oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

This patch adds support for a use-strongest-server-key krb5.conf kdc parameter that controls how the KDC (AS and TGS) selects a long-term key from a service principal's HDB entry. If TRUE the KDC picks the strongest supported key from the service principal's current keyset. If FALSE the KDC picks the first supported key from the service principal's current keyset.

Browse Source 
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
This commit is contained in:
Nicolas Williams
2011-04-06 01:26:37 -05:00
committed by Love Hörnquist Åstrand
parent 481fe133b2
commit 256cf6ea12
4 changed files with 32 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/krb5/krb5.conf.5
View File

@@ -418,6 +418,11 @@ pre-authentication). Defaults to TRUE.
.It Li tgs-use-strongest-session-key = Va BOOL
Like as-use-strongest-session-key, but applies to the session key
enctype of tickets issued by the TGS. Defaults to TRUE.
.It Li use-strongest-server-key = Va BOOL
If TRUE then the KDC picks, for the ticket encrypted part's key, the
first supported enctype from the target service principal's hdb entry's
current keyset. Else the KDC picks the first supported enctype from the
target service principal's hdb entry's current keyset. Defaults to TRUE.
.It Li check-ticket-addresses = Va BOOL
Verify the addresses in the tickets used in tgs requests.
.\" XXX