IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity
9f0ec27e9f
freeipa/daemons/ipa-kdb/Makefile.am

143 lines
3.0 KiB
Makefile
Raw Normal View History

Build: transform util directory to libutil convenience library This is autoconf way of doing things. It should allow us to enable subdir-objects automake option and stay compatible with future versions of automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-10-11 08:41:46 -05:00
AUTOMAKE_OPTIONS = 1.7 subdir-objects
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
NULL =
ipa-kdb: add functions to change principals
2011-06-01 16:58:21 -05:00
Remove build warnings Fix rpm build warnings report in Fedora 19 build. https://fedorahosted.org/freeipa/ticket/3500
2013-03-12 09:28:58 -05:00
AM_CPPFLAGS = \
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
-I$(srcdir) \
Build: fix Makefile.am files to separate source and build directories This is step forward working VPATH builds which cleanly separate sources and build artifacts. It makes the system cleaner and easier to understand. Python and web UI likely require more work to make VPATH builds working. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-10-31 06:33:43 -05:00
-I$(top_srcdir)/util \
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
-DPREFIX=\""$(prefix)"\" \
-DBINDIR=\""$(bindir)"\" \
-DLIBDIR=\""$(libdir)"\" \
-DLIBEXECDIR=\""$(libexecdir)"\" \
-DDATADIR=\""$(datadir)"\" \
Use /run and /run/lock instead of /var Also add runstatedir autoconf var. IPA requires autoconf 2.59. The variable will be available with autoconf 2.70. Fixes: https://pagure.io/freeipa/issue/8272 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-04-15 05:13:00 -05:00
-DLDAPIDIR=\""$(runstatedir)"\" \
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
$(AM_CFLAGS) \
$(LDAP_CFLAGS) \
$(KRB5_CFLAGS) \
$(WARN_CFLAGS) \
Add support for generating PAC for AS requests for user principals
2011-10-10 14:42:11 -05:00
$(NDRPAC_CFLAGS) \
IPA certauth plugin This patch add a certauth plugin which allows the IPA server to support PKINIT for certificates which do not include a special SAN extension which contains a Kerberos principal but allow other mappings with the help of SSSD's certmap library. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2017-02-02 05:32:13 -06:00
$(SSSCERTMAP_CFLAGS) \
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
$(NULL)
plugindir = $(libdir)/krb5/plugins/kdb
plugin_LTLIBRARIES = \
ipadb.la \
$(NULL)
ipadb_la_SOURCES = \
ipa_kdb.c \
Build: fix distribution of daemon/ipa-kdb files https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-02 11:39:41 -05:00
ipa_kdb.h \
ipa-kdb: add common utility ldap wrapper functions
2011-06-10 13:35:46 -05:00
ipa_kdb_common.c \
ipa-kdb: Get/Store Master Key directly from LDAP
2011-06-10 13:25:03 -05:00
ipa_kdb_mkey.c \
ipa-kdb: implement change_pwd function
2011-06-20 18:35:50 -05:00
ipa_kdb_passwords.c \
ipa-kdb: functions to get principal
2011-05-25 17:32:14 -05:00
ipa_kdb_principals.c \
ipa-kdb: implement function to retrieve password policies
2011-06-23 14:02:04 -05:00
ipa_kdb_pwdpolicy.c \
Add support for generating PAC for AS requests for user principals
2011-10-10 14:42:11 -05:00
ipa_kdb_mspac.c \
Build: fix distribution of daemon/ipa-kdb files https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-02 11:39:41 -05:00
ipa_kdb_mspac_private.h \
ipa-kdb: Add delgation access control support
2011-11-20 17:36:26 -06:00
ipa_kdb_delegation.c \
ipa-kdb: add AS auditing support Fixes: https://fedorahosted.org/freeipa/ticket/2334
2012-02-13 11:15:07 -06:00
ipa_kdb_audit_as.c \
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
$(NULL)
IPA-KDB: use relative path in ipa-certmap config snippet Architecture specific paths should be avoided in the global Kerberos configuration because it is read e.g. by 32bit and 64bit libraries they are installed in parallel. Resolves https://pagure.io/freeipa/issue/6833 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-29 08:46:50 -05:00
dist_noinst_DATA = ipa_kdb.exports
IPA certauth plugin This patch add a certauth plugin which allows the IPA server to support PKINIT for certificates which do not include a special SAN extension which contains a Kerberos principal but allow other mappings with the help of SSSD's certmap library. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2017-02-02 05:32:13 -06:00
if BUILD_IPA_CERTAUTH_PLUGIN
ipadb_la_SOURCES += ipa_kdb_certauth.c
endif
Add a skeleton kdcpolicy plugin Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
2018-07-11 15:48:01 -05:00
if BUILD_IPA_KDCPOLICY_PLUGIN
ipadb_la_SOURCES += ipa_kdb_kdcpolicy.c
endif
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
ipadb_la_LDFLAGS = \
-avoid-version \
ipa-kdb: add exports file limit exported symbols only to the ones actually needed by krb5kdc
2011-07-05 21:39:23 -05:00
-module \
-Wl,--version-script,$(srcdir)/ipa_kdb.exports
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
ipadb_la_LIBADD = \
$(KRB5_LIBS) \
$(LDAP_LIBS) \
Add support for generating PAC for AS requests for user principals
2011-10-10 14:42:11 -05:00
$(NDRPAC_LIBS) \
Use libunistring ulc_casecmp() on unicode strings https://fedorahosted.org/freeipa/ticket/3772
2013-07-16 10:47:27 -05:00
$(UNISTRING_LIBS) \
IPA certauth plugin This patch add a certauth plugin which allows the IPA server to support PKINIT for certificates which do not include a special SAN extension which contains a Kerberos principal but allow other mappings with the help of SSSD's certmap library. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2017-02-02 05:32:13 -06:00
$(SSSCERTMAP_LIBS) \
Build: fix Makefile.am files to separate source and build directories This is step forward working VPATH builds which cleanly separate sources and build artifacts. It makes the system cleaner and easier to understand. Python and web UI likely require more work to make VPATH builds working. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-10-31 06:33:43 -05:00
$(top_builddir)/util/libutil.la \
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
$(NULL)
ipa-kdb: convert test to cmocka Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-05-20 11:31:19 -05:00
if HAVE_CMOCKA
ipa-kdb: override krb5.conf when testing KDC code in cmocka When testing KDC code in cmocka we rely on libkrb5 defaults. libkrb5 would read /etc/krb5.conf by default and would load a KDB module from there if it is defined for the test realm (EXAMPLE.COM). Since EXAMPLE.COM is a common name used for test realms, make sure to not using /etc/krb5.conf from the system. Instead, force KRB5_CONFIG to /dev/null so that only libkrb5 compiled-in defaults are in use. In such setup libkrb5 will attempt to load KDB driver db2 for our test realm. db2 driver doesn't fail if its database is not available (unlike FreeIPA's one), so it survives initialization. As result, ipa-kdb-tests pass without unexpected breakage. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-11-24 08:55:33 -06:00
TESTS_ENVIRONMENT = . $(srcdir)/tests/test_setup.sh;
dist_ipa_kdb_tests_SOURCES = tests/test_setup.sh
Add unit test for get_authz_data_types() https://fedorahosted.org/freeipa/ticket/2960
2013-02-19 05:16:37 -06:00
TESTS = ipa_kdb_tests
check_PROGRAMS = ipa_kdb_tests
endif
ipa_kdb_tests_SOURCES = \
tests/ipa_kdb_tests.c \
ipa_kdb.c \
ipa_kdb_common.c \
ipa_kdb_mkey.c \
ipa_kdb_passwords.c \
ipa_kdb_principals.c \
ipa_kdb_pwdpolicy.c \
ipa_kdb_mspac.c \
ipa_kdb_delegation.c \
ipa_kdb_audit_as.c \
$(NULL)
IPA certauth plugin This patch add a certauth plugin which allows the IPA server to support PKINIT for certificates which do not include a special SAN extension which contains a Kerberos principal but allow other mappings with the help of SSSD's certmap library. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2017-02-02 05:32:13 -06:00
if BUILD_IPA_CERTAUTH_PLUGIN
ipa_kdb_tests_SOURCES += ipa_kdb_certauth.c
endif
Add a skeleton kdcpolicy plugin Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
2018-07-11 15:48:01 -05:00
if BUILD_IPA_KDCPOLICY_PLUGIN
ipa_kdb_tests_SOURCES += ipa_kdb_kdcpolicy.c
endif
ipa-kdb: convert test to cmocka Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-05-20 11:31:19 -05:00
ipa_kdb_tests_CFLAGS = $(CMOCKA_CFLAGS)
Add unit test for get_authz_data_types() https://fedorahosted.org/freeipa/ticket/2960
2013-02-19 05:16:37 -06:00
ipa_kdb_tests_LDADD = \
ipa-kdb: convert test to cmocka Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-05-20 11:31:19 -05:00
$(CMOCKA_LIBS) \
Add unit test for get_authz_data_types() https://fedorahosted.org/freeipa/ticket/2960
2013-02-19 05:16:37 -06:00
$(KRB5_LIBS) \
$(LDAP_LIBS) \
$(NDRPAC_LIBS) \
ipa-kdb: fix unit tests Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
2014-07-22 10:17:45 -05:00
$(UNISTRING_LIBS) \
IPA certauth plugin This patch add a certauth plugin which allows the IPA server to support PKINIT for certificates which do not include a special SAN extension which contains a Kerberos principal but allow other mappings with the help of SSSD's certmap library. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2017-02-02 05:32:13 -06:00
$(SSSCERTMAP_LIBS) \
Build: fix Makefile.am files to separate source and build directories This is step forward working VPATH builds which cleanly separate sources and build artifacts. It makes the system cleaner and easier to understand. Python and web UI likely require more work to make VPATH builds working. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-10-31 06:33:43 -05:00
$(top_builddir)/util/libutil.la \
Add unit test for get_authz_data_types() https://fedorahosted.org/freeipa/ticket/2960
2013-02-19 05:16:37 -06:00
-lkdb5 \
-lsss_idmap \
$(NULL)
ipa-print-pac: acquire and print PAC record for a user Helper utility to investigate PAC content of users in trusted environments. Supports direct ticket acquisition and S4U2Self protocol transition. 1. Direct ticket acquisition In direct ticket acquisition mode the utility first does one of the following actions: - obtain a TGT ticket for a user principal using supplied password - import existing TGT from a default credentials cache Once a user TGT is available, the utility will attempt to acquire a service ticket to a service which key is specified in a keytab (default or passed with --keytab option) and simulate establishing context to the service application. If establishing context succeeds, MS-PAC content of the service ticket will be printed out. 2. S4U2Self protocol transition In protocol transition case a service application obtains own TGT using a key from the keytab and then requests a service ticket to itself in the name of the user principal, performing S4U2Self request. If accepting this service ticket succeeds, MS-PAC content of the service ticket will be printed out. If KDC does not support or rejects issuing MS-PAC record for a user, an error message 'KDC has no support for padata type' will be printed. Related: https://pagure.io/freeipa/issue/8319 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Signed-off-by: Isaac Boukris <iboukris@redhat.com> Reviewed-By: Isaac Boukris <iboukris@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2020-05-18 01:40:30 -05:00
appdir = $(libexecdir)/ipa
app_PROGRAMS = ipa-print-pac
ipa_print_pac_SOURCES = ipa-print-pac.c \
$(NULL)
ipa_print_pac_CFLAGS = \
-I$(srcdir) \
-I$(top_srcdir)/util \
-DPREFIX=\""$(prefix)"\" \
-DBINDIR=\""$(bindir)"\" \
-DLIBDIR=\""$(libdir)"\" \
-DLIBEXECDIR=\""$(libexecdir)"\"\
-DDATADIR=\""$(datadir)"\" \
-DLDAPIDIR=\""$(runstatedir)"\" \
$(AM_CFLAGS) \
$(POPT_CFLAGS) \
$(KRB5_CFLAGS) \
$(KRB5_GSSAPI_CFLAGS) \
$(WARN_CFLAGS) \
$(NDRPAC_CFLAGS) \
$(NULL)
ipa_print_pac_LDADD = \
$(KRB5_GSSAPI_LIBS) \
$(KRB5_LIBS) \
$(NDRPAC_LIBS) \
$(POPT_LIBS) \
$(NULL)
Clean / ignore make check artefact In tree runs of make check leave some artifacts around. The patch adds them to make clean and .gitignore. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-01-09 04:23:32 -06:00
clean-local:
rm -f tests/.dirstamp
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
EXTRA_DIST = \
README \
Build: fix distribution of daemon/ipa-kdb files https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-02 11:39:41 -05:00
README.s4u2proxy.txt \
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
$(NULL)
Reference in New Issue Copy Permalink