6 Commits

Author	SHA1	Message	Date
Andrew Bartlett	ae0f81ab23	r23456: Update Samba4 to current lorikeet-heimdal. ... Andrew Bartlett	2007-10-10 14:53:18 -05:00
Andrew Bartlett	ef5604b877	r15481: Update heimdal/ to match current lorikeet-heimdal. ... This includes many useful upstream changes, many of which should reduce warnings in our compile. It also includes a change to the HDB interface, which removes the need for Samba4/lorikeet-heimdal to deviate from upstream for hdb_fetch(). The new flags replace the old entry type enum. (This required the rework in hdb-ldb.c included in this commit) Andrew Bartlett	2007-10-10 14:05:39 -05:00
Andrew Bartlett	8fd5224c6b	r12269: Update to current lorikeet-heimdal. This changed the way the hdb ... interface worked, so hdb-ldb.c and the glue have been updated. Andrew Bartlett	2007-10-10 13:47:26 -05:00
Andrew Bartlett	2426581dfb	r12000: Update to current lorikeet-heimdal, including in particular support ... for referencing an existing in-MEMORY keytab (required for the new way we push that to GSSAPI). Andrew Bartlett	2007-10-10 13:46:57 -05:00
Andrew Bartlett	6b75573df4	r11995: A big kerberos-related update. ... This merges Samba4 up to current lorikeet-heimdal, which includes a replacement for some Samba-specific hacks. In particular, the credentials system now supplies GSS client and server credentials. These are imported into GSS with gss_krb5_import_creds(). Unfortunetly this can't take an MEMORY keytab, so we now create a FILE based keytab as provision and join time. Because the keytab is now created in advance, we don't spend .4s at negprot doing sha1 s2k calls. Also, because the keytab is read in real time, any change in the server key will be correctly picked up by the the krb5 code. To mark entries in the secrets which should be exported to a keytab, there is a new kerberosSecret objectClass. The new routine cli_credentials_update_all_keytabs() searches for these, and updates the keytabs. This is called in the provision.js via the ejs wrapper credentials_update_all_keytabs(). We can now (in theory) use a system-provided /etc/krb5.keytab, if krb5Keytab: FILE:/etc/krb5.keytab is added to the secrets.ldb record. By default the attribute privateKeytab: secrets.keytab is set, pointing to allow the whole private directory to be moved without breaking the internal links.	2007-10-10 13:46:56 -05:00
Heimdal Import User	118be28a7a	r8302: import mini HEIMDAL into the tree	2007-10-10 13:19:33 -05:00