oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity
28,871 Commits 2 Branches 2 Tags
a2db5caebfb2bf05cd6ec526b5ad94e3a33c4dd6
Commit Graph

61 Commits

Author SHA1 Message Date
YASUOKA Masahiko
4279b467cb Remove an extra line that uses "klist". The command was replaced with 
"heimtools klist".
 2018-12-14 16:31:42 -06:00
Quanah Gibson-Mount
7c16ce3457 Minor typo/grammar fixes 2017-03-10 15:47:43 -05:00
Nicolas Williams
2027aa11ed Use --detach in tests to avoid waiting 2016-12-07 19:52:29 -06:00
Nicolas Williams
8735d47d8b Add missing tests/gss env setup 2016-12-06 22:44:34 -06:00
Nicolas Williams
a59bb7132f When building a princ name pick a sane def type 
This is part of the fix to #173.  MSFT RODCs insist on the name type for
krbtgt principals be set to KRB5_NT_SRV_INST.

Commentary from Jeffrey Altman <jaltman@secure-endpoints.com>

As reported by David Mulder of Dell's Quest, Active Directory will
return a BAD_INTEGRITY error when a request for a krbtgt service
ticket is received with principal type NT-PRINCIPAL instead of NT-SRV-INST
as required by RFC 4120.

[Nico: RFC4120 does not require this.  See the description of the
       name-type field of PrincipalName on page 55.]

  ERROR: VAS_ERR_KRB5: Failed to obtain credentials.
  Client: SLED10-32$@F.QAS,
  Service: SLED10-32$@F.QAS, Server: ad2-f.f.qas
  Caused by: KRB5KRB_AP_ERR_BAD_INTEGRITY (-1765328353): Decrypt integrity check failed

Microsoft began enforcing principal type checking for RODCs in 2008R2.
Microsoft does state that ALL krgtgt/REALM tickets SHOULD be sent using
principal name type of KRB5_NT_SRV_INST instead of KRB5_NT_PRINCIPAL.

From Microsoft:

  "I believe we discovered the problem. There isn't a bug in Windows.
  There's been a code change to address another issue which puts in additional
  checks for Kerberos tickets. The problem is with the Unix clients when the
  client request a TGT. The Unix clients are using Name-type Principal
  [KRB_NT_PRINCIPAL (1)] instead of using Name-type Service and Instance
  [KRB_NT_SRV_INST (2)]...."

This change assigns the NT-SRV-INST principal type each time a krbtgt
service principal is created.  Unlike Microsoft, the Heimdal mostly does
not care about the name-type of any principals, with the exception of
referrals, where the name type is needed to decide how to find a
next-hop realm.
 2016-11-14 21:29:47 -06:00
Nicolas Williams
95a2ba6aea Test gss_acquire_cred_with_password() 2015-04-15 12:37:51 -05:00
Nicolas Williams
612e5c2a12 Test name canon rules via GSS and put kdc tests last 
Put kdc last in tests/Makefile.am.  There's two tests in tests/kdc
    that have been failing for a long time, and that causes the
    remaining tests to not be run.  By putting kdc last those tests do
    run.
 2011-10-22 14:54:27 -05:00
Love Hornquist Astrand
fda076962d check prefixed keytab too 2011-04-09 18:28:15 -07:00
Love Hornquist Astrand
86da42df1d abstract out --no-afslog and --no-unlog 2010-06-01 14:42:16 -07:00
Love Hornquist Astrand
a2378f6b82 log what the error string say too 2009-12-14 23:15:56 -08:00
Love Hornquist Astrand
3a42c1f7cb More debug logging 2009-12-14 22:43:37 -08:00
Love Hornquist Astrand
36566c31a0 sprinkle more 'echo "test failed"' 2009-12-14 22:12:29 -08:00
Love Hornquist Astrand
45260b1fda sprinkle 'echo "test failed"' 2009-12-14 22:11:19 -08:00
Love Hornquist Astrand
baf9c1c85b in sh, equal compare is really = for strings, not == 2009-12-14 18:25:04 -08:00
Love Hornquist Astrand
01a1e1baef check that gss_krb5_set_allowable_enctypes works 2009-11-30 17:19:13 -08:00
Love Hornquist Astrand
8052362e92 test spnegoiov 2009-08-29 09:03:46 -07:00
Stefan Metzmacher
2f1a370cd3 hack for gss-wrap-iov to it work 
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
 2009-08-28 13:31:12 -07:00
Love Hornquist Astrand
fa502c6648 Add support for gss_{import,export}_cred() as requested by metze 
Works for krb5 and SPNEGO mechanisms. Kerberos credentials are passed as
credential cache names, or if there are memory based credentials, inband in the protocol. This means that the credentials buffers must be keep secret.

As documented by IBM (they have the wrong prototype though)
and GGF (GSS-API Extensions) back in 2001
 2009-07-29 13:36:02 +02:00
Love Hörnquist Åstrand
c99b2003e2 Implement gss_wrap_iov, gss_unwrap_iov for CFX type encryption types. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@25286 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2009-06-22 17:56:41 +00:00
Love Hörnquist Åstrand
dfebb92702 test wrapunwrap 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@24784 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2009-02-22 23:26:27 +00:00
Love Hörnquist Åstrand
e172367898 switch to utf8 encoding of all files 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23814 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-09-13 08:53:55 +00:00
Love Hörnquist Åstrand
b43a607fb7 fail on error 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23685 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-08-26 12:34:37 +00:00
Love Hörnquist Åstrand
17d8a114ea test aliases 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23684 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-08-25 11:12:06 +00:00
Love Hörnquist Åstrand
ab4ce491b0 test use referrals 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23677 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-08-25 02:34:11 +00:00
Love Hörnquist Åstrand
a19b9d161e fix errors 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23544 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-08-16 22:59:54 +00:00
Love Hörnquist Åstrand
5948792004 make quiet 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23535 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-08-16 22:58:20 +00:00
Love Hörnquist Åstrand
dfb1db9505 delegate policy 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23486 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-08-11 09:58:24 +00:00
Love Hörnquist Åstrand
d0d20c1128 remove lefterover debug message 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23426 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-07-26 18:39:59 +00:00
Love Hörnquist Åstrand
ebffab1aee check max loop, pretty status messages 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23424 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-07-26 18:39:12 +00:00
Love Hörnquist Åstrand
ad59df40ae remove gbd 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23423 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-07-26 18:38:50 +00:00
Love Hörnquist Åstrand
becaa9d9f9 check client code 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23421 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-07-26 18:38:14 +00:00
Love Hörnquist Åstrand
39fe446983 Support parsing KRB-ERROR passed back from windows server when the time is out of sync, modify krb5_cc_[sg]et_config interface to handle principals too, add tests for this 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23420 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-07-26 18:37:48 +00:00
Love Hörnquist Åstrand
d461bb4ce8 test --ok-as-delgate and not 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23406 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-07-26 18:31:24 +00:00
Love Hörnquist Åstrand
ffa6d8121c remove stray bash 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23384 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-07-24 20:03:52 +00:00
Love Hörnquist Åstrand
c16610f924 Need to use mutual to make this work. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23383 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-07-24 20:03:29 +00:00
Love Hörnquist Åstrand
8f92cc94b4 Build a service without aes, build context and see that we still got 
an aes session key thanks to EtypeList.

git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23382 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-07-24 20:03:13 +00:00
Love Hörnquist Åstrand
2f58fa6ccb Test gsskrb5_register_acceptor_identity. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22683 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-03-14 21:12:55 +00:00
Love Hörnquist Åstrand
bafd4055b8 Don't test the chmod 0'ed keytab, since that test doesn't work for root 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22659 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-02-26 13:19:52 +00:00
Love Hörnquist Åstrand
91c2002f8e Check spnego error messages too. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22601 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-02-21 12:58:14 +00:00
Love Hörnquist Åstrand
51c0537eef Does not work yet error case. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22567 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-02-03 18:19:32 +00:00
Love Hörnquist Åstrand
a0caf44c41 Test unreadable/non existant keytab and its error message. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22536 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-01-27 12:20:33 +00:00
Love Hörnquist Åstrand
6479b98f70 Quoting. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22425 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2008-01-13 09:46:01 +00:00
Love Hörnquist Åstrand
cc3de997ab empty messages.log 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@21844 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2007-08-08 06:54:22 +00:00
Love Hörnquist Åstrand
913b06b055 disable dns canon on test, break on some buildfarm hosts. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@21263 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2007-06-22 07:34:34 +00:00
Love Hörnquist Åstrand
ea808c9c0e use diffrent port, 49188, and hope that it isnt used, help on solaris where the help services runs on port 8888 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@20202 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2007-02-08 00:59:47 +00:00
Love Hörnquist Åstrand
a9e71ed195 don't need to set GSSAPI_SPNEGO_NAME any longer 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19436 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2006-12-19 12:11:05 +00:00
Love Hörnquist Åstrand
e94890aa89 Define GSSAPI_SPNEGO_NAME and re-add spnego 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19433 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2006-12-18 22:50:24 +00:00
Love Hörnquist Åstrand
489a126759 disable spnego test for now 
k


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19432 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2006-12-18 22:12:41 +00:00
Love Hörnquist Åstrand
cd91aac791 add trap, remove allow-digest, pretty print. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19430 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2006-12-18 21:59:42 +00:00
Love Hörnquist Åstrand
8f4072982a Add dce-style context building test. 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19041 ec53bebd-3082-4978-b11e-865c3cabbd6b
 2006-11-15 08:49:28 +00:00