summaryrefslogtreecommitdiffstats
path: root/src/util/sss_krb5.h
Commit message (Collapse)AuthorAgeFilesLines
* Use pattern #elif defined(identifier)Lukas Slebodnik2014-03-141-1/+1
| | | | | | | | | | | | | | We had in source code following pattern #elif HAVE_<name> It worked because undefined identifier(in some cases) was evaluated to 0. But we do not care about value of HAVE_SOMETHING. We just need to know whether identifier was defined. There is not equivalent to #ifdef (short for of #if definded) We need to use long form: #elif defined HAVE_<name> It causes also compiler warning with enabled compiler flag -Wundef. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* krb5: Remove unused helper functionsSimo Sorce2013-09-091-8/+0
| | | | | | | these functions are not needed anymore. Related: https://fedorahosted.org/sssd/ticket/2061
* krb5: Remove unused functionSimo Sorce2013-09-091-2/+0
| | | | | Related: https://fedorahosted.org/sssd/ticket/2061
* krb5: Make check_for_valid_tgt() staticSimo Sorce2013-09-091-4/+0
| | | | | | | check_for_valid_tgt() is used exclusively in krb5_uitls.c so move it there. Resolves: https://fedorahosted.org/sssd/ticket/2061
* KRB5: Add support for KEYRING cache typeStephen Gallagher2013-08-271-0/+2
| | | | https://fedorahosted.org/sssd/ticket/2036
* KRB5: Add new #define for collection cache typesStephen Gallagher2013-08-221-3/+3
| | | | | | Kerberos now supports multiple types of collection caches, not just DIR: caches. We should add a macro for generic collection behavior and use that where appropriate.
* Use conditional build for retrieving ccache.Lukas Slebodnik2013-07-151-0/+4
| | | | | | | | Some krb5 functions needn't be available for retrieving ccache with principal. Therefore ifdef is used to solve this situation with older version of libkrb5. There were two functions with similar functionality in krb5_child and krb5_utils. They were merged to one universal function, which was moved to file src/util/sss_krb5.c
* AD: Write out domain-realm mappingsJakub Hrozek2013-06-271-2/+0
| | | | | This patch reuses the code from IPA provider to make sure that domain-realm mappings are written even for AD sub domains.
* subdomains: touch krb5.conf when creating new domain-realm mappingsPavel Březina2013-06-161-0/+3
| | | | https://fedorahosted.org/sssd/ticket/1815
* Allow usage of enterprise principalsSumit Bose2013-04-221-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | Enterprise principals are currently most useful for the AD provider and hence enabled here by default while for the other Kerberos based authentication providers they are disabled by default. If additional UPN suffixes are configured for the AD domain the user principal stored in the AD LDAP server might not contain the real Kerberos realm of the AD domain but one of the additional suffixes which might be completely randomly chooses, e.g. are not related to any existing DNS domain. This make it hard for a client to figure out the right KDC to send requests to. To get around this enterprise principals (see http://tools.ietf.org/html/rfc6806 for details) were introduced. Basically a default realm is added to the principal so that the Kerberos client libraries at least know where to send the request to. It is not in the responsibility of the KDC to either handle the request itself, return a client referral if he thinks a different KDC can handle the request or return and error. This feature is also use to allow authentication in AD environments with cross forest trusts. Fixes https://fedorahosted.org/sssd/ticket/1842
* Only build extract_and_send_pac on platforms that support itJakub Hrozek2012-11-121-0/+7
|
* Add replacement for krb5_find_authdata()Sumit Bose2012-10-261-0/+5
| | | | | | | | | krb5_find_authdata() is only available in MIT Kerberos 1.10 or higher. To allow sssd to be compiled on platform with lower version of MIT Kerberos a replacement call is added. Please note that on those platform the replacement call will only return an error. If the krb5_find_authdata functionality is really needed on those platform it must be implemented by a different patch.
* Only call krb5_set_trace_callback on platforms that support itJakub Hrozek2012-10-121-3/+2
|
* Collect krb5 trace on high debug levelsJakub Hrozek2012-10-121-0/+7
| | | | | | | If the debug level contains SSSDBG_TRACE_ALL, then the logs would also include tracing information from libkrb5. https://fedorahosted.org/sssd/ticket/1539
* remove left over principal selectionPavel Březina2012-10-021-4/+0
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1303 Domain start up was taking too long when there are many principals in a kerberos keytab. We were looking up in the keytab two times. The first time we try to select a proper principal and remember it. The second call happens almost right after the first one and it is just a check if the principal exists in the keytab, without any output information other than success/failure. It is probably a left over from https://fedorahosted.org/sssd/ticket/781. This patch removes the second call.
* Revert commit 4c157ecedd52602f75574605ef48d0c48e9bfbe8Stef Walter2012-07-061-8/+0
| | | | | | | | * This broke corner cases when used with default_tkt_types = des-cbc-crc and DES enabled on an AD domain. * This is fixed in kerberos instead, in a more correct way and in a way which we cannot replicate.
* Fix typo breaking DIR cache detectionStephen Gallagher2012-06-181-2/+0
|
* KRB5: Auto-detect DIR cache support in configureStephen Gallagher2012-06-151-0/+8
| | | | | | We can't support the DIR cache features in systems with kerberos libraries older than 1.10. Make sure we don't build it on those systems.
* Use Kerberos context in KRB5_DEBUGJakub Hrozek2012-06-141-0/+8
| | | | | Passing Kerberos context to sss_krb5_get_error_message will allow us to get better error messages.
* Add support for storing credential caches in the DIR: back endJakub Hrozek2012-06-141-1/+2
| | | | https://fedorahosted.org/sssd/ticket/974
* Residual util functionsJakub Hrozek2012-06-141-0/+16
| | | | | | Kerberos credential caches can be specified by TYPE:RESIDUAL. This patch adds a couple of utilities to support parsing if ccache locations, checking types etc.
* Limit krb5_get_init_creds_keytab() to etypes in keytabStef Walter2012-05-071-0/+8
| | | | | | | | | * Load the enctypes for the keys in the keytab and pass them to krb5_get_init_creds_keytab(). * This fixes the problem where the server offers a enctype that krb5 supports, but we don't have a key for in the keytab. https://bugzilla.redhat.com/show_bug.cgi?id=811375
* Modify behavior of pam_pwd_expiration_warningJan Zeleny2012-05-041-0/+5
| | | | | | | | | | | | | | | | | | New option pwd_expiration_warning is introduced which can be set per domain and can override the value specified by the original pam_pwd_expiration_warning. If the value of expiration warning is set to zero, the filter isn't apllied at all - if backend server returns the warning, it will be automatically displayed. Default value for Kerberos: 7 days Default value for LDAP: don't apply the filter Technical note: default value when creating the domain is -1. This is important so we can distinguish between "no value set" and 0. Without this possibility it would be impossible to set different values for LDAP and Kerberos provider.
* Clean up log messages about keytab_nameStephen Gallagher2012-04-051-0/+2
| | | | | | | | | There were many places where we were printing (null) to the logs because a NULL keytab name tells libkrb5 to use its configured default instead of a particular path. This patch should clean up all uses of this to print "default" in the logs. https://fedorahosted.org/sssd/ticket/1288
* Add compatibility layer for Heimdal Kerberos implementationStephen Gallagher2011-12-221-0/+15
|
* Add wrapper for krb5_get_init_creds_opt_set_canonicalizeJan Zeleny2011-11-021-0/+3
|
* Added some kerberos functions for building on RHEL5Jan Zeleny2011-05-051-0/+10
|
* Modify principal selection for keytab authenticationJan Zeleny2011-04-251-0/+8
| | | | | | | | | | | | | | | | Currently we construct the principal as host/fqdn@REALM. The problem with this is that this principal doesn't have to be in the keytab. In that case the provider fails to start. It is better to scan the keytab and find the most suitable principal to use. Only in case no suitable principal is found the backend should fail to start. The second issue solved by this patch is that the realm we are authenticating the machine to can be in general different from the realm our users are part of (in case of cross Kerberos trust). The patch adds new configuration option SDAP_SASL_REALM. https://fedorahosted.org/sssd/ticket/781
* Extend and move function for finding principal in keytabJan Zeleny2011-04-251-0/+6
| | | | | | | | The function now supports finding principal in keytab not only based on realm, but based on both realm and primary/instance parts. The function also supports * wildcard at the beginning or at the end of primary principal part. The function for finding principal has been moved to util/sss_krb5.c, so it can be used in other parts of the code.
* Fix build issue with older Kerberos librarySumit Bose2010-12-081-0/+7
|
* Add support for FAST in krb5 providerSumit Bose2010-12-071-0/+14
|
* Use new MIT krb5 API for better password expiration warningsSumit Bose2010-09-231-1/+12
|
* Validate keytab at startupJakub Hrozek2010-08-031-0/+9
| | | | | | | | In addition to validating the keytab everytime a TGT is requested, we also validate the keytab on back end startup to give early warning that the keytab is not usable. Fixes: #556
* Rename server/ directory to src/Stephen Gallagher2010-02-181-0/+50
Also update BUILD.txt
generated by cgit (git 2.34.1) at 2024-05-14 13:06:33 +0000