
#!/bin/sh

# list_princs keytab
# returns a list of principals in the keytab
# sorted and uniquified
list_princs() {
    klist -k $keytab | awk '(NR > 3) {print $2}' | sort | uniq
}

set_command() {
    if [ x$command != x ] ; then
	cmd_error Only one command can be specified
	usage
	exit 1
    fi
    command=$1
}

#interactive_prompt prompt princ
# If in interactive mode  return  true if the principal  should be acted on
# otherwise return true all the time
interactive_prompt() {
    if [ $interactive = 0 ] ; then
	return 0
    fi
    printf "%s for %s? [yn]" "$1" "$2"
    read ans
    case $ans in
    n*|N*)
	return 1
	;;
    esac
    return 0
    }
    
cmd_error() {
    echo $@ 2>&1
    }

usage() {
    echo "Usage: $0 [-i] [-f file] [-e keysalts] list|change|delete|delold"
}


change_key() {
    princs=`list_princs `
    for princ in $princs; do
	if interactive_prompt "Change key " $princ; then
	    kadmin -k -t $keytab -p $princ -q \
		"ktadd -k $keytab $keysalts $princ"
	fi
    done
    }

delete_old_keys() {
    princs=`list_princs `
    for princ in $princs; do
	if interactive_prompt "Delete old keys " $princ; then
	    kadmin -k -t $keytab -p $princ -q "ktrem -k $keytab $princ old"
	fi
    done
    }

delete_keys() {
    interactive=1
    princs=`list_princs `
    for princ in $princs; do
	if interactive_prompt "Delete all keys " $princ; then
	    kadmin -p $princ -k -t $keytab -q "ktrem -k $keytab $princ all"
	fi
    done
    }


keytab=/etc/krb5.keytab
interactive=0
keysalts=""

while [ $# -gt 0 ] ; do
    opt=$1
    shift
        case $opt in
	"-f")
	keytab=$1
	shift
	;;
	"-i")
	interactive=1
	;;
	"-e")
	keysalts="$keysalts -e \"$1\""
	shift
	;;
	change|delold|delete|list)
	set_command $opt
	;;
	*)
	cmd_error Illegal option: $opt
	usage
	exit 1
	;;
	esac
done
	

case $command in
    change)
    change_key
    ;;
    delold)
    delete_old_keys
    ;;
    delete)
    delete_keys
    ;;
    list)
    klist -k $keytab
    ;;
    *)
        usage
	;;
    esac