samba.git/source4/auth, branch master

s4:auth: Implement ‘krb5 acceptor report canonical client name’ option for Heimdal

2026-01-15T01:48:37+00:00

Adjust tests to match the new behaviour.

The implementation is simply to set a flag that is already present
in upstream Heimdal.

Signed-off-by: Jennifer Sutton 
Reviewed-by: Douglas Bagnall

lib: Don't call a function to initialize an empty DATA_BLOB

2026-01-07T09:57:40+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

s4:kdc always include the PAC

2025-11-13T23:12:55+00:00

Set the heimdal always_include_pac configuration flag, based on the samba
kdc always include pac option

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton 

Autobuild-User(master): Douglas Bagnall 
Autobuild-Date(master): Thu Nov 13 23:12:55 UTC 2025 on atb-devel-224

Add missing include needed for cmocka.h

2025-10-17T11:12:29+00:00

This will be required in future.

Signed-off-by: Andreas Schneider 
Reviewed-by: Anoop C S

s4:kdc:sdb Support Windows flexible cert mappings

2025-10-10T01:27:31+00:00

Extract certificate mappings from the altSecurityIdentities attribute and
populate the new sdb_certificate_mappings element of sdb

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton

s4:auth:sam Fix key trust attribute name

2025-09-16T22:22:34+00:00

Use the correct attribute name for the key trust credentials,
msDS-KeyCredentialLink.

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton

s4:auth: Fix 'no delegation' logic in gensec_gssapi_start()

2025-09-11T16:02:33+00:00

This fixes samba4.ntvfs.cifs.krb5.base.lock test with MIT Kerberos.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15912

Signed-off-by: Andreas Schneider 
Signed-off-by: Stefan Metzmacher 
Pair-Programmed-With: Stefan Metzmacher 

Reviewed-by: Alexander Bokovoy

s4:auth: Fix trailing white spaces in gensec_gssapi.c

2025-09-11T16:02:33+00:00

Signed-off-by: Andreas Schneider 
Reviewed-by: Alexander Bokovoy

s4:kdc Support for key trust authentication

2025-07-29T05:31:10+00:00

Extract the public kes from msDS-KeyCredentialLink and populate the sdb
structure.  These values can then be passed to Kergeros to allow key
trust authentication.

Signed-off-by: Gary Lockyer 
Reviewed-by: Douglas Bagnall 

Autobuild-User(master): Douglas Bagnall 
Autobuild-Date(master): Tue Jul 29 05:31:10 UTC 2025 on atb-devel-224

s4:auth/ntlm: let auth_winbind pass WB_SAMLOGON_FOR_NETLOGON

2025-04-03T09:36:31+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme