7 Commits

Author	SHA1	Message	Date
Joseph Sutton	484c6980be	CVE-2022-32744 s4:kdc: Modify HDB plugin to only look up kpasswd principal ... This plugin is now only used by the kpasswd service. Thus, ensuring we only look up the kadmin/changepw principal means we can't be fooled into accepting tickets for other service principals. We make sure not to specify a specific kvno, to ensure that we do not accept RODC-issued tickets. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>	2022-07-27 10:52:36 +00:00
Joseph Sutton	2d3bd2d9ab	s4:kdc: Remove kadmin mode from HDB plugin ... It appears we no longer require it. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>	2022-07-27 10:52:36 +00:00
Andrew Bartlett	5a05066baf	s4:kdc: Update to match updated Heimdal's new HDB version ... Including updates to hook into the improved hdb_auth_status by Stefan Metzmacher <metze@samba.org> from his Heimdal upgrade branch. NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>	2022-01-19 20:50:35 +00:00
Andrew Bartlett	e758f41113	kdc: Add belts-and-braces check that we fail if the hdb version changes ... This checks both if host system run-time Heimdal has changed version, and that the build-time version is supported. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-By: Jelmer Vernooij <jelmer@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Jan 20 22:26:49 CET 2014 on sn-devel-104	2014-01-20 22:26:49 +01:00
Jeffrey Clark	368208069e	Support for Heimdal's unified krb5 and hdb plugin system. ... Fixes exportkeytab and a kdc crash when building against heimdal master. Bug-Debian: http://bugs.debian.org/732342 Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jelmer Vernooij <jelmer@samba.org>	2014-01-21 08:30:36 +13:00
Jelmer Vernooij	92489bfed4	Cope with first element in hdb_method having a different name in different heimdal versions. ... It's called `interface_version` in older Heimdal versions and `version` in newer versions. Signed-off-by: Jelmer Vernooij <jelmer@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Nov 28 04:17:55 CET 2013 on sn-devel-104	2013-11-28 04:17:55 +01:00
Andrew Bartlett	12ce07e53b	s4-kdc: Add hdb plugin for samba4, to allow kadmin to work ... This will help users who are used to the kadmin interface, and could be extended to import existing MIT or Heimdal keys into a Samba4 AD domain. To use, add to your krb5.conf [kdc] database = { dbname = samba4: } or [kdc] database = { dbname = samba4:/usr/local/samba/etc/smb.conf } And copy hdb_samba4.so from PREFIX/modules/hdb to your Heimdal lib directory Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Wed Nov 30 03:22:11 CET 2011 on sn-devel-104	2011-11-30 03:22:11 +01:00