579393c8b9
When new keys are added (typically via kadm5_setkey_principal_3), truncate the key history to remove old keys, that is keys older than the newest key which was in effect prior longer ago than the principal's maximum ticket lifetime. This feature is controlled via the "[kadmin]" section's "prune-key-history" boolean parameter, which defaults to false. Currently this happens only when kadm5_setkey_principal_3() is called directly on the server, the client API simulates kadm5_setkey_principal_3() via a get, update, modify sequence that does not prune the key history. The plan is to add a new kadm5 protocol RPC and convert clients to call that instead. In setkey_principal_3 seal keys after entry key update Also, for now, don't check the return value of kadm5_log_modify() in the new kadm5_s_setkey_principal_3(). This has to be addressed more globally. Censor stale keys in kadm5_s_get_principal
120 lines
2.3 KiB
Modula-2
120 lines
2.3 KiB
Modula-2
EXPORTS
|
|
encode_hdb_keyset
|
|
hdb_add_master_key
|
|
hdb_add_current_keys_to_history
|
|
hdb_change_kvno
|
|
hdb_check_db_format
|
|
hdb_clear_extension
|
|
hdb_clear_master_key
|
|
hdb_create
|
|
hdb_db_dir
|
|
hdb_dbinfo_get_acl_file
|
|
hdb_dbinfo_get_binding
|
|
hdb_dbinfo_get_dbname
|
|
hdb_dbinfo_get_label
|
|
hdb_dbinfo_get_log_file
|
|
hdb_dbinfo_get_mkey_file
|
|
hdb_dbinfo_get_next
|
|
hdb_dbinfo_get_realm
|
|
hdb_default_db
|
|
hdb_enctype2key
|
|
hdb_entry2string
|
|
hdb_entry2value
|
|
hdb_entry_alias2value
|
|
hdb_entry_check_mandatory
|
|
hdb_entry_clear_password
|
|
hdb_entry_get_ConstrainedDelegACL
|
|
hdb_entry_get_aliases
|
|
hdb_entry_get_password
|
|
hdb_entry_get_pkinit_acl
|
|
hdb_entry_get_pkinit_cert
|
|
hdb_entry_get_pkinit_hash
|
|
hdb_entry_get_pw_change_time
|
|
hdb_entry_set_password
|
|
hdb_entry_set_pw_change_time
|
|
hdb_find_extension
|
|
hdb_foreach
|
|
hdb_free_dbinfo
|
|
hdb_free_entry
|
|
hdb_free_key
|
|
hdb_free_keys
|
|
hdb_free_master_key
|
|
hdb_generate_key_set
|
|
hdb_generate_key_set_password
|
|
hdb_get_dbinfo
|
|
hdb_init_db
|
|
hdb_interface_version DATA
|
|
hdb_key2principal
|
|
hdb_kvno2keys
|
|
hdb_list_builtin
|
|
hdb_lock
|
|
hdb_next_enctype2key
|
|
hdb_principal2key
|
|
hdb_print_entry
|
|
hdb_process_master_key
|
|
hdb_prune_keys
|
|
hdb_read_master_key
|
|
hdb_replace_extension
|
|
hdb_seal_key
|
|
hdb_seal_key_mkey
|
|
hdb_seal_keys
|
|
hdb_seal_keys_mkey
|
|
hdb_set_last_modified_by
|
|
hdb_set_master_key
|
|
hdb_set_master_keyfile
|
|
hdb_unlock
|
|
hdb_unseal_key
|
|
hdb_unseal_key_mkey
|
|
hdb_unseal_keys
|
|
hdb_unseal_keys_mkey
|
|
hdb_value2entry
|
|
hdb_value2entry_alias
|
|
hdb_write_master_key
|
|
length_hdb_keyset
|
|
initialize_hdb_error_table_r
|
|
|
|
hdb_kt_ops
|
|
hdb_get_kt_ops
|
|
|
|
; MIT KDB related entries
|
|
_hdb_mdb_value2entry
|
|
_hdb_mit_dump2mitdb_entry
|
|
|
|
; some random bits needed for libkadm
|
|
HDBFlags2int
|
|
asn1_HDBFlags_units
|
|
copy_Event
|
|
copy_HDB_extensions
|
|
copy_Key
|
|
copy_Keys
|
|
copy_Salt
|
|
decode_HDB_Ext_Aliases
|
|
decode_HDB_Ext_PKINIT_acl
|
|
decode_HDB_extension
|
|
decode_Key
|
|
decode_Keys
|
|
encode_HDB_Ext_Aliases
|
|
encode_HDB_Ext_PKINIT_acl
|
|
encode_HDB_extension
|
|
encode_Key
|
|
encode_Keys
|
|
free_Event
|
|
free_HDB_Ext_Aliases
|
|
free_HDB_Ext_PKINIT_acl
|
|
free_HDB_extension
|
|
free_HDB_extensions
|
|
free_Key
|
|
free_Keys
|
|
free_Salt
|
|
free_hdb_entry
|
|
free_hdb_keyset
|
|
int2HDBFlags
|
|
length_HDB_Ext_Aliases
|
|
length_HDB_Ext_PKINIT_acl
|
|
length_HDB_extension
|
|
length_Key
|
|
length_Keys
|
|
add_Keys
|
|
add_HDB_Ext_KeySet
|
|
remove_Keys
|