Alexander Bokovoy d551e853fc ipa-kdb: process out of realm server lookup during S4U ... Kerberos principal aliases lookup had a long-standing TODO item to support server referrals for host-based aliases. This commit implements server referrals for hosts belonging to trusted domains. The use-case is a part of S4U processing in a two-way trust when an IPA service requests a ticket to a host in a trusted domain (e.g. service on AD DC). In such situation, the server principal in TGS request will be a normal principal in our domain and KDC needs to respond with a server referral. This referral can be issued by a KDB driver or by the KDC itself, using 'domain_realms' section of krb5.conf. Since KDB knows all suffixes associated with the trusted domains, implement the logic there. Fixes: https://pagure.io/freeipa/issue/9164 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Julien Rische <jrische@redhat.com>		2023-06-01 11:10:21 +02:00
..
dnssec	pylint: remove useless suppression	2023-01-10 08:30:58 +01:00
ipa-kdb	ipa-kdb: process out of realm server lookup during S4U	2023-06-01 11:10:21 +02:00
ipa-otpd	ipa-otpd: add passkey_child_debug_level option	2023-06-01 08:20:37 +02:00
ipa-sam	ipa-sam: retrieve trusted domain account credential from the TDO itself	2022-04-13 18:37:12 +02:00
ipa-slapi-plugins	extdom: avoid sss_nss_getorigby*() calls when get*_r_wrapper() returns object from a wrong domain (performance optimization)	2022-10-04 14:01:56 +02:00
ipa-version.h.in	Build: move version handling from Makefile to configure	2016-11-09 13:08:32 +01:00
Makefile.am	build: Unify compiler warning flags used	2021-01-15 14:11:56 +01:00