freeipa

mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00

Files

Alexander Bokovoy d3ccfefaa4 ipa-kdb: filter out group membership from MS-PAC for exact SID matches too

When incoming SID blacklist contains exact SIDs of users and groups,
attempt to filter them out as well, according to [MS-PAC] 4.1.1.2.

Note that we treat user's SID and primary group RID filtering as violation
of the KDC policy because the resulting MS-PAC will have no user SID or
primary group and thus will be invalid.

For group RIDs we filter them out. According to [MS-KILE] 3.3.5.6.3.1
it is OK to have empty group RIDs array as GroupCount SHOULD be
equal to Groups.MembershipCount returned by SamrGetGroupsForUser
[MS-SAMR] 3.1.5.9.1, not MUST, thus it may be empty.

Part of fix for https://bugzilla.redhat.com/show_bug.cgi?id=1222475

Reviewed-By: Tomas Babej <tbabej@redhat.com>

2015-07-08 01:56:52 +02:00

tests

ipa-kdb: fix unit tests

2014-09-26 11:28:26 +02:00

ipa_kdb_audit_as.c

ipa-kdb: unexpected error code in 'ipa_kdb_audit_as_req' triggers a message

2015-01-30 11:02:16 +01:00

ipa_kdb_common.c

Use libunistring ulc_casecmp() on unicode strings

2013-07-18 18:08:53 +02:00

ipa_kdb_delegation.c

ipa-kdb: fix delegation acl check

2012-02-28 13:03:22 -05:00

ipa_kdb_mkey.c

ipa-kdb: Get/Store Master Key directly from LDAP

2011-08-26 08:24:49 -04:00

ipa_kdb_mspac.c

ipa-kdb: filter out group membership from MS-PAC for exact SID matches too

2015-07-08 01:56:52 +02:00

ipa_kdb_passwords.c

Detect default encsalts kadmin password change

2015-05-27 09:45:56 -04:00

ipa_kdb_principals.c

Detect default encsalts kadmin password change

2015-05-27 09:45:56 -04:00

ipa_kdb_pwdpolicy.c

Detect default encsalts kadmin password change

2015-05-27 09:45:56 -04:00

ipa_kdb.c

ipa-kdb: common function to get key encodings/salt types

2015-06-29 17:15:00 +02:00

ipa_kdb.exports

ipa-kdb: add exports file

2011-08-26 08:24:49 -04:00

ipa_kdb.h

ipa-kdb: common function to get key encodings/salt types

2015-06-29 17:15:00 +02:00

Makefile.am

ipa-kdb: fix unit tests

2014-09-26 11:28:26 +02:00

README

ipa-kdb: Initial plugin skeleton

2011-08-26 08:24:49 -04:00

README.s4u2proxy.txt

Fix s4u2proxy README and add warning

2015-06-08 14:37:29 -04:00

README

This is the ipa krb5kdc database backend.