sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Code
f92def2f94
samba-mirror/source4/kdc/kdc-glue.h

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

64 lines
2.0 KiB
C
Raw Normal View History

s4:cleanups More trailing spaces and tabs
2009-12-23 23:17:16 +03:00
/*
r7221: Add the start of a KDC service (to be built on a 'libkdc' from a to be included Heimdal) to Samba4. Andrew Bartlett (This used to be commit 51ba3ea60c265b837821b6c3e031dfe229c10d6a)
2005-06-03 15:23:15 +04:00
Unix SMB/CIFS implementation.
KDC structures
Copyright (C) Andrew Tridgell 2005
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
s4:cleanups More trailing spaces and tabs
2009-12-23 23:17:16 +03:00
r7221: Add the start of a KDC service (to be built on a 'libkdc' from a to be included Heimdal) to Samba4. Andrew Bartlett (This used to be commit 51ba3ea60c265b837821b6c3e031dfe229c10d6a)
2005-06-03 15:23:15 +04:00
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
r23792: convert Samba4 to GPLv3 There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-07-10 06:07:03 +04:00
the Free Software Foundation; either version 3 of the License, or
r7221: Add the start of a KDC service (to be built on a 'libkdc' from a to be included Heimdal) to Samba4. Andrew Bartlett (This used to be commit 51ba3ea60c265b837821b6c3e031dfe229c10d6a)
2005-06-03 15:23:15 +04:00
(at your option) any later version.
s4:cleanups More trailing spaces and tabs
2009-12-23 23:17:16 +03:00
r7221: Add the start of a KDC service (to be built on a 'libkdc' from a to be included Heimdal) to Samba4. Andrew Bartlett (This used to be commit 51ba3ea60c265b837821b6c3e031dfe229c10d6a)
2005-06-03 15:23:15 +04:00
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
s4:cleanups More trailing spaces and tabs
2009-12-23 23:17:16 +03:00
r7221: Add the start of a KDC service (to be built on a 'libkdc' from a to be included Heimdal) to Samba4. Andrew Bartlett (This used to be commit 51ba3ea60c265b837821b6c3e031dfe229c10d6a)
2005-06-03 15:23:15 +04:00
You should have received a copy of the GNU General Public License
r23792: convert Samba4 to GPLv3 There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-07-10 06:07:03 +04:00
along with this program. If not, see <http://www.gnu.org/licenses/>.
r7221: Add the start of a KDC service (to be built on a 'libkdc' from a to be included Heimdal) to Samba4. Andrew Bartlett (This used to be commit 51ba3ea60c265b837821b6c3e031dfe229c10d6a)
2005-06-03 15:23:15 +04:00
*/
s4-kdc: added ifdef guards in kdc.h this prevents too much recursion in the compiler preprocessor
2010-09-28 08:03:14 +04:00
#ifndef _KDC_KDC_H
#define _KDC_KDC_H
r7221: Add the start of a KDC service (to be built on a 'libkdc' from a to be included Heimdal) to Samba4. Andrew Bartlett (This used to be commit 51ba3ea60c265b837821b6c3e031dfe229c10d6a)
2005-06-03 15:23:15 +04:00
#include "system/kerberos.h"
r7241: The KDC almost links... Using current lorikeet/heimdal, and with the KDC module enabled (it is disabled by default), I almost get the KDC to link. (To enable the KDC for testing, comment out the only line in smbd/config.m4, and add 'kdc' to the 'server services' line in smb.conf). (This used to be commit 26cd4b4f68a370390e08263067402c6c70e49ec8)
2005-06-03 18:32:10 +04:00
#include "auth/kerberos/kerberos.h"
kdc: use mostly only public kerberos headers We shoule avoid using the private heimdal function _krb5_principalname2krb5_principal() metze (This used to be commit 10db07c69addce6e90851fb55738d5f9e142946b)
2008-08-01 19:24:24 +04:00
#include <hdb.h>
s4:kdc: Fix build failure by including <heimbase.h> NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-12-24 06:57:42 +03:00
#include <heimbase.h>
s4:kdc Allow a password change when the password is expired This requires a rework on Heimdal's windc plugin layer, as we want full control over what tickets Heimdal will issue. (In particular, in case our requirements become more complex in future). The original problem was that Heimdal's check would permit the ticket, but Samba would then deny it, not knowing it was for kadmin/changepw Also (in hdb-samba4) be a bit more careful on what entries we will make the 'change_pw' service mark that this depends on. Andrew Bartlett
2009-06-18 05:08:46 +04:00
#include <kdc.h>
s4:kdc: Rename windc to kdc plugin This is an adaptation to Heimdal: commit fcff5933ade652343d7c169659da92fac0e6e0d4 Author: Luke Howard <lukeh@padl.com> Date: Mon Jan 3 11:10:18 2022 +1100 kdc: rename windc to kdc plugin Rename the "windc" plugin API to the more general "kdc" plugin API, for two reasons: the Heimdal KDC uses the Windows PAC even when not emulating a domain controller, and the plugin API has accreted methods that are not specific to emulating a domain controller (such as referral_policy and finalize_reply). NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-02-22 04:39:13 +03:00
#include <krb5/kdc-plugin.h>
s4:kdc move db functions in their own file Keep all heimdal related plugin code within hdb_samba4.c Move interfaces needed by multiple plugins in db-glue.c Move sequence context in main db context so that we do not depend on db->hdb_dbc in the common code. Remove unnecessary paremeters from function prototypes
2010-01-28 09:27:11 +03:00
#include "kdc/samba_kdc.h"
s4-kdc: Move definitions to kdc-server.h Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-06-10 12:10:50 +03:00
#include "kdc/kdc-server.h"
r7221: Add the start of a KDC service (to be built on a 'libkdc' from a to be included Heimdal) to Samba4. Andrew Bartlett (This used to be commit 51ba3ea60c265b837821b6c3e031dfe229c10d6a)
2005-06-03 15:23:15 +04:00
s4:kdc Simplify header files
2010-01-21 17:57:41 +03:00
/* from hdb-samba4.c */
s4:kdc Use better db context structure This allows to use a common structure not tied to hdb_samba4 Also allows to avoid many casts within hdb_samba4 functions This is the first step to abstract samba kdc databse functions so they can be used by the MIT forthcoming plugin.
2010-01-28 08:08:36 +03:00
NTSTATUS hdb_samba4_create_kdc(struct samba_kdc_base_context *base_ctx,
kdc: Remove confusing duplicate open of sam.ldb to find RODC status Instead, make this query after we open the DB in common with the MIT code. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-05-30 02:40:16 +03:00
krb5_context context, struct HDB **db,
struct samba_kdc_db_context **kdc_db_ctx);
s4-kdc: added ifdef guards in kdc.h this prevents too much recursion in the compiler preprocessor
2010-09-28 08:03:14 +04:00
CVE-2022-32744 s4:kdc: Modify HDB plugin to only look up kpasswd principal This plugin is now only used by the kpasswd service. Thus, ensuring we only look up the kadmin/changepw principal means we can't be fooled into accepting tickets for other service principals. We make sure not to specify a specific kvno, to ensure that we do not accept RODC-issued tickets. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-05-26 07:39:20 +03:00
NTSTATUS hdb_samba4_kpasswd_create_kdc(struct samba_kdc_base_context *base_ctx,
krb5_context context, struct HDB **db);
s4:kdc: Add function to attach an NTSTATUS code to a Kerberos request structure Our KDC plugin can use this to store NTSTATUS codes that can be added to the final KDC reply later. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-01 05:35:56 +03:00
krb5_error_code hdb_samba4_set_ntstatus(astgs_request_t r,
NTSTATUS status,
krb5_error_code error);
s4:kdc: Add functionality to log client and server authentication policies Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-16 02:01:04 +03:00
struct authn_audit_info;
krb5_error_code hdb_samba4_set_steal_client_audit_info(astgs_request_t r,
struct authn_audit_info *client_audit_info);
krb5_error_code hdb_samba4_set_steal_server_audit_info(astgs_request_t r,
struct authn_audit_info *server_audit_info);
s4-kdc: move kdc_check_pac() to a new subsystem KDC-GLUE. This subsystem should be used to provide shared code between the s4 heimdal kdc and the s4 heimdal wdc plugin. Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2014-05-12 12:21:18 +04:00
/* from kdc-glue.c */
int kdc_check_pac(krb5_context krb5_context,
DATA_BLOB server_sig,
struct PAC_SIGNATURE_DATA *kdc_sig,
s4:kdc: Adapt to hdb_entry_ex removal Rather than having a 'free_entry' member that can be called to free an hdb_entry, we now implement the free function in HDB. We perform the free only if the context pointer is non-NULL. We also remove the ZERO_STRUCTP() in sdb_entry_to_hdb_entry(), as the context pointer is now part of the 'hdb_entry' structure itself, and this would undesirably zero it out. This is an adaptation to Heimdal commits: commit c5551775e204d00c7ee8055ab6ddbba7e0590584 Author: Luke Howard <lukeh@padl.com> Date: Fri Jan 7 12:15:55 2022 +1100 hdb: decorate HDB_entry with context member Decorate HDB_entry with context and move free_entry callback into HDB structure itself. Requires updating hdb_free_entry() signature to include HDB parameter. A follow-up commit will consolidate hdb_entry_ex (which has a single hdb_entry member) into hdb_entry. commit 0e8c4ccc6ee0123ea39e53e8917fc3f6bb74e8c8 Author: Luke Howard <lukeh@padl.com> Date: Fri Jan 7 12:54:40 2022 +1100 hdb: eliminate hdb_entry_ex Remove hdb_entry_ex and revert to the original design of hdb_entry (except with an additional context member in hdb_entry which is managed by the free_entry method in HDB). NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-02-22 09:41:14 +03:00
hdb_entry *ent);
s4:kdc: Add function to get device PAC entry from Heimdal request structure Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-29 03:53:24 +03:00
struct samba_kdc_entry_pac samba_kdc_get_device_pac(const astgs_request_t r);
s4-kdc: added ifdef guards in kdc.h this prevents too much recursion in the compiler preprocessor
2010-09-28 08:03:14 +04:00
#endif
Copy Permalink