r11543: A major upgrade to our KDC and PAC handling.

We now put the PAC in the AS-REP, so that the client has it in the
TGT.  We then validate it (and re-sign it) on a TGS-REQ, ie when the
client wants a ticket.

This should also allow us to interop with windows KDCs.

If we get an invalid PAC at the TGS stage, we just drop it.

I'm slowly trying to move the application logic out of hdb-ldb.c, and
back in with the rest of Samba's auth system, for consistancy.  This
continues that trend.

Andrew Bartlett
(This used to be commit 36973b1eef7db5983cce76ba241e54d5f925c69c)

1 files changed, 45 insertions, 7 deletions

diff --git a/source4/kdc/pac-glue.h b/source4/kdc/pac-glue.h
index 69490bb7f3..953ddae815 100644
--- a/source4/kdc/pac-glue.h
+++ b/source4/kdc/pac-glue.h
@@ -1,8 +1,46 @@
+/* 
+   Unix SMB/CIFS implementation.
 
- krb5_error_code samba_get_pac(krb5_context context, 
-			       struct krb5_kdc_configuration *config,
-			       krb5_principal client, 
-			       krb5_keyblock *krbtgt_keyblock, 
-			       krb5_keyblock *server_keyblock, 
-			       time_t tgs_authtime,
-			       krb5_data *pac);
+   PAC Glue between Samba and the KDC
+   
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+ struct hdb_ldb_private {
+	struct ldb_context *samdb;
+	struct ldb_message *msg;
+	struct ldb_message *realm_ref_msg;
+ };
+
+ krb5_error_code hdb_ldb_authz_data_as_req(krb5_context context, struct hdb_entry_ex *entry_ex, 
+					   METHOD_DATA* pa_data_seq,
+					   time_t authtime,
+					   EncryptionKey *tgtkey,
+					   EncryptionKey *sessionkey,
+					   AuthorizationData **out);
+
+ krb5_error_code hdb_ldb_authz_data_tgs_req(krb5_context context, struct hdb_entry_ex *entry_ex, 
+					    krb5_principal client, 
+					    AuthorizationData *in, 
+					    time_t authtime,
+					    EncryptionKey *tgtkey,
+					    EncryptionKey *servicekey,
+					    EncryptionKey *sessionkey,
+					    AuthorizationData **out);
+ krb5_error_code hdb_ldb_check_client_access(krb5_context context, hdb_entry_ex *entry_ex, 
+					     HostAddresses *addresses);