mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 18:01:23 -06:00
015ae27598
Depending on whether identity of a principal was asserted by the KDC or by a service doing protocol transition (S4U2Self), AD DCs add a special extra SID to a PAC record: - S-1-18-1 is a SID for an Authentication Authority Asserted Identity - S-1-18-2 is a SID for a Service Asserted Identity This behavior is governed by [MS-SFU] 3.2.5.1.2 "KDC replies with Service Ticket". In order to add an asserted identity SID, we need to pass down the client flags as set by the KDC and check for a protocol transition bit. Fixes: https://pagure.io/freeipa/issue/8319 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Isaac Boukris <iboukris@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> |
||
|---|---|---|
| .. | ||
| tests | ||
| ipa_kdb_audit_as.c | ||
| ipa_kdb_certauth.c | ||
| ipa_kdb_common.c | ||
| ipa_kdb_delegation.c | ||
| ipa_kdb_kdcpolicy.c | ||
| ipa_kdb_mkey.c | ||
| ipa_kdb_mspac_private.h | ||
| ipa_kdb_mspac.c | ||
| ipa_kdb_passwords.c | ||
| ipa_kdb_principals.c | ||
| ipa_kdb_pwdpolicy.c | ||
| ipa_kdb.c | ||
| ipa_kdb.exports | ||
| ipa_kdb.h | ||
| ipa-print-pac.c | ||
| Makefile.am | ||
| README | ||
| README.s4u2proxy.txt | ||
This is the ipa krb5kdc database backend. As the KDB interfaces heavily with krb5, we inherit its code style as well. However, note the following changes: - no modelines (and different file preamble) - return types don't require their own line - single-statement blocks may optionally be braced - /* and */ do not ever get their own line - C99 for-loops are permitted (and encouraged) - a restricted set of other C99 features are permitted In particular, variable-length arrays, flexible array members, compound literals, universal character names, and //-style comments are not permitted. Use of regular malloc/free is preferred over talloc for new code. By and large, existing code mostly conforms to these requirements. New code must conform to them.