mirror of
https://github.com/samba-team/samba.git
synced 2025-03-10 12:58:35 +03:00
3c1e780ec7
This merges Samba4 with lorikeet-heimdal, which itself has been tracking Heimdal CVS for the past couple of weeks. This is such a big change because Heimdal reorganised it's internal structures, with the mechglue merge, and because many of our 'wishes' have been granted: we now have DCE_STYLE GSSAPI, send_to_kdc hooks and many other features merged into the mainline code. We have adapted to upstream's choice of API in these cases. In gensec_gssapi and gensec_krb5, we either expect a valid PAC, or NO PAC. This matches windows behavour. We also have an option to require the PAC to be present (which allows us to automate the testing of this code). This also includes a restructure of how the kerberos dependencies are handled, due to the fallout of the merge. Andrew Bartlett (This used to be commit 4826f1735197c2a471d771495e6d4c1051b4c471)
124 lines
3.5 KiB
Groff
124 lines
3.5 KiB
Groff
-- $Id: hdb.asn1,v 1.17 2006/08/24 10:45:19 lha Exp $
|
|
HDB DEFINITIONS ::=
|
|
BEGIN
|
|
|
|
IMPORTS EncryptionKey, KerberosTime, Principal FROM krb5;
|
|
|
|
HDB_DB_FORMAT INTEGER ::= 2 -- format of database,
|
|
-- update when making changes
|
|
|
|
-- these must have the same value as the pa-* counterparts
|
|
hdb-pw-salt INTEGER ::= 3
|
|
hdb-afs3-salt INTEGER ::= 10
|
|
|
|
Salt ::= SEQUENCE {
|
|
type[0] INTEGER (0..4294967295),
|
|
salt[1] OCTET STRING
|
|
}
|
|
|
|
Key ::= SEQUENCE {
|
|
mkvno[0] INTEGER (0..4294967295) OPTIONAL, -- master key version number
|
|
key[1] EncryptionKey,
|
|
salt[2] Salt OPTIONAL
|
|
}
|
|
|
|
Event ::= SEQUENCE {
|
|
time[0] KerberosTime,
|
|
principal[1] Principal OPTIONAL
|
|
}
|
|
|
|
HDBFlags ::= BIT STRING {
|
|
initial(0), -- require as-req
|
|
forwardable(1), -- may issue forwardable
|
|
proxiable(2), -- may issue proxiable
|
|
renewable(3), -- may issue renewable
|
|
postdate(4), -- may issue postdatable
|
|
server(5), -- may be server
|
|
client(6), -- may be client
|
|
invalid(7), -- entry is invalid
|
|
require-preauth(8), -- must use preauth
|
|
change-pw(9), -- change password service
|
|
require-hwauth(10), -- must use hwauth
|
|
ok-as-delegate(11), -- as in TicketFlags
|
|
user-to-user(12), -- may use user-to-user auth
|
|
immutable(13), -- may not be deleted
|
|
trusted-for-delegation(14), -- Trusted to print forwardabled tickets
|
|
allow-kerberos4(15), -- Allow Kerberos 4 requests
|
|
allow-digest(16) -- Allow digest requests
|
|
}
|
|
|
|
GENERATION ::= SEQUENCE {
|
|
time[0] KerberosTime, -- timestamp
|
|
usec[1] INTEGER (0..4294967295), -- microseconds
|
|
gen[2] INTEGER (0..4294967295) -- generation number
|
|
}
|
|
|
|
HDB-Ext-PKINIT-acl ::= SEQUENCE OF SEQUENCE {
|
|
subject[0] UTF8String,
|
|
issuer[1] UTF8String OPTIONAL,
|
|
anchor[2] UTF8String OPTIONAL
|
|
}
|
|
|
|
HDB-Ext-PKINIT-hash ::= SEQUENCE OF SEQUENCE {
|
|
digest-type[0] OBJECT IDENTIFIER,
|
|
digest[1] OCTET STRING
|
|
}
|
|
|
|
HDB-Ext-Constrained-delegation-acl ::= SEQUENCE OF Principal
|
|
|
|
-- hdb-ext-referrals ::= PA-SERVER-REFERRAL-DATA
|
|
|
|
HDB-Ext-Lan-Manager-OWF ::= OCTET STRING
|
|
|
|
HDB-Ext-Password ::= SEQUENCE {
|
|
mkvno[0] INTEGER (0..4294967295) OPTIONAL, -- master key version number
|
|
password OCTET STRING
|
|
}
|
|
|
|
HDB-Ext-Aliases ::= SEQUENCE {
|
|
case-insensitive[0] BOOLEAN, -- case insensitive name allowed
|
|
aliases[1] SEQUENCE OF Principal -- all names, inc primary
|
|
}
|
|
|
|
|
|
HDB-extension ::= SEQUENCE {
|
|
mandatory[0] BOOLEAN, -- kdc MUST understand this extension,
|
|
-- if not the whole entry must
|
|
-- be rejected
|
|
data[1] CHOICE {
|
|
pkinit-acl[0] HDB-Ext-PKINIT-acl,
|
|
pkinit-cert-hash[1] HDB-Ext-PKINIT-hash,
|
|
allowed-to-delegate-to[2] HDB-Ext-Constrained-delegation-acl,
|
|
-- referral-info[3] HDB-Ext-Referrals,
|
|
lm-owf[4] HDB-Ext-Lan-Manager-OWF,
|
|
password[5] HDB-Ext-Password,
|
|
aliases[6] HDB-Ext-Aliases,
|
|
last-pw-change[7] KerberosTime,
|
|
...
|
|
},
|
|
...
|
|
}
|
|
|
|
HDB-extensions ::= SEQUENCE OF HDB-extension
|
|
|
|
|
|
hdb_entry ::= SEQUENCE {
|
|
principal[0] Principal OPTIONAL, -- this is optional only
|
|
-- for compatibility with libkrb5
|
|
kvno[1] INTEGER (0..4294967295),
|
|
keys[2] SEQUENCE OF Key,
|
|
created-by[3] Event,
|
|
modified-by[4] Event OPTIONAL,
|
|
valid-start[5] KerberosTime OPTIONAL,
|
|
valid-end[6] KerberosTime OPTIONAL,
|
|
pw-end[7] KerberosTime OPTIONAL,
|
|
max-life[8] INTEGER (0..4294967295) OPTIONAL,
|
|
max-renew[9] INTEGER (0..4294967295) OPTIONAL,
|
|
flags[10] HDBFlags,
|
|
etypes[11] SEQUENCE OF INTEGER (0..4294967295) OPTIONAL,
|
|
generation[12] GENERATION OPTIONAL,
|
|
extensions[13] HDB-extensions OPTIONAL
|
|
}
|
|
|
|
END
|