summaryrefslogtreecommitdiff
path: root/src/util/sss_krb5.h
AgeCommit message (Collapse)AuthorFilesLines
2012-07-06Revert commit 4c157ecedd52602f75574605ef48d0c48e9bfbe8Stef Walter1-8/+0
* This broke corner cases when used with default_tkt_types = des-cbc-crc and DES enabled on an AD domain. * This is fixed in kerberos instead, in a more correct way and in a way which we cannot replicate.
2012-06-18Fix typo breaking DIR cache detectionStephen Gallagher1-2/+0
2012-06-15KRB5: Auto-detect DIR cache support in configureStephen Gallagher1-0/+8
We can't support the DIR cache features in systems with kerberos libraries older than 1.10. Make sure we don't build it on those systems.
2012-06-14Use Kerberos context in KRB5_DEBUGJakub Hrozek1-0/+8
Passing Kerberos context to sss_krb5_get_error_message will allow us to get better error messages.
2012-06-14Add support for storing credential caches in the DIR: back endJakub Hrozek1-1/+2
https://fedorahosted.org/sssd/ticket/974
2012-06-14Residual util functionsJakub Hrozek1-0/+16
Kerberos credential caches can be specified by TYPE:RESIDUAL. This patch adds a couple of utilities to support parsing if ccache locations, checking types etc.
2012-05-07Limit krb5_get_init_creds_keytab() to etypes in keytabStef Walter1-0/+8
* Load the enctypes for the keys in the keytab and pass them to krb5_get_init_creds_keytab(). * This fixes the problem where the server offers a enctype that krb5 supports, but we don't have a key for in the keytab. https://bugzilla.redhat.com/show_bug.cgi?id=811375
2012-05-04Modify behavior of pam_pwd_expiration_warningJan Zeleny1-0/+5
New option pwd_expiration_warning is introduced which can be set per domain and can override the value specified by the original pam_pwd_expiration_warning. If the value of expiration warning is set to zero, the filter isn't apllied at all - if backend server returns the warning, it will be automatically displayed. Default value for Kerberos: 7 days Default value for LDAP: don't apply the filter Technical note: default value when creating the domain is -1. This is important so we can distinguish between "no value set" and 0. Without this possibility it would be impossible to set different values for LDAP and Kerberos provider.
2012-04-05Clean up log messages about keytab_nameStephen Gallagher1-0/+2
There were many places where we were printing (null) to the logs because a NULL keytab name tells libkrb5 to use its configured default instead of a particular path. This patch should clean up all uses of this to print "default" in the logs. https://fedorahosted.org/sssd/ticket/1288
2011-12-22Add compatibility layer for Heimdal Kerberos implementationStephen Gallagher1-0/+15
2011-11-02Add wrapper for krb5_get_init_creds_opt_set_canonicalizeJan Zeleny1-0/+3
2011-05-05Added some kerberos functions for building on RHEL5Jan Zeleny1-0/+10
2011-04-25Modify principal selection for keytab authenticationJan Zeleny1-0/+8
Currently we construct the principal as host/fqdn@REALM. The problem with this is that this principal doesn't have to be in the keytab. In that case the provider fails to start. It is better to scan the keytab and find the most suitable principal to use. Only in case no suitable principal is found the backend should fail to start. The second issue solved by this patch is that the realm we are authenticating the machine to can be in general different from the realm our users are part of (in case of cross Kerberos trust). The patch adds new configuration option SDAP_SASL_REALM. https://fedorahosted.org/sssd/ticket/781
2011-04-25Extend and move function for finding principal in keytabJan Zeleny1-0/+6
The function now supports finding principal in keytab not only based on realm, but based on both realm and primary/instance parts. The function also supports * wildcard at the beginning or at the end of primary principal part. The function for finding principal has been moved to util/sss_krb5.c, so it can be used in other parts of the code.
2010-12-08Fix build issue with older Kerberos librarySumit Bose1-0/+7
2010-12-07Add support for FAST in krb5 providerSumit Bose1-0/+14
2010-09-23Use new MIT krb5 API for better password expiration warningsSumit Bose1-1/+12
2010-08-03Validate keytab at startupJakub Hrozek1-0/+9
In addition to validating the keytab everytime a TGT is requested, we also validate the keytab on back end startup to give early warning that the keytab is not usable. Fixes: #556
2010-02-18Rename server/ directory to src/Stephen Gallagher1-0/+50
Also update BUILD.txt
generated by cgit (git 2.34.1) at 2024-11-16 18:56:20 +0000