From 8ff1f50b0c47f7ff92d557ef4caf64a44b387ab4 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Tue, 28 Jul 2009 14:05:19 +1000 Subject: s4:kerberos Add support for user principal names in certificates This extends the PKINIT code in Heimdal to ask the HDB layer if the User Principal Name name in the certificate is an alias (perhaps just by case change) of the name given in the AS-REQ. (This was a TODO in the Heimdal KDC) The testsuite is extended to test this behaviour, and the other PKINIT certficate (using the standard method to specify a principal name in a certificate) is updated to use a Administrator (not administrator). (This fixes the kinit test). Andrew Bartlett --- selftest/target/Samba4.pm | 42 +++++++++++++++++++++++++++++++++++------- 1 file changed, 35 insertions(+), 7 deletions(-) (limited to 'selftest') diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm index 7833bf4479..d2c11e4f32 100644 --- a/selftest/target/Samba4.pm +++ b/selftest/target/Samba4.pm @@ -295,6 +295,7 @@ sub mk_keyblobs($$) my $adminkeyfile = "$tlsdir/adminkey.pem"; my $reqadmin = "$tlsdir/req-admin.der"; my $admincertfile = "$tlsdir/admincert.pem"; + my $admincertupnfile = "$tlsdir/admincertupn.pem"; mkdir($tlsdir, 0777); @@ -442,24 +443,51 @@ EOF open(ADMINCERTFILE, ">$admincertfile"); print ADMINCERTFILE <$admincertupnfile"); + print ADMINCERTUPNFILE <