(context.default_realm).to eq('TEST.REALM')
+    end
+
+    it 'accepts nil to reset to the default' do
+      original = context.default_realm
+      context.default_realm = 'TEMP.REALM'
+      context.default_realm = nil
+      expect(context.default_realm).to eq(original)
+    end
+
+    it 'raises TypeError for non-string argument' do
+      expect { context.default_realm = 123 }.to raise_error(TypeError)
+    end
+
+    it 'raises when context is closed' do
+      context.close
+      expect { context.default_realm = 'X' }.to raise_error(Kerberos::Krb5::Exception)
+    end
   end
 
   after(:each) do