summaryrefslogtreecommitdiffstats
path: root/daemons/ipa-kdb/ipa_kdb.c
Commit message (Collapse)AuthorAgeFilesLines
* ipa-kdb: common function to get key encodings/salt typesMartin Babinsky2015-06-291-70/+59
| | | | | | | | | | | This patch moves duplicate code in `ipadb_get_connection` to get default and supported key encodings/salt types from Kerberos container to a common function handling this task. It is actually a small cosmetic enhancement of the fix of https://fedorahosted.org/freeipa/ticket/4914 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Detect default encsalts kadmin password changeSimo Sorce2015-05-271-0/+38
| | | | | | | | | | | | | | | | | | | When kadmin tries to change a password it will get the allowed keysalts from the password policy. Failure to provide them will result in kadmin using the defaults specified in the kdc.conf file or hardcoded defaults (the default salt is then of type NORMAL). This patch provides the supported values that have been read out of the appropriate LDAP attribute when we read the server configuration. Then at actual password change, check if kadmin is handing us back the exact list of supported encsalts we sent it, and in that case replace it with the real default encsalts. Fixes https://fedorahosted.org/freeipa/ticket/4914 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Martin Babinsky <mbabinsk@redhat.com>
* Avoid calling ldap functions without a contextSimo Sorce2015-01-081-3/+16
| | | | | | | | | | | | | | We need to make sure we have a ld context before we can load the configuration, otherwise ldap APIs will abort crashing the KDC. If we have an issue connecting to LDAP the lcontext will be NULL, but we are not checking that condition when we try to refresh the global configuration. https://fedorahosted.org/freeipa/ticket/4810 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Periodically refresh global ipa-kdb configurationNathaniel McCallum2014-06-191-35/+49
| | | | | | | | | | | | | Before this patch, ipa-kdb would load global configuration on startup and never update it. This means that if global configuration is changed, the KDC never receives the new configuration until it is restarted. This patch enables caching of the global configuration with a timeout of 60 seconds. https://fedorahosted.org/freeipa/ticket/4153 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: validate that an OTP user has tokensNathaniel McCallum2014-02-141-4/+6
| | | | | | | | | | | | This handles the case where a user is configured for OTP in ipaUserAuthType, but the user has not yet created any tokens. Until the user creates tokens, the user should still be able to log in via password. This logic already exists in LDAP, but ipa-kdb needs to perform the same validation to know what data to return to the KDC. https://fedorahosted.org/freeipa/ticket/4154 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* KDC: implement transition check for trusted domainsAlexander Bokovoy2013-10-041-1/+1
| | | | | | | | | | | | When client principal requests for a ticket for a server principal and we have to perform transition, check that all three belong to either our domain or the domains we trust through forest trusts. In case all three realms (client, transition, and server) match trusted domains and our domain, issue permission to transition from client realm to server realm. Part of https://fedorahosted.org/freeipa/ticket/3909
* ipa-kdb: reinit mspac on HTTP TGT acquisition to aid trust-add caseAlexander Bokovoy2013-07-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trust is established, we also create idrange for the trusted domain. With FreeIPA 3.3 these ranges can have different types, and in order to detect which one is to create, we need to do lookup at AD LDAP server. Such lookup requires authenticated bind. We cannot bind as user because IPA framework operates under constrained delegation using the user's credentials and allowing HTTP/ipa.server@REALM to impersonate the user against trusted domain's services would require two major things: - first, as we don't really know exact AD LDAP server names (any AD DC can be used), constrained delegation would have to be defined against a wild-card - second, constrained delegation requires that target principal exists in IPA LDAP as DN. These two together limit use of user's ticket for the purpose of IPA framework looking up AD LDAP. Additionally, immediately after trust is established, issuing TGT with MS-PAC to HTTP/ipa.server@REALM may fail due to the fact that KDB driver did not yet refreshed its list of trusted domains -- we have limited refresh rate of 60 seconds by default. This patch makes possible to force re-initialization of trusted domains' view in KDB driver if we are asked for TGT for HTTP/ipa.server@REALM. We will need to improve refresh of trusted domains' view in KDB driver in future to notice changes in cn=etc,$SUFFIX tree automatically. This improvement is tracked in https://fedorahosted.org/freeipa/ticket/1302 and https://fedorahosted.org/freeipa/ticket/3626 Part of https://fedorahosted.org/freeipa/ticket/3649
* ipa-kdb: cache KDC hostname on startupAlexander Bokovoy2013-07-231-0/+15
| | | | | | | | | | | We need KDC hostname for several purposes: - short-circuit detection of principals on the same server as KDC - generating NetBIOS name Make sure we cache hostname information on startup and use it instead of detecting the hostname in run-time. This will miss the case that KDC hostname got changed but such cases are not supported anyway without restarting KDC and making changes to principals.
* ipa-kdb: Add OTP supportNathaniel McCallum2013-05-171-1/+37
| | | | | | | | | | | | | If OTP is enabled for a user, then: 1. Long-term keys are not provided to KDB 2. The user string 'otp' is defined to KDB Since it is not secure to send radius configuration information over krb5 user strings, we simply set the string to a known default ('[]') which enables the default configuration in the KDC. https://fedorahosted.org/freeipa/ticket/3561 http://freeipa.org/page/V3/OTP
* ipa-kdb: Read global defaul ipaKrbAuthzDataSumit Bose2013-03-081-1/+26
| | | | | | | The ipaKrbAuthzData LDAP attribute is read from the ipaConfig object and the read value(s) are stored in the ipadb context. https://fedorahosted.org/freeipa/ticket/2960
* ipa-kdb: Free talloc autofree context when module is closedsbose2013-02-141-0/+3
| | | | | | | | | | | | | | | Currently kdb5kdc crashes on exit if the ipadb KDB modules is loaded and trusts are configured. The reason is the talloc autofree context which get initialised during the ndr_push_union_blob() call. On exit the KDC module is unloaded an later on atexit() tries to free the context, but all related symbols are already unloaded with the module. This patch frees the talloc autofree context during the cleanup routine of the module. Since this is called only at exit and not during normal operations this is safe even if other KDC plugins use the talloc autofree context, e.g. via some Samba libraries, as well. Fixes https://fedorahosted.org/freeipa/ticket/3410
* ipa-kdb: remove memory leaksMartin Kosek2013-02-141-0/+4
| | | | | | | | All known memory leaks caused by unfreed allocated memory or unfreed LDAP results (which should be also done after unsuccessful searches) are fixed. https://fedorahosted.org/freeipa/ticket/3413
* Add support for disabling KDC writesSimo Sorce2012-06-061-0/+66
| | | | | | | | | | | Add two global ipaConfig options to disable undesirable writes that have performance impact. The "KDC:Disable Last Success" will disable writing back to ldap the last successful AS Request time (successful kinit) The "KDC:Disable Lockout" will disable completely writing back lockout related data. This means lockout policies will stop working. https://fedorahosted.org/freeipa/ticket/2734
* policy: add function to check lockout policySimo Sorce2012-02-191-1/+1
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/2393
* ipa-kdb: add AS auditing supportSimo Sorce2012-02-141-1/+1
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/2334
* ipa-kdb: Add delgation access control supportSimo Sorce2011-12-081-1/+1
|
* Add support for generating PAC for AS requests for user principalsSimo Sorce2011-11-071-1/+6
|
* Fix CID 11019: Resource leakSimo Sorce2011-11-071-6/+7
| | | | https://fedorahosted.org/freeipa/ticket/2037
* ipa-kdb: Fix memory leakSimo Sorce2011-11-031-0/+1
|
* ipa-kdb: implement change_pwd functionSimo Sorce2011-08-261-1/+1
|
* ipa-kdb: implement function to retrieve password policiesSimo Sorce2011-08-261-43/+6
|
* ipa-kdb: Get/Store Master Key directly from LDAPSimo Sorce2011-08-261-8/+13
|
* ipa-kdb: functions to get principalSimo Sorce2011-08-261-35/+0
|
* ipa-kdb: implement get_time functionSimo Sorce2011-08-261-1/+5
|
* ipa-kdb: initialize module functionsSimo Sorce2011-08-261-6/+340
| | | | | Initialize module also on ipadb_create invocation. This is what kdb5_util expects.
* ipa-kdb: Initial plugin skeletonSimo Sorce2011-08-261-0/+185
generated by cgit (git 2.34.1) at 2024-09-27 03:38:13 +0000