oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity
26,529 Commits 2 Branches 2 Tags
75987ebbaee93965493e773fa03afb8bd5487a9f
Commit Graph

26529 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Love Hörnquist Åstrand
75987ebbae update to match plugin abi 2011-07-23 11:59:06 -07:00
Stefan Metzmacher
296548d34a kdc: pass down the delegated_proxy_principal to the verify_pac() function 
This is needed in order to add the S4U_DELEGATION_INFO to the pac.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-07-23 11:48:11 -07:00
Stefan Metzmacher
626d2607d5 kdc/windc_plugin.h: KRB5_WINDC_PLUGIN_MINOR 4 => 5 
commit "heimdal Add support for extracting a particular KVNO from the database"
(f469fc6d49 in heimdal/master
 and 9b5e304ccedc8f0f7ce2342e4d9c621417dd1c1e in samba/master)
changed the windc_plugin interface, so we need to change the
version number.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-07-23 11:48:11 -07:00
Stefan Metzmacher
aabb937b46 kdc: don't allow self delegation if a backend check_constrained_delegation() hook is given 
A service should use S4U2Self instead of S4U2Proxy.

Windows servers allow S4U2Proxy only to explicitly configured
target principals.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-07-23 11:48:11 -07:00
Stefan Metzmacher
6cb0e81760 kdc: pass down the server hdb_entry_ex to check_constrained_delegation() 
This way we can compare the already canonicalized principals,
while still passing the client specified target principal down
to the backend specific constrained_delegation() hook.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-07-23 11:48:11 -07:00
Stefan Metzmacher
d6a56b847b kdc: use the correct client realm in the EncTicketPart 
With S4U2Proxy tgt->crealm might be different from tgt_name->realm.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-07-23 11:48:11 -07:00
Love Hörnquist Åstrand
fb8c65a8c2 better logging 2011-07-23 11:44:42 -07:00
Love Hörnquist Åstrand
12403a31ce sprinkle more windows files 2011-07-23 11:18:21 -07:00
Jelmer Vernooij
0b3c720c01 cf: Also enable pthreads on Linux 3. 
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
 2011-07-23 09:22:51 -07:00
Love Hornquist Astrand
ed91d4c9e3 Mac compat 2011-07-22 11:50:30 -07:00
Love Hörnquist Åstrand
fe10979669 Merge pull request #9 from lha/master 
gss names
 2011-07-22 11:41:49 -07:00
Jeffrey Altman
c13deafcce Synchronize Windows export list with Unix 
Change-Id: Ic0ee3d1f4b49761fbd2676f4f9562f1bf906e382
 2011-07-21 11:50:45 -04:00
Jeffrey Altman
27cc30d38e GSS_C_ATTR_LOCAL_LOGIN_USER 
Be consistent with other GSSAPI global variables.  GSS_C_ATTR_LOCAL_LOGIN_USER
becomes a macro in gssapi.h that refers to an exported variable
__gss_c_attr_local_login_user

Change-Id: I2661d74cd0f760780f75b35f92d6b4f9112080dc
 2011-07-21 11:46:15 -04:00
Jeffrey Altman
b7df4f8bb3 dirent: fix filespec_from_dir_path 
If the path does not begin with a separator, do not advance
skip the first character in the component referred to by 'comp'.

Change-Id: Ide184ba2065bd8b2075be27b8e1f4cae11026fdd
 2011-07-21 11:40:04 -04:00
Jeffrey Altman
b8ce309acb Permit TESTMechType array to initialize on Windows (C89) 
Change-Id: I3c006b9c45f29b129ad6f5102792c1e912bd9c8e
 2011-07-21 11:36:31 -04:00
Love Hörnquist Åstrand
f79183821f sprinkle doxygen and kode more like the rest of the code base 2011-07-19 21:29:19 -07:00
Roland C. Dowdeswell
77c8ef2c06 krb5_free_default_realm() from mit_glue.c needs to be exported to be useful. 
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-07-19 21:25:47 -07:00
Roland C. Dowdeswell
3ef06de67b Fix a couple of bugs in krb5_c_valid_enctype(): 
1.  on errors, it appears to core dump, and

      2.  the sense of the return code is inverted from the
          MIT implementation.

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-07-19 21:25:15 -07:00
Love Hörnquist Åstrand
7aaba443bc add NTMakefile and windows directories 2011-07-17 12:16:59 -07:00
Love Hörnquist Åstrand
9bff431435 sizeof is used incorrectly in DES3_random_to_key() 
from OpenBSD via Jonathan Gray <jsg@goblin.cx>
 2011-07-13 23:16:06 -07:00
Jeffrey Altman
49cead6a58 Merge pull request #11 from asankah/master 
Updates from Asanka to complete the Heimdal on Windows install package.  Plugins in Software/Heimdal; customizable 32-bit tools directory in multi-platform installer; Feature Tree view; and updated version number.
 2011-06-20 13:26:52 -07:00
Love Hörnquist Åstrand
d756ad019a make tests pass again 2011-06-19 11:49:33 -07:00
Love Hörnquist Åstrand
e73a5a9c54 remove stray klist 2011-06-19 11:39:39 -07:00
Love Hörnquist Åstrand
45b9139cc4 if we are using db1 or db3 (really 3,4,5), when we will need LIB_db_create, otherwise use LIB_NDBM 2011-06-19 11:20:48 -07:00
Love Hörnquist Åstrand
5a25df7851 set HEIMDAL_LOCALEDIR for librfc3961.la too 2011-06-19 11:02:27 -07:00
Love Hörnquist Åstrand
09b07e9ef4 fix ifdef 2011-06-19 10:58:50 -07:00
Love Hörnquist Åstrand
625d29fc3e remove unused ifdef 2011-06-19 10:58:35 -07:00
Love Hörnquist Åstrand
749c112c31 only set IP_TOS on IPv4 sockets 2011-06-19 10:58:22 -07:00
Love Hörnquist Åstrand
e5eb401fcd simplify checking and start to use __has_extension 2011-06-19 10:43:12 -07:00
Love Hörnquist Åstrand
4337582a64 add missing break, quiet clang analyzer 2011-06-19 10:28:51 -07:00
Stefan Metzmacher
e54d07a9b6 kdc: check and regenerate the PAC in the s4u2proxy case 
TODO: we need to add a S4U_DELEGATION_INFO to the PAC later.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-19 10:26:11 -07:00
Stefan Metzmacher
9ab4070800 kdc: pass the correct principal name for the resulting service ticket 
Depending on S4U2Proxy the principal name for the resulting
ticket is not the principal of the client ticket.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-19 10:26:11 -07:00
Stefan Metzmacher
2c031ca78c kdc: let check_PAC() to verify the incoming server and krbtgt cheksums 
For a normal TGS-REQ they're both signed with krbtgt key.
But for S4U2Proxy requests which ask for contrained delegation,
the keys differ.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-19 10:26:11 -07:00
Asanka C. Herath
adb8cba7ee Windows: Version 1.4.9930.630 2011-06-15 12:38:56 -04:00
Asanka C. Herath
8f51d5a8dc Windows: Use WixUI_FeatureTree for installer. 2011-06-15 01:55:21 -04:00
Asanka C. Herath
7236505bf0 Windows: Multiplatform installer should have a different name. 2011-06-15 01:55:21 -04:00
Asanka C. Herath
8aaf3183ca Windows: Make the 32-bit tools install directory customizable. 2011-06-15 01:55:20 -04:00
Asanka C. Herath
3048545de3 Windows: Use Software/Heimdal registry key for Heimdal specific configuration 
The 'plugin_dir' value is Heimdal specific.  So keep it in the
Software/Heimdal registry key.  The Software/Kerberos registry key
will also be loaded and will contain generic Kerberos configuration.
 2011-06-15 01:55:19 -04:00
Love Hörnquist Åstrand
b8ddbe73c4 quite down clang analyzer warnings for the generate asn1 code 2011-06-14 22:29:49 -07:00
Love Hörnquist Åstrand
e9e4f99f01 add missing space in log message 2011-06-14 22:00:25 -07:00
Love Hörnquist Åstrand
63565137d3 don't set i = 0, its never read 2011-06-14 21:57:34 -07:00
Love Hörnquist Åstrand
7dccddc6fb count number of enctypes too 2011-06-14 21:44:23 -07:00
Love Hörnquist Åstrand
0f489b7b28 unexport krb5_init_etype, remove duplicate code 2011-06-14 21:08:52 -07:00
Nicolas Williams
f93a56f931 Set improved enctypes parameter defaults to better match the RFC. 
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-14 20:35:19 -07:00
Nicolas Williams
016193ac6a Added manpage documentation for krb5_{as, tgs}_enctypes. 
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-14 20:35:19 -07:00
Nicolas Williams
2fbad6432b Initial support for default_{as, tgs}_etypes. 
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-14 20:35:19 -07:00
Nicolas Williams
c06d5ebfda Fixes to patches that add *use-strong* parameters. 
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-14 20:35:19 -07:00
Nicolas Williams
8ada355954 Forgot to default use_strongest_server_key... 
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-14 20:35:19 -07:00
Nicolas Williams
76a192b906 Forgot to default preauth_use_strongest_session_key... 
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-14 20:35:19 -07:00
Nicolas Williams
256cf6ea12 This patch adds support for a use-strongest-server-key krb5.conf kdc parameter that controls how the KDC (AS and TGS) selects a long-term key from a service principal's HDB entry. If TRUE the KDC picks the strongest supported key from the service principal's current keyset. If FALSE the KDC picks the first supported key from the service principal's current keyset. 
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
 2011-06-14 20:35:19 -07:00