summaryrefslogtreecommitdiffstats
path: root/util/ipa_krb5.c
Commit message (Collapse)AuthorAgeFilesLines
* Add compatibility function for older libkrb5Simo Sorce2015-05-301-1/+60
| | | | | | | | | | | | | | Before krb5 1.13 the krb5_salttype_to_string() function was returning incorrect names (display names of some kind instead of the names used by the rest of the library to map saltname to the salt type integer number). This patch adds a function that checks at runtime if we have a working function and uses a fallback map updated to the salt types known up to 1.12, this allows us to use the library provided function in following releases where new salt types may emerge. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Milan Kubik <mkubik@redhat.com>
* Detect default encsalts kadmin password changeSimo Sorce2015-05-271-0/+85
| | | | | | | | | | | | | | | | | | | When kadmin tries to change a password it will get the allowed keysalts from the password policy. Failure to provide them will result in kadmin using the defaults specified in the kdc.conf file or hardcoded defaults (the default salt is then of type NORMAL). This patch provides the supported values that have been read out of the appropriate LDAP attribute when we read the server configuration. Then at actual password change, check if kadmin is handing us back the exact list of supported encsalts we sent it, and in that case replace it with the real default encsalts. Fixes https://fedorahosted.org/freeipa/ticket/4914 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Martin Babinsky <mbabinsk@redhat.com>
* Fix unchecked return value in krb5 common utilsJan Cholasta2014-11-251-0/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4713 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-getkeytab: Add support for get_keytab extopSimo Sorce2014-06-261-55/+75
| | | | | | | | | | | | This new extended operation is tried by default and then the code falls back to the old method if it fails. The new method allows for server side password generation as well as retrieval of existing credentials w/o causing regeneration of keys on the server. Resolves: https://fedorahosted.org/freeipa/ticket/3859 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* keytabs: Expose and modify key encoding functionSimo Sorce2014-06-261-3/+9
| | | | | | | | | | | Make it available outside of the encoding.c file for use in a follow-up patch. Add option to not pass a password and generate a random key instead. Related: https://fedorahosted.org/freeipa/ticket/3859 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Add support to ipa-kdb for keyless principalsNathaniel McCallum2014-02-191-0/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/3779 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Move code into common krb5 utilsSimo Sorce2012-07-301-0/+150
| | | | | | | | This moves the decoding function that reads the keys from the ber format into a structure in the common krb5 util code right below the function that encodes the same data structure into a ber format. This way the 2 functions are in the same place and can be both used by all ia components.
* Move some krb5 keys related functions from ipa-client to utilSumit Bose2012-06-111-0/+362
|
* Add missing copyright headerSimo Sorce2011-11-171-0/+22
|
* Amend #2038 fixSimo Sorce2011-11-051-3/+5
| | | | The math was unsafe, thanks to Nalin for spotting it.
* Modify random salt creation for interoperabilitySimo Sorce2011-11-041-8/+29
| | | | | See: https://fedorahosted.org/freeipa/ticket/2038
* ipa-kdb: implement change_pwd functionSimo Sorce2011-08-261-0/+33
|
* ipa-pwd-extop: make encsalt parsing function commonSimo Sorce2011-08-261-0/+73
| | | | It is going to be used by the ipa-kdb module too.
* ipa-pwd-extop: Move encoding in common tooSimo Sorce2011-08-261-0/+120
| | | | Also to be used by ipa-kdb
* ipa-pwd-extop: Move encryption of keys in commonSimo Sorce2011-08-261-2/+219
| | | | This way we can reuse the same code from ipa-kdb later
* Use internal implementation of internal Kerberos functionsJakub Hrozek2010-11-221-0/+44
Don't use KRB5_PRIVATE. The patch implements and uses the following krb5 functions that are otherwise private in recent MIT Kerberos releases: * krb5_principal2salt_norealm * krb5_free_ktypes Signed-off-by: Simo Sorce <ssorce@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-25 01:10:27 +0000