freeipa.git/daemons/ipa-kdb, branch kdc-fixes

TODO: make sure a single krbPrincipalName value gets used for canonicalization too

2015-08-10T21:03:29+00:00

IPA KDB: use empty profile to init krb5 context in tests

2015-08-10T09:39:22+00:00

If the systems /etc/krb5.conf contains some unexpected or broken
configuration the test might fail. With this patch the tests are run
with an empty configuration.

IPA KDB: allow case in-sensitive realm in AS request

2015-08-10T09:39:13+00:00

If the canonicalization flag is set the realm of the client principal in
an AS request (kinit) is transformed into upper-case to match the IPA
convention for realm names.

Resolves https://fedorahosted.org/freeipa/ticket/4844

ipa-kdb: add unit_tests for string_to_sid() and dom_sid_string()

2015-07-07T23:56:52+00:00

Reviewed-By: Tomas Babej

ipa-kdb: make string_to_sid() and dom_sid_string() more robust

2015-07-07T23:56:52+00:00

Reviewed-By: Tomas Babej

ipa-kdb: add unit-test for filter_logon_info()

2015-07-07T23:56:52+00:00

Reviewed-By: Tomas Babej

ipa-kdb: convert test to cmocka

2015-07-07T23:56:52+00:00

Reviewed-By: Tomas Babej

ipa-kdb: filter out group membership from MS-PAC for exact SID matches too

2015-07-07T23:56:52+00:00

When incoming SID blacklist contains exact SIDs of users and groups,
attempt to filter them out as well, according to [MS-PAC] 4.1.1.2.

Note that we treat user's SID and primary group RID filtering as violation
of the KDC policy because the resulting MS-PAC will have no user SID or
primary group and thus will be invalid.

For group RIDs we filter them out. According to [MS-KILE] 3.3.5.6.3.1
it is OK to have empty group RIDs array as GroupCount SHOULD be
equal to Groups.MembershipCount returned by SamrGetGroupsForUser
[MS-SAMR] 3.1.5.9.1, not MUST, thus it may be empty.

Part of fix for https://bugzilla.redhat.com/show_bug.cgi?id=1222475

Reviewed-By: Tomas Babej

ipa-kdb: use proper memory chunk size when moving sids

2015-07-07T23:56:52+00:00

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1222475
Reviewed-By: Tomas Babej

ipa-kdb: common function to get key encodings/salt types

2015-06-29T15:15:00+00:00

This patch moves duplicate code in `ipadb_get_connection` to get default and
supported key encodings/salt types from Kerberos container to a common
function handling this task.

It is actually a small cosmetic enhancement of the fix of
https://fedorahosted.org/freeipa/ticket/4914

Reviewed-By: Martin Basti