oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

document kdc options

Browse Source
This commit is contained in:
Love Hornquist Astrand
2011-10-12 15:37:24 +02:00
parent c2be6a8580
commit d6474982e5
1 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
doc/setup.texi
View File

@@ -1452,6 +1452,45 @@ Mar 26 23:40:10 Mar 27 09:40:10 krbtgt/EXAMPLE.ORG@@EXAMPLE.ORG
@section Configure the KDC @section Configure the KDC
Configuration options for the KDC.
@table @asis
@item enable-pkinit = bool
Enable PKINIT for this KDC.
@item pkinit_identity = string
Identity that the KDC will use when talking to clients.
@item pkinit_anchors = string
Trust anchors that the KDC will use when evaluating the trust of the
client certificate.
@item pkinit_pool = strings ...
Extra certificate the KDC will use when building trust chains if it
can't find enough certificates in the request from the client.
@item pkinit_allow_proxy_certificate = bool
Allow clients to use proxy certificates, its the root certificate that
is clients EE certificate that is used for authorisation.
@item pkinit_win2k_require_binding = bool
Require windows clients up be upgrade to not allow cut and paste
attack on encrypted data, applies to Windows XP and windows 2000
servers.
@item pkinit_principal_in_certificate = bool
Enable the KDC to use id-pkinit-san to determine to determine the
mapping between a certificate and principal.
@end table
@example @example
[kdc] [kdc]
enable-pkinit = yes enable-pkinit = yes