Commit Graph

26615 Commits

Author SHA1 Message Date
Love Hörnquist Åstrand
8fccb51d49 Merge pull request #12 from nicowilliams/krb5_admin_patches_2nd
Krb5 admin patches 2nd

This has all the patches needed for krb5_admind to build and pass most tests, that includes:
- more kadm5 API compatibility (including very basic profile functionality)
- multi-kvno support (useful for key rollovers) (a test for this is included in tests/db/check-kdc)

Unfinished:
- password history (currently uses key history, needs to be separated and use digests)
- policies (only default policy allowed)
- mit kdb changes not tested yet


Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2011-07-24 15:41:36 -07:00
Love Hörnquist Åstrand
1124c4872d KVNOs are krb5uint32 in RFC4120, make it so 2011-07-24 14:23:45 -07:00
Love Hörnquist Åstrand
671e231d75 fix warning 2011-07-24 14:09:23 -07:00
Linus Nordberg
2e35198908 Add version-script.map to _DEPENDENCIES.
Added to 11 out of 14 directories with map files.  Not lib/ntlm,
lib/hcrypto and kdc which have the map file as an explicit dependency
to _OBBJECTS.

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2011-07-24 14:07:59 -07:00
Love Hörnquist Åstrand
f60ec15834 partly unify enctype/keytype since there is only enctypes 2011-07-24 14:03:08 -07:00
Love Hörnquist Åstrand
16eabf8e4c add an invalid protection level to the enum 2011-07-24 14:00:23 -07:00
Love Hörnquist Åstrand
af4aea85ae cast to avoid size_t vs int issue 2011-07-24 13:07:07 -07:00
Love Hörnquist Åstrand
8f2294e1f9 switch order of type and GSSAPI_LIB_VARIABLE 2011-07-24 13:00:36 -07:00
Love Hörnquist Åstrand
052c5767fd fixup type for GSS_C_ATTR_LOCAL_LOGIN_USER 2011-07-24 12:47:55 -07:00
Love Hörnquist Åstrand
d434bda588 make sure keylen is a multiple of 2 2011-07-24 12:34:51 -07:00
Andrew Bartlett
84bc108d8f lib/krb5: Allow any kvno to match when searching the keytab.
Windows does not use a KVNO when it checks it's passwords, and MIT
doesn't check the KVNO when no acceptor identity is specified (looping
over all keys in the keytab).

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2011-07-24 10:37:40 -07:00
Love Hörnquist Åstrand
c5db78a3c2 switch to use use_strongest_server_key
use the same behavior as 1.4 release.
2011-07-24 10:33:28 -07:00
Marc Balmer
ae9ac01f3f Typo
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2011-07-24 10:29:47 -07:00
Nicolas Williams
a7717ae4f9 Use heim_assert() instead of assert() 2011-07-24 11:10:37 -05:00
Nicolas Williams
11c54cd6c8 Protect against negative n_ks_tuple values and against randkey returning negative n_keys 2011-07-24 11:08:58 -05:00
Nicolas Williams
95262936c7 s/assert/heim_assert/ and remove dead code 2011-07-24 11:07:27 -05:00
Love Hörnquist Åstrand
6372a13b47 1.5.99 2011-07-23 12:08:37 -07:00
Love Hörnquist Åstrand
4bff0fbb31 check for NULL as argument to krb5_{prepend,set}_error_message functions 2011-07-23 12:06:01 -07:00
Love Hörnquist Åstrand
75987ebbae update to match plugin abi 2011-07-23 11:59:06 -07:00
Stefan Metzmacher
296548d34a kdc: pass down the delegated_proxy_principal to the verify_pac() function
This is needed in order to add the S4U_DELEGATION_INFO to the pac.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2011-07-23 11:48:11 -07:00
Stefan Metzmacher
626d2607d5 kdc/windc_plugin.h: KRB5_WINDC_PLUGIN_MINOR 4 => 5
commit "heimdal Add support for extracting a particular KVNO from the database"
(f469fc6d49 in heimdal/master
 and 9b5e304ccedc8f0f7ce2342e4d9c621417dd1c1e in samba/master)
changed the windc_plugin interface, so we need to change the
version number.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2011-07-23 11:48:11 -07:00
Stefan Metzmacher
aabb937b46 kdc: don't allow self delegation if a backend check_constrained_delegation() hook is given
A service should use S4U2Self instead of S4U2Proxy.

Windows servers allow S4U2Proxy only to explicitly configured
target principals.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2011-07-23 11:48:11 -07:00
Stefan Metzmacher
6cb0e81760 kdc: pass down the server hdb_entry_ex to check_constrained_delegation()
This way we can compare the already canonicalized principals,
while still passing the client specified target principal down
to the backend specific constrained_delegation() hook.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2011-07-23 11:48:11 -07:00
Stefan Metzmacher
d6a56b847b kdc: use the correct client realm in the EncTicketPart
With S4U2Proxy tgt->crealm might be different from tgt_name->realm.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2011-07-23 11:48:11 -07:00
Love Hörnquist Åstrand
fb8c65a8c2 better logging 2011-07-23 11:44:42 -07:00
Love Hörnquist Åstrand
12403a31ce sprinkle more windows files 2011-07-23 11:18:21 -07:00
Jelmer Vernooij
0b3c720c01 cf: Also enable pthreads on Linux 3.
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
2011-07-23 09:22:51 -07:00
Nicolas Williams
dfc7ec92fa Make kadm5_lock() and unlock work, and add kadmin commands for them.
The libkadm5 functions hdb_open() and close around all HDB ops.  This
meant the previous implementation of kadm5_lock() and unlock would
always result in a core dump.  Now we hdb_open() for write in
kadm5_lock() and hdb_close() in kadm5_unlock(), with all kadm5_s_*()
functions now not opening nor closing the HDB when the server context
keep_open flag is set.

Also, there's now kadmin(8) lock and unlock commands.  These are there
primarily as a way to test the kadm5_lock()/unlock() operations, but
MIT's kadmin.local also has lock/unlock commands, and these can be
useful for scripting (though they require much care).
2011-07-22 21:07:48 -05:00
Nicolas Williams
43c5244ecc Fix from Roland Dowdeswell -- kadm5_setkey_principal() has to rev kvno earlier 2011-07-22 16:18:44 -05:00
Nicolas Williams
e23a1efdc9 Fixes for updates of KADM5_KVNO but not KEY_DATA and vice-versa.
It turns out that updates of kvno but not key data and vice-versa are
both, allowed and actually done (e.g, in kadmin's ank).  Doing the right
thing in these cases turns out to be a bit tricky, but this commit ought
to do it.
2011-07-22 16:07:10 -05:00
Nicolas Williams
dae01950a2 add_enctype needs to set the kvno of the keys it adds!
add_enctype() was not fetching the kvno of the principal it was
modifying, and it was not setting the kvno of the new keys (instead it
set it to 0).  This worked fine before multi-kvno, but broke then.  The
fix is to fetch the kvno and set the new keys' kvno to that.

I'm thinking of adding a new kadmin command to prune old kvnos by date
or kvno differential...
2011-07-22 16:07:10 -05:00
Nicolas Williams
1edc2cee45 Test multi-kvno support in kadmin and KDC (part 1). 2011-07-22 16:07:10 -05:00
Nicolas Williams
1e14951592 Preserve set_time on historic keysets in kadm5_s_modify_principal() path. 2011-07-22 16:07:10 -05:00
Nicolas Williams
0f53687346 Two mods from Roland to make kadm5_setkey_principal_3() work. 2011-07-22 16:07:09 -05:00
Nicolas Williams
4f5dbf2f81 Two patches from Roland Dowdeswell to make n_keys/new_keys args optional. 2011-07-22 16:07:09 -05:00
Nicolas Williams
c818890dd7 Re-write _kadm5_set_keys2() to handle key history. 2011-07-22 16:07:08 -05:00
Nicolas Williams
1eb56edd86 Introduce Keys ::= SEQUENCE OF Key in hdb.asn1 so we can get convenience utils. 2011-07-22 16:07:08 -05:00
Nicolas Williams
689d4f4dd9 Another HDB_F_DECRYPT-isn't-critical fix. 2011-07-22 16:07:08 -05:00
Nicolas Williams
5335559845 Oops, HDB_F_DECRYPT isn't critical; making it so breaks tests. 2011-07-22 16:07:08 -05:00
Nicolas Williams
a246c394d2 Fix warnings. 2011-07-22 16:07:08 -05:00
Nicolas Williams
e020dc25b8 Fix a double free in ank.c. 2011-07-22 16:07:08 -05:00
Nicolas Williams
f2897efd09 Make the KDC path work. 2011-07-22 16:07:08 -05:00
Nicolas Williams
e23c7a7daf How on earth did this build breaking thinko get through? 2011-07-22 16:07:07 -05:00
Nicolas Williams
9d6d3ee5f3 Fixed a likely bug in modify_principal() where the memset() of ent happens after early error checking. 2011-07-22 16:07:07 -05:00
Nicolas Williams
07370612bd Remove policy name checking against krb5.conf code. 2011-07-22 16:07:07 -05:00
Nicolas Williams
87742e8118 Add missing KADM5_AUTH_GET_KEYS error and use it. 2011-07-22 16:07:07 -05:00
Nicolas Williams
ed511e06f9 Updated kadmind.8 and kadmin.8. 2011-07-22 16:07:07 -05:00
Nicolas Williams
909653e50f Add comment and assert about key history to kadm5_log_replay_modify() 2011-07-22 16:07:07 -05:00
Nicolas Williams
b16ca34642 Fix incorrect key history check optimization. (NOT TESTED) 2011-07-22 16:07:07 -05:00
Nicolas Williams
784e6a69df Avoid useless work related to keepold. 2011-07-22 16:07:07 -05:00