kx509 fails to create certs for principals with slashes in them. For
example:
client% kinit foo/admin
foo/admin@EXAMPLE.COM's Password:
client% kx509
Timed out waiting on KCA
The KCA reports: "Principal is not a user." However, there is a use
case set out in this post:
https://thestaticvoid.com/post/2012/10/25/protecting-puppet-with-kerberos/
that would create a kx509 cert for a host principal for authenticating
against a secure HTTP service. This commit modifies the certificate
creation code to allow principals with slashes in them.
The TGS was incorrectly using authtime to compute renew_till for new
tickets, which was in turn leading to endtime potentially being equal to
starttime, which caused the TGS to return KRB5KDC_ERR_NEVER_VALID.
This happens when the TGT renewal lifetime is longer than the max renew
lifetime of any other services, after that much time (target services'
max renew life) passes. The TGT is still good but TGS-REQs fail.
This makes it easier to install Heimdal and MIT kerberos on
the same system by just providing the heimdal-krb5.pc file;
the krb5.pc file is provided by both.
This is similar to what's done with heimdal-gssapi.pc/krb5-gssapi.pc.
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
The first enctype RFC3961 prf output length's bytes are correct because
the little- and big-endian representations of unsigned zero are the
same. The second block of output was wrong because the counter was not
being encoded as big-endian.
This change could break applications. But those applications would not
have been interoperating with other implementations anyways (in
particular: MIT's).
The use of the wrong value for the length of ":mkey=" was identified
by Brian May and reported via github:
https://github.com/heimdal/heimdal/issues/40
Change-Id: I0aed86a5bb0359b7a266369076fde5e62f23b5fe
In order for the 64-bit FULL installer to install both the 64-bit
and 32-bit versions of gssapi.dll a merge module needs to be created
so that both versions can exist within the same install package.
Change-Id: Iaa979556e1691d3906e497f87e7d12cd89b1d980
When installing the gssapi.dll within the Heimdal\bin directory
make sure to install the version that has the assembly manifest.
Otherwise, the DLL cannot find the heimdal.dll.
Change-Id: Idd6f8f00db718f8a764e1cfa9d06d188ab22a313
