rkerberos 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b4449ae24587324c6b505b5b6c61fa612730a6bc1443fdb0434d8f1d0a80ce0
-  data.tar.gz: 35b35b78ba36dadeb712e340956ae12a8f809e619d05a83bd089c295f6068937
+  metadata.gz: 0dc45dbb751a22370948c430c6590df2a07739638dee7d208f8050d515dfbbfc
+  data.tar.gz: 318bd1b2a81b3791fddf876cdc65895a84645d9f60aa0c0cef3872005b217f6b
 SHA512:
-  metadata.gz: d70da2c89782b2cd3a04be1ac6a07417b7baaa841fec419a95f9c225d52183d6de6ee4110c7cec4a40561eaf9bc330e81d38e0a56c7a2f0edb297730ef3022e2
-  data.tar.gz: 1ceaebf845c73143ba93c85e7e99a714a2ad4af2b6fdef881c550de0e0de6151e034f3012b7c570c75f0e5fc00555e4b4fcc578c0ed8c6b99d7ff2fbdee6ea6d
+  metadata.gz: 0aebb033c55950e140cbfc02abf00f37f4cedd5141228f0bb135d4b70dd93ce50dda121bda128374339259a4a58f7c6e5db09590cd41ba708130beafca734bd2
+  data.tar.gz: 26753f9dcecbecbf3234fc941fe42d380ac0e77829671fe4cc947dfcc081166e0faf77444fa65533bd1b26713b81f67f13f59e5be01a1f0749f3fc7b85430644

data/CHANGES.md

@@ -1,3 +1,18 @@
+# 0.3.1 - 21-Aug-2026
+* Hardened initial credential verification so it fails closed when verification
+  cannot be performed, rejects closed keytabs and credential caches, and safely
+  initializes a supplied cache before storing credentials.
+* Added shared context lifetime tracking. `Context#close` now raises while
+  dependent wrappers remain open; `close(force: true)` logically closes the
+  context and defers native cleanup until its dependents close.
+* Hardened native handle cleanup and closed-object checks across `Krb5`, `Kadm5`,
+  `CredentialsCache`, `Keytab`, and `Principal`.
+* Fixed `Kadm5#modify_policy` to apply values assigned through `Policy` writers,
+  including password history, and require an explicit principal for keytab
+  authentication.
+* Fixed `Keytab#each` and `Keytab.foreach` to raise iteration errors instead of
+  silently returning partial results.
+
 # 0.3.0 - 20-Aug-2026
 * Added optional shared `Context` support to the `Krb5`, `Kadm5`, `Config`,
   `CredentialsCache`, `Keytab`, and `Principal` constructors.

data/EXAMPLES.md

@@ -183,7 +183,7 @@ krb5.close
 ### Version
 
 ```ruby
-puts Kerberos::Krb5::VERSION  # => "0.3.0"
+puts Kerberos::Krb5::VERSION  # => "0.3.1"
 ```
 
 ---

data/README.md

@@ -18,7 +18,12 @@ puts krb.get_permitted_enctypes.keys.join(',')
 
 # Credentials cache
 cc = Kerberos::Krb5::CredentialsCache.new
-krb.verify_init_creds(ccache: cc)
+krb.get_init_creds_password(
+  principal: ENV['KRB5_PRINCIPAL'],
+  password: ENV['KRB5_PASSWORD'],
+  ccache: cc
+)
+krb.verify_init_creds
 puts cc.primary_principal
 
 # Keytab
@@ -38,6 +43,13 @@ ctx = Kerberos::Krb5::Context.new # standard context
 ctx = Kerberos::Krb5::Context.new(profile: '/etc/krb5.conf') # or use a profile
 ctx = Kerberos::Krb5::Context.new(secure: true) # or use a secure context
 ctx.close
+
+# Contexts with active dependent wrappers reject close. A forced close stops
+# direct context use immediately and defers native cleanup until dependents close.
+ctx = Kerberos::Krb5::Context.new
+krb = Kerberos::Krb5.new(context: ctx)
+ctx.close(force: true)
+krb.close
 ```
 
 # Requirements
@@ -160,7 +172,6 @@ The test environment includes:
 # TODO
 * Create a separate class for the replay cache.
 * Better credentials cache support.
-* Ability to add and delete keytab entries.
 
 # Authors
 * Daniel Berger

data/ext/rkerberos/ccache.c

@@ -20,6 +20,8 @@ static void rkrb5_ccache_typed_free(void *ptr) {
     krb5_free_principal(c->ctx, c->principal);
   if (c->ctx && c->rb_context == Qnil)
     krb5_free_context(c->ctx);
+  else if (c->rb_context != Qnil)
+    rkrb5_context_release(c->rb_context);
   free(c);
 }
 
@@ -91,17 +93,7 @@ static VALUE rkrb5_ccache_initialize(int argc, VALUE* argv, VALUE self){
 
   // Initialize or borrow the context
   if(!NIL_P(v_context)){
-    RUBY_KRB5_CONTEXT* ctx_ptr;
-
-    if(!rb_obj_is_kind_of(v_context, cKrb5Context))
-      rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");
-
-    TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ctx_ptr);
-
-    if(!ctx_ptr->ctx)
-      rb_raise(cKrb5Exception, "context is closed");
-
-    ptr->ctx = ctx_ptr->ctx;
+    ptr->ctx = rkrb5_context_borrow(v_context);
     ptr->rb_context = v_context;
   }
   else{
@@ -176,6 +168,8 @@ static VALUE rkrb5_ccache_close(VALUE self){
 
   if(ptr->ctx && ptr->rb_context == Qnil)
     krb5_free_context(ptr->ctx);
+  else if(ptr->rb_context != Qnil)
+    rkrb5_context_release(ptr->rb_context);
 
   ptr->ccache = NULL;
   ptr->ctx = NULL;
@@ -309,6 +303,8 @@ static VALUE rkrb5_ccache_destroy(VALUE self){
 
       if(ptr->ctx && ptr->rb_context == Qnil)
         krb5_free_context(ptr->ctx);
+      else if(ptr->rb_context != Qnil)
+        rkrb5_context_release(ptr->rb_context);
 
       ptr->ccache = NULL;
       ptr->ctx = NULL;
@@ -324,6 +320,8 @@ static VALUE rkrb5_ccache_destroy(VALUE self){
 
   if(ptr->ctx && ptr->rb_context == Qnil)
     krb5_free_context(ptr->ctx);
+  else if(ptr->rb_context != Qnil)
+    rkrb5_context_release(ptr->rb_context);
 
   ptr->ccache = NULL;
   ptr->ctx = NULL;

data/ext/rkerberos/config.c

@@ -4,6 +4,22 @@
 VALUE cKadm5Config;
 VALUE cKeySalt;
 
+static void rkadm5_config_cleanup(RUBY_KADM5_CONFIG *ptr){
+  if(!ptr->ctx)
+    return;
+
+  kadm5_free_config_params(ptr->ctx, &ptr->config);
+
+  if(ptr->rb_context == Qnil)
+    krb5_free_context(ptr->ctx);
+  else
+    rkrb5_context_release(ptr->rb_context);
+
+  ptr->ctx = NULL;
+  ptr->rb_context = Qnil;
+  memset(&ptr->config, 0, sizeof(ptr->config));
+}
+
 
 // TypedData functions for RUBY_KADM5_CONFIG
 static void rkadm5_config_typed_mark(void *ptr) {
@@ -16,11 +32,7 @@ static void rkadm5_config_typed_mark(void *ptr) {
 static void rkadm5_config_typed_free(void *ptr) {
   if (!ptr) return;
   RUBY_KADM5_CONFIG *c = (RUBY_KADM5_CONFIG *)ptr;
-  if (c->ctx) {
-    kadm5_free_config_params(c->ctx, &c->config);
-    if (c->rb_context == Qnil)
-      krb5_free_context(c->ctx);
-  }
+  rkadm5_config_cleanup(c);
   free(c);
 }
 
@@ -85,17 +97,7 @@ static VALUE rkadm5_config_initialize(int argc, VALUE* argv, VALUE self){
   v_context = kw_vals[0] == Qundef ? Qnil : kw_vals[0];
 
   if(!NIL_P(v_context)){
-    RUBY_KRB5_CONTEXT* ctx_ptr;
-
-    if(!rb_obj_is_kind_of(v_context, cKrb5Context))
-      rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");
-
-    TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ctx_ptr);
-
-    if(!ctx_ptr->ctx)
-      rb_raise(cKrb5Exception, "context is closed");
-
-    ptr->ctx = ctx_ptr->ctx;
+    ptr->ctx = rkrb5_context_borrow(v_context);
     ptr->rb_context = v_context;
   }
   else{
@@ -234,6 +236,10 @@ static VALUE rkadm5_config_initialize(int argc, VALUE* argv, VALUE self){
     rb_iv_set(self, "@keysalts", Qnil);
   }
 
+  // All configuration data has been copied into Ruby values, so this object
+  // no longer needs to retain its native context lease.
+  rkadm5_config_cleanup(ptr);
+
   // This is read only data
   rb_obj_freeze(self);
 

data/ext/rkerberos/context.c

@@ -15,6 +15,38 @@ static void rkrb5_context_typed_free(void *ptr) {
   free(c);
 }
 
+krb5_context rkrb5_context_borrow(VALUE v_context){
+  RUBY_KRB5_CONTEXT* ptr;
+
+  if(!rb_obj_is_kind_of(v_context, cKrb5Context))
+    rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");
+
+  TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ptr);
+
+  if(!ptr->ctx || ptr->closed)
+    rb_raise(cKrb5Exception, "context is closed");
+
+  ptr->borrowers++;
+  return ptr->ctx;
+}
+
+void rkrb5_context_release(VALUE v_context){
+  RUBY_KRB5_CONTEXT* ptr;
+
+  if(NIL_P(v_context))
+    return;
+
+  ptr = (RUBY_KRB5_CONTEXT*)RTYPEDDATA_DATA(v_context);
+
+  if(ptr->borrowers > 0)
+    ptr->borrowers--;
+
+  if(ptr->closed && ptr->borrowers == 0 && ptr->ctx){
+    krb5_free_context(ptr->ctx);
+    ptr->ctx = NULL;
+  }
+}
+
 static size_t rkrb5_context_typed_size(const void *ptr) {
   return sizeof(RUBY_KRB5_CONTEXT);
 }
@@ -34,19 +66,42 @@ static VALUE rkrb5_context_allocate(VALUE klass){
 
 /*
  * call-seq:
- *   context.close
+ *   context.close(force: false)
  *
- * Closes the context object.
+ * Closes the context object. Raises if wrappers are still borrowing the
+ * context. With +force: true+, the context is closed to new operations and
+ * borrowers immediately, but its native resources are retained until the
+ * existing borrowers have closed.
  */
-static VALUE rkrb5_context_close(VALUE self){
+static VALUE rkrb5_context_close(int argc, VALUE* argv, VALUE self){
   RUBY_KRB5_CONTEXT* ptr;
+  VALUE v_opts, v_force;
+  ID kw_table[1] = { rb_intern("force") };
+  VALUE kw_vals[1];
 
   TypedData_Get_Struct(self, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ptr);
 
-  if(ptr->ctx)
-    krb5_free_context(ptr->ctx);
+  rb_scan_args(argc, argv, "0:", &v_opts);
+
+  if(NIL_P(v_opts))
+    v_opts = rb_hash_new();
+
+  rb_get_kwargs(v_opts, kw_table, 0, 1, kw_vals);
+  v_force = kw_vals[0] == Qundef ? Qfalse : kw_vals[0];
 
-  ptr->ctx = NULL;
+  if(ptr->closed || !ptr->ctx)
+    return self;
+
+  if(ptr->borrowers > 0 && !RTEST(v_force))
+    rb_raise(cKrb5Exception, "context is in use by %lu dependent wrapper%s",
+      (unsigned long)ptr->borrowers, ptr->borrowers == 1 ? "" : "s");
+
+  ptr->closed = 1;
+
+  if(ptr->borrowers == 0){
+    krb5_free_context(ptr->ctx);
+    ptr->ctx = NULL;
+  }
 
   return self;
 }
@@ -147,7 +202,7 @@ static VALUE rkrb5_context_default_realm(VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ptr);
 
-  if(!ptr->ctx)
+  if(!ptr->ctx || ptr->closed)
     rb_raise(cKrb5Exception, "no context has been established");
 
   kerror = krb5_get_default_realm(ptr->ctx, &realm);
@@ -175,7 +230,7 @@ static VALUE rkrb5_context_set_default_realm(VALUE self, VALUE v_realm){
 
   TypedData_Get_Struct(self, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ptr);
 
-  if(!ptr->ctx)
+  if(!ptr->ctx || ptr->closed)
     rb_raise(cKrb5Exception, "no context has been established");
 
   if(NIL_P(v_realm)){
@@ -205,7 +260,7 @@ void Init_context(void){
   rb_define_method(cKrb5Context, "initialize", rkrb5_context_initialize, -1);
 
   // Instance Methods
-  rb_define_method(cKrb5Context, "close", rkrb5_context_close, 0);
+  rb_define_method(cKrb5Context, "close", rkrb5_context_close, -1);
   rb_define_method(cKrb5Context, "default_realm", rkrb5_context_default_realm, 0);
   rb_define_method(cKrb5Context, "default_realm=", rkrb5_context_set_default_realm, 1);
 }

data/ext/rkerberos/kadm5.c

@@ -8,6 +8,7 @@ VALUE cKadm5PrincipalNotFoundException;
 
 // Prototype
 static VALUE rkadm5_close(VALUE);
+static void rkadm5_check_open(RUBY_KADM5 *);
 static void free_tl_data(krb5_tl_data *);
 static void free_db_args(char**);
 char** parse_db_args(VALUE v_db_args);
@@ -33,6 +34,8 @@ static void rkadm5_typed_free(void *ptr) {
     krb5_free_principal(k->ctx, k->princ);
   if (k->ctx && k->rb_context == Qnil)
     krb5_free_context(k->ctx);
+  else if (k->rb_context != Qnil)
+    rkrb5_context_release(k->rb_context);
   free_db_args(k->db_args);
   free(k);
 }
@@ -55,6 +58,11 @@ static VALUE rkadm5_allocate(VALUE klass){
   return TypedData_Wrap_Struct(klass, &rkadm5_data_type, ptr);
 }
 
+static void rkadm5_check_open(RUBY_KADM5 *ptr){
+  if(!ptr->ctx || !ptr->handle)
+    rb_raise(cKadm5Exception, "no administrative context has been established");
+}
+
 /*
  * call-seq:
  *   Kerberos::Kadm5.new(principal: 'name', password: 'xxxxx')
@@ -140,17 +148,14 @@ static VALUE rkadm5_initialize(int argc, VALUE* argv, VALUE self){
     pass = StringValueCStr(v_password);
   }
 
-  if(RTEST(v_ccache) && NIL_P(v_principal)){
-    if(NIL_P(v_principal))
-      v_principal = rb_funcall(v_ccache, rb_intern("principal"), 0);
-  }
+  if(RTEST(v_keytab) && NIL_P(v_principal))
+    rb_raise(rb_eArgError, "principal must be specified when using a keytab");
+
+  if(RTEST(v_ccache) && !rb_obj_is_kind_of(v_ccache, cKrb5CCache))
+    rb_raise(rb_eTypeError, "ccache must be a Kerberos::Krb5::CredentialsCache object");
 
-  // For a keytab use the first entry's principal
-  if(RTEST(v_keytab) && NIL_P(v_principal)) {
-    VALUE v_enum, v_first;
-    v_enum = rb_funcall(v_keytab, rb_intern("each"), 0);
-    v_first = rb_funcall(v_enum, rb_intern("first"), 0);
-    v_principal = rb_iv_get(v_first, "@principal");
+  if(RTEST(v_ccache) && NIL_P(v_principal)){
+    v_principal = rb_funcall(v_ccache, rb_intern("principal"), 0);
   }
 
   user = StringValueCStr(v_principal);
@@ -166,17 +171,7 @@ static VALUE rkadm5_initialize(int argc, VALUE* argv, VALUE self){
 
   // Initialize or borrow the context
   if(!NIL_P(v_context)){
-    RUBY_KRB5_CONTEXT* ctx_ptr;
-
-    if(!rb_obj_is_kind_of(v_context, cKrb5Context))
-      rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");
-
-    TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ctx_ptr);
-
-    if(!ctx_ptr->ctx)
-      rb_raise(cKrb5Exception, "context is closed");
-
-    ptr->ctx = ctx_ptr->ctx;
+    ptr->ctx = rkrb5_context_borrow(v_context);
     ptr->rb_context = v_context;
   }
   else{
@@ -239,12 +234,9 @@ static VALUE rkadm5_initialize(int argc, VALUE* argv, VALUE self){
   else if(RTEST(v_ccache)){
     RUBY_KRB5_CCACHE* cc_ptr;
 
-    if(!rb_obj_is_kind_of(v_ccache, cKrb5CCache))
-      rb_raise(rb_eTypeError, "ccache must be a Kerberos::Krb5::CredentialsCache object");
-
     TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, cc_ptr);
 
-    if(!cc_ptr->ccache)
+    if(!cc_ptr->ctx || !cc_ptr->ccache)
       rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");
 
     kerror = kadm5_init_with_creds(
@@ -289,8 +281,7 @@ static VALUE rkadm5_set_password(VALUE self, VALUE v_user, VALUE v_pass){
   user = StringValueCStr(v_user);
   pass = StringValueCStr(v_pass);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -327,8 +318,7 @@ static VALUE rkadm5_set_pwexpire(VALUE self, VALUE v_user, VALUE v_pwexpire){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -398,6 +388,8 @@ static VALUE rkadm5_create_principal(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   rb_scan_args(argc, argv, "0:", &v_opts);
 
   if(NIL_P(v_opts))
@@ -429,9 +421,6 @@ static VALUE rkadm5_create_principal(int argc, VALUE* argv, VALUE self){
   add_db_args(&princ, db_args);
   free_db_args(db_args);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
-
   // Determine the principal name and populate mask from the principal object
   if(RTEST(v_principal)){
     VALUE v_princ_name, v_policy, v_expire, v_pw_expire, v_max_life, v_max_renew, v_attrs;
@@ -536,8 +525,7 @@ static VALUE rkadm5_delete_principal(VALUE self, VALUE v_user){
   Check_Type(v_user, T_STRING);
   user = StringValueCStr(v_user);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -579,6 +567,8 @@ static VALUE rkadm5_close(VALUE self){
 
   if(ptr->ctx && ptr->rb_context == Qnil)
     krb5_free_context(ptr->ctx);
+  else if(ptr->rb_context != Qnil)
+    rkrb5_context_release(ptr->rb_context);
 
   free_db_args(ptr->db_args);
 
@@ -674,8 +664,7 @@ static VALUE rkadm5_find_principal(VALUE self, VALUE v_user){
 
   memset(&ent, 0, sizeof(ent));
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -735,8 +724,7 @@ static VALUE rkadm5_get_principal(VALUE self, VALUE v_user){
 
   memset(&ent, 0, sizeof(ent));
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   if(ptr->princ){
     krb5_free_principal(ptr->ctx, ptr->princ);
@@ -794,6 +782,8 @@ static VALUE rkadm5_create_policy(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   rb_scan_args(argc, argv, "01:", &v_policy, &v_kwargs);
 
   if(!NIL_P(v_kwargs)){
@@ -871,6 +861,8 @@ static VALUE rkadm5_delete_policy(VALUE self, VALUE v_policy){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   policy = StringValueCStr(v_policy);
 
   kerror = kadm5_delete_policy(ptr->handle, policy);
@@ -901,8 +893,7 @@ static VALUE rkadm5_get_policy(VALUE self, VALUE v_name){
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
   memset(&ent, 0, sizeof(ent));
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   policy_name = StringValueCStr(v_name);
 
@@ -955,8 +946,7 @@ static VALUE rkadm5_find_policy(VALUE self, VALUE v_name){
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
   memset(&ent, 0, sizeof(ent));
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   policy_name = StringValueCStr(v_name);
 
@@ -1001,34 +991,59 @@ static VALUE rkadm5_find_policy(VALUE self, VALUE v_name){
  * Example:
  *
  *   policy = Kerberos::Kadm5::Policy.find('test')
- *   policy.max_length = 1024
+ *   policy.max_life = 1024
  *   kadm5.modify_policy(policy)
  */
 static VALUE rkadm5_modify_policy(VALUE self, VALUE v_policy){
   RUBY_KADM5* ptr;
-  RUBY_KADM5_POLICY* pptr;
   kadm5_ret_t kerror;
-  long mask = KADM5_POLICY;
+  kadm5_policy_ent_rec ent;
+  long mask = 0;
+  VALUE v_name, v_min_classes, v_min_life, v_max_life, v_min_length, v_history_num;
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
-  TypedData_Get_Struct(v_policy, RUBY_KADM5_POLICY, &rkadm5_policy_data_type, pptr);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
+
+  if(!rb_obj_is_kind_of(v_policy, cKadm5Policy))
+    rb_raise(rb_eTypeError, "expected a Kerberos::Kadm5::Policy object");
+
+  v_name        = rb_iv_get(v_policy, "@policy");
+  v_min_classes = rb_iv_get(v_policy, "@min_classes");
+  v_min_length  = rb_iv_get(v_policy, "@min_length");
+  v_min_life    = rb_iv_get(v_policy, "@min_life");
+  v_max_life    = rb_iv_get(v_policy, "@max_life");
+  v_history_num = rb_iv_get(v_policy, "@history_num");
+
+  memset(&ent, 0, sizeof(ent));
+  ent.policy = StringValueCStr(v_name);
 
-  if(pptr->policy.pw_min_classes)
+  if(!NIL_P(v_min_classes)){
     mask |= KADM5_PW_MIN_CLASSES;
+    ent.pw_min_classes = NUM2LONG(v_min_classes);
+  }
 
-  if(pptr->policy.pw_min_length)
+  if(!NIL_P(v_min_length)){
     mask |= KADM5_PW_MIN_LENGTH;
+    ent.pw_min_length = NUM2LONG(v_min_length);
+  }
 
-  if(pptr->policy.pw_min_life)
+  if(!NIL_P(v_min_life)){
     mask |= KADM5_PW_MIN_LIFE;
+    ent.pw_min_life = NUM2LONG(v_min_life);
+  }
 
-  if(pptr->policy.pw_max_life)
+  if(!NIL_P(v_max_life)){
     mask |= KADM5_PW_MAX_LIFE;
+    ent.pw_max_life = NUM2LONG(v_max_life);
+  }
+
+  if(!NIL_P(v_history_num)){
+    mask |= KADM5_PW_HISTORY_NUM;
+    ent.pw_history_num = NUM2LONG(v_history_num);
+  }
 
-  kerror = kadm5_modify_policy(ptr->handle, &pptr->policy, mask);
+  kerror = kadm5_modify_policy(ptr->handle, &ent, mask);
 
   if(kerror)
     rb_raise(cKadm5Exception, "kadm5_modify_policy: %s (%li)", error_message(kerror), kerror);
@@ -1059,6 +1074,8 @@ static VALUE rkadm5_get_policies(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   rb_scan_args(argc, argv, "01", &v_expr);
 
   if(NIL_P(v_expr))
@@ -1107,6 +1124,8 @@ static VALUE rkadm5_get_principals(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   rb_scan_args(argc, argv, "01", &v_expr);
 
   if(NIL_P(v_expr))
@@ -1155,6 +1174,8 @@ static VALUE rkadm5_get_privs(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KADM5, &rkadm5_data_type, ptr);
 
+  rkadm5_check_open(ptr);
+
   rb_scan_args(argc, argv, "01", &v_strings);
 
   kerror = kadm5_get_privs(ptr->handle, &privs);
@@ -1200,8 +1221,7 @@ static VALUE rkadm5_randkey_principal(VALUE self, VALUE v_user){
 
   user = StringValueCStr(v_user);
 
-  if(!ptr->ctx)
-    rb_raise(cKadm5Exception, "no context has been established");
+  rkadm5_check_open(ptr);
 
   kerror = krb5_parse_name(ptr->ctx, user, &princ);
 
@@ -1240,10 +1260,13 @@ char** parse_db_args(VALUE v_db_args){
     case T_ARRAY:
       // Multiple arguments
       array_length = RARRAY_LEN(v_db_args);
+
+      for(long i = 0; i < array_length; ++i)
+        Check_Type(rb_ary_entry(v_db_args, i), T_STRING);
+
       db_args = (char **) malloc((array_length + 1) * sizeof(char *));
       for(long i = 0; i < array_length; ++i){
         VALUE elem = rb_ary_entry(v_db_args, i);
-        Check_Type(elem, T_STRING);
         db_args[i] = strdup(StringValueCStr(elem));
       }
       db_args[array_length] = NULL;