Adding upstream version 2.9.4.upstream/2.9.4

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1671 insertions, 0 deletions

diff --git a/src/responder/kcm/kcmsrv_ccache_secdb.c b/src/responder/kcm/kcmsrv_ccache_secdb.c
new file mode 100644
index 0000000..ff5e6e2
--- /dev/null
+++ b/src/responder/kcm/kcmsrv_ccache_secdb.c
@@ -0,0 +1,1671 @@
+/*
+   SSSD
+
+   KCM Server - ccache storage using libsss_secrets
+
+   Copyright (C) Red Hat, 2016
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "config.h"
+
+#include <talloc.h>
+#include <stdio.h>
+
+#include "util/util.h"
+#include "secrets/secrets.h"
+#include "util/crypto/sss_crypto.h"
+#include "util/sss_krb5.h"
+#include "util/strtonum.h"
+#include "responder/kcm/kcmsrv_ccache_pvt.h"
+#include "responder/kcm/kcmsrv_ccache_be.h"
+#include "responder/kcm/kcm_renew.h"
+#include "providers/krb5/krb5_ccache.h"
+
+#define KCM_SECDB_URL        "persistent"
+#define KCM_SECDB_BASE_FMT    KCM_SECDB_URL"/%"SPRIuid"/"
+#define KCM_SECDB_CCACHE_FMT  KCM_SECDB_BASE_FMT"ccache/"
+#define KCM_SECDB_DFL_FMT     KCM_SECDB_BASE_FMT"default"
+
+static errno_t sec_get(TALLOC_CTX *mem_ctx,
+                       struct sss_sec_req *req,
+                       struct sss_iobuf **_buf)
+{
+    errno_t ret;
+    TALLOC_CTX *tmp_ctx;
+    uint8_t *data;
+    size_t len;
+    struct sss_iobuf *buf;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) {
+        return ENOMEM;
+    }
+
+    ret = sss_sec_get(tmp_ctx, req, &data, &len);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_MINOR_FAILURE,
+              "Cannot retrieve the secret [%d]: %s\n", ret, sss_strerror(ret));
+        goto done;
+    }
+
+    buf = sss_iobuf_init_steal(tmp_ctx, data, len);
+    if (buf == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot init the iobuf\n");
+        ret = EIO;
+        goto done;
+    }
+
+    *_buf = talloc_steal(mem_ctx, buf);
+
+    ret = EOK;
+
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static errno_t sec_put(TALLOC_CTX *mem_ctx,
+                       struct sss_sec_req *req,
+                       struct sss_iobuf *buf)
+{
+    errno_t ret;
+
+    ret = sss_sec_put(req, sss_iobuf_get_data(buf), sss_iobuf_get_size(buf));
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Cannot write the secret [%d]: %s\n", ret, sss_strerror(ret));
+    }
+
+    return ret;
+}
+
+static errno_t sec_update(TALLOC_CTX *mem_ctx,
+                          struct sss_sec_req *req,
+                          struct sss_iobuf *buf)
+{
+    errno_t ret;
+
+    ret = sss_sec_update(req, sss_iobuf_get_data(buf), sss_iobuf_get_size(buf));
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Cannot write the secret [%d]: %s\n", ret, sss_strerror(ret));
+    }
+
+    return ret;
+}
+
+static const char *secdb_container_url_create(TALLOC_CTX *mem_ctx,
+                                              struct cli_creds *client)
+{
+    return talloc_asprintf(mem_ctx,
+                           KCM_SECDB_CCACHE_FMT,
+                           cli_creds_get_uid(client));
+}
+
+static const char *secdb_cc_url_create(TALLOC_CTX *mem_ctx,
+                                       struct cli_creds *client,
+                                       const char *secdb_key)
+{
+    return talloc_asprintf(mem_ctx,
+                           KCM_SECDB_CCACHE_FMT"%s",
+                           cli_creds_get_uid(client),
+                           secdb_key);
+}
+
+static const char *secdb_dfl_url_create(TALLOC_CTX *mem_ctx,
+                                        struct cli_creds *client)
+{
+    return talloc_asprintf(mem_ctx,
+                           KCM_SECDB_DFL_FMT,
+                           cli_creds_get_uid(client));
+}
+
+static errno_t kcm_ccache_to_secdb_kv(TALLOC_CTX *mem_ctx,
+                                      struct kcm_ccache *cc,
+                                      struct cli_creds *client,
+                                      const char **_url,
+                                      struct sss_iobuf **_payload)
+{
+    errno_t ret;
+    const char *url;
+    const char *key;
+    TALLOC_CTX *tmp_ctx;
+    struct sss_iobuf *payload;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) {
+        return ENOMEM;
+    }
+
+    key = sec_key_create(tmp_ctx, cc->name, cc->uuid);
+    if (key == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create key for %s\n", cc->name);
+        ret = ENOMEM;
+        goto done;
+    }
+
+    url = secdb_cc_url_create(tmp_ctx, client, key);
+    if (url == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create URL from %s\n", key);
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = kcm_ccache_to_sec_input_binary(mem_ctx, cc, &payload);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot convert ccache to a secret [%d][%s]\n", ret, sss_strerror(ret));
+        goto done;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Created URL %s\n", url);
+    *_url = talloc_steal(mem_ctx, url);
+    *_payload = talloc_steal(mem_ctx, payload);
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+struct ccdb_secdb {
+    struct sss_sec_ctx *sctx;
+};
+
+/* Since with the synchronous database, the database operations are just
+ * fake-async wrappers around otherwise sync operations, we don't often
+ * need any state structure, unless the _recv() function returns anything,
+ * so we use this empty structure instead
+ */
+struct ccdb_secdb_state {
+};
+
+static errno_t secdb_container_url_req(TALLOC_CTX *mem_ctx,
+                                       struct sss_sec_ctx *sctx,
+                                       struct cli_creds *client,
+                                       struct sss_sec_req **_sreq)
+{
+    const char *url;
+    struct sss_sec_req *sreq;
+    errno_t ret;
+    TALLOC_CTX *tmp_ctx;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) {
+        return ENOMEM;
+    }
+
+    url = secdb_container_url_create(tmp_ctx, client);
+    if (url == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = sss_sec_new_req(tmp_ctx, sctx, url, geteuid(), &sreq);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Created request for URL %s\n", url);
+    *_sreq = talloc_steal(mem_ctx, sreq);
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static errno_t secdb_cc_url_req(TALLOC_CTX *mem_ctx,
+                                struct sss_sec_ctx *sctx,
+                                struct cli_creds *client,
+                                const char *secdb_url,
+                                struct sss_sec_req **_sreq)
+{
+    struct sss_sec_req *sreq;
+    errno_t ret;
+    TALLOC_CTX *tmp_ctx;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) {
+        return ENOMEM;
+    }
+
+    ret = sss_sec_new_req(tmp_ctx, sctx, secdb_url, geteuid(), &sreq);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Created request for URL %s\n", secdb_url);
+    *_sreq = talloc_steal(mem_ctx, sreq);
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static errno_t secdb_cc_key_req(TALLOC_CTX *mem_ctx,
+                                struct sss_sec_ctx *sctx,
+                                struct cli_creds *client,
+                                const char *secdb_key,
+                                struct sss_sec_req **_sreq)
+{
+    const char *url;
+    struct sss_sec_req *sreq;
+    errno_t ret;
+    TALLOC_CTX *tmp_ctx;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) {
+        return ENOMEM;
+    }
+
+    url = secdb_cc_url_create(tmp_ctx, client, secdb_key);
+    if (url == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = secdb_cc_url_req(tmp_ctx, sctx, client, url, &sreq);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Created request for URL %s\n", url);
+    *_sreq = talloc_steal(mem_ctx, sreq);
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static errno_t secdb_dfl_url_req(TALLOC_CTX *mem_ctx,
+                                 struct sss_sec_ctx *sctx,
+                                 struct cli_creds *client,
+                                 struct sss_sec_req **_sreq)
+{
+    const char *url;
+    struct sss_sec_req *sreq;
+    errno_t ret;
+    TALLOC_CTX *tmp_ctx;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) {
+        return ENOMEM;
+    }
+
+    url = secdb_dfl_url_create(tmp_ctx, client);
+    if (url == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = sss_sec_new_req(tmp_ctx, sctx, url, geteuid(), &sreq);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Created request for URL %s\n", url);
+    *_sreq = talloc_steal(mem_ctx, sreq);
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static errno_t key_by_uuid(TALLOC_CTX *mem_ctx,
+                           struct sss_sec_ctx *sctx,
+                           struct cli_creds *client,
+                           uuid_t uuid,
+                           char **_key)
+{
+    TALLOC_CTX *tmp_ctx;
+    errno_t ret;
+    char *key_match = NULL;
+    char **keys = NULL;
+    size_t nkeys;
+    struct sss_sec_req *sreq = NULL;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) {
+        return ENOMEM;
+    }
+
+    ret = secdb_container_url_req(tmp_ctx, sctx, client, &sreq);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    ret = sss_sec_list(tmp_ctx, sreq, &keys, &nkeys);
+    if (ret == ENOENT) {
+        DEBUG(SSSDBG_MINOR_FAILURE, "The container was not found\n");
+        goto done;
+    } else if (ret != EOK) {
+        goto done;
+    }
+
+    for (size_t i = 0; i < nkeys; i++) {
+        if (sec_key_match_uuid(keys[i], uuid)) {
+            key_match = keys[i];
+            break;
+        }
+    }
+
+    if (key_match == NULL) {
+        DEBUG(SSSDBG_TRACE_INTERNAL, "No key matched\n");
+        ret = ENOENT;
+        goto done;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Found key %s\n", key_match);
+    *_key = talloc_steal(mem_ctx, key_match);
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static errno_t key_by_name(TALLOC_CTX *mem_ctx,
+                           struct sss_sec_ctx *sctx,
+                           struct cli_creds *client,
+                           const char *name,
+                           char **_key)
+{
+    TALLOC_CTX *tmp_ctx;
+    errno_t ret;
+    char *key_match = NULL;
+    char **keys = NULL;
+    size_t nkeys;
+    struct sss_sec_req *sreq = NULL;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) {
+        return ENOMEM;
+    }
+
+    ret = secdb_container_url_req(tmp_ctx, sctx, client, &sreq);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    ret = sss_sec_list(tmp_ctx, sreq, &keys, &nkeys);
+    if (ret == ENOENT) {
+        DEBUG(SSSDBG_MINOR_FAILURE, "The container was not found\n");
+        goto done;
+    } else if (ret != EOK) {
+        goto done;
+    }
+
+    for (size_t i = 0; i < nkeys; i++) {
+        if (sec_key_match_name(keys[i], name)) {
+            key_match = keys[i];
+            break;
+        }
+    }
+
+    if (key_match == NULL) {
+        DEBUG(SSSDBG_TRACE_INTERNAL, "No key matched\n");
+        ret = ENOENT;
+        goto done;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Found key %s\n", key_match);
+    *_key = talloc_steal(mem_ctx, key_match);
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static errno_t secdb_get_cc(TALLOC_CTX *mem_ctx,
+                            struct sss_sec_ctx *sctx,
+                            const char *secdb_key,
+                            struct cli_creds *client,
+                            struct kcm_ccache **_cc)
+{
+    errno_t ret;
+    TALLOC_CTX *tmp_ctx = NULL;
+    struct kcm_ccache *cc = NULL;
+    struct sss_sec_req *sreq = NULL;
+    struct sss_iobuf *ccbuf;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) {
+        return ENOMEM;
+    }
+
+    ret = secdb_cc_key_req(tmp_ctx, sctx, client, secdb_key, &sreq);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Cannot create secdb request [%d][%s]\n", ret, sss_strerror(ret));
+        goto done;
+    }
+
+    ret = sec_get(tmp_ctx, sreq, &ccbuf);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Cannot get the secret [%d][%s]\n", ret, sss_strerror(ret));
+        goto done;
+    }
+
+    ret = sec_kv_to_ccache_binary(tmp_ctx, secdb_key, ccbuf, client, &cc);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "Cannot convert data to ccache [%d]: %s, "
+              "deleting this entry\n", ret, sss_strerror(ret));
+        ret = sss_sec_delete(sreq);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "Failed to delete entry: [%d]: %s",
+                  ret, sss_strerror(ret));
+        }
+        ret = ENOENT;
+        goto done;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Fetched the ccache\n");
+    *_cc = talloc_steal(mem_ctx, cc);
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static errno_t ccdb_secdb_init(struct kcm_ccdb *db,
+                               struct confdb_ctx *cdb,
+                               const char *confdb_service_path)
+{
+    struct ccdb_secdb *secdb = NULL;
+    errno_t ret;
+    struct sss_sec_quota *kcm_quota;
+    struct sss_sec_quota_opt dfl_kcm_nest_level = {
+        .opt_name = CONFDB_KCM_CONTAINERS_NEST_LEVEL,
+        .default_value = DEFAULT_SEC_CONTAINERS_NEST_LEVEL,
+    };
+    struct sss_sec_quota_opt dfl_kcm_max_secrets = {
+        .opt_name = CONFDB_KCM_MAX_CCACHES,
+        .default_value = DEFAULT_SEC_KCM_MAX_SECRETS,
+    };
+    struct sss_sec_quota_opt dfl_kcm_max_uid_secrets = {
+        .opt_name = CONFDB_KCM_MAX_UID_CCACHES,
+        .default_value = DEFAULT_SEC_KCM_MAX_UID_SECRETS,
+    };
+    struct sss_sec_quota_opt dfl_kcm_max_payload_size = {
+        .opt_name = CONFDB_KCM_MAX_CCACHE_SIZE,
+        .default_value = DEFAULT_SEC_KCM_MAX_PAYLOAD_SIZE,
+    };
+
+
+    secdb = talloc_zero(db, struct ccdb_secdb);
+    if (secdb == NULL) {
+        return ENOMEM;
+    }
+
+    kcm_quota = talloc_zero(secdb, struct sss_sec_quota);
+    if (kcm_quota == NULL) {
+        talloc_free(secdb);
+        return ENOMEM;
+    }
+
+    ret = sss_sec_get_quota(cdb,
+                            confdb_service_path,
+                            &dfl_kcm_nest_level,
+                            &dfl_kcm_max_secrets,
+                            &dfl_kcm_max_uid_secrets,
+                            &dfl_kcm_max_payload_size,
+                            kcm_quota);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "Failed to get KCM global quotas [%d]: %s\n",
+              ret, sss_strerror(ret));
+        talloc_free(secdb);
+        return ret;
+    }
+
+    if (kcm_quota->max_uid_secrets > 0) {
+       kcm_quota->max_uid_secrets += KCM_MAX_UID_EXTRA_SECRETS;
+    }
+
+    ret = sss_sec_init(db, kcm_quota, &secdb->sctx);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot initialize the security database\n");
+        talloc_free(secdb);
+        return ret;
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "secdb initialized\n");
+    db->db_handle = secdb;
+    return EOK;
+}
+
+struct ccdb_secdb_nextid_state {
+    unsigned int nextid;
+};
+
+static bool is_in_use(char **keys, size_t nkeys, const char *nextid_name)
+{
+    for (size_t i = 0; i < nkeys; i++) {
+        if (sec_key_match_name(keys[i], nextid_name) == true) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+static struct tevent_req *ccdb_secdb_nextid_send(TALLOC_CTX *mem_ctx,
+                                               struct tevent_context *ev,
+                                               struct kcm_ccdb *db,
+                                               struct cli_creds *client)
+{
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_nextid_state *state = NULL;
+    struct ccdb_secdb *secdb = NULL;
+    const int maxtries = 3;
+    int numtry;
+    errno_t ret;
+    struct sss_sec_req *sreq = NULL;
+    char **keys = NULL;
+    size_t nkeys;
+    char *nextid_name = NULL;
+
+    DEBUG(SSSDBG_TRACE_LIBS, "Generating a new ID\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_nextid_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    if (secdb == NULL) {
+        ret = EIO;
+        goto immediate;
+    }
+
+    ret = secdb_container_url_req(state, secdb->sctx, client, &sreq);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sss_sec_list(state, sreq, &keys, &nkeys);
+    if (ret == ENOENT) {
+        keys = NULL;
+        nkeys = 0;
+    } else if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Cannot list keys [%d]: %s\n",
+              ret, sss_strerror(ret));
+        goto immediate;
+    }
+
+    for (numtry = 0; numtry  < maxtries; numtry++) {
+        state->nextid = sss_rand() % MAX_CC_NUM;
+        nextid_name = talloc_asprintf(state, "%"SPRIuid":%u",
+                                      cli_creds_get_uid(client),
+                                      state->nextid);
+        if (nextid_name == NULL) {
+            ret = ENOMEM;
+            goto immediate;
+        }
+
+        if (!is_in_use(keys, nkeys, nextid_name)) {
+            break;
+        }
+    }
+
+    if (numtry >= maxtries) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Failed to find a random ccache in %d tries\n", numtry);
+        ret = EBUSY;
+        goto immediate;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_LIBS, "Generated next ID %d\n", state->nextid);
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_nextid_recv(struct tevent_req *req,
+                                    unsigned int *_nextid)
+{
+    struct ccdb_secdb_nextid_state *state = tevent_req_data(req,
+                                                struct ccdb_secdb_nextid_state);
+
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    *_nextid = state->nextid;
+    return EOK;
+}
+
+static struct tevent_req *ccdb_secdb_set_default_send(TALLOC_CTX *mem_ctx,
+                                                      struct tevent_context *ev,
+                                                      struct kcm_ccdb *db,
+                                                      struct cli_creds *client,
+                                                      uuid_t uuid)
+{
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_state *state = NULL;
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    errno_t ret;
+    char uuid_str[UUID_STR_SIZE];
+    struct sss_sec_req *sreq = NULL;
+    struct sss_iobuf *iobuf;
+    char *cur_default;
+
+    uuid_unparse(uuid, uuid_str);
+    DEBUG(SSSDBG_TRACE_INTERNAL,
+          "Setting the default ccache to %s\n", uuid_str);
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = secdb_dfl_url_req(state, secdb->sctx, client, &sreq);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    iobuf = sss_iobuf_init_readonly(state,
+                                    (const uint8_t *) uuid_str,
+                                    UUID_STR_SIZE);
+    if (iobuf == NULL) {
+        ret = ENOMEM;
+        goto immediate;
+    }
+
+    ret = sss_sec_get(state, sreq, (uint8_t**)&cur_default, NULL);
+    if (ret == ENOENT) {
+        ret = sec_put(state, sreq, iobuf);
+    } else if (ret == EOK) {
+        ret = sec_update(state, sreq, iobuf);
+    }
+
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = EOK;
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Set the default ccache\n");
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_set_default_recv(struct tevent_req *req)
+{
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    return EOK;
+}
+
+struct ccdb_secdb_get_default_state {
+    uuid_t uuid;
+};
+
+static struct tevent_req *ccdb_secdb_get_default_send(TALLOC_CTX *mem_ctx,
+                                                      struct tevent_context *ev,
+                                                      struct kcm_ccdb *db,
+                                                      struct cli_creds *client)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_get_default_state *state = NULL;
+    errno_t ret;
+    struct sss_sec_req *sreq = NULL;
+    struct sss_iobuf *dfl_iobuf = NULL;
+    size_t uuid_size;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Getting the default ccache\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_get_default_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = secdb_dfl_url_req(state, secdb->sctx, client, &sreq);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sec_get(state, sreq, &dfl_iobuf);
+    if (ret == ENOENT) {
+        uuid_clear(state->uuid);
+        ret = EOK;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    uuid_size = sss_iobuf_get_size(dfl_iobuf);
+    if (uuid_size != UUID_STR_SIZE) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Unexpected UUID size %zu, deleting this entry\n", uuid_size);
+        ret = sss_sec_delete(sreq);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Failed to delete entry: [%d]: %s, "
+                  "consider manual removal of "SECRETS_DB_PATH"/secrets.ldb\n",
+                  ret, sss_strerror(ret));
+            sss_log(SSS_LOG_CRIT,
+                    "Can't delete an entry from "SECRETS_DB_PATH"/secrets.ldb, "
+                    "content seems to be corrupted. Consider file removal. "
+                    "(Take a note, this will delete all credentials managed "
+                    "via sssd_kcm)");
+        }
+        uuid_clear(state->uuid);
+        ret = EOK;
+        goto immediate;
+    }
+
+    uuid_parse((const char *) sss_iobuf_get_data(dfl_iobuf), state->uuid);
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Got the default ccache\n");
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_get_default_recv(struct tevent_req *req,
+                                           uuid_t uuid)
+{
+    struct ccdb_secdb_get_default_state *state = tevent_req_data(req,
+                                                struct ccdb_secdb_get_default_state);
+
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+
+    uuid_copy(uuid, state->uuid);
+    return EOK;
+}
+
+static errno_t ccdb_secdb_get_cc_for_uuid(TALLOC_CTX *mem_ctx,
+                                          size_t uuid_list_count,
+                                          const char **uuid_list,
+                                          const char **uid_list,
+                                          struct ccdb_secdb *secdb,
+                                          struct kcm_ccache ***_cc_list)
+{
+    TALLOC_CTX *tmp_ctx;
+    errno_t ret;
+    uid_t uid;
+    char **list;
+    uuid_t uuid;
+    char *uuid_str;
+    char *secdb_key;
+    struct cli_creds cli_cred;
+    struct kcm_ccache **cc_list;
+    int real_count = 0;
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        ret = ENOMEM;
+        return ret;
+    }
+
+    cc_list = talloc_zero_array(tmp_ctx, struct kcm_ccache *, uuid_list_count + 1);
+    if (cc_list == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    for (size_t i = 0; i < uuid_list_count; i++) {
+        struct passwd *pwd;
+
+        ret = split_on_separator(tmp_ctx, uuid_list[i], ':', true, true,
+                                 &list, NULL);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "split on separator failed [%d]: %s\n",
+                                     ret, sss_strerror(ret));
+            goto done;
+        }
+
+        uuid_str = list[0];
+        uuid_str[UUID_STR_SIZE - 1] = '\0';
+        ret = uuid_parse(uuid_str, uuid);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "uuid parse of [%s] failed [%d]: %s\n",
+                                     list[0], ret, sss_strerror(ret));
+            goto done;
+        }
+        uid = strtouint32(uid_list[i], NULL, 10);
+        ret = errno;
+        if (ret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "Invalid UID [%s] conversion to uint32 "
+                                       "[%d]: %s\n", uid_list[i], ret,
+                                       sss_strerror(ret));
+            goto done;
+        }
+
+        errno = 0;
+        pwd = getpwuid(uid);
+        if (pwd == NULL) {
+            ret = errno;
+            DEBUG(SSSDBG_MINOR_FAILURE, "Unable to resolve user [%d] who "
+                  "is the owner of an existing ccache [%d]: %s\n",
+                  uid, ret, sss_strerror(ret));
+            /* Not fatal */
+            continue;
+        }
+
+        cli_cred.ucred.uid = pwd->pw_uid;
+        cli_cred.ucred.gid = pwd->pw_gid;
+
+        ret = key_by_uuid(tmp_ctx, secdb->sctx, &cli_cred, uuid, &secdb_key);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "key_by_uuid() failed for uuid = '%s'", uuid_str);
+            goto done;
+        }
+
+        ret = secdb_get_cc(cc_list, secdb->sctx, secdb_key, &cli_cred,
+                           &cc_list[real_count]);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                  "Failed to get ccache [%d]: %s\n", ret, sss_strerror(ret));
+            /* probably ccache in old format was met and purged, just skip */
+            continue;
+        }
+
+        if (cc_list[real_count] == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Failed to get cc for uuid = '%s' and uid = %s\n",
+                  uuid_list[i], uid_list[i]);
+            ret = EIO;
+            goto done;
+        }
+        DEBUG(SSSDBG_TRACE_INTERNAL,
+              "Retrieved ccache [%s]\n", cc_list[real_count]->name);
+        real_count++;
+    }
+
+    cc_list = talloc_realloc(tmp_ctx, cc_list, struct kcm_ccache *,
+                             real_count + 1);
+    if (cc_list == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    cc_list[real_count] = NULL;
+    *_cc_list = talloc_steal(mem_ctx, cc_list);
+
+    return EOK;
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+struct ccdb_secdb_list_state {
+    uuid_t *uuid_list;
+};
+
+static errno_t ccdb_secdb_list_all_cc(TALLOC_CTX *mem_ctx,
+                                      struct krb5_ctx *krb5_ctx,
+                                      struct tevent_context *ev,
+                                      struct kcm_ccdb *db,
+                                      struct kcm_ccache ***_cc_list)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    TALLOC_CTX *tmp_ctx;
+    errno_t ret;
+    const char **uid_list;
+    const char **uuid_list;
+    size_t uuid_list_count;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Retrieving all ccaches\n");
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        ret = ENOMEM;
+        return ret;
+    }
+
+    ret = sss_sec_list_cc_uuids(tmp_ctx, secdb->sctx, &uuid_list, &uid_list, &uuid_list_count);
+    if (ret != EOK && ret != ENOENT) {
+        DEBUG(SSSDBG_TRACE_INTERNAL, "Error retrieving ccache uuid list "
+                                     "[%d]: %s\n", ret, sss_strerror(ret));
+        goto done;
+    } else if (ret == ENOENT) {
+        goto done;
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Found [%zu] ccache uuids\n", uuid_list_count);
+
+    /* New count is full cc list size minus getpwuid() failures */
+    ret = ccdb_secdb_get_cc_for_uuid(mem_ctx, uuid_list_count, uuid_list,
+                                     uid_list, secdb, _cc_list);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_TRACE_INTERNAL, "Error getting cc list from uuid list "
+                                     "[%d]: %s\n", ret, sss_strerror(ret));
+        goto done;
+    }
+
+    DEBUG(SSSDBG_TRACE_FUNC, "Retrieving all caches done\n");
+    ret = EOK;
+
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static struct tevent_req *ccdb_secdb_list_send(TALLOC_CTX *mem_ctx,
+                                               struct tevent_context *ev,
+                                               struct kcm_ccdb *db,
+                                               struct cli_creds *client)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_list_state *state = NULL;
+    errno_t ret;
+    char **keys = NULL;
+    size_t nkeys;
+    struct sss_sec_req *sreq = NULL;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Listing all ccaches\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_list_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = secdb_container_url_req(state, secdb->sctx, client, &sreq);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sss_sec_list(state, sreq, &keys, &nkeys);
+    if (ret == ENOENT) {
+        nkeys = 0;
+        /* Fall through and return an empty list */
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Found %zu ccaches\n", nkeys);
+
+    state->uuid_list = talloc_array(state, uuid_t, nkeys + 1);
+    if (state->uuid_list == NULL) {
+        ret = ENOMEM;
+        goto immediate;
+    }
+
+    for (size_t i = 0; i < nkeys; i++) {
+        ret = sec_key_get_uuid(keys[i],
+                               state->uuid_list[i]);
+        if (ret != EOK) {
+            goto immediate;
+        }
+    }
+    /* Sentinel */
+    uuid_clear(state->uuid_list[nkeys]);
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Listing all caches done\n");
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_list_recv(struct tevent_req *req,
+                                  TALLOC_CTX *mem_ctx,
+                                  uuid_t **_uuid_list)
+{
+    struct ccdb_secdb_list_state *state = tevent_req_data(req,
+                                                struct ccdb_secdb_list_state);
+
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    *_uuid_list = talloc_steal(mem_ctx, state->uuid_list);
+    return EOK;
+}
+
+struct ccdb_secdb_getbyuuid_state {
+    struct kcm_ccache *cc;
+};
+
+static struct tevent_req *ccdb_secdb_getbyuuid_send(TALLOC_CTX *mem_ctx,
+                                                    struct tevent_context *ev,
+                                                    struct kcm_ccdb *db,
+                                                    struct cli_creds *client,
+                                                    uuid_t uuid)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_getbyuuid_state *state = NULL;
+    errno_t ret;
+    char *secdb_key = NULL;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Getting ccache by UUID\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_getbyuuid_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = key_by_uuid(state, secdb->sctx, client, uuid, &secdb_key);
+    if (ret == ENOENT) {
+        state->cc = NULL;
+        ret = EOK;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = secdb_get_cc(state, secdb->sctx, secdb_key, client, &state->cc);
+    if (ret == ENOENT) {
+        state->cc = NULL;
+        ret = EOK;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Got ccache by UUID\n");
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_getbyuuid_recv(struct tevent_req *req,
+                                         TALLOC_CTX *mem_ctx,
+                                         struct kcm_ccache **_cc)
+{
+    struct ccdb_secdb_getbyuuid_state *state = tevent_req_data(req,
+                                            struct ccdb_secdb_getbyuuid_state);
+
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    *_cc = talloc_steal(mem_ctx, state->cc);
+    return EOK;
+}
+
+struct ccdb_secdb_getbyname_state {
+    struct kcm_ccache *cc;
+};
+
+static struct tevent_req *ccdb_secdb_getbyname_send(TALLOC_CTX *mem_ctx,
+                                                    struct tevent_context *ev,
+                                                    struct kcm_ccdb *db,
+                                                    struct cli_creds *client,
+                                                    const char *name)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_getbyname_state *state = NULL;
+    errno_t ret;
+    char *secdb_key = NULL;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Getting ccache by name\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_getbyname_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = key_by_name(state, secdb->sctx, client, name, &secdb_key);
+    if (ret == ENOENT) {
+        state->cc = NULL;
+        ret = EOK;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = secdb_get_cc(state, secdb->sctx, secdb_key, client, &state->cc);
+    if (ret == ENOENT) {
+        state->cc = NULL;
+        ret = EOK;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Got ccache by name\n");
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_getbyname_recv(struct tevent_req *req,
+                                       TALLOC_CTX *mem_ctx,
+                                       struct kcm_ccache **_cc)
+{
+    struct ccdb_secdb_getbyname_state *state = tevent_req_data(req,
+                                                struct ccdb_secdb_getbyname_state);
+
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    *_cc = talloc_steal(mem_ctx, state->cc);
+    return EOK;
+}
+
+
+struct ccdb_secdb_name_by_uuid_state {
+    const char *name;
+};
+
+struct tevent_req *ccdb_secdb_name_by_uuid_send(TALLOC_CTX *mem_ctx,
+                                                struct tevent_context *ev,
+                                                struct kcm_ccdb *db,
+                                                struct cli_creds *client,
+                                                uuid_t uuid)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_name_by_uuid_state *state = NULL;
+    errno_t ret;
+    char *key;
+    const char *name;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Translating UUID to name\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_name_by_uuid_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = key_by_uuid(state, secdb->sctx, client, uuid, &key);
+    if (ret == ENOENT) {
+        ret = ERR_NO_CREDS;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    name = sec_key_get_name(key);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Malformed key, cannot get name\n");
+        goto immediate;
+    }
+
+    state->name = talloc_strdup(state, name);
+    if (state->name == NULL) {
+        ret = ENOMEM;
+        goto immediate;
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Got ccache by UUID\n");
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+errno_t ccdb_secdb_name_by_uuid_recv(struct tevent_req *req,
+                                     TALLOC_CTX *sec_ctx,
+                                     const char **_name)
+{
+    struct ccdb_secdb_name_by_uuid_state *state = tevent_req_data(req,
+                                                struct ccdb_secdb_name_by_uuid_state);
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    *_name = talloc_steal(sec_ctx, state->name);
+    return EOK;
+}
+
+struct ccdb_secdb_uuid_by_name_state {
+    uuid_t uuid;
+};
+
+struct tevent_req *ccdb_secdb_uuid_by_name_send(TALLOC_CTX *mem_ctx,
+                                                struct tevent_context *ev,
+                                                struct kcm_ccdb *db,
+                                                struct cli_creds *client,
+                                                const char *name)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_uuid_by_name_state *state = NULL;
+    errno_t ret;
+    char *key;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Translating name to UUID\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_uuid_by_name_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = key_by_name(state, secdb->sctx, client, name, &key);
+    if (ret == ENOENT) {
+        ret = ERR_NO_CREDS;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sec_key_get_uuid(key, state->uuid);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+                "Malformed key, cannot get UUID\n");
+        goto immediate;
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Got ccache by UUID\n");
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_uuid_by_name_recv(struct tevent_req *req,
+                                            TALLOC_CTX *sec_ctx,
+                                            uuid_t _uuid)
+{
+    struct ccdb_secdb_uuid_by_name_state *state = tevent_req_data(req,
+                                                struct ccdb_secdb_uuid_by_name_state);
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    uuid_copy(_uuid, state->uuid);
+    return EOK;
+}
+
+
+static struct tevent_req *ccdb_secdb_create_send(TALLOC_CTX *mem_ctx,
+                                                 struct tevent_context *ev,
+                                                 struct kcm_ccdb *db,
+                                                 struct cli_creds *client,
+                                                 struct kcm_ccache *cc)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_state *state = NULL;
+    errno_t ret;
+    struct sss_sec_req *container_req = NULL;
+    struct sss_sec_req *ccache_req = NULL;
+    const char *url;
+    struct sss_iobuf *ccache_payload;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Creating ccache storage for %s\n", cc->name);
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    /* Do the encoding asap so that if we fail, we don't even attempt any
+     * writes */
+    ret = kcm_ccache_to_secdb_kv(state, cc, client, &url, &ccache_payload);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot convert cache %s to JSON [%d]: %s\n",
+              cc->name, ret, sss_strerror(ret));
+        goto immediate;
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Creating the ccache container\n");
+    ret = secdb_container_url_req(state, secdb->sctx, client, &container_req);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sss_sec_create_container(container_req);
+    if (ret == EEXIST) {
+        DEBUG(SSSDBG_TRACE_INTERNAL, "Container already exists, ignoring\n");
+    } else if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "Failed to create the ccache container\n");
+        goto immediate;
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "ccache container created\n");
+    DEBUG(SSSDBG_TRACE_INTERNAL, "creating empty ccache payload\n");
+
+    ret = secdb_cc_url_req(state, secdb->sctx, client, url, &ccache_req);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sec_put(state, ccache_req, ccache_payload);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "payload created\n");
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_create_recv(struct tevent_req *req)
+{
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    return EOK;
+}
+
+static struct tevent_req *ccdb_secdb_mod_send(TALLOC_CTX *mem_ctx,
+                                              struct tevent_context *ev,
+                                              struct kcm_ccdb *db,
+                                              struct cli_creds *client,
+                                              uuid_t uuid,
+                                              struct kcm_mod_ctx *mod_cc)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_state *state = NULL;
+    errno_t ret;
+    char *secdb_key = NULL;
+    struct kcm_ccache *cc = NULL;
+    struct sss_iobuf *payload = NULL;
+    struct sss_sec_req *sreq = NULL;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Modifying ccache\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = key_by_uuid(state, secdb->sctx, client, uuid, &secdb_key);
+    if (ret == ENOENT) {
+        ret = ERR_NO_CREDS;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = secdb_get_cc(state, secdb->sctx, secdb_key, client, &cc);
+    if (ret == ENOENT) {
+        ret = ERR_NO_CREDS;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = kcm_mod_cc(cc, mod_cc);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Cannot modify ccache [%d]: %s\n",
+              ret, sss_strerror(ret));
+        goto immediate;
+    }
+
+    ret = kcm_ccache_to_sec_input_binary(state, cc, &payload);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = secdb_cc_key_req(state, secdb->sctx, client, secdb_key, &sreq);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sec_update(state, sreq, payload);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_mod_recv(struct tevent_req *req)
+{
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    return EOK;
+}
+
+static struct tevent_req *ccdb_secdb_store_cred_send(TALLOC_CTX *mem_ctx,
+                                                     struct tevent_context *ev,
+                                                     struct kcm_ccdb *db,
+                                                     struct cli_creds *client,
+                                                     uuid_t uuid,
+                                                     struct sss_iobuf *cred_blob)
+{
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_state *state = NULL;
+    char *secdb_key = NULL;
+    struct kcm_ccache *cc = NULL;
+    struct sss_iobuf *payload = NULL;
+    struct sss_sec_req *sreq = NULL;
+    errno_t ret;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Storing creds in ccache\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = key_by_uuid(state, secdb->sctx, client, uuid, &secdb_key);
+    if (ret == ENOENT) {
+        ret = ERR_NO_CREDS;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = secdb_get_cc(state, secdb->sctx, secdb_key, client, &cc);
+    if (ret == ENOENT) {
+        ret = ERR_NO_CREDS;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = kcm_cc_store_cred_blob(cc, cred_blob);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Cannot store credentials to ccache [%d]: %s\n",
+              ret, sss_strerror(ret));
+        goto immediate;
+    }
+
+    ret = kcm_ccache_to_sec_input_binary(state, cc, &payload);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = secdb_cc_key_req(state, secdb->sctx, client, secdb_key, &sreq);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sec_update(state, sreq, payload);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_store_cred_recv(struct tevent_req *req)
+{
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    return EOK;
+}
+
+static struct tevent_req *ccdb_secdb_delete_send(TALLOC_CTX *mem_ctx,
+                                                 struct tevent_context *ev,
+                                                 struct kcm_ccdb *db,
+                                                 struct cli_creds *client,
+                                                 uuid_t uuid)
+{
+    struct tevent_req *req = NULL;
+    struct ccdb_secdb_state *state = NULL;
+    struct ccdb_secdb *secdb = talloc_get_type(db->db_handle, struct ccdb_secdb);
+    struct sss_sec_req *container_req = NULL;
+    struct sss_sec_req *sreq = NULL;
+    char *secdb_key = NULL;
+    char **keys = NULL;
+    size_t nkeys;
+    errno_t ret;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Deleting ccache\n");
+
+    req = tevent_req_create(mem_ctx, &state, struct ccdb_secdb_state);
+    if (req == NULL) {
+        return NULL;
+    }
+
+    ret = secdb_container_url_req(state, secdb->sctx, client, &container_req);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sss_sec_list(state, container_req, &keys, &nkeys);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_MINOR_FAILURE, "No ccaches to delete\n");
+        goto immediate;
+    }
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Found %zu ccaches\n", nkeys);
+
+    if (nkeys == 0) {
+        ret = EOK;
+        goto immediate;
+    }
+
+    ret = key_by_uuid(state, secdb->sctx, client, uuid, &secdb_key);
+    if (ret == ENOENT) {
+        ret = ERR_NO_CREDS;
+        goto immediate;
+    } else if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = secdb_cc_key_req(state, secdb->sctx, client, secdb_key, &sreq);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = sss_sec_delete(sreq);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    if (nkeys > 1) {
+        DEBUG(SSSDBG_TRACE_INTERNAL, "There are other ccaches, done\n");
+        ret = EOK;
+        goto immediate;
+    }
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Removing ccache container\n");
+
+    ret = sss_sec_delete(container_req);
+    if (ret != EOK) {
+        goto immediate;
+    }
+
+    ret = EOK;
+immediate:
+    if (ret == EOK) {
+        tevent_req_done(req);
+    } else {
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ccdb_secdb_delete_recv(struct tevent_req *req)
+{
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    return EOK;
+}
+
+const struct kcm_ccdb_ops ccdb_secdb_ops = {
+    .init = ccdb_secdb_init,
+
+    .nextid_send = ccdb_secdb_nextid_send,
+    .nextid_recv = ccdb_secdb_nextid_recv,
+
+    .set_default_send = ccdb_secdb_set_default_send,
+    .set_default_recv = ccdb_secdb_set_default_recv,
+
+    .get_default_send = ccdb_secdb_get_default_send,
+    .get_default_recv = ccdb_secdb_get_default_recv,
+
+    .list_send = ccdb_secdb_list_send,
+    .list_recv = ccdb_secdb_list_recv,
+
+    .list_all_cc = ccdb_secdb_list_all_cc,
+
+    .getbyname_send = ccdb_secdb_getbyname_send,
+    .getbyname_recv = ccdb_secdb_getbyname_recv,
+
+    .getbyuuid_send = ccdb_secdb_getbyuuid_send,
+    .getbyuuid_recv = ccdb_secdb_getbyuuid_recv,
+
+    .name_by_uuid_send = ccdb_secdb_name_by_uuid_send,
+    .name_by_uuid_recv = ccdb_secdb_name_by_uuid_recv,
+
+    .uuid_by_name_send = ccdb_secdb_uuid_by_name_send,
+    .uuid_by_name_recv = ccdb_secdb_uuid_by_name_recv,
+
+    .create_send = ccdb_secdb_create_send,
+    .create_recv = ccdb_secdb_create_recv,
+
+    .mod_send = ccdb_secdb_mod_send,
+    .mod_recv = ccdb_secdb_mod_recv,
+
+    .store_cred_send = ccdb_secdb_store_cred_send,
+    .store_cred_recv = ccdb_secdb_store_cred_recv,
+
+    .delete_send = ccdb_secdb_delete_send,
+    .delete_recv = ccdb_secdb_delete_recv,
+};