freeipa.git/daemons, branch ipasam_getkeytab

Convert ipa-sam to use the new getkeytab control

2015-12-03T13:19:14+00:00

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5495

Improve keytab code to select the right principal.

2015-12-02T22:48:47+00:00

Whe requesting a keytab the salt used is the NORMAL type (for backwards and AD
compatibility), however since we added alias support we need to search for the
krbCanonicalName in preference, hen nothing is specified, and for the requested
principal name when a getkeytab operation is performed. This is so that the
correct salt can be applied. (Windows AD uses some peculiar aliases for some
special accounts to generate the salt).

Signed-off-by: Simo Sorce

Allow to specify Kerberos authz data type per user

2015-12-02T21:14:03+00:00

Like for services setting the ipaKrbAuthzData attribute on a user object will
allow us to control exactly what authz data is allowed for that user.
Setting NONE would allow no authz data, while setting MS-PAC would allow only
Active Directory compatible data.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/2579

Allow admins to disable preauth for SPNs.

2015-12-02T21:14:03+00:00

Some legacy softare is not able to properly cope with preauthentication,
allow the admins to disable the requirement to use preauthentication for
all Service Principal Names if they so desire. IPA Users are excluded,
for users, which use password of lessere entrpy, preauthentication is
always required by default.

This setting does NOT override explicit policies set on service principals
or in the global policy, it only affects the default.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/3860

Disable User's ability to use the setkeytab exop.

2015-12-02T21:14:03+00:00

Users can still obtain a keytab for themselves using the getkeytab exop
which does not circumvent password policy checks.

Users are disallowed from using setkeytab by default in new installations
but not in existing installations (no forced upgrade).

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5485

Introduce option to disable the SetKeytab exop

2015-12-02T21:14:03+00:00

If DisableSetKeytab is set in ipaConfig options then setkeytab will not be
available. The default is still to allow this operation for backwards
compatibility towards older clients that do not know how to use the new
GetKeytab extended operation.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5485

Use only AES enctypes by default

2015-12-02T21:14:03+00:00

Remove des3 and arcfour from the defaults for new installs.

NOTE: the ipasam/dcerpc code sill uses arcfour

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/4740

FIX: ipa_kdb_principals: add missing break statement

2015-11-30T16:34:02+00:00

Needs a 'break' otherwise prevents correct reporting of data and it always overrides
it with the placeholder data.

Reviewed-By: Simo Sorce

Return default TL_DATA is krbExtraData is missing

2015-11-25T13:12:11+00:00

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/937
Reviewed-By: Martin Babinsky

ipasam: fix a use-after-free issue

2015-11-23T13:45:54+00:00

Since endptr points to a location inside of dummy, dummy should be freed
only after dereferencing endptr.

Reviewed-By: Alexander Bokovoy