aabb937b46
kdc: don't allow self delegation if a backend check_constrained_delegation() hook is given
Stefan Metzmacher
2011-06-24 12:40:33 +02:00
6cb0e81760
kdc: pass down the server hdb_entry_ex to check_constrained_delegation()
Stefan Metzmacher
2011-06-24 11:53:37 +02:00
d6a56b847b
kdc: use the correct client realm in the EncTicketPart
Stefan Metzmacher
2011-06-24 11:08:33 +02:00
fb8c65a8c2
better logging
Love Hörnquist Åstrand
2011-07-23 11:44:42 -07:00
12403a31ce
sprinkle more windows files
Love Hörnquist Åstrand
2011-07-23 11:18:21 -07:00
0b3c720c01
cf: Also enable pthreads on Linux 3.
Jelmer Vernooij
2011-07-22 14:19:34 +02:00
dfc7ec92fa
Make kadm5_lock() and unlock work, and add kadmin commands for them.
Nicolas Williams
2011-07-22 21:07:48 -05:00
43c5244ecc
Fix from Roland Dowdeswell -- kadm5_setkey_principal() has to rev kvno earlier
Nicolas Williams
2011-07-22 16:18:44 -05:00
e23a1efdc9
Fixes for updates of KADM5_KVNO but not KEY_DATA and vice-versa.
Nicolas Williams
2011-07-21 17:39:53 -05:00
dae01950a2
add_enctype needs to set the kvno of the keys it adds!
Nicolas Williams
2011-07-21 15:39:22 -05:00
1edc2cee45
Test multi-kvno support in kadmin and KDC (part 1).
Nicolas Williams
2011-07-21 15:38:49 -05:00
1e14951592
Preserve set_time on historic keysets in kadm5_s_modify_principal() path.
Nicolas Williams
2011-07-21 15:26:50 -05:00
0f53687346
Two mods from Roland to make kadm5_setkey_principal_3() work.
Nicolas Williams
2011-07-21 10:32:29 -05:00
4f5dbf2f81
Two patches from Roland Dowdeswell to make n_keys/new_keys args optional.
Nicolas Williams
2011-07-20 18:54:29 -05:00
c818890dd7
Re-write _kadm5_set_keys2() to handle key history.
Nicolas Williams
2011-07-20 17:45:14 -05:00
1eb56edd86
Introduce Keys ::= SEQUENCE OF Key in hdb.asn1 so we can get convenience utils.
Nicolas Williams
2011-07-20 17:44:27 -05:00
689d4f4dd9
Another HDB_F_DECRYPT-isn't-critical fix.
Nicolas Williams
2011-07-20 14:57:27 -05:00
5335559845
Oops, HDB_F_DECRYPT isn't critical; making it so breaks tests.
Nicolas Williams
2011-07-20 00:49:01 -05:00
a246c394d2
Fix warnings.
Nicolas Williams
2011-07-20 00:01:53 -05:00
e020dc25b8
Fix a double free in ank.c.
Nicolas Williams
2011-07-19 21:14:15 -05:00
f2897efd09
Make the KDC path work.
Nicolas Williams
2011-07-19 19:42:09 -05:00
e23c7a7daf
How on earth did this build breaking thinko get through?
Nicolas Williams
2011-07-19 19:41:02 -05:00
9d6d3ee5f3
Fixed a likely bug in modify_principal() where the memset() of ent happens after early error checking.
Nicolas Williams
2011-07-19 14:19:38 -05:00
07370612bd
Remove policy name checking against krb5.conf code.
Nicolas Williams
2011-07-19 14:18:54 -05:00
87742e8118
Add missing KADM5_AUTH_GET_KEYS error and use it.
Nicolas Williams
2011-07-19 14:01:56 -05:00
ed511e06f9
Updated kadmind.8 and kadmin.8.
Nicolas Williams
2011-07-19 13:41:36 -05:00
909653e50f
Add comment and assert about key history to kadm5_log_replay_modify()
Nicolas Williams
2011-07-19 12:54:49 -05:00
b16ca34642
Fix incorrect key history check optimization. (NOT TESTED)
Nicolas Williams
2011-07-19 12:34:38 -05:00
784e6a69df
Avoid useless work related to keepold.
Nicolas Williams
2011-07-19 12:34:06 -05:00
9adb40a06e
Forgot to export the kadm5 policy functions.
Nicolas Williams
2011-07-19 10:05:30 -05:00
31974aa24c
More s/int/size_t/ for iterators. Also fixed a stupid bug.
Nicolas Williams
2011-07-19 01:30:42 -05:00
f2bb83c088
Add default to policy prompt and fix harmless bug in edit_policy()
Nicolas Williams
2011-07-19 00:41:23 -05:00
a1203a703d
Re-fix an earlier mistake that fell out in a branch switcheroo.
Nicolas Williams
2011-07-19 00:31:39 -05:00
0d90e0c4d0
Complete --keepold support and fix crasher in kadmin cpw -r --keepold.
Nicolas Williams
2011-07-19 00:21:30 -05:00
2510d2d8fc
Oops, reverse sense of get-keys check...
Nicolas Williams
2011-07-18 23:35:58 -05:00
f15745c60c
Forgot to save edits to kadmin/server.c to use the new get-keys authorization.
Nicolas Williams
2011-07-18 23:15:59 -05:00
558a8d05a6
Forgot to export kadm5_store_principal_ent_nokeys().
Nicolas Williams
2011-07-18 23:15:33 -05:00
fad463bbd9
Fix policy validation bug (parse_policy() should return success when the policy name is OK!)
Nicolas Williams
2011-07-18 22:51:33 -05:00
a35ea4955a
create_principal() must memset(ent, 0, ...) before ever returning (fixes core dump)
Nicolas Williams
2011-07-18 22:50:59 -05:00
cf1c898e95
Undo a s/size_t/int/. Iterators must be unsigned.
Nicolas Williams
2011-07-18 22:49:50 -05:00
0674e4b13a
Ooops! Mind those tags when re-ordering ASN.1 SEQUENCEs! (hdb_keyset)
Nicolas Williams
2011-07-18 22:49:20 -05:00
4b0245d096
Export the new kadm5 functions.
Nicolas Williams
2011-07-18 18:37:51 -05:00
e16360e2db
Add --keepold option to cpw.
Nicolas Williams
2011-07-18 15:46:04 -05:00
acc8cd4b22
Duh, act on keepold in randkey!
Nicolas Williams
2011-07-18 01:13:43 -05:00
af23757829
Trivial policy bug fix.
Nicolas Williams
2011-07-18 15:40:59 -05:00
e7ea698366
Fixed dumb bug that caused keys to not accumulate in history.
Nicolas Williams
2011-07-18 15:45:15 -05:00
53ea8ac59b
Make changes to hdb_keyset type be backward-compatible.
Nicolas Williams
2011-07-18 15:38:16 -05:00
a280ed4d4c
Forgot a file for the hdb_keyset backwards-compat extention.
Nicolas Williams
2011-07-18 15:39:41 -05:00
fac34871be
More kadmin support for kvno diff policy.
Nicolas Williams
2011-07-17 18:49:34 -05:00
3794d8b37b
Changed lib/hdb/Makefile.am to use --sequence=HDB-Ext-KeySet
Nicolas Williams
2011-07-17 15:28:06 -05:00
355ae357eb
Moved set_time field of hdb_keyset to end and add extensibility marker.
Nicolas Williams
2011-07-17 15:20:25 -05:00
c2ec368c36
Add HDB extension for storing policy regarding what historic keys may be used for
Nicolas Williams
2011-07-16 17:51:39 -05:00
308e53a4a8
Initial support for filtering out "dead" historical keys.
Nicolas Williams
2011-07-15 19:13:10 -05:00
7e0a801e28
Changed decrypt key history logic and added HDB_F_ALL_KVNOS.
Nicolas Williams
2011-07-15 18:09:05 -05:00
1f349a6aba
kadmin support for policies.
Nicolas Williams
2011-07-15 16:30:37 -05:00
a04721b737
Added basic policy support, w/ policy names listed in krb5.conf
Nicolas Williams
2011-07-15 15:31:51 -05:00
c338446ede
More kadm5 policy stub stuff.
Nicolas Williams
2011-07-15 12:22:42 -05:00
26f9924bb3
Added stubs for the kadm5 policy functions.
Nicolas Williams
2011-07-15 11:48:46 -05:00
56259efbac
Added dummy kadm5_get_policies()
Nicolas Williams
2011-07-15 11:40:49 -05:00
abd94953e2
Fixes to lock nesting code.
Nicolas Williams
2011-07-14 23:34:20 -05:00
58d72035f1
Added kadm5_lock() and unlock.
Nicolas Williams
2011-07-14 17:35:28 -05:00
109607a355
Fix uninitialized variable.
Nicolas Williams
2011-07-14 17:12:02 -05:00
45294a93a7
Added a disting get-keys authorization for kadmind.
Nicolas Williams
2011-07-14 15:39:20 -05:00
3d0019d3ce
Added kadm5_setkey_principal*() and kadm5_decrypt_key().
Nicolas Williams
2011-07-14 14:48:07 -05:00
e8e314bbb1
Beginning of another new kadm5 function. Need to switch branches for a bit.
Nicolas Williams
2011-03-14 16:27:53 -05:00
6e04b05e9d
Initial support for kadm5_randkey_principal_3(), needed by krb5_admin. NOT TESTED YET.
Nicolas Williams
2011-07-14 15:44:14 -05:00
51e9da4a66
Fixed (preemptively) a double free and added password history based on key history.
Nicolas Williams
2011-07-13 01:49:44 -05:00
34189a23fe
Added a flag to ensure that we don't mod/store hdb entries fetched with specified kvno.
Nicolas Williams
2011-07-13 01:48:32 -05:00
e7f385ad0d
Initial patch to make the MIT KDB backend for HDB handle multiple kvnos.
Nicolas Williams
2011-07-13 00:24:42 -05:00
34bb7ae363
Fix double free.
Nicolas Williams
2011-07-12 19:39:08 -05:00
a095933ee0
We want the time that a keyset was set, not the time it was replaced.
Nicolas Williams
2011-07-12 16:00:43 -05:00
b45ac85b65
Add support for fetching old keys via kadm5 API.
Nicolas Williams
2011-07-12 12:16:46 -05:00
08650b573b
Also encrypt the history when storing the entry.
Nicolas Williams
2011-07-12 10:34:57 -05:00
fca53990e4
Initial commit for second approach for multiple kvno. NOT TESTED!
Nicolas Williams
2011-03-25 16:00:49 -05:00
ed91d4c9e3
Mac compat
Love Hornquist Astrand
2011-07-22 11:50:30 -07:00
fe10979669
Merge pull request #9 from lha/master
Love Hörnquist Åstrand
2011-07-22 11:41:49 -07:00
c13deafcce
Synchronize Windows export list with Unix
Jeffrey Altman
2011-07-21 11:50:45 -04:00
d756ad019a
make tests pass again
Love Hörnquist Åstrand
2011-06-19 11:49:33 -07:00
e73a5a9c54
remove stray klist
Love Hörnquist Åstrand
2011-06-19 11:39:39 -07:00
45b9139cc4
if we are using db1 or db3 (really 3,4,5), when we will need LIB_db_create, otherwise use LIB_NDBM
Love Hörnquist Åstrand
2011-06-19 11:20:48 -07:00
5a25df7851
set HEIMDAL_LOCALEDIR for librfc3961.la too
Love Hörnquist Åstrand
2011-06-19 11:02:27 -07:00
09b07e9ef4
fix ifdef
Love Hörnquist Åstrand
2011-06-19 10:58:50 -07:00
625d29fc3e
remove unused ifdef
Love Hörnquist Åstrand
2011-06-19 10:58:35 -07:00
749c112c31
only set IP_TOS on IPv4 sockets
Love Hörnquist Åstrand
2011-06-19 10:58:22 -07:00
e5eb401fcd
simplify checking and start to use __has_extension
Love Hörnquist Åstrand
2011-06-19 10:43:12 -07:00
Stefan Metzmacher