| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
the other
ideas I have had.
When I get a full list of things I want to do to a krb5_context I'll
either add gsskrb5_ wrappers, or a way of speicfying the krb5 context
per gssapi context.
(I want to ensure that the only krb5_context variables created while
executing Samba4 are via our wrapper).
Andrew Bartlett
(This used to be commit 8a22d46e70e9f863831aba0c9913d195f833d625)
|
|
ignore Kerberos and fallback to NTLMSSP when joining. Thanks to Andrew Bartlett
for the assistence.
(This used to be commit 3b6bfbe8cf555f4144ed06044d3ecb8044f86bca)
|
|
(This used to be commit 5767c05909c9927b3a806614b1f1bd2f90a35dd3)
|
|
data to be signed/sealed. We can use this to split the data from the
signature portion of the resultant wrapped packet.
This required merging the gsskrb5_wrap_size patch from
lorikeet-heimdal, and fixes AES encrption issues on DCE/RPC (we no
longer use a static 45 byte value).
This fixes one of the krb5 issues in my list.
Andrew Bartlett
(This used to be commit e4f2afc34362953f56a026b66ae1aea81e9db104)
|
|
Andrew Bartlett
(This used to be commit b9695d5e7cc052a952d8d60bc1ab08e00f4827e8)
|
|
Andrew Bartlett
(This used to be commit c17926b6fe278fd757862885f82fd342b755167c)
|
|
with an aim to make the code simpiler and more correct.
Gone is the old (since the very early Samba 3.0 krb5 days) 'iterate over
all keytypes)' code in gensec_krb5, we now follow the approach used in
gensec_gssapi, and use a keytab.
I have also done a lot of work in the GSSAPI code, to try and reduce
the diff between us and upstream heimdal. It was becoming hard to
track patches in this code, and I also want this patch (the DCE_STYLE
support) to be in a 'manageable' state for when lha considers it for
merging. (metze assures me it still has memory leak problems, but
I've started to address some of that).
This patch also includes a simple update of other code to current
heimdal, as well as changes we need for better PAC verification.
On the PAC side of things we now match windows member servers by
checking the name and authtime on an incoming PAC. Not generating these
right was the cause of the PAC pain, and so now both the main code and
torture test validate this behaviour.
One thing doesn't work with this patch:
- the sealing of RPC pipes with kerberos, Samba -> Samba seems
broken. I'm pretty sure this is related to AES, and the need to break
apart the gss_wrap interface.
Andrew Bartlett
(This used to be commit a3aba57c00a9c5318f4706db55d03f64e8bea60c)
|
|
'MEMORY_WILDCARD' keytab type. (part of this checking is in effect a
merge from lorikeet-heimdal, where I removed this)
This is achieved by correctly using the GSSAPI gsskrb5_acquire_cred()
function, as this allows us to specify the target principal, regardless
of which alias the client may use.
This patch also tries to simplify some principal handling and fixes some
error cases.
Posted to samba-technical, reviewed by metze, and looked over by lha on IRC.
Andrew Bartlett
(This used to be commit 506a7b67aee949b102d8bf0d6ee9cd12def10d00)
|
|
lorikeet-heimdal
to Samba4.
Andrew Bartlett
(This used to be commit 6835e427907bf52f7fdd332b726ffa47041853de)
|
|
Merge these norealm functions from lorikeet-heimdal.
Andrew Bartlett
(This used to be commit 6aef275efd7f434f65824eb3dd129c8e5efd8731)
|
|
Andrew Bartlett
(This used to be commit 53f2bf3b9178b78527bb43b9dca7b43e1497dd20)
|
|
To enable, set:
[libdefaults]
dns_lookup_realm = true
dns_lookup_kdc = true
in your /etc/krb5.conf.
In the future I may override the krb5.conf and set this on by default
in Samba4.
Andrew Bartlett
(This used to be commit 32fb50d02560123b8d0ab13346041806c062f9bf)
|
|
Andrew Bartlett
(This used to be commit cc35cd5ee2abbd6be01dc1ea66eca0bd48a6f636)
|
|
to Heimdal CVS as of 2005-08-27).
Andrew Bartlett
(This used to be commit 913924a4997f5e14c503f87510cbd8e4bfd965a9)
|
|
saga was
that the logon_time field in the pac must match the authtime field in the ticket we
gave the client in the AS-REP (and thus also the authtime field in the ticket we get
back in the TGS-REQ).
Many thanks to Andrew Bartlett for his patience in showing me the
basic ropes of all this code! This was a joint effort.
(This used to be commit 7bee374b3ffcdb0424a83f909fe5ad504ea3882e)
|
|
Delete test_crypto_wrapping.c, previously included but unbuilt.
Andrew Bartlett
(This used to be commit d5fb30fb0cef330e0947969f0c9afc1f58fc4c7d)
|
|
correctly.
This fixes the build on Fedora Core 4.
Andrew Bartlett
(This used to be commit aa36b2adad0d66b8171aa3ccca3057298361bec5)
|
|
This is my first attempt at this, so there may be a few rough edges.
Andrew Bartlett
(This used to be commit 9a1d2f2fec67930975da856a2d365345cec46216)
|
|
metze
(This used to be commit 60e2d58685ee50f90d6ad2ce2609a3c0b433ae10)
|
|
metze
(This used to be commit 1008459a98a8232f039b87c91443d653858e0500)
|
|
this should fix the build on solaris 10
lha can that be merged to the main heimdal if that apears to not break
the build on other platforms
metze
(This used to be commit cb0259627976c10906016233fb27a1d05ae7e4b0)
|
|
(This used to be commit 903d963ca8fdefa23eaa77b5117d90b6b84866ab)
|
|
(This used to be commit 87f7098ee3a24be202b6aaa1ab2a4e44b7b89975)
|
|
(This used to be commit 59c3de6ca8b8e153e5cfd67da5f2afc2e23d36db)
|
|
that uses the Samba
interfaces list. This makes heimdal obey the 'interfaces=' smb.conf option, and should also
fix the portability problems with the heimdal code
(This used to be commit ba621d1c554e135f449a144019b84719a086e04f)
|
|
fashion to yapp for pidl
if they are installed, then we rebuild the generated files, otherwise
we use the ones in svn
(This used to be commit 6ab503b7cc902b8691dc80907bb44f1f705ab8ee)
|
|
(This used to be commit 118be28a7aef233799956615a99d1a2a74dac175)
|
