summaryrefslogtreecommitdiffstats
path: root/daemons/ipa-kdb/ipa_kdb.h
Commit message (Collapse)AuthorAgeFilesLines
* client referral support for trusted domain principals4-2-trust-fixesAlexander Bokovoy2015-09-031-0/+8
| | | | https://fedorahosted.org/freeipa/ticket/3559
* ipa-kdb: common function to get key encodings/salt typesMartin Babinsky2015-06-291-0/+3
| | | | | | | | | | | This patch moves duplicate code in `ipadb_get_connection` to get default and supported key encodings/salt types from Kerberos container to a common function handling this task. It is actually a small cosmetic enhancement of the fix of https://fedorahosted.org/freeipa/ticket/4914 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Detect default encsalts kadmin password changeSimo Sorce2015-05-271-0/+2
| | | | | | | | | | | | | | | | | | | When kadmin tries to change a password it will get the allowed keysalts from the password policy. Failure to provide them will result in kadmin using the defaults specified in the kdc.conf file or hardcoded defaults (the default salt is then of type NORMAL). This patch provides the supported values that have been read out of the appropriate LDAP attribute when we read the server configuration. Then at actual password change, check if kadmin is handing us back the exact list of supported encsalts we sent it, and in that case replace it with the real default encsalts. Fixes https://fedorahosted.org/freeipa/ticket/4914 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Martin Babinsky <mbabinsk@redhat.com>
* Handle DAL ABI change in MIT 1.13Simo Sorce2015-02-131-0/+7
| | | | | | | | | | | | | In this new MIT version the DAL interface changes slightly but KRB5_KDB_DAL_MAJOR_VERSION was not changed. Luckily KRB5_KDB_API_VERSION did change and that's enough to know what to compile in. Resolves: https://fedorahosted.org/freeipa/ticket/4861 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Periodically refresh global ipa-kdb configurationNathaniel McCallum2014-06-191-4/+13
| | | | | | | | | | | | | Before this patch, ipa-kdb would load global configuration on startup and never update it. This means that if global configuration is changed, the KDC never receives the new configuration until it is restarted. This patch enables caching of the global configuration with a timeout of 60 seconds. https://fedorahosted.org/freeipa/ticket/4153 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: validate that an OTP user has tokensNathaniel McCallum2014-02-141-3/+3
| | | | | | | | | | | | This handles the case where a user is configured for OTP in ipaUserAuthType, but the user has not yet created any tokens. Until the user creates tokens, the user should still be able to log in via password. This logic already exists in LDAP, but ipa-kdb needs to perform the same validation to know what data to return to the KDC. https://fedorahosted.org/freeipa/ticket/4154 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add krbticketPolicyAux objectclass if neededSimo Sorce2013-11-261-0/+1
| | | | | | When modifying ticket flags add the objectclass to the object if it is missing. https://fedorahosted.org/freeipa/ticket/3901
* KDC: implement transition check for trusted domainsAlexander Bokovoy2013-10-041-1/+4
| | | | | | | | | | | | When client principal requests for a ticket for a server principal and we have to perform transition, check that all three belong to either our domain or the domains we trust through forest trusts. In case all three realms (client, transition, and server) match trusted domains and our domain, issue permission to transition from client realm to server realm. Part of https://fedorahosted.org/freeipa/ticket/3909
* ipa-kdb: reinit mspac on HTTP TGT acquisition to aid trust-add caseAlexander Bokovoy2013-07-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trust is established, we also create idrange for the trusted domain. With FreeIPA 3.3 these ranges can have different types, and in order to detect which one is to create, we need to do lookup at AD LDAP server. Such lookup requires authenticated bind. We cannot bind as user because IPA framework operates under constrained delegation using the user's credentials and allowing HTTP/ipa.server@REALM to impersonate the user against trusted domain's services would require two major things: - first, as we don't really know exact AD LDAP server names (any AD DC can be used), constrained delegation would have to be defined against a wild-card - second, constrained delegation requires that target principal exists in IPA LDAP as DN. These two together limit use of user's ticket for the purpose of IPA framework looking up AD LDAP. Additionally, immediately after trust is established, issuing TGT with MS-PAC to HTTP/ipa.server@REALM may fail due to the fact that KDB driver did not yet refreshed its list of trusted domains -- we have limited refresh rate of 60 seconds by default. This patch makes possible to force re-initialization of trusted domains' view in KDB driver if we are asked for TGT for HTTP/ipa.server@REALM. We will need to improve refresh of trusted domains' view in KDB driver in future to notice changes in cn=etc,$SUFFIX tree automatically. This improvement is tracked in https://fedorahosted.org/freeipa/ticket/1302 and https://fedorahosted.org/freeipa/ticket/3626 Part of https://fedorahosted.org/freeipa/ticket/3649
* ipa-kdb: cache KDC hostname on startupAlexander Bokovoy2013-07-231-0/+1
| | | | | | | | | | | We need KDC hostname for several purposes: - short-circuit detection of principals on the same server as KDC - generating NetBIOS name Make sure we cache hostname information on startup and use it instead of detecting the hostname in run-time. This will miss the case that KDC hostname got changed but such cases are not supported anyway without restarting KDC and making changes to principals.
* Use libunistring ulc_casecmp() on unicode stringsNathaniel McCallum2013-07-181-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/3772
* ipa-kdb: Add OTP supportNathaniel McCallum2013-05-171-0/+13
| | | | | | | | | | | | | If OTP is enabled for a user, then: 1. Long-term keys are not provided to KDB 2. The user string 'otp' is defined to KDB Since it is not secure to send radius configuration information over krb5 user strings, we simply set the string to a known default ('[]') which enables the default configuration in the KDC. https://fedorahosted.org/freeipa/ticket/3561 http://freeipa.org/page/V3/OTP
* ipa-kdb: Read ipaKrbAuthzData with other principal dataSumit Bose2013-03-081-0/+1
| | | | | | | | The ipaKrbAuthzData LDAP attribute is read together with the other data of the requestedprincipal and the read value(s) are stored in the e-data of the entry for later use. https://fedorahosted.org/freeipa/ticket/2960
* ipa-kdb: Read global defaul ipaKrbAuthzDataSumit Bose2013-03-081-0/+3
| | | | | | | The ipaKrbAuthzData LDAP attribute is read from the ipaConfig object and the read value(s) are stored in the ipadb context. https://fedorahosted.org/freeipa/ticket/2960
* ipa-kdb: remove memory leaksMartin Kosek2013-02-141-0/+2
| | | | | | | | All known memory leaks caused by unfreed allocated memory or unfreed LDAP results (which should be also done after unsuccessful searches) are fixed. https://fedorahosted.org/freeipa/ticket/3413
* Prevent integer overflow when setting krbPasswordExpirationTomas Babej2013-02-081-0/+2
| | | | | | | | | | | | | | | | Since in Kerberos V5 are used 32-bit unix timestamps, setting maxlife in pwpolicy to values such as 9999 days would cause integer overflow in krbPasswordExpiration attribute. This would result into unpredictable behaviour such as users not being able to log in after password expiration if password policy was changed (#3114) or new users not being able to log in at all (#3312). The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver. https://fedorahosted.org/freeipa/ticket/3312 https://fedorahosted.org/freeipa/ticket/3114
* Move mspac structure to be a private pointerSimo Sorce2012-08-021-7/+2
| | | | | By keeping it's definition in the mspac file it is easier to modify and make sure any opertion on it is handled in the same file.
* Add support for disabling KDC writesSimo Sorce2012-06-061-0/+2
| | | | | | | | | | | Add two global ipaConfig options to disable undesirable writes that have performance impact. The "KDC:Disable Last Success" will disable writing back to ldap the last successful AS Request time (successful kinit) The "KDC:Disable Lockout" will disable completely writing back lockout related data. This means lockout policies will stop working. https://fedorahosted.org/freeipa/ticket/2734
* policy: add function to check lockout policySimo Sorce2012-02-191-0/+8
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/2393
* ipa-kdb: add AS auditing supportSimo Sorce2012-02-141-1/+17
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/2334
* ipa-kdb: Add delgation access control supportSimo Sorce2011-12-081-0/+7
|
* ipa-kdb: enhance deref searchesSimo Sorce2011-12-081-2/+5
| | | | | Allow to deref more than one attribute. The attrs searched are the same for all deref attributes at this time.
* Add support for generating PAC for AS requests for user principalsSimo Sorce2011-11-071-0/+38
|
* ipa-kdb: Properly set password expiration time.Simo Sorce2011-09-191-0/+4
| | | | | | | We do the policy check so we are the only one that can calculate the new pwd espiration time. Fixes: https://fedorahosted.org/freeipa/ticket/1793
* ipa-kdb: add password policy supportSimo Sorce2011-08-261-0/+12
| | | | Use default policy for new principals created by kadmin
* ipa-kdb: implement change_pwd functionSimo Sorce2011-08-261-4/+9
|
* ipa-kdb: implement function to retrieve password policiesSimo Sorce2011-08-261-0/+15
|
* ipa-kdb: Get/Store Master Key directly from LDAPSimo Sorce2011-08-261-0/+17
|
* ipa-kdb: add functions to change principalsSimo Sorce2011-08-261-0/+36
|
* ipa-kdb: functions to get principalSimo Sorce2011-08-261-0/+20
|
* ipa-kdb: add common utility ldap wrapper functionsSimo Sorce2011-08-261-0/+31
|
* ipa-kdb: implement get_time functionSimo Sorce2011-08-261-0/+1
|
* ipa-kdb: initialize module functionsSimo Sorce2011-08-261-0/+43
Initialize module also on ipadb_create invocation. This is what kdb5_util expects.
generated by cgit (git 2.34.1) at 2024-04-30 17:06:36 +0000