summaryrefslogtreecommitdiff
path: root/source4/kdc/wscript_build
AgeCommit message (Collapse)AuthorFilesLines
2025-09-16s4:kdc:sdb_to_hdb key trust supportGary Lockyer1-0/+11
Convert key trust public keys contained in the clients sdb records, and add to the HDB_Ext_KeyTrust extension on the clients HDB record Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Sep 16 23:23:42 UTC 2025 on atb-devel-224
2025-07-29s4:kdc Support for key trust authenticationGary Lockyer1-0/+12
Extract the public kes from msDS-KeyCredentialLink and populate the sdb structure. These values can then be passed to Kergeros to allow key trust authentication. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Jul 29 05:31:10 UTC 2025 on atb-devel-224
2024-06-10kdc: Detect (about to) expire UF_SMARTCARD_REQUIRED accounts and rotate ↵Andrew Bartlett1-1/+1
passwords This ensures that before the KDC starts to process the entry we check if it is expired and rotate it. As an account with UF_SMARTCARD_REQUIRED simply can not expire unless msDS-ExpirePasswordsOnSmartCardOnlyAccounts is set and the Domain Functional Level is >= 2016 we do not need to do configuration checks here. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Pair-programmed-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-04-21s4:kdc: Fix grammarJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-25s4:kdc: Return NTSTATUS and auditing information from samba_kdc_update_pac() ↵Joseph Sutton1-1/+1
to be logged Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-25s4:kdc: Add helper function to determine whether authentication to a server ↵Joseph Sutton1-1/+1
is allowed Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-15auth: Move authn_policy code into auth subsystemJoseph Sutton1-6/+0
This ensures that this code will still be usable by other libraries and subsystems if Samba is built with ‘--without-ad-dc’. We also drop dependencies on ‘ldb’ and ‘talloc’ that we shouldn’t have needed anyway. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-18s4:kdc: Add support for constructed claims (for authentication silos)Joseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu May 18 01:58:24 UTC 2023 on atb-devel-224
2023-05-18s4:kdc: Look up authentication policies for Kerberos clients and serversJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-18s4:kdc: Add helper functions for authentication policiesJoseph Sutton1-0/+12
These functions are not yet used. They are arranged into two libraries: ‘authn_policy’, containing the core functions, and ‘authn_policy_util’, containing utility functions that can access the database. This separation is so that libraries depended upon by ‘samdb’ or ‘dsdb-module’ can use the core functions without introducing a dependency cycle. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-18s4:kdc: Factor out PAC blob functions into new source fileJoseph Sutton1-1/+1
pac-glue.c has become rather large, and can do without these PAC blob–handling functions. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-31s4:kdc: Add support for AD client claimsJoseph Sutton1-1/+1
We now create a client claims blob and add it to the PAC. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-31s4:kdc: Add utility functions for AD claimsJoseph Sutton1-0/+6
get_claims_for_principal() is a new function that creates a claims blob for a principal based on attributes in the database. It's not hooked into the KDC yet, so this entails no change in behaviour. Constructed claims and certificate claims are not supported yet. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-07-27CVE-2022-2031 s4:kpasswd: Require an initial ticketJoseph Sutton1-0/+1
Ensure that for password changes the client uses an AS-REQ to get the ticket to kpasswd, and not a TGS-REQ. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-03-18s4:kdc: Add function to get user_info_dc from databaseJoseph Sutton1-1/+1
The resulting user_info_dc is kept in the 'samba_kdc_entry' structure, so it can be reused between calls. This allows us to simplify samba_kdc_get_pac_blobs(), as it no longer need to return a user_info_dc structure. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-01s4-kdc: Adapt to move from HDB auditing to KDC auditing constantsAndrew Bartlett1-1/+1
This is to adapt to: commit 6530021f09a5cab631be19a1b5898a0ba6b32f16 Author: Luke Howard <lukeh@padl.com> Date: Thu Jan 13 14:37:29 2022 +1100 kdc: move auth event definitions into KDC header Move KDC auth event macro definitions out of hdb.h and into a new KDC header, kdc-audit.h. NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-01-19HEIMDAL: move code from source4/heimdal* to third_party/heimdal*Stefan Metzmacher1-1/+1
This makes it clearer that we always want to do heimdal changes via the lorikeet-heimdal repository. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Autobuild-User(master): Joseph Sutton <jsutton@samba.org> Autobuild-Date(master): Wed Jan 19 21:41:59 UTC 2022 on sn-devel-184
2022-01-19s4:heimdal_build: changes required to build after importAndrew Bartlett1-1/+1
For libtommath we do this by using the list from makefile.commo in in libtommath rather than trying to match the list by hand. This will be easier to maintain over the long term. Thanks to work over many years by: - Gary Lockyer <gary@catalyst.net.nz> - Stefan Metzmacher <metze@samba.org> - Andrew Bartlett <abartlet@samba.org> NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-12-06build: Remove kdc_include except where neededAndrew Bartlett1-9/+0
This include was being set on too many subsystems, including some MIT-related. This was a problem because it would then trigger the mixing of MIT and Heimdal krb5.h files. It is now only set on the plugins and services that use the embedded Heimdal KDC. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14924 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2021-10-20waf: Allow building with MIT KRB5 >= 1.20Andreas Schneider1-0/+1
gssrpc/xdr.h:105:1: error: function declaration isn’t a prototype [-Werror=strict-prototypes] 105 | typedef bool_t (*xdrproc_t)(); | ^~~~~~~ This can't be fixed, as the protoype is variadic. It can take up to three arguments. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14870 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2017-05-30kdc: Send bad password via NETLOGON in RODCGarming Sam1-1/+1
This means that a RWDC will be collecting the badPwdCount to ensure domain wide lockout. TODO The parameters should be better constructed. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-30hdb: Dupe a copy of repl secrets into the KDCGarming Sam1-1/+1
When you have an RODC, this will force the fetch of secrets if not found here Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-29s4-kdc: Start the kpasswd service with MIT KDCAndreas Schneider1-0/+7
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-04-29s4-kdc: Add MIT Kerberos specific kpasswd codeAndreas Schneider1-2/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-04-29s4-kdc: Register the MIT irpc PAC validation serviceAndreas Schneider1-0/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-04-29s4-kdc: Add MIT KRB5 based irpc service for PAC validationAndreas Schneider1-0/+14
Pair-Programmed-With: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-04-29s4-kdc: Add a MIT Kerberos KDC serviceAndreas Schneider1-18/+32
This starts the krb5kdc binary shipped with MIT Kerberos. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-03-29auth: Generate a human readable Authentication log message.Gary Lockyer1-5/+5
Add a human readable authentication log line, to allow verification that all required details are being passed. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-01-11wscript: remove executable bits for all wscript* filesStefan Metzmacher1-0/+0
These files should not be executable. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Wed Jan 11 20:21:01 CET 2017 on sn-devel-144
2016-09-13s4-kdc: Switch to the new kpasswd service implementationAndreas Schneider1-1/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-13s4-kdc: Add new kpasswd service Heimdal backendAndreas Schneider1-1/+5
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-13s4-kdc: Add a new kpasswd service implementationAndreas Schneider1-0/+9
This function is intended to be be passed to kdc_add_socket(). The function kpasswd_handle_request() which is called by kpasswd_process() is Kerberos implementation specific and should be implemented in a kpasswd-service-<kerberos flavour>.c file. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-11s4-kdc: Move kpasswd_make_error_reply() to a helper fileAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-06-19s4-kdc: Move KDC packet handling functions to kdc-server.cAndreas Schneider1-3/+13
Create an Kerberos implmentation independent KDC-SERVER subsystem so we can use it to implement a kpasswd server with MIT Kerberos in future. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sun Jun 19 03:31:32 CEST 2016 on sn-devel-144
2016-06-18s4-kdc: Rename proxy-heimdal.c to kdc-proxy.cAndreas Schneider1-1/+1
The plan is to have a KDC-SERVER subsystem later. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-06-18s4-kdc: Rename heimdal KDC filesAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-04-25s4: add a minimal ktutil for selftestRalph Boehme1-0/+5
This minimalistic version of ktutil dumps all principal names and encryption types from a keytab, eg: ./bin/samba4ktutil test.keytab ktpassuser@HILLHOUSE.SITE (arcfour-hmac-md5) ktpassuser@HILLHOUSE.SITE (aes256-cts-hmac-sha1-96) ktpassuser@HILLHOUSE.SITE (aes128-cts-hmac-sha1-96) ktpassuser@HILLHOUSE.SITE (des-cbc-md5) ktpassuser@HILLHOUSE.SITE (des-cbc-crc) This is all we need to run some tests against keytabs exported with `samba-tool domain exportkeytab`. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-03-17mit-kdb: Add initial MIT KDB Samba driverAndreas Schneider1-0/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Simo Sorce <idra@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-With: Simo Sorce <idra@samba.org> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-17mit_samba: Add function to change the passwordAndreas Schneider1-0/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-17mit_samba: Make mit_samba a shim layer between Samba and KDBAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-17mit_samba: Use sdb in the mit_samba pluginGünther Deschner1-1/+2
Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-17s4-kdc: Introduce a simple sdb_kdb shim layerGünther Deschner1-0/+8
Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-08-05waf: Add talloc as a dependencyAndreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Aug 5 04:08:30 CEST 2015 on sn-devel-104
2015-07-30s4-kdc: Use sdb in db-glue and hdb-samba4Günther Deschner1-2/+2
Guenther Pair-Programmed-With: Andreas Schneider <asn@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Jul 30 13:29:27 CEST 2015 on sn-devel-104
2015-07-30s4-kdc: Introduce a simple sdb_hdb shim layerGünther Deschner1-0/+7
Guenther Pair-Programmed-With: Andreas Schneider <asn@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2015-07-30s4-kdc: Introduce sdb a KDC backend abstractionGünther Deschner1-0/+6
Guenther Pair-Programmed-With: Andreas Schneider <asn@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2015-07-30s4-kdc: PAC_GLUE does not depend on hdb anymore.Günther Deschner1-1/+1
Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2015-07-21s4-kdc_kpasswd: split out some code to a KPASSWD_GLUE subsystem.Günther Deschner1-1/+6
This can then be easier shared with MIT's kadmin services for kpasswd services. Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2015-07-21s4-kdc: move kdc_check_pac() to a new subsystem KDC-GLUE.Günther Deschner1-7/+24
This subsystem should be used to provide shared code between the s4 heimdal kdc and the s4 heimdal wdc plugin. Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2015-07-21waf: Make mit_samba a subsystem and do not build with HeimdalAndreas Schneider1-12/+13
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 07:47:07 +0000