samba.git/source4/heimdal/kdc/misc.c, branch talloc-2.1.4

heimdal:kdc: add support for HDB_ERR_WRONG_REALM

2015-07-08T16:38:20+00:00

A backend can return this if asked with HDB_F_GET_CLIENT|HDB_F_FOR_AS_REQ
for a KRB5_NT_ENTERPRISE_PRINCIPAL record or for HDB_F_GET_SERVER | HDB_F_FOR_TGS_REQ.

entry_ex->entry.principal->realm needs to return the real realm of the principal
(or at least a the realm of the next cross-realm trust hop).

This is needed to route enterprise principals between AD domain trusts.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

heimdal: Ensure that HDB_ERR_NOT_FOUND_HERE, critical for the RODC, is not overwritten

2015-01-23T04:42:07+00:00

This change ensures that our RODC will correctly proxy when asked to provide
a ticket for a service or user where the keys are not on this RODC.

Signed-off-by: Garming Sam 
Pair-programmed-with: Garming Sam 
Signed-off-by: Andrew Bartlett

heimdal: Really bug in KDC handling of enterprise princs

2015-01-23T04:42:07+00:00

The value of this commit to Samba is to continue to match Heimdal's
upstream code in this area.  Because we set HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL
there is no runtime difference.

(commit message by Andrew Bartlett)

Cherry-pick of Heimdal commit 9aa7883ff2efb3e0a60016c9090c577acfd0779f

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam 

Reviewed-by: Andrew Bartlett

heimdal: Fix bug in KDC handling of enterprise principals

2015-01-23T04:42:07+00:00

The useful change in Samba from this commit is that we gain
validation of the enterprise principal name.

(commit message by Andrew Bartlett)

Cherry-pick of Heimdal commit c76ec8ec6a507a6f34ca80c11e5297146acff83f

Reviewed-by: Garming Sam 
Signed-off-by: Andrew Bartlett 

Reviewed-by: Andrew Bartlett

s4:heimdal: import lorikeet-heimdal-201107241840 (commit 0fdf11fa3cdb47df9f5393ebf36d9f5742243036)

2011-07-26T00:16:08+00:00

s4:heimdal: import lorikeet-heimdal-201107150856 (commit 48936803fae4a2fb362c79365d31f420c917b85b)

2011-07-15T09:15:05+00:00

s4:heimdal: import lorikeet-heimdal-201012010201 (commit 81fe27bcc0148d410ca4617f8759b9df1a5e935c)

2010-12-01T06:00:47+00:00

heimdal Return HDB_ERR_NOT_FOUND_HERE to the caller

2010-11-12T07:18:55+00:00

This means that no reply packet should be generated, but that instead
the user of the libkdc API should forward the packet to a real KDC,
that has a full database.

Andrew Bartlett

s4:heimdal: import lorikeet-heimdal-201010022046 (commit 1bea031b9404b14114b0272ecbe56e60c567af5c)

2010-10-03T01:15:04+00:00

heimdal Add support for extracting a particular KVNO from the database

2010-09-28T18:23:07+00:00

This should allow master key rollover.

(but the real reason is to allow multiple krbtgt accounts, as used by
Active Directory to implement RODC support)

Andrew Bartlett