rkerberos 0.2.3 → 0.3.1

data/ext/rkerberos/kadm5.c

@@ -8,6 +8,7 @@ VALUE cKadm5PrincipalNotFoundException;
 
 // Prototype
 static VALUE rkadm5_close(VALUE);
+static void rkadm5_check_open(RUBY_KADM5 *);
 static void free_tl_data(krb5_tl_data *);
 static void free_db_args(char**);
 char** parse_db_args(VALUE v_db_args);
@@ -17,6 +18,13 @@ void add_tl_data(krb5_int16 *, krb5_tl_data **,
 
 
 // TypedData functions for RUBY_KADM5
+static void rkadm5_typed_mark(void *ptr) {
+  if (!ptr) return;
+  RUBY_KADM5 *k = (RUBY_KADM5 *)ptr;
+  if (k->rb_context != Qnil)
+    rb_gc_mark(k->rb_context);
+}
+
 static void rkadm5_typed_free(void *ptr) {
   if (!ptr) return;
   RUBY_KADM5 *k = (RUBY_KADM5 *)ptr;
@@ -24,8 +32,10 @@ static void rkadm5_typed_free(void *ptr) {
     kadm5_destroy(k->handle);
   if (k->princ)
     krb5_free_principal(k->ctx, k->princ);
-  if (k->ctx)
+  if (k->ctx && k->rb_context == Qnil)
     krb5_free_context(k->ctx);
+  else if (k->rb_context != Qnil)
+    rkrb5_context_release(k->rb_context);
   free_db_args(k->db_args);
   free(k);
 }
@@ -36,7 +46,7 @@ static size_t rkadm5_typed_size(const void *ptr) {
 
 static const rb_data_type_t rkadm5_data_type = {
   "RUBY_KADM5",
-  {NULL, rkadm5_typed_free, rkadm5_typed_size,},
+  {rkadm5_typed_mark, rkadm5_typed_free, rkadm5_typed_size,},
   NULL, NULL, RUBY_TYPED_FREE_IMMEDIATELY
 };
 
@@ -44,34 +54,53 @@ static const rb_data_type_t rkadm5_data_type = {
 static VALUE rkadm5_allocate(VALUE klass){
   RUBY_KADM5* ptr = ALLOC(RUBY_KADM5);
   memset(ptr, 0, sizeof(RUBY_KADM5));
+  ptr->rb_context = Qnil;
   return TypedData_Wrap_Struct(klass, &rkadm5_data_type, ptr);
 }
 
+static void rkadm5_check_open(RUBY_KADM5 *ptr){
+  if(!ptr->ctx || !ptr->handle)
+    rb_raise(cKadm5Exception, "no administrative context has been established");
+}
+
 /*
  * call-seq:
- *   Kerberos::Kadm5.new(:principal => 'name', :password => 'xxxxx')
- *   Kerberos::Kadm5.new(:principal => 'name', :keytab => '/path/to/your/keytab')
- *   Kerberos::Kadm5.new(:principal => 'name', :keytab => true)
+ *   Kerberos::Kadm5.new(principal: 'name', password: 'xxxxx')
+ *   Kerberos::Kadm5.new(principal: 'name', keytab: '/path/to/your/keytab')
+ *   Kerberos::Kadm5.new(principal: 'name', keytab: true)
+ *   Kerberos::Kadm5.new(principal: 'name', ccache: ccache_object)
  *
- * Creates and returns a new Kerberos::Kadm5 object. A hash argument is
- * accepted that allows you to specify a principal and a password, or
- * a keytab file.
+ * Creates and returns a new Kerberos::Kadm5 object. Keyword arguments allow
+ * you to specify a principal and a password, a keytab file, or a credentials
+ * cache.
  *
  * If you pass a string as the :keytab value it will attempt to use that file
  * for the keytab. If you pass true as the value it will attempt to use the
  * default keytab file, typically /etc/krb5.keytab.
  *
+ * If you pass a Kerberos::Krb5::CredentialsCache object as the :ccache value,
+ * it will authenticate using the credentials stored in that cache via
+ * kadm5_init_with_creds.
+ *
  * You may also pass the :service option to specify the service name. The
  * default is kadmin/admin.
  *
  * There is also a :db_args option, which is a single string or array of strings
  * containing options usually passed to kadmin with the -x switch. For a list of
- * available options, see the kadmin manpage
+ * available options, see the kadmin manpage.
+ *
+ * Only one of :password, :keytab, or :ccache may be specified.
  *
  */
-static VALUE rkadm5_initialize(VALUE self, VALUE v_opts){
+static VALUE rkadm5_initialize(int argc, VALUE* argv, VALUE self){
   RUBY_KADM5* ptr;
-  VALUE v_principal, v_password, v_keytab, v_service, v_db_args;
+  VALUE v_opts, v_principal, v_password, v_keytab, v_service, v_db_args, v_context, v_ccache;
+  ID kw_table[7] = {
+    rb_intern("principal"), rb_intern("password"), rb_intern("keytab"),
+    rb_intern("ccache"), rb_intern("service"), rb_intern("db_args"),
+    rb_intern("context")
+  };
+  VALUE kw_vals[7];
   char* user;
   char* pass = NULL;
   char* keytab = NULL;
@@ -80,35 +109,56 @@ static VALUE rkadm5_initialize(VALUE self, VALUE v_opts){
   krb5_error_code kerror;
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
-  Check_Type(v_opts, T_HASH);
+  rb_scan_args(argc, argv, "0:", &v_opts);
+
+  if(NIL_P(v_opts))
+    v_opts = rb_hash_new();
+
+  rb_get_kwargs(v_opts, kw_table, 0, 7, kw_vals);
+  v_principal = kw_vals[0] == Qundef ? Qnil : kw_vals[0];
+  v_password = kw_vals[1] == Qundef ? Qnil : kw_vals[1];
+  v_keytab = kw_vals[2] == Qundef ? Qnil : kw_vals[2];
+  v_ccache = kw_vals[3] == Qundef ? Qnil : kw_vals[3];
+  v_service = kw_vals[4] == Qundef ? Qnil : kw_vals[4];
+  v_db_args = kw_vals[5] == Qundef ? Qnil : kw_vals[5];
+  v_context = kw_vals[6] == Qundef ? Qnil : kw_vals[6];
+
+  // Validate mutual exclusivity
+  {
+    int auth_count = 0;
+    if(RTEST(v_password)) auth_count++;
+    if(RTEST(v_keytab))   auth_count++;
+    if(RTEST(v_ccache))   auth_count++;
+
+    if(auth_count > 1)
+      rb_raise(rb_eArgError, "only one of password, keytab, or ccache may be specified");
+
+    if(auth_count == 0)
+      rb_raise(rb_eArgError, "one of password, keytab, or ccache must be specified");
+  }
 
-  // Accept both string and symbol keys
-  v_principal = rb_hash_aref2(v_opts, rb_str_new_cstr("principal"));
-  if (NIL_P(v_principal)) v_principal = rb_hash_aref2(v_opts, ID2SYM(rb_intern("principal")));
+  // Principal must be specified if using a password
+  if(RTEST(v_password)){
+    if(NIL_P(v_principal))
+      rb_raise(rb_eArgError, "principal must be specified");
 
-  // Principal must be specified
-  if(NIL_P(v_principal))
-    rb_raise(rb_eArgError, "principal must be specified");
+    Check_Type(v_password, T_STRING);
+    Check_Type(v_principal, T_STRING);
 
-  Check_Type(v_principal, T_STRING);
-  user = StringValueCStr(v_principal);
+    pass = StringValueCStr(v_password);
+  }
 
-  v_password = rb_hash_aref2(v_opts, rb_str_new_cstr("password"));
-  if (NIL_P(v_password)) v_password = rb_hash_aref2(v_opts, ID2SYM(rb_intern("password")));
-  v_keytab = rb_hash_aref2(v_opts, rb_str_new_cstr("keytab"));
-  if (NIL_P(v_keytab)) v_keytab = rb_hash_aref2(v_opts, ID2SYM(rb_intern("keytab")));
+  if(RTEST(v_keytab) && NIL_P(v_principal))
+    rb_raise(rb_eArgError, "principal must be specified when using a keytab");
 
-  if(RTEST(v_password) && RTEST(v_keytab))
-    rb_raise(rb_eArgError, "cannot use both a password and a keytab");
+  if(RTEST(v_ccache) && !rb_obj_is_kind_of(v_ccache, cKrb5CCache))
+    rb_raise(rb_eTypeError, "ccache must be a Kerberos::Krb5::CredentialsCache object");
 
-  if(RTEST(v_password)){
-    Check_Type(v_password, T_STRING);
-    pass = StringValueCStr(v_password);
+  if(RTEST(v_ccache) && NIL_P(v_principal)){
+    v_principal = rb_funcall(v_ccache, rb_intern("principal"), 0);
   }
 
-  v_service = rb_hash_aref2(v_opts, rb_str_new_cstr("service"));
-  if (NIL_P(v_service)) v_service = rb_hash_aref2(v_opts, ID2SYM(rb_intern("service")));
-
+  user = StringValueCStr(v_principal);
   if(NIL_P(v_service)){
     service = (char *) "kadmin/admin";
   }
@@ -117,16 +167,21 @@ static VALUE rkadm5_initialize(VALUE self, VALUE v_opts){
     service = StringValueCStr(v_service);
   }
 
-  v_db_args = rb_hash_aref2(v_opts, rb_str_new_cstr("db_args"));
-  if (NIL_P(v_db_args)) v_db_args = rb_hash_aref2(v_opts, ID2SYM(rb_intern("db_args")));
   ptr->db_args = parse_db_args(v_db_args);
 
-  // Normally I would wait to initialize the context, but we might need it
-  // to get the default keytab file name.
-  kerror = krb5_init_context(&ptr->ctx);
+  // Initialize or borrow the context
+  if(!NIL_P(v_context)){
+    ptr->ctx = rkrb5_context_borrow(v_context);
+    ptr->rb_context = v_context;
+  }
+  else{
+    kerror = krb5_init_context(&ptr->ctx);
 
-  if(kerror)
-    rb_raise(cKadm5Exception, "krb5_init_context: %s", error_message(kerror));
+    if(kerror)
+      rb_raise(cKadm5Exception, "krb5_init_context: %s", error_message(kerror));
+
+    ptr->rb_context = Qnil;
+  }
 
   // The docs say I can use NULL to get the default, but reality appears to be otherwise.
   if(RTEST(v_keytab)){
@@ -176,8 +231,28 @@ static VALUE rkadm5_initialize(VALUE self, VALUE v_opts){
     if(kerror)
       rb_raise(cKadm5Exception, "kadm5_init_with_skey: %s", error_message(kerror));
   }
-  else{
-    // TODO: Credentials cache.
+  else if(RTEST(v_ccache)){
+    RUBY_KRB5_CCACHE* cc_ptr;
+
+    TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, cc_ptr);
+
+    if(!cc_ptr->ctx || !cc_ptr->ccache)
+      rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");
+
+    kerror = kadm5_init_with_creds(
+      ptr->ctx,
+      user,
+      cc_ptr->ccache,
+      service,
+      NULL,
+      KADM5_STRUCT_VERSION,
+      KADM5_API_VERSION_3,
+      ptr->db_args,
+      &ptr->handle
+    );
+
+    if(kerror)
+      rb_raise(cKadm5Exception, "kadm5_init_with_creds: %s", error_message(kerror));
   }
 
   if(rb_block_given_p()){
@@ -206,8 +281,7 @@ static VALUE rkadm5_set_password(VALUE self, VALUE v_user, VALUE v_pass){
   user = StringValueCStr(v_user);
   pass = StringValueCStr(v_pass);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -244,8 +318,7 @@ static VALUE rkadm5_set_pwexpire(VALUE self, VALUE v_user, VALUE v_pwexpire){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -281,50 +354,147 @@ static VALUE rkadm5_set_pwexpire(VALUE self, VALUE v_user, VALUE v_pwexpire){
 
 /*
  * call-seq:
- *   kadm5.create_principal(name, password, db_args=nil)
- *   kadm5.create_principal(principal)
+ *   kadm5.create_principal(name:, password:, db_args: nil)
+ *   kadm5.create_principal(principal:, password:, db_args: nil)
+ *
+ * Creates a new principal with an initial password of +password+.
+ *
+ * The principal may be specified either as a +name+ string or as a
+ * +principal+ object (a Kerberos::Krb5::Principal). When a Principal
+ * object is provided, any non-nil writable attributes on that object
+ * are forwarded to the KDC:
+ *
+ *   * +policy+
+ *   * +expire_time+
+ *   * +password_expiration+
+ *   * +max_life+
+ *   * +max_renewable_life+
+ *   * +attributes+
  *
- * Creates a new principal +name+ with an initial password of +password+.
- * +db_args+ is an optional string or array of strings containing options that are usually
- * passed to add_principal with the -x option. For a list of options, see the kadmin manpage,
- * in the add_principal section.
- *--
- * TODO: Allow a Principal object to be passed in as an argument.
+ * +db_args+ is an optional string or array of strings containing options
+ * that are usually passed to add_principal with the -x option. For a
+ * list of options, see the kadmin manpage, in the add_principal section.
  */
 static VALUE rkadm5_create_principal(int argc, VALUE* argv, VALUE self){
   RUBY_KADM5* ptr;
-  char* user;
   char* pass;
   char** db_args;
   int mask;
   kadm5_principal_ent_rec princ;
   krb5_error_code kerror;
-  VALUE v_user, v_pass, v_db_args;
+  VALUE v_opts, v_name, v_principal, v_pass, v_db_args;
+  ID kw_table[4] = { rb_intern("name"), rb_intern("principal"), rb_intern("password"), rb_intern("db_args") };
+  VALUE kw_vals[4];
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
-  rb_scan_args(argc, argv, "21", &v_user, &v_pass, &v_db_args);
-  Check_Type(v_user, T_STRING);
+  rkadm5_check_open(ptr);
+
+  rb_scan_args(argc, argv, "0:", &v_opts);
+
+  if(NIL_P(v_opts))
+    v_opts = rb_hash_new();
+
+  rb_get_kwargs(v_opts, kw_table, 0, 4, kw_vals);
+  v_name = kw_vals[0] == Qundef ? Qnil : kw_vals[0];
+  v_principal = kw_vals[1] == Qundef ? Qnil : kw_vals[1];
+  v_pass = kw_vals[2] == Qundef ? Qnil : kw_vals[2];
+  v_db_args = kw_vals[3] == Qundef ? Qnil : kw_vals[3];
+
+  if(NIL_P(v_pass))
+    rb_raise(rb_eArgError, "password: is required");
+
   Check_Type(v_pass, T_STRING);
 
+  if(NIL_P(v_name) && NIL_P(v_principal))
+    rb_raise(rb_eArgError, "name: or principal: is required");
+
+  if(RTEST(v_name) && RTEST(v_principal))
+    rb_raise(rb_eArgError, "name: and principal: are mutually exclusive");
+
   memset(&princ, 0, sizeof(princ));
 
   mask = KADM5_PRINCIPAL | KADM5_TL_DATA;
-  user = StringValueCStr(v_user);
   pass = StringValueCStr(v_pass);
 
   db_args = parse_db_args(v_db_args);
   add_db_args(&princ, db_args);
   free_db_args(db_args);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  // Determine the principal name and populate mask from the principal object
+  if(RTEST(v_principal)){
+    VALUE v_princ_name, v_policy, v_expire, v_pw_expire, v_max_life, v_max_renew, v_attrs;
 
-  kerror = krb5_parse_name(ptr->ctx, user, &princ.principal);
+    if(!rb_obj_is_kind_of(v_principal, cKrb5Principal))
+      rb_raise(rb_eTypeError, "principal: must be a Kerberos::Krb5::Principal object");
 
-  if(kerror){
-    free_tl_data(princ.tl_data);
-    rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));
+    v_princ_name = rb_iv_get(v_principal, "@principal");
+
+    if(NIL_P(v_princ_name))
+      rb_raise(rb_eArgError, "principal object has no name set");
+
+    Check_Type(v_princ_name, T_STRING);
+
+    kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_princ_name), &princ.principal);
+
+    if(kerror){
+      free_tl_data(princ.tl_data);
+      rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));
+    }
+
+    // Forward optional attributes from the Principal object
+    v_policy = rb_iv_get(v_principal, "@policy");
+
+    if(RTEST(v_policy)){
+      Check_Type(v_policy, T_STRING);
+      princ.policy = StringValueCStr(v_policy);
+      mask |= KADM5_POLICY;
+    }
+
+    v_expire = rb_iv_get(v_principal, "@expire_time");
+
+    if(RTEST(v_expire)){
+      princ.princ_expire_time = (krb5_timestamp)NUM2LONG(rb_funcall(v_expire, rb_intern("to_i"), 0));
+      mask |= KADM5_PRINC_EXPIRE_TIME;
+    }
+
+    v_pw_expire = rb_iv_get(v_principal, "@password_expiration");
+
+    if(RTEST(v_pw_expire)){
+      princ.pw_expiration = (krb5_timestamp)NUM2LONG(rb_funcall(v_pw_expire, rb_intern("to_i"), 0));
+      mask |= KADM5_PW_EXPIRATION;
+    }
+
+    v_max_life = rb_iv_get(v_principal, "@max_life");
+
+    if(RTEST(v_max_life)){
+      princ.max_life = NUM2LONG(v_max_life);
+      mask |= KADM5_MAX_LIFE;
+    }
+
+    v_max_renew = rb_iv_get(v_principal, "@max_renewable_life");
+
+    if(RTEST(v_max_renew)){
+      princ.max_renewable_life = NUM2LONG(v_max_renew);
+      mask |= KADM5_MAX_RLIFE;
+    }
+
+    v_attrs = rb_iv_get(v_principal, "@attributes");
+
+    if(RTEST(v_attrs)){
+      princ.attributes = NUM2LONG(v_attrs);
+      mask |= KADM5_ATTRIBUTES;
+    }
+  }
+  else{
+    Check_Type(v_name, T_STRING);
+
+    kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_name), &princ.principal);
+
+    if(kerror){
+      free_tl_data(princ.tl_data);
+      rb_raise(cKadm5Exception, "krb5_parse_name: %s", error_message(kerror));
+    }
   }
 
   kerror = kadm5_create_principal(ptr->handle, &princ, mask, pass);
@@ -355,8 +525,7 @@ static VALUE rkadm5_delete_principal(VALUE self, VALUE v_user){
   Check_Type(v_user, T_STRING);
   user = StringValueCStr(v_user);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -396,8 +565,10 @@ static VALUE rkadm5_close(VALUE self){
   if(ptr->princ)
     krb5_free_principal(ptr->ctx, ptr->princ);
 
-  if(ptr->ctx)
+  if(ptr->ctx && ptr->rb_context == Qnil)
     krb5_free_context(ptr->ctx);
+  else if(ptr->rb_context != Qnil)
+    rkrb5_context_release(ptr->rb_context);
 
   free_db_args(ptr->db_args);
 
@@ -405,6 +576,7 @@ static VALUE rkadm5_close(VALUE self){
   ptr->ctx    = NULL;
   ptr->princ  = NULL;
   ptr->handle = NULL;
+  ptr->rb_context = Qnil;
 
   return self;
 }
@@ -413,11 +585,11 @@ static VALUE rkadm5_close(VALUE self){
 static VALUE create_principal_from_entry(VALUE v_name, RUBY_KADM5* ptr, kadm5_principal_ent_rec* ent){
   krb5_error_code kerror;
   VALUE v_principal;
-  VALUE v_args[1];
+  VALUE v_opts = rb_hash_new();
 
-  v_args[0] = v_name;
+  rb_hash_aset(v_opts, ID2SYM(rb_intern("name")), v_name);
 
-  v_principal = rb_class_new_instance(1, v_args, cKrb5Principal);
+  v_principal = rb_class_new_instance_kw(1, &v_opts, cKrb5Principal, RB_PASS_KEYWORDS);
 
   rb_iv_set(v_principal, "@attributes", LONG2FIX(ent->attributes));
   rb_iv_set(v_principal, "@aux_attributes", INT2FIX(ent->aux_attributes));
@@ -492,8 +664,7 @@ static VALUE rkadm5_find_principal(VALUE self, VALUE v_user){
 
   memset(&ent, 0, sizeof(ent));
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -553,8 +724,7 @@ static VALUE rkadm5_get_principal(VALUE self, VALUE v_user){
 
   memset(&ent, 0, sizeof(ent));
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -596,28 +766,41 @@ static VALUE rkadm5_get_principal(VALUE self, VALUE v_user){
  * Example:
  *
  *   # Using a Policy object
- *   policy = Kerberos::Kadm5::Policy.new(:name => 'test', :min_length => 5)
+ *   policy = Kerberos::Kadm5::Policy.new(name: 'test', min_length: 5)
  *   kadm5.create_policy(policy)
  *
- *   # Using a hash
- *   kadm5.create_policy(:name => 'test', :min_length => 5)
+ *   # Using keywords
+ *   kadm5.create_policy(name: 'test', min_length: 5)
  */
-static VALUE rkadm5_create_policy(VALUE self, VALUE v_policy){
+static VALUE rkadm5_create_policy(int argc, VALUE* argv, VALUE self){
   RUBY_KADM5* ptr;
   kadm5_ret_t kerror;
   kadm5_policy_ent_rec ent;
   long mask = KADM5_POLICY;
+  VALUE v_policy, v_kwargs;
   VALUE v_name, v_min_classes, v_min_life, v_max_life, v_min_length, v_history_num;
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
-  // Allow a hash or a Policy object
-  if(rb_obj_is_kind_of(v_policy, rb_cHash)){
+  rkadm5_check_open(ptr);
+
+  rb_scan_args(argc, argv, "01:", &v_policy, &v_kwargs);
+
+  if(!NIL_P(v_kwargs)){
     VALUE v_args[1];
-    v_args[0] = v_policy;
-    v_policy = rb_class_new_instance(1, v_args, cKadm5Policy);
+    if(!NIL_P(v_policy))
+      rb_raise(rb_eArgError, "provide a Policy object or keyword arguments, not both");
+
+    v_args[0] = v_kwargs;
+    v_policy = rb_class_new_instance_kw(1, v_args, cKadm5Policy, RB_PASS_KEYWORDS);
   }
 
+  if(NIL_P(v_policy))
+    rb_raise(rb_eArgError, "a Policy object or policy keywords are required");
+
+  if(!rb_obj_is_kind_of(v_policy, cKadm5Policy))
+    rb_raise(rb_eTypeError, "expected a Kerberos::Kadm5::Policy object or policy keywords");
+
   v_name        = rb_iv_get(v_policy, "@policy");
   v_min_classes = rb_iv_get(v_policy, "@min_classes");
   v_min_length  = rb_iv_get(v_policy, "@min_length");
@@ -678,6 +861,8 @@ static VALUE rkadm5_delete_policy(VALUE self, VALUE v_policy){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   policy = StringValueCStr(v_policy);
 
   kerror = kadm5_delete_policy(ptr->handle, policy);
@@ -708,8 +893,7 @@ static VALUE rkadm5_get_policy(VALUE self, VALUE v_name){
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
   memset(&ent, 0, sizeof(ent));
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   policy_name = StringValueCStr(v_name);
 
@@ -725,16 +909,16 @@ static VALUE rkadm5_get_policy(VALUE self, VALUE v_name){
     VALUE v_arg[1];
     VALUE v_hash = rb_hash_new();
 
-    rb_hash_aset(v_hash, rb_str_new2("name"), rb_str_new2(ent.policy));
-    rb_hash_aset(v_hash, rb_str_new2("min_life"), LONG2FIX(ent.pw_min_life));
-    rb_hash_aset(v_hash, rb_str_new2("max_life"), LONG2FIX(ent.pw_max_life));
-    rb_hash_aset(v_hash, rb_str_new2("min_length"), LONG2FIX(ent.pw_min_length));
-    rb_hash_aset(v_hash, rb_str_new2("min_classes"), LONG2FIX(ent.pw_min_classes));
-    rb_hash_aset(v_hash, rb_str_new2("history_num"), LONG2FIX(ent.pw_history_num));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("name")), rb_str_new2(ent.policy));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_life")), LONG2FIX(ent.pw_min_life));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("max_life")), LONG2FIX(ent.pw_max_life));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_length")), LONG2FIX(ent.pw_min_length));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_classes")), LONG2FIX(ent.pw_min_classes));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("history_num")), LONG2FIX(ent.pw_history_num));
 
     v_arg[0] = v_hash;
 
-    v_policy = rb_class_new_instance(1, v_arg, cKadm5Policy);
+    v_policy = rb_class_new_instance_kw(1, v_arg, cKadm5Policy, RB_PASS_KEYWORDS);
 
     kadm5_free_policy_ent(ptr->handle, &ent);
   }
@@ -762,8 +946,7 @@ static VALUE rkadm5_find_policy(VALUE self, VALUE v_name){
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
   memset(&ent, 0, sizeof(ent));
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   policy_name = StringValueCStr(v_name);
 
@@ -782,16 +965,16 @@ static VALUE rkadm5_find_policy(VALUE self, VALUE v_name){
     VALUE v_arg[1];
     VALUE v_hash = rb_hash_new();
 
-    rb_hash_aset(v_hash, rb_str_new2("name"), rb_str_new2(ent.policy));
-    rb_hash_aset(v_hash, rb_str_new2("min_life"), LONG2FIX(ent.pw_min_life));
-    rb_hash_aset(v_hash, rb_str_new2("max_life"), LONG2FIX(ent.pw_max_life));
-    rb_hash_aset(v_hash, rb_str_new2("min_length"), LONG2FIX(ent.pw_min_length));
-    rb_hash_aset(v_hash, rb_str_new2("min_classes"), LONG2FIX(ent.pw_min_classes));
-    rb_hash_aset(v_hash, rb_str_new2("history_num"), LONG2FIX(ent.pw_history_num));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("name")), rb_str_new2(ent.policy));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_life")), LONG2FIX(ent.pw_min_life));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("max_life")), LONG2FIX(ent.pw_max_life));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_length")), LONG2FIX(ent.pw_min_length));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("min_classes")), LONG2FIX(ent.pw_min_classes));
+    rb_hash_aset(v_hash, ID2SYM(rb_intern("history_num")), LONG2FIX(ent.pw_history_num));
 
     v_arg[0] = v_hash;
 
-    v_policy = rb_class_new_instance(1, v_arg, cKadm5Policy);
+    v_policy = rb_class_new_instance_kw(1, v_arg, cKadm5Policy, RB_PASS_KEYWORDS);
 
     kadm5_free_policy_ent(ptr->handle, &ent);
   }
@@ -808,34 +991,59 @@ static VALUE rkadm5_find_policy(VALUE self, VALUE v_name){
  * Example:
  *
  *   policy = Kerberos::Kadm5::Policy.find('test')
- *   policy.max_length = 1024
+ *   policy.max_life = 1024
  *   kadm5.modify_policy(policy)
  */
 static VALUE rkadm5_modify_policy(VALUE self, VALUE v_policy){
   RUBY_KADM5* ptr;
-  RUBY_KADM5_POLICY* pptr;
   kadm5_ret_t kerror;
-  long mask = KADM5_POLICY;
+  kadm5_policy_ent_rec ent;
+  long mask = 0;
+  VALUE v_name, v_min_classes, v_min_life, v_max_life, v_min_length, v_history_num;
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
-  TypedData_Get_Struct(v_policy, RUBY_KADM5_POLICY, &rkadm5_policy_data_type, pptr);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
-  if(pptr->policy.pw_min_classes)
+  if(!rb_obj_is_kind_of(v_policy, cKadm5Policy))
+    rb_raise(rb_eTypeError, "expected a Kerberos::Kadm5::Policy object");
+
+  v_name        = rb_iv_get(v_policy, "@policy");
+  v_min_classes = rb_iv_get(v_policy, "@min_classes");
+  v_min_length  = rb_iv_get(v_policy, "@min_length");
+  v_min_life    = rb_iv_get(v_policy, "@min_life");
+  v_max_life    = rb_iv_get(v_policy, "@max_life");
+  v_history_num = rb_iv_get(v_policy, "@history_num");
+
+  memset(&ent, 0, sizeof(ent));
+  ent.policy = StringValueCStr(v_name);
+
+  if(!NIL_P(v_min_classes)){
     mask |= KADM5_PW_MIN_CLASSES;
+    ent.pw_min_classes = NUM2LONG(v_min_classes);
+  }
 
-  if(pptr->policy.pw_min_length)
+  if(!NIL_P(v_min_length)){
     mask |= KADM5_PW_MIN_LENGTH;
+    ent.pw_min_length = NUM2LONG(v_min_length);
+  }
 
-  if(pptr->policy.pw_min_life)
+  if(!NIL_P(v_min_life)){
     mask |= KADM5_PW_MIN_LIFE;
+    ent.pw_min_life = NUM2LONG(v_min_life);
+  }
 
-  if(pptr->policy.pw_max_life)
+  if(!NIL_P(v_max_life)){
     mask |= KADM5_PW_MAX_LIFE;
+    ent.pw_max_life = NUM2LONG(v_max_life);
+  }
 
-  kerror = kadm5_modify_policy(ptr->handle, &pptr->policy, mask);
+  if(!NIL_P(v_history_num)){
+    mask |= KADM5_PW_HISTORY_NUM;
+    ent.pw_history_num = NUM2LONG(v_history_num);
+  }
+
+  kerror = kadm5_modify_policy(ptr->handle, &ent, mask);
 
   if(kerror)
     rb_raise(cKadm5Exception, "kadm5_modify_policy: %s (%li)", error_message(kerror), kerror);
@@ -866,6 +1074,8 @@ static VALUE rkadm5_get_policies(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   rb_scan_args(argc, argv, "01", &v_expr);
 
   if(NIL_P(v_expr))
@@ -914,6 +1124,8 @@ static VALUE rkadm5_get_principals(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   rb_scan_args(argc, argv, "01", &v_expr);
 
   if(NIL_P(v_expr))
@@ -962,6 +1174,8 @@ static VALUE rkadm5_get_privs(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   rb_scan_args(argc, argv, "01", &v_strings);
 
   kerror = kadm5_get_privs(ptr->handle, &privs);
@@ -1007,8 +1221,7 @@ static VALUE rkadm5_randkey_principal(VALUE self, VALUE v_user){
 
   user = StringValueCStr(v_user);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   kerror = krb5_parse_name(ptr->ctx, user, &princ);
 
@@ -1047,10 +1260,13 @@ char** parse_db_args(VALUE v_db_args){
     case T_ARRAY:
       // Multiple arguments
       array_length = RARRAY_LEN(v_db_args);
+
+      for(long i = 0; i < array_length; ++i)
+        Check_Type(rb_ary_entry(v_db_args, i), T_STRING);
+
       db_args = (char **) malloc((array_length + 1) * sizeof(char *));
       for(long i = 0; i < array_length; ++i){
         VALUE elem = rb_ary_entry(v_db_args, i);
-        Check_Type(elem, T_STRING);
         db_args[i] = strdup(StringValueCStr(elem));
       }
       db_args[array_length] = NULL;
@@ -1137,12 +1353,12 @@ void Init_kadm5(void){
 
   // Initialization Method
 
-  rb_define_method(cKadm5, "initialize", rkadm5_initialize, 1);
+  rb_define_method(cKadm5, "initialize", rkadm5_initialize, -1);
 
   // Instance Methods
 
   rb_define_method(cKadm5, "close", rkadm5_close, 0);
-  rb_define_method(cKadm5, "create_policy", rkadm5_create_policy, 1);
+  rb_define_method(cKadm5, "create_policy", rkadm5_create_policy, -1);
   rb_define_method(cKadm5, "create_principal", rkadm5_create_principal, -1);
   rb_define_method(cKadm5, "delete_policy", rkadm5_delete_policy, 1);
   rb_define_method(cKadm5, "delete_principal", rkadm5_delete_principal, 1);