Ken Raeburn [Mon, 25 Sep 2006 21:17:42 +0000 (21:17 +0000)]
Patch from Will Fiveash for "kdb5_util create" support in LDAP, modified to
drop separate port-number spec so it'll build with current sources. Not
tested because of a bug in the recent Novell patch. :-(
- Updated documentation with additional information and fixed errors.
nidmgr32.dll (1.1.0.1)
- Fixed a deadlock in the configuration provider that may cause
NetIDMgr to deadlock on load.
- Prevent the configuration provider handle list from getting
corrupted in the event of a plug-in freeing a handle twice.
- Add more parameter validation for the configuration provider.
- If a plug-in is only partially registered (only some of the entries
were set in the registry), the completion of the registration didn't
complete successfully, leaving the plug-in in an unusable state.
This has been fixed. Plug-ins will now successfully complete
registration once they are loaded for the first time, assuming the
correct resources are present in the module.
- Fixed notifications for setting a default identity. Notifications
were not being properly sent out resulting in the credentials window
not being updated when the default identity changed.
- Changes to the API for type safety.
- Handling of binary data fields was changed to support validation and
comparison.
- Data types that do not support KCDB_CBSIZE_AUTO now check for and
report an error if it is specified.
- Password fields in the new credentials dialog will trim leading and
trailing whitespace before using a user-entered value.
- Change password action will no longer be disabled if no identity is
selected. An identity selection control is present in the dialog
making this restriction unnecessary.
- When renewing credentials, error messages will be suppressed if the
renewal was for an identity and the identity does not have any
identity credentials associated with it.
- Error messages that are related to credentials acquisition or
password changes will now display the name of the identity that the
error applies to.
- Automatic renewals now renews all identities that have credentials
associated with them instead of just the default identity.
- Fixed a bug where error messages did not have a default button which
can be invoked with the return key or the space bar.
- The new credentials window will force itself to the top. This can
be disabled via a registry setting, but is on by default.
- Fixed the sort order in the new credentials tabs to respect sort
hints provided by plug-ins.
- If a new credentials operation fails, the password fields will be
cleared.
- Once a new credentials operation starts, the controls for specifying
the identity and password and any other custom prompts will be
disabled until the operation completes.
- Notifications during the new credentials operation now supply a
handle to the proper data structures as documented.
- Hyperlinks in the new credentials dialog now support markup that
will prevent the dialog from switching to the credentials type panel
when the link is activated.
- If there are too many buttons added by plug-ins in the new
credentials dialog, they will be resized to accomodate all of them.
- The options button in the new credentials dialog will be disabled
while a new credentials operation is in progress.
- The 'about' dialog retains the original copyright strings included
in the resource.
- Multiple modal dialogs are now supported. Only the topmost one will
be active. Once it is closed, the other dialogs will gain focus in
turn. This allows for error messages to be displayed from other
modal dialogs.
- The hypertext window supports italics.
krb4cred.dll (1.1.0.1)
- Fixed a bug where the plug-in would attempt to free a handle twice.
- Fixed a handle leak.
- Changed the facility name used for event reporting to match the
credentials type name.
krb5cred.dll (1.1.0.1)
- Fixed handling of expired passwords. If the password for an
identity is found to have expired at the time a new credentials
acquisition is in progress, the user will be given an opportunity to
change the password. If this is successful, the new credentials
operation will continue with the new password.
- Prevent the new credentials dialog from switching to the Kerberos 5
credentials panel during a password change.
- Prompts that were cached indefinitely will now have a limited
lifetime. Prompt caches that were created using prior versions of
the plug-in will automatically expire.
- Multistrings in the resource files were converted to CSV to protect
them against a bug in Visual Studio 2005 which corrupted
multistrings.
- Added handling of and reporting WinSock errors that are returned
from the Kerberos 5 libraries.
- Fixed uninitialized variables.
- The username and realm that is entered when selecting an identity
will be trimmed of leading and trailing whitespace.
- Changed the facility name used for event reporting to match the
credentials type name.
windows thread support frees thread local storage after TlsSetValue
threads.c: The return value of TlsSetValue is non-zero on
success. As a result of misinterpreting the
return value, the memory set in TLS is then freed.
A subsequent call to TlsGetValue returns the
invalid pointer.
Sam Hartman [Thu, 21 Sep 2006 01:48:50 +0000 (01:48 +0000)]
Set the canonicalize flag in TGS requests and accept cross-realm referral tickets.
We do not yet accept tickets in which the server name changes.
* krb5_sname_to_principal: If there is no domain realm mapping return null realm
*krb5_get_cred_via_tkt: New behavior as described below
1) the referrals case:
- check for TGT for initial realm
- if a remote realm was specified (which must have happened via a
domain_realm mapping), obtain a TGT for it the standard way and
start with that.
- use client realm for server if not specified
- iterate through this loop:
- request ticket with referrals turned on
- if that fails:
- if this was the first request, punt to non-referrals case
- otherwise, retry once without referrals turned on then terminate
either way
- if it works, either use the service ticket or follow the referral path
- if loop count exceeded, hardfail
2) the nonreferrals case
- this is mostly the old walk_realm_tree TGT-finding (which allows
limited shortcut referrals per 4120) followed by a standard tgs-req.
- originally requested principal is used for this, although if we were
handed something without a realm, determine a fallback realm based on
DNS TXT records or a truncation of the domain name.
Ken Raeburn [Mon, 18 Sep 2006 23:51:50 +0000 (23:51 +0000)]
Savitha's patches for:
- LDAP URI support for specifying server and port
- support for ldapi interface
- updated to newer LDAP APIs
- updated documentation
Ken Raeburn [Sat, 16 Sep 2006 01:59:15 +0000 (01:59 +0000)]
* kdb5.c (kdb_load_library): Make error message a little more accurate.
(get_errmsg): New function. Uses errcode_2_string and release_errcode_string
functions to copy out an error message from the plugin and store it locally,
if the error code supplied is nonzero. Changed other uses of plugin functions
to call get_errmsg on returning.
(krb5_db_errcode2string): Deleted.
Ken Raeburn [Sat, 16 Sep 2006 01:32:40 +0000 (01:32 +0000)]
Move RPC header files to include/gssrpc, which we copy to them at
build time, and which is the only place we use them from anyways.
Update Makefile references and dependencies.
Ken Raeburn [Wed, 6 Sep 2006 20:31:54 +0000 (20:31 +0000)]
Make database plugin responsible for releasing the error-message string, so
that we can use the krb5_get_error_message interface internally.
* kdb5.h: Add release_errcode_string field to the interface.
* db2_exp.c, ldap_exp.c: Initialize it.
* ldap_misc.c: Use krb5_get/free_error_message for error message strings.
* kdb_ldap.h: Declare krb5_ldap_release_errcode_string.
Ken Raeburn [Tue, 5 Sep 2006 21:54:47 +0000 (21:54 +0000)]
(prof_get_integer_def, prof_get_string_def): New functions: check specified
config section in the profile, then the default section, then fall back to
passed default value (for integer only). Set error string on error.
(krb5_ldap_read_server_params): Use them, instead of explicitly doubling each
profile_get call.
windows ccache and keytab file paths without a prefix
ktbase.c, ccbase.c: When a file path is specified without
the prefix we must infer the use of the "FILE" prefix.
However, we were setting the prefix including the colon
separator when the separator should have been ignored.
Ken Raeburn [Fri, 1 Sep 2006 02:51:38 +0000 (02:51 +0000)]
Reject old OpenLDAP versions with bugs tickled by this code.
Clean up some warnings during the build.
* ldap_misc.c (strptime) [NEED_STRPTIME_PROTO]: Declare, conditionally.
(krb5_ldap_errcode_2_string): Return string, not error code, to fit with DAL
interface spec.
* kdb_ldap.h: Error out for OpenLDAP versions before 2.2.24.
(LDAP_DEPRECATED): Define; openldap-2.3.27 defaults to undefined.
(krb5_ldap_lib_init): Prototype.
(krb5_get_policydn): Declare.
(krb5_ldap_errcode_2_string): Fix return type.
Ken Raeburn [Thu, 31 Aug 2006 21:17:34 +0000 (21:17 +0000)]
Patches from Will Fiveash to allow for configuration and building on
Solaris. Tested (configured & built) on RHEL 4 and Solaris 10. One
minor bugfix added.
Ken Raeburn [Tue, 29 Aug 2006 19:52:38 +0000 (19:52 +0000)]
Patch from Savitha R:
ldap_util
1. Kdb5_ldap_util interface
Removed supp enctypes, suppsalttypes from create realm and modify
realm since they are currently not used
2. memset passwd strings to zero when not used any more
3. Using krb5_sname_to_principal in place of gethostbyname while
creating the kadmin principal with hostname.
libkdb_ldap
1. Added mandatory functions which were missing in the LDAP plug-in
2. Error handling changes - Setting the error message in the
kerberos context when decryption of the service passwd fails or
connection to the LDAP server fails during initialization.
Additional changes:
libkdb_ldap: Link against com_err library, to provide error_message().
Ken Raeburn [Wed, 23 Aug 2006 22:56:29 +0000 (22:56 +0000)]
Merge Todd's TCP changepw support, with a few fixups
* include/cm.h (state_strings, enum conn_states, struct incoming_krb5_message,
struct conn_state): Moved here from lib/krb5/os/sendto_kdc.c.
(stuct sendto_callback_info): New type.
* lib/krb5/os/sendto_kdc.c (set_conn_state_msg_length): New function.
(setup_connection): Deleted argument message_len_buf. Don't store message
length; call set_conn_state_msg_length instead.
(start_connection): New arguments callback_info and callback_buffer. Invoke
callback function if any, and set message length on success.
(maybe_send): New arguments callback_info and callback_buffer; pass them to
start_connection.
(krb5int_sendto): New arguments callback_info, remoteaddr, remoteaddrlen. If
callback info is provided, allocate per-connection buffers, and pass them to
maybe_send. On cleanup, invoke the cleanup callback function if any.
(krb5_sendto_kdc): Update krb5int_sendto call.
* include/k5-int.h (struct sendto_callback_info): Add forward declaration.
(krb5int_sendto, struct _krb5int_access.sendto_udp): Update for new signature.
* lib/krb5/os/send524 (krb5int_524_sendto_kdc): Update krb5int_sendto call.
* lib/krb4/send_to_kdc.c (krb5int_send_to_kdc_addr): Update sendto_udp call.
* lib/krb5/os/changepw.c (struct sendto_callback_context): New type.
(krb5_locate_kpasswd): New argument useTcp, used to select socket type in
krb5int_locate_server call.
(kpasswd_sendto_msg_cleanup, kpasswd_sendto_msg_callback): New functions.
(krb5_change_set_password): Call krb5int_sendto with callbacks, instead of
managing the exchange here. On RESPONSE_TOO_BIG error, try again with TCP
only.
* lib/krb5/krb/chpw.c (krb5int_rd_chpw_rep): If length is wrong, check if a
buggy server sent a KRB_ERROR.
Jeffrey Altman [Thu, 17 Aug 2006 01:21:00 +0000 (01:21 +0000)]
NetIDMgr Credential Provider Sample Code and Documentation
This commit provides a template for a Network Identity Manager
Credential Provider. It doesn't provide any real functionality
but it does provide all of the functions that need to be specified
and filled in as part of the process of producing a NetIdMgr plug-in.
This code should be pulled up to 1.4.x for inclusion in the KFW 3.1
SDK as well as to 1.5.x.
cc_err_xlate: Updated error mappings to generate the same errors as ccapiv2.
stdccv3_setup: Don't translate errors since cc_err_xlate isn't idempotent.
krb5_stdccv3_resolve: Don't fail if we can't open the ccache.
Tom Yu [Tue, 15 Aug 2006 19:27:08 +0000 (19:27 +0000)]
* src/clients/ksu/main.c (sweep_up): Don't check return value of
krb5_seteuid(0), as it is not harmful for it to fail, and it will
fail after setuid(target_user). Correct error message.
Tom Yu [Mon, 7 Aug 2006 23:33:39 +0000 (23:33 +0000)]
* src/lib/gssapi/mechglue/mglueP.h: Add loopback field to opaque
structs of gss_ctx_id_t, gss_name_t, gss_cred_id_t to catch some
application programming errors. Add new macro GSSINT_CHK_LOOP()
which returns non-zero if loopback field doesn't point to itself.
Changed GSSAPI opaque types (gss_name_t, gss_cred_id_t, gss_ctx_id_t) from
void* to pointers to opaque structs. This change removed some casts and
introduced or changed a bunch of other casts to suppress warnings.
krb5_gss_accept_sec_context(): Fixed a bug found by the above changes
where krb5_gss_release_cred() was being called with the wrong argument 2
(gss_cred_id_t instead of gss_cred_id_t*).
KFW integrated login was failing when the user is
not a power user or administrator. This was occurring
because the temporary file ccache was being created in
a directory the user could not read. While fixing this
it was noticed that the ACLs on the ccache were too broad.
Instead of applying a fix to the FILE: krb5_ccache
implementation it was decided that simply applying a new
set of ACLs (SYSTEM and "user" with no inheritance) to
the file immediately after the krb5_cc_initialize() call
would close the broadest security issues.
The file is initially created in the SYSTEM %TEMP% directory
with "SYSTEM" ACL only. Then it is moved to the user's %TEMP%
directory with "SYSTEM" and "user" ACLs. Finally, after
copying the credentials to the API: ccache, the file is deleted.
acquire_cred(), kg_caller_provided_ccache_name(): On further reflection
and testing the correct thing appears to be to have gss_krb5_ccache_name()
stop gss_acquire_cred() from searching for the desired name in the cache
collection. If the caller sets the ccache name then gss_acquire_cred will only
look in that ccache. Added kg_caller_provided_ccache_name() to tell whether
or not the caller has actually set the ccache. This should fix the problem for
both Mac OS X and Windows.
Ken Raeburn [Wed, 19 Jul 2006 16:14:57 +0000 (16:14 +0000)]
need to look harder for tclConfig.sh
Our current scheme doesn't find tclConfig.sh as installed by NetBSD's
pkg system, even if it finds tclsh and gets the library pathname from
it. The problem is that tclConfig.sh is one directory up.
* aclocal.m4 (AC_KRB5_TCL_FIND_CONFIG): Check $tcl_dir/.. for tclConfig.sh.
acquire_cred(): Realized that my previous patch now basically favors the
ccache over the desired name. Added a KLL function to search for the
desired name, favoring the default ccache.
This commit corrects errors in the Wix installer script
files that violate the Wix schema but which were not
caught by earlier releases of the Wix 2.0 installer.
Ken Raeburn [Tue, 18 Jul 2006 00:40:19 +0000 (00:40 +0000)]
Merge remaining changes from LDAP integration branch
svn+ssh://svn.mit.edu/krb5/branches/ldap-integ@18333.
* plugins/kdb/ldap: New directory.
* aclocal.m4 (WITH_LDAP): New macro.
(CONFIG_RULES): Invoke it.
* configure.in: Test ldap option, maybe configure and generate makefiles for
new directories, and set and substitute ldap_plugin_dir.
* Makefile.in (SUBDIRS): Add @ldap_plugin_dir@.
* lib/kdb/kdb5.c (kdb_load_library): Put more info in error message.
* lib/kadm5/admin.h (KADM5_CPW_FUNCTION, KADM5_RANDKEY_USED,
KADM5_CONFIG_PASSWD_SERVER): New macros, disabled for now.
(struct _kadm5_config_params): New field kpasswd_server, commented out for now.
* lib/krb5/error_tables/kdb5_err.et: Add error codes KRB5_KDB_ACCESS_ERROR,
KRB5_KDB_INTERNAL_ERROR, KRB5_KDB_CONSTRAINT_VIOLATION.
Cleaned up CCAPI v3 code to remove memory leaks. Fixed crashes in
cc_ccache <-> krb5_ccache translation code. Still testing edge cases but
the code seems to work now with the KfM CCAPI implementation.
projects / thirdparty / krb5.git / log
