decd8f4102
The TGS will issue referrals based on [domain_realm] mappings. With this change the TGS will also issue referrals based on HDB entry aliases. The TGS needed no changes for this, only support in lib/hdb was missing. All we had to do was return HDB_ERR_WRONG_REALM from hdb_fetch_kvno() when the given principal is an alias and its canonical name's realm is different from the alias'. This feature is important because the KDC currently does not re-read krb5.conf and must be restarted for changes to e.g., [domain_realm] mappings to take effect. As well, making krb5.conf changes to all the KDCs for a realm would need to be arranged. But with aliases in the HDB, these problems go away. Relatedly, we should really have an option to store the KDC's entire configuration in the HDB... Futures: - Add support for aliasing of entire namespaces via HDB aliases with WELLKNOWN namespace name forms. This will round out domain-to-realm mapping configuration support via HDB.
Heimdal
Heimdal is an implementation of:
- ASN.1/DER,
- PKIX, and
- Kerberos.
For information how to install see here.
There are man pages for most of the commands.
Bug reports and bugs are appreciated. Use GitHub issues.
For more information see the project homepage https://heimdal.software/heimdal/ or the mailing lists:
heimdal-announce@heimdal.software low-volume announcement heimdal-discuss@heimdal.software high-volume discussion
send mail to heimdal-announce-subscribe@heimdal.software and heimdal-discuss-subscribe@heimdal.software respectively to subscribe.
Build Status