IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-28 09:06:44 -06:00
Code Issues Packages Projects Releases Wiki Activity
d3ccfefaa4
freeipa/daemons/ipa-kdb
History
Alexander Bokovoy d3ccfefaa4 ipa-kdb: filter out group membership from MS-PAC for exact SID matches too 
When incoming SID blacklist contains exact SIDs of users and groups,
attempt to filter them out as well, according to [MS-PAC] 4.1.1.2.

Note that we treat user's SID and primary group RID filtering as violation
of the KDC policy because the resulting MS-PAC will have no user SID or
primary group and thus will be invalid.

For group RIDs we filter them out. According to [MS-KILE] 3.3.5.6.3.1
it is OK to have empty group RIDs array as GroupCount SHOULD be
equal to Groups.MembershipCount returned by SamrGetGroupsForUser
[MS-SAMR] 3.1.5.9.1, not MUST, thus it may be empty.

Part of fix for https://bugzilla.redhat.com/show_bug.cgi?id=1222475

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
..
tests ipa-kdb: fix unit tests 2014-09-26 11:28:26 +02:00
ipa_kdb_audit_as.c ipa-kdb: unexpected error code in 'ipa_kdb_audit_as_req' triggers a message 2015-01-30 11:02:16 +01:00
ipa_kdb_common.c Use libunistring ulc_casecmp() on unicode strings 2013-07-18 18:08:53 +02:00
ipa_kdb_delegation.c ipa-kdb: fix delegation acl check 2012-02-28 13:03:22 -05:00
ipa_kdb_mkey.c ipa-kdb: Get/Store Master Key directly from LDAP 2011-08-26 08:24:49 -04:00
ipa_kdb_mspac.c ipa-kdb: filter out group membership from MS-PAC for exact SID matches too 2015-07-08 01:56:52 +02:00
ipa_kdb_passwords.c Detect default encsalts kadmin password change 2015-05-27 09:45:56 -04:00
ipa_kdb_principals.c Detect default encsalts kadmin password change 2015-05-27 09:45:56 -04:00
ipa_kdb_pwdpolicy.c Detect default encsalts kadmin password change 2015-05-27 09:45:56 -04:00
ipa_kdb.c ipa-kdb: common function to get key encodings/salt types 2015-06-29 17:15:00 +02:00
ipa_kdb.exports ipa-kdb: add exports file 2011-08-26 08:24:49 -04:00
ipa_kdb.h ipa-kdb: common function to get key encodings/salt types 2015-06-29 17:15:00 +02:00
Makefile.am ipa-kdb: fix unit tests 2014-09-26 11:28:26 +02:00
README ipa-kdb: Initial plugin skeleton 2011-08-26 08:24:49 -04:00
README.s4u2proxy.txt Fix s4u2proxy README and add warning 2015-06-08 14:37:29 -04:00

README 

This is the ipa krb5kdc database backend.