freeipa

0 Fork 0

mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-10-25 14:40:16 -05:00

Files

T

Julien Rische 43b1fd77f1 ipa-kdb: support storing multiple KVNO for the same principal

All MIT krb5 keys are encoded with an encryption type identifier and a
KVNO (key version number). The KVNO is referring to the original
credentials string (and its associated salt) which was used to generate
the key using the derivation function of the associated encryption type.

So far, when a set of Kerberos keys was provided to ipa-kdb, only the
newest KVNO ones were saved in a single "krbPrincipalKey" LDAP
attribute. All the older ones were deleted in the process.

This commit allows to keep older keys by splitting them in multiple
"krbPrincipalKey" attribute based on their KVNO.

Fixes: https://pagure.io/freeipa/issue/9370
Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

2025-06-20 17:24:23 +02:00

ipa_hostname.c

Easier to use ipa_gethostfqdn()

2020-10-26 17:11:19 +11:00

ipa_hostname.h

ipa_sam: do not modify static buffer holding fqdn

2020-10-26 17:11:19 +11:00

ipa_krb5.c

ipa-kdb: support storing multiple KVNO for the same principal

2025-06-20 17:24:23 +02:00

ipa_krb5.h

kdb: apply combinatorial logic for ticket flags