summaryrefslogtreecommitdiffstats
path: root/daemons/ipa-kdb
Commit message (Collapse)AuthorAgeFilesLines
* ipa-kdb: set krbCanonicalName when creating new principalsMartin Babinsky2016-06-231-3/+1
| | | | | | | | | | Additionally, stop setting ipakrbprincipalalias attribute during principal creation. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* perform case-insensitive principal search when canonicalization is requestedMartin Babinsky2016-06-231-1/+12
| | | | | | | | | | | | | When canonicalization is requested, the krbprincipalname attribute is searched for case-insensitively. In the case that krbcanonicalname is not set, the matched alias is returned with the casing stored in backend, not the one input by client. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* adtrust: support UPNs for trusted domain usersAlexander Bokovoy2016-06-112-11/+50
| | | | | | | | | | | | | | | | | | | | Add support for additional user name principal suffixes from trusted Active Directory forests. UPN suffixes are property of the forest and as such are associated with the forest root domain. FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued attribute of ipaNTTrustedDomain object class. In order to look up UPN suffixes, netr_DsRGetForestTrustInformation LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts. For more details on UPN and naming in Active Directory see https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Migrate from #ifndef guards to #pragma onceNathaniel McCallum2016-05-291-5/+1
| | | | | | | | | | | | Using a pragma instead of guards is easier to write, less error prone and avoids name clashes (a source of very subtle bugs). This pragma is supported on almost all compilers, including all the compilers we care about: https://en.wikipedia.org/wiki/Pragma_once#Portability. This patch does not change the autogenerated files: asn1/asn1c/*.h. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Enable authentication indicators for OTP and RADIUSNathaniel McCallum2016-05-261-2/+8
| | | | | | | | | If the user is configured for OTP or RADIUS authentication, insert the relevant authentication indicator. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Return password-only preauth if passwords are allowedNathaniel McCallum2016-05-261-4/+2
| | | | | | | | | | Before this patch, if either password or password+otp were permitted, only the otp preauth mech would be returned to the client. Now, the client will receive either enc_ts or enc_chl in addition to otp. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipa_kdb: add krbPrincipalAuthInd handlingMatt Rogers2016-05-021-0/+170
| | | | | | | | | | Store and retrieve the authentication indicator "require_auth" string in the krbPrincipalAuthInd attribute. Skip storing auth indicators to krbExtraData. https://fedorahosted.org/freeipa/ticket/5782 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Allow to specify Kerberos authz data type per userSimo Sorce2016-03-091-7/+9
| | | | | | | | | | | | Like for services setting the ipaKrbAuthzData attribute on a user object will allow us to control exactly what authz data is allowed for that user. Setting NONE would allow no authz data, while setting MS-PAC would allow only Active Directory compatible data. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/2579 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Allow admins to disable preauth for SPNs.Simo Sorce2016-03-083-6/+27
| | | | | | | | | | | | | | | | Some legacy softare is not able to properly cope with preauthentication, allow the admins to disable the requirement to use preauthentication for all Service Principal Names if they so desire. IPA Users are excluded, for users, which use password of lessere entrpy, preauthentication is always required by default. This setting does NOT override explicit policies set on service principals or in the global policy, it only affects the default. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/3860 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-kdb: map_groups() consider all resultsSumit Bose2016-02-021-52/+56
| | | | | | | Resolves https://fedorahosted.org/freeipa/ticket/5573 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: get_authz_data_types() make sure entry can be NULLSumit Bose2016-01-272-1/+9
| | | | | | | | | | | | This function determines which type of authorization data should be added to the Kerberos ticket. There are global default and it is possible to configure this per service as well. The second argument is the data base entry of a service. If no service is given it makes sense to return the global defaults and most parts of get_authz_data_types() handle this case well and this patch fixes the remain issue and adds a test for this as well. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Always verify we have a valid ldap context.Simo Sorce2016-01-131-0/+29
| | | | | | | | | | | LDAP calls just assert if an invalid (NULL) context is passed in, so we need to be sure we have a valid connection context before calling into LDAP APIs and fail outright if a context can't be obtained. https://fedorahosted.org/freeipa/ticket/5577 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* FIX: ipa_kdb_principals: add missing break statementMartin Basti2015-11-301-0/+1
| | | | | | | Needs a 'break' otherwise prevents correct reporting of data and it always overrides it with the placeholder data. Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Return default TL_DATA is krbExtraData is missingSimo Sorce2015-11-251-1/+10
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/937 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa_kdb_tests: Fix test with default krb5.confLukas Slebodnik2015-11-181-0/+4
| | | | | | | Default krb5.conf needn't have defined default_realm. Unit tests should not rely on existing default value. Reviewed-By: Martin Basti <mbasti@redhat.com>
* cmocka_tests: Do not use deprecated cmocka interfaceLukas Slebodnik2015-11-181-8/+15
| | | | | | | | The cmocka-1.0 introduced new interface for tests which is not compatible with the old one. And the old interface is deprecated which caused compiled warnings. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_kdb_tests: Fix warning Wmissing-bracesLukas Slebodnik2015-11-131-2/+2
| | | | | | | | | | | | | | | | tests/ipa_kdb_tests.c:254:9: warning: missing braces around initializer [-Wmissing-braces] {3, {BLACKLIST_SID"-1000", BLACKLIST_SID"-1001", BLACKLIST_SID"-1002"}, ^ tests/ipa_kdb_tests.c:254:9: note: (near initialization for ‘test_data[6]’) tests/ipa_kdb_tests.c:256:9: warning: missing braces around initializer [-Wmissing-braces] {0, NULL, 0 , NULL} ^ tests/ipa_kdb_tests.c:256:9: note: (near initialization for ‘test_data[7]’) tests/ipa_kdb_tests.c:234:21: warning: missing braces around initializer [-Wmissing-braces] } test_data[] = { ^ Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_kdb_tests: Remove unused variablesLukas Slebodnik2015-11-131-4/+0
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* client referral support for trusted domain principalsAlexander Bokovoy2015-10-083-0/+123
| | | | | | https://fedorahosted.org/freeipa/ticket/3559 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipa-kdb: add unit_tests for string_to_sid() and dom_sid_string()Sumit Bose2015-07-081-0/+60
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: make string_to_sid() and dom_sid_string() more robustSumit Bose2015-07-081-1/+10
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: add unit-test for filter_logon_info()Sumit Bose2015-07-083-50/+323
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: convert test to cmockaSumit Bose2015-07-082-88/+49
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: filter out group membership from MS-PAC for exact SID matches tooAlexander Bokovoy2015-07-081-1/+99
| | | | | | | | | | | | | | | | | | When incoming SID blacklist contains exact SIDs of users and groups, attempt to filter them out as well, according to [MS-PAC] 4.1.1.2. Note that we treat user's SID and primary group RID filtering as violation of the KDC policy because the resulting MS-PAC will have no user SID or primary group and thus will be invalid. For group RIDs we filter them out. According to [MS-KILE] 3.3.5.6.3.1 it is OK to have empty group RIDs array as GroupCount SHOULD be equal to Groups.MembershipCount returned by SamrGetGroupsForUser [MS-SAMR] 3.1.5.9.1, not MUST, thus it may be empty. Part of fix for https://bugzilla.redhat.com/show_bug.cgi?id=1222475 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: use proper memory chunk size when moving sidsAlexander Bokovoy2015-07-081-3/+17
| | | | | Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1222475 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: common function to get key encodings/salt typesMartin Babinsky2015-06-292-70/+62
| | | | | | | | | | | This patch moves duplicate code in `ipadb_get_connection` to get default and supported key encodings/salt types from Kerberos container to a common function handling this task. It is actually a small cosmetic enhancement of the fix of https://fedorahosted.org/freeipa/ticket/4914 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix s4u2proxy README and add warningSimo Sorce2015-06-081-2/+14
| | | | | | | | The attribute mentioned was using an older name that was later changed in the implementation. Also add a prominent warning about the use of the kadmin flags. Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Detect default encsalts kadmin password changeSimo Sorce2015-05-275-0/+144
| | | | | | | | | | | | | | | | | | | When kadmin tries to change a password it will get the allowed keysalts from the password policy. Failure to provide them will result in kadmin using the defaults specified in the kdc.conf file or hardcoded defaults (the default salt is then of type NORMAL). This patch provides the supported values that have been read out of the appropriate LDAP attribute when we read the server configuration. Then at actual password change, check if kadmin is handing us back the exact list of supported encsalts we sent it, and in that case replace it with the real default encsalts. Fixes https://fedorahosted.org/freeipa/ticket/4914 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Martin Babinsky <mbabinsk@redhat.com>
* ipa-kdb: reject principals from disabled domains as a KDC policyAlexander Bokovoy2015-02-161-1/+1
| | | | | | | Fixes https://fedorahosted.org/freeipa/ticket/4788 Reviewed-By: Sumit Bose <sbose@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-kdb: when processing transitions, hand over unknown ones to KDCAlexander Bokovoy2015-02-161-1/+2
| | | | | | | | | | | When processing cross-realm trust transitions, let the KDC to handle those we don't know about. Admins might define the transitions as explicit [capaths] in krb5.conf. https://fedorahosted.org/freeipa/ticket/4791 Reviewed-By: Sumit Bose <sbose@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Handle DAL ABI change in MIT 1.13Simo Sorce2015-02-132-0/+14
| | | | | | | | | | | | | In this new MIT version the DAL interface changes slightly but KRB5_KDB_DAL_MAJOR_VERSION was not changed. Luckily KRB5_KDB_API_VERSION did change and that's enough to know what to compile in. Resolves: https://fedorahosted.org/freeipa/ticket/4861 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Expose the disabled User Auth TypeNathaniel McCallum2015-02-121-6/+7
| | | | | | | | | Additionally, fix a small bug in ipa-kdb so that the disabled User Auth Type is properly handled. https://fedorahosted.org/freeipa/ticket/4720 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-kdb: more robust handling of principal addition/editingMartin Babinsky2015-01-301-23/+47
| | | | | | | | | | | | | | | | | | | | | | | | The patch addresses the following defect reported by covscan in FreeIPA master: """ Error: FORWARD_NULL (CWE-476): /daemons/ipa-kdb/ipa_kdb_principals.c:1886: assign_zero: Assigning: "principal" = "NULL". /daemons/ipa-kdb/ipa_kdb_principals.c:1929: var_deref_model: Passing null pointer "principal" to "ipadb_entry_to_mods", which dereferences it. /daemons/ipa-kdb/ipa_kdb_principals.c:1491:9: deref_parm_in_call: Function "ipadb_get_ldap_mod_str" dereferences "principal". /daemons/ipa-kdb/ipa_kdb_principals.c:1174:5: deref_parm_in_call: Function "strdup" dereferences "value" """ This is a part of series of patches related to https://fedorahosted.org/freeipa/ticket/4795 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* always get PAC for client principal if AS_REQ is trueMartin Babinsky2015-01-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | This patch proposes a fix for the following defect reported by covscan in FreeIPA master code: """ Error: DEADCODE (CWE-561): /daemons/ipa-kdb/ipa_kdb_mspac.c:2013: assignment: Assigning: "client_entry" = "NULL". /daemons/ipa-kdb/ipa_kdb_mspac.c:2077: null: At condition "client_entry", the value of "client_entry" must be "NULL". /daemons/ipa-kdb/ipa_kdb_mspac.c:2077: dead_error_condition: The condition "client_entry" cannot be true. /daemons/ipa-kdb/ipa_kdb_mspac.c:2077: dead_error_line: Execution cannot reach the expression "client_entry" inside this statement: "kerr = ipadb_get_pac(contex...". """ This is a part of a series of patches related to https://fedorahosted.org/freeipa/ticket/4795 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: unexpected error code in 'ipa_kdb_audit_as_req' triggers a messageMartin Babinsky2015-01-302-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is related this defect reported by covscan on FreeIPA master: """ Error: DEADCODE (CWE-561): /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != -1765328353L", taking false branch. Now the value of "error_code" is equal to -1765328353. /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != -1765328360L", taking false branch. Now the value of "error_code" is equal to -1765328360. /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != 0", taking false branch. Now the value of "error_code" is equal to 0. /daemons/ipa-kdb/ipa_kdb_audit_as.c:71: intervals: When switching on "error_code", the value of "error_code" must be in one of the following intervals: {[-1765328360,-1765328360], [-1765328353,-1765328353], [0,0]}. /daemons/ipa-kdb/ipa_kdb_audit_as.c:71: dead_error_condition: The switch value "error_code" cannot reach the default case. /daemons/ipa-kdb/ipa_kdb_audit_as.c:123: dead_error_begin: Execution cannot reach this statement: "default:". """ This patch is a part of series related to https://fedorahosted.org/freeipa/ticket/4795. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Avoid calling ldap functions without a contextSimo Sorce2015-01-081-3/+16
| | | | | | | | | | | | | | We need to make sure we have a ld context before we can load the configuration, otherwise ldap APIs will abort crashing the KDC. If we have an issue connecting to LDAP the lcontext will be NULL, but we are not checking that condition when we try to refresh the global configuration. https://fedorahosted.org/freeipa/ticket/4810 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix unchecked return value in ipa-kdbJan Cholasta2014-11-251-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4713 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix possible NULL dereference in ipa-kdbJan Cholasta2014-11-051-3/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4651 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: fix unit testsSumit Bose2014-09-262-1/+4
| | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* Periodically refresh global ipa-kdb configurationNathaniel McCallum2014-06-195-45/+86
| | | | | | | | | | | | | Before this patch, ipa-kdb would load global configuration on startup and never update it. This means that if global configuration is changed, the KDC never receives the new configuration until it is restarted. This patch enables caching of the global configuration with a timeout of 60 seconds. https://fedorahosted.org/freeipa/ticket/4153 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Restore krbCanonicalName handlingNalin Dahyabhai2014-05-301-5/+1
| | | | | | | | | | | When an entry has a krbCanonicalName, if KRB5_KDB_FLAG_ALIAS_OK is set, rewrite the principal name to the canonical value, else error out, instead of always returning an error if the requested name doesn't look like the canonical one. https://fedorahosted.org/freeipa/ticket/3966 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Accept any alias, not just the last valueNalin Dahyabhai2014-05-301-0/+3
| | | | | | | | | If the entry's krbPrincipalName attribute is multi-valued, accept any of the values, not just the last one we happen to examine. https://fedorahosted.org/freeipa/ticket/3966 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* kdb: Don't provide password expiration when using only RADIUSNathaniel McCallum2014-05-221-0/+4
| | | | | | | | | | If the KDC doesn't use the FreeIPA password for authentication, then it is futile to provide this information. Doing so will only confuse the user. It also causes password change dialogues when the password is irrelevant. https://fedorahosted.org/freeipa/ticket/4299 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Avoid passing non-terminated string to is_master_hostMartin Kosek2014-03-111-1/+2
| | | | | | | | | | | When string is not terminated, queries with corrupted base may be sent to LDAP: ... cn=ipa1.example.com<garbage>,cn=masters... https://fedorahosted.org/freeipa/ticket/4214 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: do not fetch client principal if it is the same as existing entryAlexander Bokovoy2014-03-061-6/+13
| | | | | | | | | | | | | | | When client principal is the same as supplied client entry, don't fetch it again. Note that when client principal is not NULL, client entry might be NULL for cross-realm case, so we need to make sure to not dereference NULL pointer here. Also fix reverted condition for case when we didn't find the client principal in the database, preventing a memory leak. https://fedorahosted.org/freeipa/ticket/4223 Reviewed-By: Sumit Bose <sbose@redhat.com>
* fix filtering of subdomain-based trust usersAlexander Bokovoy2014-03-051-9/+32
| | | | | | https://fedorahosted.org/freeipa/ticket/4207 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-kdb: make sure we don't produce MS-PAC in case of authdata flag cleared ↵Alexander Bokovoy2014-02-261-0/+8
| | | | | | | | | | | | by admin When admin clears authdata flag for the service principal, KDC will pass NULL client pointer (service proxy) to the DAL driver. Make sure we bail out correctly. Reviewed-By: Tomáš Babej <tbabej@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-kdb: in case of delegation use original client's database entry, not the ↵Alexander Bokovoy2014-02-261-2/+7
| | | | | | | | | proxy https://fedorahosted.org/freeipa/ticket/4195 Reviewed-By: Tomáš Babej <tbabej@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Add support to ipa-kdb for keyless principalsNathaniel McCallum2014-02-191-0/+18
| | | | | | https://fedorahosted.org/freeipa/ticket/3779 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: validate that an OTP user has tokensNathaniel McCallum2014-02-143-25/+135
| | | | | | | | | | | | This handles the case where a user is configured for OTP in ipaUserAuthType, but the user has not yet created any tokens. Until the user creates tokens, the user should still be able to log in via password. This logic already exists in LDAP, but ipa-kdb needs to perform the same validation to know what data to return to the KDC. https://fedorahosted.org/freeipa/ticket/4154 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-27 09:04:28 +0000