Before this change Heimdal could read KDBs. Now it can write to
them too.
Heimdal can now also dump HDBs (including KDBs) in MIT format, which
can then be imported with kdb5_util load.
This is intended to help in migrations from MIT to Heimdal by
allowing migrations from Heimdal to MIT so that it is possible
to rollback from Heimdal to MIT should there be any issues. The
idea is to allow a) running Heimdal kdc/kadmind with a KDB, or
b) running Heimdal with an HDB converted from a KDB and then
rollback by dumping the HDB and loading a KDB.
Note that not all TL data types are supported, only two: last
password change and modify-by. This is the minimum necessary.
PKINIT users may need to add support for KRB5_TL_USER_CERTIFICATE,
and for databases with K/M history we may need to add KRB5_TL_MKVNO
support.
Support for additional TL data types can be added in
lib/hdb/hdb-mitdb.c:_hdb_mdb_value2entry() and
lib/hdb/print.c:entry2mit_string_int().
We have some cross-realm principals in an MIT KDB with one kind of
1DES enctype, but the other realm's KDCs issue x-realm TGTs where
the ticket encpart key enctype is a different 1DES enctype. We need
this to work if we use Heimdal with the MIT HDB backend.
An alternative would be to check for similar (or, rather,
compatible) enctypes in the KDC (and elsewhere?). This patch avoids
the need to make such ugly changes elsewhere.
Also: add support for ignoring null enctype / zero-length keys,
which *can* be found in MIT DB entries created in pre-historic
times.
Also: make the mitdb HDB backend more elegant (e.g., use the ASN.1
compiler's generated sequence/array utility functions.
Also: add a utility function needed for kadm5 kvno change
improvements and make kadmin's mod --kvno work correctly and
naturally.
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
Fixed a double-free bug that was triggered by MIT KDB entries with
multiple kvnos in non-increasing order.
Added lots of comments regarding the MIT KDB entry format.
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
