summaryrefslogtreecommitdiffstats
path: root/doc/admin/conf_files
Commit message (Collapse)AuthorAgeFilesLines
* Remove indent workaround in man page RST sourcesGreg Hudson2014-07-023-68/+24
| | | | | | | | | | docutils 0.10 properly adds indentation to example blocks in man pages, so we do not need to force an extra indentation level. Get rid of the workaround wherever we use it. ticket: 7954 (new) target_version: 1.12.2 tags: pullup
* Update the kadm5.acl exampleBen Kaduk2014-06-161-16/+18
| | | | | | | | | | | | | | | | | | | | | | Make the example and documentation a closer match to reality. In particular, the list permission is all-or-nothing; it is not restricted in scope by the target_principal field. Change the table entry to try and indicate this fact, and do not put list permissions on any example line that is scoped by a target_principal pattern. While here, remove the nonsensical granting of global inquire permissions to */* (inaccurately described as "all principals"), and the granting of privileges to foreign-realm principals. It is not possible to obtain an initial ticket (as required by the kadmin service) for a principal in a different realm, and the current kadmind implementation can serve only a single realm at a time -- this permission literally has no effect. Replace it with a (presumably automated) "Service Management System" example, where it might make sense to limit the principals which are automatically created. ticket: 7939
* Remove pkinit_win2k_require_binding optionGreg Hudson2014-06-131-5/+0
| | | | | | | | | | | | When constructing a draft9 PKINIT request, always include KRB5_PADATA_AS_CHECKSUM padata to ask for an RFC 4556 ReplyKeyPack. Do not accept a draft9 ReplyKeyPack in the KDC response. For now, retain the krb5_reply_key_pack_draft9 ASN.1 codec and the KDC support for generating a draft9 ReplyKeyPack when a draft9 PKINIT request does not contain KRB5_PADATA_AS_CHECKSUM. ticket: 7933
* Remove PKINIT longhorn compatibility optionGreg Hudson2014-06-121-3/+0
| | | | | | | | Remove the PKINIT Windows Server 2008 beta compatibility code conditionalized under the "longhorn" variable. It is not required to interoperate with any released version of Windows. ticket: 7934 (new)
* Improve PKINIT certificate documentationGreg Hudson2014-06-121-1/+2
| | | | | | | | | | | | | | Describe how to use a commercially-issued server certificate for anonymous PKINIT. Separate the KDC and client configuration instructions so that the steps necessary for anonymous PKINIT are not combined with the additional steps necessary for regular PKINIT. Describe kpServerAuth as the EKU used in commercially issued server certificates, not as the value used by Microsoft (which does not appear to be true according to [MS-PKCA]). ticket: 7931 (new) target_version: 1.12.2 tags: pullup
* Do not document pkinit_win2kGreg Hudson2014-06-111-5/+0
| | | | | | | | | This variable was never used in the PKINIT code as it was contributed; there was only code to read its value. ticket: 7932 (new) target_version: 1.12.2 tags: pullup
* Do not document pkinit_mapping_fileGreg Hudson2014-06-031-4/+0
| | | | | | | | | This feature was never implemented in the PKINIT code as it was contributed; there was only stub support for reading the filename. ticket: 7928 (new) target_version: 1.12.2 tags: pullup
* Load custom anchors when using KKDCPNalin Dahyabhai2014-06-021-0/+26
| | | | | | | | Add an http_anchors per-realm setting which we'll apply when using an HTTPS proxy, more or less mimicking the syntax of its similarly-named PKINIT counterpart. We only check the [realms] section, though. ticket: 7929
* Correct documentation of 'x' in kadm5.aclBen Kaduk2014-05-291-1/+1
| | | | | It really is all privileges, including setting keys and disallowing the propagation of the principal database.
* Update sample configs to include master_kdcGreg Hudson2014-04-151-4/+0
| | | | | | | | | | | | Where we have ATHENA.MIT.EDU stanzas in sample or test krb5.conf files which define kdc entries, also define a master_kdc entry. Remove default_domain and v4_instance_convert entries in examples as they are only needed for krb5/krb4 principal conversions. In the krb5_conf.rst example, remove enctype specifications as we don't want to encourage their use when they aren't necessary, and remove a redundant domain_realm entry. ticket: 7901 (new)
* Update iprop_master_ulogsize documentationGreg Hudson2014-03-131-2/+2
| | | | | | | | | | When we removed the maximum number of ulog entries (#7368), we did not update the documentation for that parameter in kdc.conf. Reported by Richard Basch. ticket: 7849 target_version: 1.12.2 tags: pullup
* Better keysalt docsTom Yu2013-12-092-18/+39
| | | | | | | | | | Add a new section to kdc_conf.rst to describe keysalt lists, and update other documentation to better distinguish enctype lists from keysalt lists. ticket: 7608 target_version: 1.12 tags: pullup
* Correct kadm5.acl back-reference documentationGreg Hudson2013-11-211-3/+4
| | | | | | | | | In kadm5.acl, *N in the target principal name refers to the Nth wildcard in the acting principal pattern, not the Nth component. ticket: 7774 (new) target_version: 1.12 tags: pullup
* Clarify realm and dbmodules configuration docsGreg Hudson2013-11-061-23/+34
| | | | | | | | | | | | | In kdc_conf.rst, add examples showing how to configure a realm parameter and a database parameter. Document that the default DB configuration section is the realm name, and use that in the example. Move the db_module_dir description to the end of the [dbmodules] documentation since it is rarely used and could confuse a reader about the usual structure of the section. ticket: 7759 (new) target_version: 1.12 tags: pullup
* Add a flag to prevent all host canonicalizationGreg Hudson2013-09-061-1/+9
| | | | | | | | If dns_canonicalize_hostname is set to false in [libdefaults], krb5_sname_to_principal will not canonicalize the hostname using either forward or reverse lookups. ticket: 7703 (new)
* Omit signedpath if no_auth_data_required is setGreg Hudson2013-08-201-2/+2
| | | | | | | | | | The no_auth_data_required bit was introduced to suppress PACs in service tickets when the back end supports them. Make it also suppress AD-SIGNEDPATH, so that the ~70-byte expansion of the ticket can be avoided for services which aren't going to do constrained delegation. ticket: 7697 (new)
* Document hostrealm interfaceGreg Hudson2013-08-151-0/+26
| | | | ticket: 7687
* Remove redundant domain_realm mappingsBen Kaduk2013-08-121-7/+11
| | | | | | | | | | | | | | | | | | | This fixes a long-standing documentation bug where we claimed that a domain_realm mapping for a host name would not affect entries under that domain name. The code has always had the behavior where a host name mapping implies the corresponding domain name mapping, since the 1.0 release. While here, replace media-lab with csail in example files, as the media lab realm is no longer in use. Also strip port 88 from KDC specifications, and drop the harmful default_{tgs,tkt}_enctypes lines from src/util/profile/krb5.conf. Further cleanup on these files to remove defunct realms may be in order. ticket: 7690 (new) tags: pullup target_version: 1.11.4
* Add server-side otp preauth pluginNathaniel McCallum2013-07-111-0/+66
| | | | | | | | | | This plugin implements the proposal for providing OTP support by proxying requests to RADIUS. Details can be found inside the provided documentation as well as on the project page. http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS ticket: 7678
* Document dict_file formatGreg Hudson2013-07-011-3/+4
| | | | | Briefly describe the format of the kadmin dictionary file in kdc_conf.rst.
* Rely on module ordering for localauthGreg Hudson2013-06-271-15/+15
| | | | | | | Register built-in localauth modules in the order we want them used by default, and document accordingly. ticket: 7665
* Provide plugin module ordering guaranteesGreg Hudson2013-06-271-0/+6
| | | | | | | | Rewrite the plugin internals so that modules have a well-defined order--either the order of enable_only tags, or dynamic modules followed by the built-in modules in order of registration. ticket: 7665 (new)
* Clean up dangling antecedent in allow_weak_cryptoBen Kaduk2013-05-311-6/+6
| | | | | | | | | | The "previous three lists" are not previous any more. Say explicitly which three lists, and make the parenthetical bind to the correct noun. ticket: 7655 (new) tags: pullup target_version: 1.11.4
* Clarify that kdc.conf and krb5.conf are mergedBen Kaduk2013-05-202-1/+14
| | | | These two files are merged into the profile for KDC applications
* Replace "First introduced" with concise "New"Zhanna Tsitkov2013-03-252-8/+7
|
* Document localauth interfaceGreg Hudson2013-03-091-0/+35
| | | | ticket: 7583
* Document "first introduced version" in conf filesZhanna Tsitkov2013-01-072-6/+10
| | | | | For the config options that were introduced starting from release 1.9, specify the release number.
* Clarify enctype settings in krb5_conf.rstTom Yu2012-12-171-5/+15
| | | | | | | | | Clarify the krb5.conf settings default_tkt_enctypes and default_tgs_enctypes in krb5_conf.rst. ticket: 7513 (new) target_version: 1.11 tags: pullup
* Reformat RST to avoid sphinx warningsBen Kaduk2012-12-103-3/+10
| | | | | | | | | | | | | | | | | | | | | | | Old versions of docutils will see inline markup (e.g., :ref:`foo`) at the beginning of a line in the content of a directive block and attempt to interpret that markup as options or arguments to the directive. RST intended as inline markup (as opposed to modifying the behavior of the directive) will not be interpretable in this context, and causes Sphinx to emit a warning. Work around this behavior by always leaving a blank line before the content of a directive block, forcing it to be interpreted as content and not options or arguments. The buggy behavior was only encountered in note environments, but for consistency of style, also reformat warning and error blocks. Note the new style constraint in doc/README. ticket: 7469 (new) title: doc buildslave generates sphinx warnings tags: pullup target_version: 1.11
* Document param expansion for keytab/ccache namesZhanna Tsitkov2012-11-291-2/+3
| | | | | | | | | | The DEFCCNAME, DEFCKTNAME and DEFKTNAME configuration options are subjects to parameter expansion. Also note that this feature was first introduced in release 1.11. ticket: 7472 tags: pullup target_version: 1.11
* Rename doc subdirectoriesBen Kaduk2012-11-144-0/+1915
We like these names better, and they match the PDF document filenames. admins -> admin appldev -> appdev users -> user and catch up where the names are used elsewhere. The relay/ directory has been removed, with its contents moved to the top level in build_this.rst and a new about.rst. The section headers for kadmind, krb5kdc, sserver, kpasswd, kswitch, and sclient are misdetected as conflict markers. bigredbutton: whitespace ticket: 7433 tags: pullup
generated by cgit (git 2.34.1) at 2025-10-01 16:55:18 +0000