7bf4d76e75
- Formalize the TYPE:collection_name:subsidiary_name naming scheme for
ccaches in ccache collections
- KEYRING: ccaches are weird because they have one more optional field: the
"anchor", so rather than just assume a naming convention everywhere, we
add new functions as well
- Add krb5_cc_{resolve,default}_sub() that allows one to specify a
"subsidiary" ccache name in a collection separately from the
collection name
- Add krb5_cc_{resolve,default}_for() which take a principal name,
unparse it, and use it as the subsidiary ccache name (with colons
replaced)
- Make kinit use the new interfaces
- Add missing DIR ccache iteration functionality
- Revamps test_cc
- Add krb5_cc_get_collection() and krb5_cc_get_subsidiary()
- Bump the ccops SPI version number
- Add gss_store_cred_into2()
- Make MEMORY:anonymous not linked into the global MEMORY ccache
collection, and uses this for delegated cred handles
TBD:
- Split this up into a krb5 change and gss mech_krb5 change?
- Add krb5_cc_init_and_store() utility, per Greg's suggestion?
166 lines
3.9 KiB
Plaintext
166 lines
3.9 KiB
Plaintext
[libdefaults]
|
|
default_realm = TEST.H5L.SE TEST2.H5L.SE
|
|
default_cc_collection = DIR:@objdir@/cc_dir/
|
|
no-addresses = TRUE
|
|
allow_weak_crypto = @WEAK@
|
|
dns_lookup_kdc = no
|
|
dns_lookup_realm = no
|
|
|
|
|
|
[appdefaults]
|
|
pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
|
|
reconnect-min = 2s
|
|
reconnect-backoff = 2s
|
|
reconnect-max = 10s
|
|
|
|
[realms]
|
|
TEST.H5L.SE = {
|
|
kdc = localhost:@port@
|
|
admin_server = localhost:@admport@
|
|
kpasswd_server = localhost:@pwport@
|
|
}
|
|
SUB.TEST.H5L.SE = {
|
|
kdc = localhost:@port@
|
|
}
|
|
TEST2.H5L.SE = {
|
|
kdc = localhost:@port@
|
|
kpasswd_server = localhost:@pwport@
|
|
}
|
|
TEST3.H5L.SE = {
|
|
kdc = localhost:@port@
|
|
}
|
|
TEST4.H5L.SE = {
|
|
kdc = localhost:@port@
|
|
}
|
|
SOME-REALM5.FR = {
|
|
kdc = localhost:@port@
|
|
}
|
|
SOME-REALM6.US = {
|
|
kdc = localhost:@port@
|
|
}
|
|
SOME-REALM7.UK = {
|
|
kdc = localhost:@port@
|
|
}
|
|
SOME-REALM8.UK = {
|
|
kdc = localhost:@port@
|
|
}
|
|
TEST-HTTP.H5L.SE = {
|
|
kdc = http/localhost:@port@
|
|
}
|
|
H1.TEST.H5L.SE = {
|
|
kdc = localhost:@port@
|
|
}
|
|
H2.TEST.H5L.SE = {
|
|
kdc = localhost:@port@
|
|
}
|
|
H3.H2.TEST.H5L.SE = {
|
|
kdc = localhost:@port@
|
|
}
|
|
H4.H2.TEST.H5L.SE = {
|
|
kdc = localhost:@port@
|
|
}
|
|
|
|
[domain_realm]
|
|
.test.h5l.se = TEST.H5L.SE
|
|
.sub.test.h5l.se = SUB.TEST.H5L.SE
|
|
.h1.test.h5l.se = H1.TEST.H5L.SE
|
|
.h2.test.h5l.se = H2.TEST.H5L.SE
|
|
.h3.h2.test.h5l.se = H3.H2.TEST.H5L.SE
|
|
.h4.h2.test.h5l.se = H4.H2.TEST.H5L.SE
|
|
.example.com = TEST2.H5L.SE
|
|
localhost = TEST.H5L.SE
|
|
.localdomain = TEST.H5L.SE
|
|
localdomain = TEST.H5L.SE
|
|
.localdomain6 = TEST.H5L.SE
|
|
localdomain6 = TEST.H5L.SE
|
|
|
|
|
|
[kdc]
|
|
enable-digest = true
|
|
allow-anonymous = true
|
|
digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2
|
|
strict-nametypes = true
|
|
|
|
enable-http = true
|
|
|
|
enable-pkinit = true
|
|
pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key
|
|
pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
|
|
pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt
|
|
# pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl
|
|
pkinit_mappings_file = @srcdir@/pki-mapping
|
|
pkinit_allow_proxy_certificate = true
|
|
|
|
database = {
|
|
label = {
|
|
dbname = @db_type@:@objdir@/current-db@kdc@
|
|
realm = TEST.H5L.SE
|
|
mkey_file = @objdir@/mkey.file
|
|
acl_file = @srcdir@/heimdal.acl
|
|
log_file = @objdir@/current@kdc@.log
|
|
}
|
|
label2 = {
|
|
dbname = @db_type@:@objdir@/current-db@kdc@
|
|
realm = TEST2.H5L.SE
|
|
mkey_file = @objdir@/mkey.file
|
|
acl_file = @srcdir@/heimdal.acl
|
|
log_file = @objdir@/current@kdc@.log
|
|
}
|
|
label3 = {
|
|
dbname = sqlite:@objdir@/current-db@kdc@.sqlite3
|
|
realm = SOME-REALM5.FR
|
|
mkey_file = @objdir@/mkey.file
|
|
acl_file = @srcdir@/heimdal.acl
|
|
log_file = @objdir@/current@kdc@.log
|
|
}
|
|
}
|
|
|
|
signal_socket = @objdir@/signal
|
|
iprop-stats = @objdir@/iprop-stats
|
|
iprop-acl = @srcdir@/iprop-acl
|
|
log-max-size = 40000
|
|
|
|
[hdb]
|
|
db-dir = @objdir@
|
|
|
|
[logging]
|
|
kdc = 0-/FILE:@objdir@/messages.log
|
|
krb5 = 0-/FILE:@objdir@/messages.log
|
|
default = 0-/FILE:@objdir@/messages.log
|
|
|
|
# If you are doing preformance measurements on OSX you want to change
|
|
# the kdc LOG line from = to - below to keep the FILE open and avoid
|
|
# open/write/close which is blocking (rdar:// ) on OSX.
|
|
# kdc = 0-/FILE=@objdir@/messages.log
|
|
|
|
[kadmin]
|
|
save-password = true
|
|
default_key_rules = {
|
|
*/des3-only@* = des3-cbc-sha1:pw-salt
|
|
*/aes-only@* = aes256-cts-hmac-sha1-96:pw-salt
|
|
}
|
|
@dk@
|
|
|
|
[capaths]
|
|
TEST.H5L.SE = {
|
|
TEST2.H5L.SE = .
|
|
SOME-REALM5.FR = 1
|
|
TEST3.H5L.SE = TEST2.H5L.SE
|
|
TEST4.H5L.SE = TEST2.H5L.SE
|
|
TEST4.H5L.SE = TEST3.H5L.SE
|
|
SOME-REALM6.US = SOME-REALM5.FR
|
|
SOME-REALM7.UK = SOME-REALM6.US
|
|
SOME-REALM7.UK = SOME-REALM5.FR
|
|
SOME-REALM8.UK = SOME-REALM6.US
|
|
}
|
|
H4.H2.TEST.H5L.SE = {
|
|
H1.TEST.H5L.SE = H3.H2.TEST.H5L.SE
|
|
H1.TEST.H5L.SE = H2.TEST.H5L.SE
|
|
H1.TEST.H5L.SE = TEST.H5L.SE
|
|
|
|
TEST.H5L.SE = H3.H2.TEST.H5L.SE
|
|
TEST.H5L.SE = H2.TEST.H5L.SE
|
|
|
|
H2.TEST.H5L.SE = H3.H2.TEST.H5L.SE
|
|
}
|