samba.git/source4/kdc, branch master

kdc: Fix S4U2Self handling with KRB5_NT_ENTERPRISE_PRINCIPAL containing a UPN

2015-03-09T08:35:05+00:00

This is now handled properly by samba_kdc_lookup_server() and this wrapper actually
breaks things.

Andrew Bartlett

Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

kdc: make Samba KDC pass new TGS-REQ and AS-REQ (to self) testing

2015-02-08T07:07:07+00:00

This also reverts 51b94ab3fd4d13ee38813eb7d20db11edaa667a8 as our
testing shows Windows 2012R2 does not have this behaviour.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam

kdc: fixup KDC to use functions portable to MIT krb5

2015-02-08T07:07:07+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam

kdc: Correctly return the krbtgt/realm@REALM principal from our KDC

2015-01-23T04:42:08+00:00

This needs to vary depending on if the client requested the canonicalize flag

This was found by our new krb5.kdc test

Signed-off-by: Garming Sam 
Pair-programmed-with: Garming Sam 
Signed-off-by: Andrew Bartlett

kdc: Add TODO to remind us where we need to hook for RODC to get secrets

2015-01-23T04:42:08+00:00

Pair-programmed-with: Garming Sam 
Signed-off-by: Garming Sam 
Signed-off-by: Andrew Bartlett

kdc: Fix Samba's KDC to only change the principal in the right cases

2015-01-23T04:42:08+00:00

If we are set to canonicalize, we get back the fixed UPPER
case realm, and the real username (ie matching LDAP
samAccountName)

Otherwise, if we are set to enterprise, we
get back the whole principal as-sent

Finally, if we are not set to canonicalize, we get back the
fixed UPPER case realm, but the as-sent username

Signed-off-by: Garming Sam 
Pair-programmed-with: Garming Sam 
Signed-off-by: Andrew Bartlett

kdc: Fix enterpise principal name handling

2015-01-23T04:42:08+00:00

Based on a patch by Samuel Cabrero 

This ensures we write the correct (implict, samAccountName) based UPN into
the ticket, rather than the userPrincipalName, which will have a different
realm.

Pair-programmed-with: Garming Sam 
Signed-off-by: Andrew Bartlett 
Signed-off-by: Garming Sam

s4:kdc/db-glue: fix supported_enctypes samba_kdc_trust_message2entry()

2015-01-21T13:56:07+00:00

This avoids writing invalid memory, because num_keys was calculated
in a wrong way...

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Guenther Deschner

s4:kdc: add aes key support for trusted domains

2014-12-19T14:39:40+00:00

We have a look at "msDS-SupportedEncryptionTypes" and >= DS_DOMAIN_FUNCTION_2008

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Günther Deschner 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Fri Dec 19 15:39:40 CET 2014 on sn-devel-104

s4:kdc: remove unused allow_warnings=True for 'MIT_SAMBA'

2014-11-25T06:25:45+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison