mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-11-02 20:30:26 -06:00
Julien Rische
43b1fd77f1
All MIT krb5 keys are encoded with an encryption type identifier and a KVNO (key version number). The KVNO is referring to the original credentials string (and its associated salt) which was used to generate the key using the derivation function of the associated encryption type. So far, when a set of Kerberos keys was provided to ipa-kdb, only the newest KVNO ones were saved in a single "krbPrincipalKey" LDAP attribute. All the older ones were deleted in the process. This commit allows to keep older keys by splitting them in multiple "krbPrincipalKey" attribute based on their KVNO. Fixes: https://pagure.io/freeipa/issue/9370 Signed-off-by: Julien Rische <jrische@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This is the ipa krb5kdc database backend. As the KDB interfaces heavily with krb5, we inherit its code style as well. However, note the following changes: - no modelines (and different file preamble) - return types don't require their own line - single-statement blocks may optionally be braced - /* and */ do not ever get their own line - C99 for-loops are permitted (and encouraged) - a restricted set of other C99 features are permitted In particular, variable-length arrays, flexible array members, compound literals, universal character names, and //-style comments are not permitted. Use of regular malloc/free is preferred over talloc for new code. By and large, existing code mostly conforms to these requirements. New code must conform to them.