Commit Graph

124 Commits

Author SHA1 Message Date
Nicolas Williams
a59bb7132f When building a princ name pick a sane def type
This is part of the fix to #173.  MSFT RODCs insist on the name type for
krbtgt principals be set to KRB5_NT_SRV_INST.

Commentary from Jeffrey Altman <jaltman@secure-endpoints.com>

As reported by David Mulder of Dell's Quest, Active Directory will
return a BAD_INTEGRITY error when a request for a krbtgt service
ticket is received with principal type NT-PRINCIPAL instead of NT-SRV-INST
as required by RFC 4120.

[Nico: RFC4120 does not require this.  See the description of the
       name-type field of PrincipalName on page 55.]

  ERROR: VAS_ERR_KRB5: Failed to obtain credentials.
  Client: SLED10-32$@F.QAS,
  Service: SLED10-32$@F.QAS, Server: ad2-f.f.qas
  Caused by: KRB5KRB_AP_ERR_BAD_INTEGRITY (-1765328353): Decrypt integrity check failed

Microsoft began enforcing principal type checking for RODCs in 2008R2.
Microsoft does state that ALL krgtgt/REALM tickets SHOULD be sent using
principal name type of KRB5_NT_SRV_INST instead of KRB5_NT_PRINCIPAL.

From Microsoft:

  "I believe we discovered the problem. There isn't a bug in Windows.
  There's been a code change to address another issue which puts in additional
  checks for Kerberos tickets. The problem is with the Unix clients when the
  client request a TGT. The Unix clients are using Name-type Principal
  [KRB_NT_PRINCIPAL (1)] instead of using Name-type Service and Instance
  [KRB_NT_SRV_INST (2)]...."

This change assigns the NT-SRV-INST principal type each time a krbtgt
service principal is created.  Unlike Microsoft, the Heimdal mostly does
not care about the name-type of any principals, with the exception of
referrals, where the name type is needed to decide how to find a
next-hop realm.
2016-11-14 21:29:47 -06:00
Nicolas Williams
dbf9750989 Tests: set db-dir so tests don't use /var/heimdal 2016-02-26 01:04:31 -06:00
Nicolas Williams
feb245f741 Undo workaround for NTLM and mechglue bugs 2015-04-17 10:55:47 -05:00
Nicolas Williams
5d50d06845 Better test workaround for NTLM bug 2015-04-16 19:53:22 -05:00
Nicolas Williams
d6a7d14fc5 Workaround bugs exposed by test_context changes
Bugs exposed by 61720a0:

 - test_context --client-name=... --mech-type=ntlm ... fails;

 - gss_acquire_cred() with desired_mech=NTLM and
   desired_name==GSS_C_NO_NAME fails;

 - gss_init_sec_context() with non-default cred handle calls the
   mechanism even when the given cred handle has no element for the
   requencet mechanism.

tests/gss/check-ntlm works by accident: gss_acquire_cred() with
desired_mechs==GSS_C_NO_OID_SET succeeds mostly because there are
Kerberos credentials available, and then the subsequent
gss_init_sec_context() call works because of the third bug described
above.
2015-04-16 18:42:51 -05:00
Nicolas Williams
95a2ba6aea Test gss_acquire_cred_with_password() 2015-04-15 12:37:51 -05:00
Nicolas Williams
a318ac86f5 Run tests/gss/check-basic 2015-03-24 11:50:01 -05:00
Nicolas Williams
f73c4edf69 Fix gss_store_cred() 2015-03-24 11:50:01 -05:00
Love Hörnquist Åstrand
62b413b5df make quiet 2014-02-18 08:27:00 -08:00
Nicolas Williams
612e5c2a12 Test name canon rules via GSS and put kdc tests last
Put kdc last in tests/Makefile.am.  There's two tests in tests/kdc
    that have been failing for a long time, and that causes the
    remaining tests to not be run.  By putting kdc last those tests do
    run.
2011-10-22 14:54:27 -05:00
Love Hörnquist Åstrand
7aaba443bc add NTMakefile and windows directories 2011-07-17 12:16:59 -07:00
Love Hornquist Astrand
12c3c12160 pass in client name 2011-05-22 13:01:00 -07:00
Love Hornquist Astrand
fda076962d check prefixed keytab too 2011-04-09 18:28:15 -07:00
Love Hornquist Astrand
37abbc7d77 test attrs-for-mech 2010-11-26 00:10:26 -08:00
Love Hornquist Astrand
2b1bc08d24 setup env_setup 2010-11-26 00:10:17 -08:00
Love Hornquist Astrand
86da42df1d abstract out --no-afslog and --no-unlog 2010-06-01 14:42:16 -07:00
Love Hornquist Astrand
a2378f6b82 log what the error string say too 2009-12-14 23:15:56 -08:00
Love Hornquist Astrand
3a42c1f7cb More debug logging 2009-12-14 22:43:37 -08:00
Love Hornquist Astrand
36566c31a0 sprinkle more 'echo "test failed"' 2009-12-14 22:12:29 -08:00
Love Hornquist Astrand
45260b1fda sprinkle 'echo "test failed"' 2009-12-14 22:11:19 -08:00
Love Hornquist Astrand
baf9c1c85b in sh, equal compare is really = for strings, not == 2009-12-14 18:25:04 -08:00
Love Hornquist Astrand
01a1e1baef check that gss_krb5_set_allowable_enctypes works 2009-11-30 17:19:13 -08:00
Love Hornquist Astrand
c6bbdb545b First drop of Windows build infrastructure from Secure Endpoints 2009-11-24 12:12:53 -08:00
Love Hornquist Astrand
8052362e92 test spnegoiov 2009-08-29 09:03:46 -07:00
Stefan Metzmacher
2f1a370cd3 hack for gss-wrap-iov to it work
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
2009-08-28 13:31:12 -07:00
Love Hornquist Astrand
8669bc5209 test more combinations 2009-08-03 12:46:49 +02:00
Love Hornquist Astrand
fa502c6648 Add support for gss_{import,export}_cred() as requested by metze
Works for krb5 and SPNEGO mechanisms. Kerberos credentials are passed as
credential cache names, or if there are memory based credentials, inband in the protocol. This means that the credentials buffers must be keep secret.

As documented by IBM (they have the wrong prototype though)
and GGF (GSS-API Extensions) back in 2001
2009-07-29 13:36:02 +02:00
Love Hörnquist Åstrand
c99b2003e2 Implement gss_wrap_iov, gss_unwrap_iov for CFX type encryption types.
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@25286 ec53bebd-3082-4978-b11e-865c3cabbd6b
2009-06-22 17:56:41 +00:00
Love Hörnquist Åstrand
60f56e7e65 no wrapext
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@25226 ec53bebd-3082-4978-b11e-865c3cabbd6b
2009-05-25 23:44:18 +00:00
Love Hörnquist Åstrand
2af460e370 test wrap-ext
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@24793 ec53bebd-3082-4978-b11e-865c3cabbd6b
2009-02-22 23:27:57 +00:00
Love Hörnquist Åstrand
dfebb92702 test wrapunwrap
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@24784 ec53bebd-3082-4978-b11e-865c3cabbd6b
2009-02-22 23:26:27 +00:00
Love Hörnquist Åstrand
e172367898 switch to utf8 encoding of all files
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23814 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-09-13 08:53:55 +00:00
Love Hörnquist Åstrand
166e3c5e0a clean tempfile
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23713 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-29 23:10:17 +00:00
Love Hörnquist Åstrand
b43a607fb7 fail on error
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23685 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-26 12:34:37 +00:00
Love Hörnquist Åstrand
17d8a114ea test aliases
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23684 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-25 11:12:06 +00:00
Love Hörnquist Åstrand
ab4ce491b0 test use referrals
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23677 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-25 02:34:11 +00:00
Love Hörnquist Åstrand
4b80c33714 Test initiate keytab files.
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23547 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-16 23:00:28 +00:00
Love Hörnquist Åstrand
a19b9d161e fix errors
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23544 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-16 22:59:54 +00:00
Love Hörnquist Åstrand
5948792004 make quiet
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23535 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-16 22:58:20 +00:00
Love Hörnquist Åstrand
dfb1db9505 delegate policy
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23486 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-11 09:58:24 +00:00
Love Hörnquist Åstrand
d0d20c1128 remove lefterover debug message
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23426 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:39:59 +00:00
Love Hörnquist Åstrand
ebffab1aee check max loop, pretty status messages
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23424 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:39:12 +00:00
Love Hörnquist Åstrand
ad59df40ae remove gbd
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23423 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:38:50 +00:00
Love Hörnquist Åstrand
becaa9d9f9 check client code
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23421 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:38:14 +00:00
Love Hörnquist Åstrand
39fe446983 Support parsing KRB-ERROR passed back from windows server when the time is out of sync, modify krb5_cc_[sg]et_config interface to handle principals too, add tests for this
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23420 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:37:48 +00:00
Love Hörnquist Åstrand
ffe5bc187e make delegated checks work....
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23407 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:32:17 +00:00
Love Hörnquist Åstrand
d461bb4ce8 test --ok-as-delgate and not
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23406 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:31:24 +00:00
Love Hörnquist Åstrand
ffa6d8121c remove stray bash
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23384 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-24 20:03:52 +00:00
Love Hörnquist Åstrand
c16610f924 Need to use mutual to make this work.
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23383 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-24 20:03:29 +00:00
Love Hörnquist Åstrand
8f92cc94b4 Build a service without aes, build context and see that we still got
an aes session key thanks to EtypeList.

git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23382 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-24 20:03:13 +00:00