sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-07 00:58:40 +03:00
Code

libcli/security: Add SID_FRESH_PUBLIC_KEY_IDENTITY

Browse Source 
This allows an ACL level check (rather than only an all-or-nothing KDC configuration)
that PKINIT freshness was used during the AS-REQ.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
This commit is contained in:
Andrew Bartlett 2024-02-27 11:09:38 +13:00
parent ea41dccb99
commit 724f403d88
3 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libcli/security/dom_sid.h
View File

@ -43,6 +43,7 @@ extern const struct dom_sid global_sid_Network;
extern const struct dom_sid global_sid_Asserted_Identity;
extern const struct dom_sid global_sid_Asserted_Identity_Service;
extern const struct dom_sid global_sid_Asserted_Identity_Authentication_Authority;
extern const struct dom_sid global_sid_Fresh_Public_Key_Identity;
extern const struct dom_sid global_sid_Creator_Owner;
extern const struct dom_sid global_sid_Creator_Group;
extern const struct dom_sid global_sid_Owner_Rights;

4
libcli/security/util_sid.c
View File

@ -83,6 +83,10 @@ const struct dom_sid global_sid_Asserted_Identity_Authentication_Authority = /*
const struct dom_sid global_sid_Asserted_Identity_Service = /* Asserted Identity Service */
{ 1, 1, {0,0,0,0,0,18}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
/* S-1-18-3 */
const struct dom_sid global_sid_Fresh_Public_Key_Identity = /* Fresh Public Key Identity */
{ 1, 1, {0,0,0,0,0,18}, {3,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
/* S-1-5-2 */
const struct dom_sid global_sid_Network = /* Network rids */
{ 1, 1, {0,0,0,0,0,5}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};

8
librpc/idl/security.idl
View File

@ -324,6 +324,14 @@ interface security
*/
const string SID_SERVICE_ASSERTED_IDENTITY = "S-1-18-2";
/*
* This is added during the AS-REQ/AS-REP exchange after the
* PKINIT Freshness extension is used (shows current
* possession, rather than just a saved signature, of the
* client pulic key).
*/
const string SID_FRESH_PUBLIC_KEY_IDENTITY = "S-1-18-3";
const string SID_COMPOUNDED_AUTHENTICATION = "S-1-5-21-0-0-0-496";
const string SID_CLAIMS_VALID = "S-1-5-21-0-0-0-497";