6bb8eaca20
e11abf41added support in libhdb for always dereferencing principal aliases during an AS-REQ (where dereferencing refers to enabling alias lookups, and rewriting the returned entry with the alias name unless canonicalization was enabled). Due to the KDC setting HDB_F_FOR_AS_REQ for all lookups from the AS, this allowed aliases on the TGS itself to be dereferenced during an AS-REQ; however, on presenting the TGT, the TGS would fail to resolve. Creating an explicit TGS principal for the aliased realm would work (at least prior toc555ed6a), but this could be confusing to deploy. This commit changes enables alias dereferencing when HDB_F_GET_ANY is set, which essentially means dereference whenever the request is coming from the KDC (as opposed to, say, kadmin). We also backoutc555ed6a, which changed the TGS to always canonicalize the server realm, as this breaks serving multiple realms from a single KDC, where server principals in different realms share a single canonical entry. HDB_F_CANON is now passed to the backend as a hint only, and per RFC 6806 the principal name is never changed in TGS replies. (However, for Samba interop, backends can override this by setting the force-canonicalize HDB flag.)
Heimdal
Heimdal is a Kerberos 5 implementation.
For information how to install see here.
There are man pages for most of the commands.
Bug reports and bugs are appreciated. Use GitHub issues or send e-mail to heimdal-bugs@h5l.org.
For more information see the project homepage https://www.h5l.org/ or the mailing lists:
- heimdal-announce@sics.se low-volume announcement
- heimdal-discuss@sics.se high-volume discussion
Send e-mail to heimdal-announce-request@sics.se and heimdal-discuss-request@sics.se respectively to subscribe.
Build Status