samba.git/source4/kdc/wscript_build, branch master

s4:kdc:sdb_to_hdb key trust support

2025-09-16T23:23:42+00:00

Convert key trust public keys contained in the clients sdb records, and add
to the HDB_Ext_KeyTrust extension on the clients HDB record

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton 

Autobuild-User(master): Douglas Bagnall 
Autobuild-Date(master): Tue Sep 16 23:23:42 UTC 2025 on atb-devel-224

s4:kdc Support for key trust authentication

2025-07-29T05:31:10+00:00

Extract the public kes from msDS-KeyCredentialLink and populate the sdb
structure.  These values can then be passed to Kergeros to allow key
trust authentication.

Signed-off-by: Gary Lockyer 
Reviewed-by: Douglas Bagnall 

Autobuild-User(master): Douglas Bagnall 
Autobuild-Date(master): Tue Jul 29 05:31:10 UTC 2025 on atb-devel-224

kdc: Detect (about to) expire UF_SMARTCARD_REQUIRED accounts and rotate passwords

2024-06-10T04:27:30+00:00

This ensures that before the KDC starts to process the entry
we check if it is expired and rotate it.  As an account with
UF_SMARTCARD_REQUIRED simply can not expire unless
msDS-ExpirePasswordsOnSmartCardOnlyAccounts is set and
the Domain Functional Level is >= 2016 we do not need
to do configuration checks here.

Signed-off-by: Andrew Bartlett 
Signed-off-by: Jo Sutton 
Pair-programmed-by: Jo Sutton 
Reviewed-by: Jo Sutton

s4:kdc: Fix grammar

2024-04-21T22:10:36+00:00

Signed-off-by: Jo Sutton 
Reviewed-by: Andrew Bartlett

s4:kdc: Return NTSTATUS and auditing information from samba_kdc_update_pac() to be logged

2023-06-25T23:29:33+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

s4:kdc: Add helper function to determine whether authentication to a server is allowed

2023-06-25T23:29:33+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

auth: Move authn_policy code into auth subsystem

2023-06-15T05:29:28+00:00

This ensures that this code will still be usable by other libraries and
subsystems if Samba is built with ‘--without-ad-dc’.

We also drop dependencies on ‘ldb’ and ‘talloc’ that we shouldn’t have
needed anyway.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

s4:kdc: Add support for constructed claims (for authentication silos)

2023-05-18T01:58:24+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Thu May 18 01:58:24 UTC 2023 on atb-devel-224

s4:kdc: Look up authentication policies for Kerberos clients and servers

2023-05-18T01:03:37+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

s4:kdc: Add helper functions for authentication policies

2023-05-18T01:03:37+00:00

These functions are not yet used.

They are arranged into two libraries: ‘authn_policy’, containing the
core functions, and ‘authn_policy_util’, containing utility functions
that can access the database. This separation is so that libraries
depended upon by ‘samdb’ or ‘dsdb-module’ can use the core functions
without introducing a dependency cycle.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett