Included is a default plugin that searches a sorted text file where
every line is of the form:
<unparsed-principal>[<whitespace><username>]
If the username is missing in a matching line then an error is
returned. If a matching line is not found then the next plugin will
be allowed to run, if any.
We enable kadm5_chpass_principal_3() in the server side of the
library. The client kadm5 library calls will still return the
error KAMD5_KS_TUPLE_NO_SUPP.
Signed-off-by: Nicolas Williams <nico@cryptonector.com>
The code was generating a char ** of string representations of the
ks_tuple() array but it was not using it. We modify the code to:
1. extend the array returned by ks_tuple2str() to include
enough space for the trailing NULL and ensure that there
is a NULL at the end,
2. not free the array before exiting ks_tuple2str() as we
intend to use it in the caller,
3. re-organise the pointers in hdb_generate_key_set() to
make it more clear how we are to free things that have
been allocated.
4. free the char ** given us by ks_tuple2str() if it has
been allocated.
Signed-off-by: Nicolas Williams <nico@cryptonector.com>
Different ticket session key enctype selection options should
distinguish between target principal type (krbtgt vs. not), not
between KDC request types.
NOTE: The test runs and succeeds, but the client seems to be getting
a new x-realm TGT after we set the kvno to 0 or remove the
kvno from the tickets. This means we're not really testing
the TGS paths! So this test is not yet ready.
AD issues x-realm TGTs with kvno 0. On key x-realm trust key change
we need to be able to try current and previous keys for trust, else
we will have some failures.
We have some cross-realm principals in an MIT KDB with one kind of
1DES enctype, but the other realm's KDCs issue x-realm TGTs where
the ticket encpart key enctype is a different 1DES enctype. We need
this to work if we use Heimdal with the MIT HDB backend.
An alternative would be to check for similar (or, rather,
compatible) enctypes in the KDC (and elsewhere?). This patch avoids
the need to make such ugly changes elsewhere.
