From b0e4d68d5124581ae353493d69bea352de4cff8a Mon Sep 17 00:00:00 2001 From: Cy Schubert Date: Tue, 3 Apr 2018 19:36:00 +0000 Subject: Import MIT KRB5 1.16. --- .travis.yml | 26 + NOTICE | 2 +- README | 287 +- doc/admin/admin_commands/kadmin_local.rst | 7 + doc/admin/admin_commands/kpropd.rst | 5 + doc/admin/admin_commands/ktutil.rst | 2 +- doc/admin/conf_files/kadm5_acl.rst | 40 +- doc/admin/conf_files/kdc_conf.rst | 17 +- doc/admin/conf_files/krb5_conf.rst | 59 +- doc/admin/pkinit.rst | 20 + doc/admin/realm_config.rst | 2 +- doc/appdev/gssapi.rst | 19 + doc/appdev/index.rst | 1 + doc/appdev/y2038.rst | 28 + doc/basic/ccache_def.rst | 2 +- doc/build/options2configure.rst | 4 - doc/conf.py | 2 +- .../_sources/admin/admin_commands/kadmin_local.txt | 7 + doc/html/_sources/admin/admin_commands/kpropd.txt | 5 + doc/html/_sources/admin/admin_commands/ktutil.txt | 2 +- doc/html/_sources/admin/conf_files/kadm5_acl.txt | 40 +- doc/html/_sources/admin/conf_files/kdc_conf.txt | 17 +- doc/html/_sources/admin/conf_files/krb5_conf.txt | 59 +- doc/html/_sources/admin/pkinit.txt | 20 + doc/html/_sources/admin/realm_config.txt | 2 +- doc/html/_sources/appdev/gssapi.txt | 19 + doc/html/_sources/appdev/index.txt | 1 + .../appdev/refs/api/krb5_auth_con_initivector.txt | 15 +- .../appdev/refs/api/krb5_fwd_tgt_creds.txt | 2 +- .../appdev/refs/api/krb5_init_creds_free.txt | 2 +- .../appdev/refs/api/krb5_init_creds_get.txt | 4 + .../appdev/refs/api/krb5_init_creds_init.txt | 4 + .../refs/api/krb5_init_creds_set_service.txt | 2 +- .../appdev/refs/api/krb5_init_creds_step.txt | 4 + doc/html/_sources/appdev/refs/api/krb5_mk_req.txt | 2 +- .../_sources/appdev/refs/api/krb5_pac_verify.txt | 2 +- .../_sources/appdev/refs/types/krb5_timestamp.txt | 3 +- doc/html/_sources/appdev/y2038.txt | 28 + doc/html/_sources/basic/ccache_def.txt | 2 +- doc/html/_sources/build/options2configure.txt | 4 - doc/html/_sources/mitK5features.txt | 95 +- doc/html/_sources/plugindev/certauth.txt | 27 + doc/html/_sources/plugindev/index.txt | 3 + doc/html/_sources/plugindev/kadm5_auth.txt | 35 + doc/html/_sources/plugindev/kdcpolicy.txt | 24 + doc/html/about.html | 4 +- doc/html/admin/admin_commands/index.html | 4 +- doc/html/admin/admin_commands/k5srvutil.html | 4 +- doc/html/admin/admin_commands/kadmin_local.html | 10 +- doc/html/admin/admin_commands/kadmind.html | 4 +- doc/html/admin/admin_commands/kdb5_ldap_util.html | 4 +- doc/html/admin/admin_commands/kdb5_util.html | 4 +- doc/html/admin/admin_commands/kprop.html | 4 +- doc/html/admin/admin_commands/kpropd.html | 8 +- doc/html/admin/admin_commands/kproplog.html | 4 +- doc/html/admin/admin_commands/krb5kdc.html | 4 +- doc/html/admin/admin_commands/ktutil.html | 6 +- doc/html/admin/admin_commands/sserver.html | 4 +- doc/html/admin/advanced/index.html | 4 +- doc/html/admin/advanced/ldapbackend.html | 4 +- doc/html/admin/advanced/retiring-des.html | 4 +- doc/html/admin/appl_servers.html | 4 +- doc/html/admin/auth_indicator.html | 4 +- doc/html/admin/backup_host.html | 4 +- doc/html/admin/conf_files/index.html | 4 +- doc/html/admin/conf_files/kadm5_acl.html | 41 +- doc/html/admin/conf_files/kdc_conf.html | 23 +- doc/html/admin/conf_files/krb5_conf.html | 63 +- doc/html/admin/conf_ldap.html | 4 +- doc/html/admin/database.html | 4 +- doc/html/admin/enctypes.html | 4 +- doc/html/admin/env_variables.html | 4 +- doc/html/admin/host_config.html | 4 +- doc/html/admin/https.html | 4 +- doc/html/admin/index.html | 4 +- doc/html/admin/install.html | 4 +- doc/html/admin/install_appl_srv.html | 4 +- doc/html/admin/install_clients.html | 4 +- doc/html/admin/install_kdc.html | 4 +- doc/html/admin/lockout.html | 4 +- doc/html/admin/otp.html | 4 +- doc/html/admin/pkinit.html | 23 +- doc/html/admin/princ_dns.html | 4 +- doc/html/admin/realm_config.html | 6 +- doc/html/admin/troubleshoot.html | 4 +- doc/html/admin/various_envs.html | 4 +- doc/html/appdev/gssapi.html | 29 +- doc/html/appdev/h5l_mit_apidiff.html | 11 +- doc/html/appdev/index.html | 6 +- doc/html/appdev/init_creds.html | 5 +- doc/html/appdev/princ_handle.html | 5 +- doc/html/appdev/refs/api/index.html | 7 +- .../appdev/refs/api/krb5_425_conv_principal.html | 5 +- .../appdev/refs/api/krb5_524_conv_principal.html | 5 +- .../appdev/refs/api/krb5_524_convert_creds.html | 5 +- doc/html/appdev/refs/api/krb5_address_compare.html | 5 +- doc/html/appdev/refs/api/krb5_address_order.html | 5 +- doc/html/appdev/refs/api/krb5_address_search.html | 5 +- .../appdev/refs/api/krb5_allow_weak_crypto.html | 5 +- .../appdev/refs/api/krb5_aname_to_localname.html | 5 +- .../appdev/refs/api/krb5_anonymous_principal.html | 5 +- doc/html/appdev/refs/api/krb5_anonymous_realm.html | 5 +- .../appdev/refs/api/krb5_appdefault_boolean.html | 5 +- .../appdev/refs/api/krb5_appdefault_string.html | 5 +- doc/html/appdev/refs/api/krb5_auth_con_free.html | 5 +- .../appdev/refs/api/krb5_auth_con_genaddrs.html | 5 +- .../refs/api/krb5_auth_con_get_checksum_func.html | 5 +- .../appdev/refs/api/krb5_auth_con_getaddrs.html | 5 +- .../refs/api/krb5_auth_con_getauthenticator.html | 5 +- .../appdev/refs/api/krb5_auth_con_getflags.html | 5 +- doc/html/appdev/refs/api/krb5_auth_con_getkey.html | 5 +- .../appdev/refs/api/krb5_auth_con_getkey_k.html | 5 +- .../refs/api/krb5_auth_con_getlocalseqnumber.html | 5 +- .../refs/api/krb5_auth_con_getlocalsubkey.html | 5 +- .../appdev/refs/api/krb5_auth_con_getrcache.html | 5 +- .../refs/api/krb5_auth_con_getrecvsubkey.html | 5 +- .../refs/api/krb5_auth_con_getrecvsubkey_k.html | 5 +- .../refs/api/krb5_auth_con_getremoteseqnumber.html | 5 +- .../refs/api/krb5_auth_con_getremotesubkey.html | 11 +- .../refs/api/krb5_auth_con_getsendsubkey.html | 5 +- .../refs/api/krb5_auth_con_getsendsubkey_k.html | 5 +- doc/html/appdev/refs/api/krb5_auth_con_init.html | 5 +- .../appdev/refs/api/krb5_auth_con_initivector.html | 35 +- .../refs/api/krb5_auth_con_set_checksum_func.html | 5 +- .../refs/api/krb5_auth_con_set_req_cksumtype.html | 5 +- .../appdev/refs/api/krb5_auth_con_setaddrs.html | 5 +- .../appdev/refs/api/krb5_auth_con_setflags.html | 5 +- .../appdev/refs/api/krb5_auth_con_setports.html | 5 +- .../appdev/refs/api/krb5_auth_con_setrcache.html | 5 +- .../refs/api/krb5_auth_con_setrecvsubkey.html | 5 +- .../refs/api/krb5_auth_con_setrecvsubkey_k.html | 5 +- .../refs/api/krb5_auth_con_setsendsubkey.html | 5 +- .../refs/api/krb5_auth_con_setsendsubkey_k.html | 5 +- .../refs/api/krb5_auth_con_setuseruserkey.html | 5 +- doc/html/appdev/refs/api/krb5_build_principal.html | 5 +- .../refs/api/krb5_build_principal_alloc_va.html | 5 +- .../appdev/refs/api/krb5_build_principal_ext.html | 5 +- .../appdev/refs/api/krb5_build_principal_va.html | 11 +- doc/html/appdev/refs/api/krb5_c_block_size.html | 5 +- .../appdev/refs/api/krb5_c_checksum_length.html | 5 +- doc/html/appdev/refs/api/krb5_c_crypto_length.html | 5 +- .../appdev/refs/api/krb5_c_crypto_length_iov.html | 5 +- doc/html/appdev/refs/api/krb5_c_decrypt.html | 5 +- doc/html/appdev/refs/api/krb5_c_decrypt_iov.html | 5 +- .../appdev/refs/api/krb5_c_derive_prfplus.html | 5 +- doc/html/appdev/refs/api/krb5_c_encrypt.html | 5 +- doc/html/appdev/refs/api/krb5_c_encrypt_iov.html | 5 +- .../appdev/refs/api/krb5_c_encrypt_length.html | 5 +- .../appdev/refs/api/krb5_c_enctype_compare.html | 5 +- doc/html/appdev/refs/api/krb5_c_free_state.html | 5 +- doc/html/appdev/refs/api/krb5_c_fx_cf2_simple.html | 5 +- doc/html/appdev/refs/api/krb5_c_init_state.html | 5 +- .../refs/api/krb5_c_is_coll_proof_cksum.html | 5 +- .../appdev/refs/api/krb5_c_is_keyed_cksum.html | 5 +- .../refs/api/krb5_c_keyed_checksum_types.html | 5 +- doc/html/appdev/refs/api/krb5_c_keylengths.html | 5 +- doc/html/appdev/refs/api/krb5_c_make_checksum.html | 5 +- .../appdev/refs/api/krb5_c_make_checksum_iov.html | 5 +- .../appdev/refs/api/krb5_c_make_random_key.html | 5 +- .../appdev/refs/api/krb5_c_padding_length.html | 5 +- doc/html/appdev/refs/api/krb5_c_prf.html | 5 +- doc/html/appdev/refs/api/krb5_c_prf_length.html | 5 +- doc/html/appdev/refs/api/krb5_c_prfplus.html | 5 +- .../appdev/refs/api/krb5_c_random_add_entropy.html | 5 +- .../appdev/refs/api/krb5_c_random_make_octets.html | 5 +- .../appdev/refs/api/krb5_c_random_os_entropy.html | 5 +- doc/html/appdev/refs/api/krb5_c_random_seed.html | 5 +- doc/html/appdev/refs/api/krb5_c_random_to_key.html | 5 +- doc/html/appdev/refs/api/krb5_c_string_to_key.html | 5 +- .../refs/api/krb5_c_string_to_key_with_params.html | 5 +- .../appdev/refs/api/krb5_c_valid_cksumtype.html | 5 +- doc/html/appdev/refs/api/krb5_c_valid_enctype.html | 5 +- .../appdev/refs/api/krb5_c_verify_checksum.html | 5 +- .../refs/api/krb5_c_verify_checksum_iov.html | 5 +- .../appdev/refs/api/krb5_calculate_checksum.html | 5 +- doc/html/appdev/refs/api/krb5_cc_cache_match.html | 5 +- doc/html/appdev/refs/api/krb5_cc_close.html | 5 +- doc/html/appdev/refs/api/krb5_cc_copy_creds.html | 5 +- doc/html/appdev/refs/api/krb5_cc_default.html | 5 +- doc/html/appdev/refs/api/krb5_cc_default_name.html | 5 +- doc/html/appdev/refs/api/krb5_cc_destroy.html | 5 +- doc/html/appdev/refs/api/krb5_cc_dup.html | 5 +- doc/html/appdev/refs/api/krb5_cc_end_seq_get.html | 5 +- doc/html/appdev/refs/api/krb5_cc_gen_new.html | 5 +- doc/html/appdev/refs/api/krb5_cc_get_config.html | 5 +- doc/html/appdev/refs/api/krb5_cc_get_flags.html | 5 +- .../appdev/refs/api/krb5_cc_get_full_name.html | 5 +- doc/html/appdev/refs/api/krb5_cc_get_name.html | 5 +- .../appdev/refs/api/krb5_cc_get_principal.html | 5 +- doc/html/appdev/refs/api/krb5_cc_get_type.html | 5 +- doc/html/appdev/refs/api/krb5_cc_initialize.html | 5 +- .../appdev/refs/api/krb5_cc_last_change_time.html | 5 +- doc/html/appdev/refs/api/krb5_cc_lock.html | 5 +- doc/html/appdev/refs/api/krb5_cc_move.html | 5 +- doc/html/appdev/refs/api/krb5_cc_new_unique.html | 5 +- doc/html/appdev/refs/api/krb5_cc_next_cred.html | 5 +- doc/html/appdev/refs/api/krb5_cc_remove_cred.html | 5 +- doc/html/appdev/refs/api/krb5_cc_resolve.html | 5 +- .../appdev/refs/api/krb5_cc_retrieve_cred.html | 5 +- doc/html/appdev/refs/api/krb5_cc_select.html | 5 +- doc/html/appdev/refs/api/krb5_cc_set_config.html | 5 +- .../appdev/refs/api/krb5_cc_set_default_name.html | 5 +- doc/html/appdev/refs/api/krb5_cc_set_flags.html | 5 +- .../appdev/refs/api/krb5_cc_start_seq_get.html | 5 +- doc/html/appdev/refs/api/krb5_cc_store_cred.html | 5 +- .../appdev/refs/api/krb5_cc_support_switch.html | 5 +- doc/html/appdev/refs/api/krb5_cc_switch.html | 5 +- doc/html/appdev/refs/api/krb5_cc_unlock.html | 5 +- .../appdev/refs/api/krb5_cccol_cursor_free.html | 5 +- .../appdev/refs/api/krb5_cccol_cursor_new.html | 5 +- .../appdev/refs/api/krb5_cccol_cursor_next.html | 5 +- .../appdev/refs/api/krb5_cccol_have_content.html | 5 +- .../refs/api/krb5_cccol_last_change_time.html | 5 +- doc/html/appdev/refs/api/krb5_cccol_lock.html | 5 +- doc/html/appdev/refs/api/krb5_cccol_unlock.html | 5 +- doc/html/appdev/refs/api/krb5_change_password.html | 5 +- doc/html/appdev/refs/api/krb5_check_clockskew.html | 5 +- doc/html/appdev/refs/api/krb5_checksum_size.html | 5 +- doc/html/appdev/refs/api/krb5_chpw_message.html | 5 +- .../appdev/refs/api/krb5_cksumtype_to_string.html | 5 +- .../appdev/refs/api/krb5_clear_error_message.html | 5 +- doc/html/appdev/refs/api/krb5_copy_addresses.html | 5 +- doc/html/appdev/refs/api/krb5_copy_authdata.html | 5 +- .../appdev/refs/api/krb5_copy_authenticator.html | 5 +- doc/html/appdev/refs/api/krb5_copy_checksum.html | 5 +- doc/html/appdev/refs/api/krb5_copy_context.html | 5 +- doc/html/appdev/refs/api/krb5_copy_creds.html | 5 +- doc/html/appdev/refs/api/krb5_copy_data.html | 5 +- .../appdev/refs/api/krb5_copy_error_message.html | 5 +- doc/html/appdev/refs/api/krb5_copy_keyblock.html | 5 +- .../refs/api/krb5_copy_keyblock_contents.html | 5 +- doc/html/appdev/refs/api/krb5_copy_principal.html | 5 +- doc/html/appdev/refs/api/krb5_copy_ticket.html | 5 +- .../refs/api/krb5_decode_authdata_container.html | 5 +- doc/html/appdev/refs/api/krb5_decode_ticket.html | 5 +- doc/html/appdev/refs/api/krb5_decrypt.html | 5 +- .../appdev/refs/api/krb5_deltat_to_string.html | 5 +- doc/html/appdev/refs/api/krb5_eblock_enctype.html | 5 +- .../refs/api/krb5_encode_authdata_container.html | 5 +- doc/html/appdev/refs/api/krb5_encrypt.html | 5 +- doc/html/appdev/refs/api/krb5_encrypt_size.html | 5 +- doc/html/appdev/refs/api/krb5_enctype_to_name.html | 5 +- .../appdev/refs/api/krb5_enctype_to_string.html | 5 +- doc/html/appdev/refs/api/krb5_expand_hostname.html | 5 +- doc/html/appdev/refs/api/krb5_find_authdata.html | 5 +- doc/html/appdev/refs/api/krb5_finish_key.html | 5 +- .../appdev/refs/api/krb5_finish_random_key.html | 5 +- doc/html/appdev/refs/api/krb5_free_addresses.html | 5 +- .../appdev/refs/api/krb5_free_ap_rep_enc_part.html | 5 +- doc/html/appdev/refs/api/krb5_free_authdata.html | 5 +- .../appdev/refs/api/krb5_free_authenticator.html | 5 +- doc/html/appdev/refs/api/krb5_free_checksum.html | 5 +- .../refs/api/krb5_free_checksum_contents.html | 5 +- doc/html/appdev/refs/api/krb5_free_cksumtypes.html | 5 +- doc/html/appdev/refs/api/krb5_free_context.html | 5 +- .../appdev/refs/api/krb5_free_cred_contents.html | 5 +- doc/html/appdev/refs/api/krb5_free_creds.html | 5 +- doc/html/appdev/refs/api/krb5_free_data.html | 5 +- .../appdev/refs/api/krb5_free_data_contents.html | 5 +- .../appdev/refs/api/krb5_free_default_realm.html | 5 +- doc/html/appdev/refs/api/krb5_free_enctypes.html | 5 +- doc/html/appdev/refs/api/krb5_free_error.html | 5 +- .../appdev/refs/api/krb5_free_error_message.html | 5 +- doc/html/appdev/refs/api/krb5_free_host_realm.html | 5 +- doc/html/appdev/refs/api/krb5_free_keyblock.html | 5 +- .../refs/api/krb5_free_keyblock_contents.html | 5 +- .../refs/api/krb5_free_keytab_entry_contents.html | 5 +- doc/html/appdev/refs/api/krb5_free_principal.html | 5 +- doc/html/appdev/refs/api/krb5_free_string.html | 5 +- doc/html/appdev/refs/api/krb5_free_tgt_creds.html | 5 +- doc/html/appdev/refs/api/krb5_free_ticket.html | 5 +- .../appdev/refs/api/krb5_free_unparsed_name.html | 5 +- doc/html/appdev/refs/api/krb5_fwd_tgt_creds.html | 7 +- doc/html/appdev/refs/api/krb5_get_credentials.html | 5 +- .../refs/api/krb5_get_credentials_renew.html | 5 +- .../refs/api/krb5_get_credentials_validate.html | 5 +- .../appdev/refs/api/krb5_get_default_realm.html | 5 +- .../appdev/refs/api/krb5_get_error_message.html | 5 +- .../refs/api/krb5_get_fallback_host_realm.html | 5 +- doc/html/appdev/refs/api/krb5_get_host_realm.html | 5 +- .../refs/api/krb5_get_in_tkt_with_keytab.html | 5 +- .../refs/api/krb5_get_in_tkt_with_password.html | 5 +- .../appdev/refs/api/krb5_get_in_tkt_with_skey.html | 5 +- .../refs/api/krb5_get_init_creds_keytab.html | 5 +- .../refs/api/krb5_get_init_creds_opt_alloc.html | 5 +- .../refs/api/krb5_get_init_creds_opt_free.html | 5 +- .../krb5_get_init_creds_opt_get_fast_flags.html | 5 +- .../refs/api/krb5_get_init_creds_opt_init.html | 5 +- .../krb5_get_init_creds_opt_set_address_list.html | 5 +- .../api/krb5_get_init_creds_opt_set_anonymous.html | 5 +- .../krb5_get_init_creds_opt_set_canonicalize.html | 5 +- ..._init_creds_opt_set_change_password_prompt.html | 5 +- .../krb5_get_init_creds_opt_set_etype_list.html | 5 +- ...rb5_get_init_creds_opt_set_expire_callback.html | 5 +- .../krb5_get_init_creds_opt_set_fast_ccache.html | 5 +- ...b5_get_init_creds_opt_set_fast_ccache_name.html | 5 +- .../krb5_get_init_creds_opt_set_fast_flags.html | 5 +- .../krb5_get_init_creds_opt_set_forwardable.html | 5 +- .../api/krb5_get_init_creds_opt_set_in_ccache.html | 5 +- .../krb5_get_init_creds_opt_set_out_ccache.html | 5 +- .../refs/api/krb5_get_init_creds_opt_set_pa.html | 5 +- .../krb5_get_init_creds_opt_set_pac_request.html | 5 +- .../krb5_get_init_creds_opt_set_preauth_list.html | 5 +- .../api/krb5_get_init_creds_opt_set_proxiable.html | 5 +- .../krb5_get_init_creds_opt_set_renew_life.html | 5 +- .../api/krb5_get_init_creds_opt_set_responder.html | 5 +- .../refs/api/krb5_get_init_creds_opt_set_salt.html | 5 +- .../api/krb5_get_init_creds_opt_set_tkt_life.html | 5 +- .../refs/api/krb5_get_init_creds_password.html | 5 +- .../refs/api/krb5_get_permitted_enctypes.html | 5 +- doc/html/appdev/refs/api/krb5_get_profile.html | 5 +- .../appdev/refs/api/krb5_get_prompt_types.html | 5 +- .../appdev/refs/api/krb5_get_renewed_creds.html | 5 +- .../appdev/refs/api/krb5_get_server_rcache.html | 5 +- .../appdev/refs/api/krb5_get_time_offsets.html | 5 +- .../appdev/refs/api/krb5_get_validated_creds.html | 5 +- doc/html/appdev/refs/api/krb5_init_context.html | 5 +- .../appdev/refs/api/krb5_init_context_profile.html | 5 +- doc/html/appdev/refs/api/krb5_init_creds_free.html | 7 +- doc/html/appdev/refs/api/krb5_init_creds_get.html | 7 +- .../appdev/refs/api/krb5_init_creds_get_creds.html | 5 +- .../appdev/refs/api/krb5_init_creds_get_error.html | 5 +- .../appdev/refs/api/krb5_init_creds_get_times.html | 5 +- doc/html/appdev/refs/api/krb5_init_creds_init.html | 6 +- .../refs/api/krb5_init_creds_set_keytab.html | 5 +- .../refs/api/krb5_init_creds_set_password.html | 5 +- .../refs/api/krb5_init_creds_set_service.html | 7 +- doc/html/appdev/refs/api/krb5_init_creds_step.html | 7 +- doc/html/appdev/refs/api/krb5_init_keyblock.html | 5 +- doc/html/appdev/refs/api/krb5_init_random_key.html | 5 +- .../appdev/refs/api/krb5_init_secure_context.html | 5 +- .../appdev/refs/api/krb5_is_config_principal.html | 5 +- .../appdev/refs/api/krb5_is_referral_realm.html | 5 +- doc/html/appdev/refs/api/krb5_is_thread_safe.html | 5 +- doc/html/appdev/refs/api/krb5_k_create_key.html | 5 +- doc/html/appdev/refs/api/krb5_k_decrypt.html | 5 +- doc/html/appdev/refs/api/krb5_k_decrypt_iov.html | 5 +- doc/html/appdev/refs/api/krb5_k_encrypt.html | 5 +- doc/html/appdev/refs/api/krb5_k_encrypt_iov.html | 5 +- doc/html/appdev/refs/api/krb5_k_free_key.html | 5 +- doc/html/appdev/refs/api/krb5_k_key_enctype.html | 5 +- doc/html/appdev/refs/api/krb5_k_key_keyblock.html | 5 +- doc/html/appdev/refs/api/krb5_k_make_checksum.html | 5 +- .../appdev/refs/api/krb5_k_make_checksum_iov.html | 5 +- doc/html/appdev/refs/api/krb5_k_prf.html | 5 +- doc/html/appdev/refs/api/krb5_k_reference_key.html | 5 +- .../appdev/refs/api/krb5_k_verify_checksum.html | 5 +- .../refs/api/krb5_k_verify_checksum_iov.html | 5 +- doc/html/appdev/refs/api/krb5_kt_add_entry.html | 5 +- .../appdev/refs/api/krb5_kt_client_default.html | 5 +- doc/html/appdev/refs/api/krb5_kt_close.html | 5 +- doc/html/appdev/refs/api/krb5_kt_default.html | 5 +- doc/html/appdev/refs/api/krb5_kt_default_name.html | 5 +- doc/html/appdev/refs/api/krb5_kt_dup.html | 5 +- doc/html/appdev/refs/api/krb5_kt_end_seq_get.html | 5 +- doc/html/appdev/refs/api/krb5_kt_free_entry.html | 5 +- doc/html/appdev/refs/api/krb5_kt_get_entry.html | 5 +- doc/html/appdev/refs/api/krb5_kt_get_name.html | 5 +- doc/html/appdev/refs/api/krb5_kt_get_type.html | 5 +- doc/html/appdev/refs/api/krb5_kt_have_content.html | 5 +- doc/html/appdev/refs/api/krb5_kt_next_entry.html | 5 +- .../appdev/refs/api/krb5_kt_read_service_key.html | 5 +- doc/html/appdev/refs/api/krb5_kt_remove_entry.html | 5 +- doc/html/appdev/refs/api/krb5_kt_resolve.html | 5 +- .../appdev/refs/api/krb5_kt_start_seq_get.html | 5 +- doc/html/appdev/refs/api/krb5_kuserok.html | 5 +- .../refs/api/krb5_make_authdata_kdc_issued.html | 5 +- doc/html/appdev/refs/api/krb5_merge_authdata.html | 5 +- doc/html/appdev/refs/api/krb5_mk_1cred.html | 5 +- doc/html/appdev/refs/api/krb5_mk_error.html | 5 +- doc/html/appdev/refs/api/krb5_mk_ncred.html | 5 +- doc/html/appdev/refs/api/krb5_mk_priv.html | 5 +- doc/html/appdev/refs/api/krb5_mk_rep.html | 5 +- doc/html/appdev/refs/api/krb5_mk_rep_dce.html | 5 +- doc/html/appdev/refs/api/krb5_mk_req.html | 7 +- doc/html/appdev/refs/api/krb5_mk_req_extended.html | 5 +- doc/html/appdev/refs/api/krb5_mk_safe.html | 5 +- doc/html/appdev/refs/api/krb5_os_localaddr.html | 5 +- doc/html/appdev/refs/api/krb5_pac_add_buffer.html | 5 +- doc/html/appdev/refs/api/krb5_pac_free.html | 5 +- doc/html/appdev/refs/api/krb5_pac_get_buffer.html | 5 +- doc/html/appdev/refs/api/krb5_pac_get_types.html | 5 +- doc/html/appdev/refs/api/krb5_pac_init.html | 5 +- doc/html/appdev/refs/api/krb5_pac_parse.html | 5 +- doc/html/appdev/refs/api/krb5_pac_sign.html | 5 +- doc/html/appdev/refs/api/krb5_pac_verify.html | 7 +- doc/html/appdev/refs/api/krb5_parse_name.html | 5 +- .../appdev/refs/api/krb5_parse_name_flags.html | 5 +- .../refs/api/krb5_prepend_error_message.html | 5 +- doc/html/appdev/refs/api/krb5_principal2salt.html | 5 +- .../appdev/refs/api/krb5_principal_compare.html | 5 +- .../refs/api/krb5_principal_compare_any_realm.html | 5 +- .../refs/api/krb5_principal_compare_flags.html | 5 +- doc/html/appdev/refs/api/krb5_process_key.html | 5 +- doc/html/appdev/refs/api/krb5_prompter_posix.html | 5 +- doc/html/appdev/refs/api/krb5_random_key.html | 5 +- doc/html/appdev/refs/api/krb5_rd_cred.html | 5 +- doc/html/appdev/refs/api/krb5_rd_error.html | 5 +- doc/html/appdev/refs/api/krb5_rd_priv.html | 5 +- doc/html/appdev/refs/api/krb5_rd_rep.html | 5 +- doc/html/appdev/refs/api/krb5_rd_rep_dce.html | 5 +- doc/html/appdev/refs/api/krb5_rd_req.html | 5 +- doc/html/appdev/refs/api/krb5_rd_safe.html | 5 +- doc/html/appdev/refs/api/krb5_read_password.html | 5 +- doc/html/appdev/refs/api/krb5_realm_compare.html | 5 +- doc/html/appdev/refs/api/krb5_recvauth.html | 5 +- .../appdev/refs/api/krb5_recvauth_version.html | 5 +- .../refs/api/krb5_responder_get_challenge.html | 5 +- .../refs/api/krb5_responder_list_questions.html | 5 +- .../api/krb5_responder_otp_challenge_free.html | 5 +- .../refs/api/krb5_responder_otp_get_challenge.html | 5 +- .../refs/api/krb5_responder_otp_set_answer.html | 5 +- .../api/krb5_responder_pkinit_challenge_free.html | 5 +- .../api/krb5_responder_pkinit_get_challenge.html | 5 +- .../refs/api/krb5_responder_pkinit_set_answer.html | 5 +- .../appdev/refs/api/krb5_responder_set_answer.html | 5 +- .../appdev/refs/api/krb5_salttype_to_string.html | 5 +- doc/html/appdev/refs/api/krb5_sendauth.html | 5 +- .../api/krb5_server_decrypt_ticket_keytab.html | 5 +- .../appdev/refs/api/krb5_set_default_realm.html | 5 +- .../refs/api/krb5_set_default_tgs_enctypes.html | 5 +- .../appdev/refs/api/krb5_set_error_message.html | 5 +- .../appdev/refs/api/krb5_set_kdc_recv_hook.html | 5 +- .../appdev/refs/api/krb5_set_kdc_send_hook.html | 5 +- doc/html/appdev/refs/api/krb5_set_password.html | 5 +- .../refs/api/krb5_set_password_using_ccache.html | 5 +- .../appdev/refs/api/krb5_set_principal_realm.html | 5 +- doc/html/appdev/refs/api/krb5_set_real_time.html | 5 +- .../appdev/refs/api/krb5_set_trace_callback.html | 5 +- .../appdev/refs/api/krb5_set_trace_filename.html | 5 +- doc/html/appdev/refs/api/krb5_sname_match.html | 5 +- .../appdev/refs/api/krb5_sname_to_principal.html | 5 +- .../appdev/refs/api/krb5_string_to_cksumtype.html | 5 +- .../appdev/refs/api/krb5_string_to_deltat.html | 5 +- .../appdev/refs/api/krb5_string_to_enctype.html | 5 +- doc/html/appdev/refs/api/krb5_string_to_key.html | 5 +- .../appdev/refs/api/krb5_string_to_salttype.html | 5 +- .../appdev/refs/api/krb5_string_to_timestamp.html | 5 +- doc/html/appdev/refs/api/krb5_timeofday.html | 5 +- .../refs/api/krb5_timestamp_to_sfstring.html | 5 +- .../appdev/refs/api/krb5_timestamp_to_string.html | 5 +- doc/html/appdev/refs/api/krb5_tkt_creds_free.html | 5 +- doc/html/appdev/refs/api/krb5_tkt_creds_get.html | 5 +- .../appdev/refs/api/krb5_tkt_creds_get_creds.html | 5 +- .../appdev/refs/api/krb5_tkt_creds_get_times.html | 5 +- doc/html/appdev/refs/api/krb5_tkt_creds_init.html | 5 +- doc/html/appdev/refs/api/krb5_tkt_creds_step.html | 5 +- doc/html/appdev/refs/api/krb5_unparse_name.html | 5 +- .../appdev/refs/api/krb5_unparse_name_ext.html | 5 +- .../appdev/refs/api/krb5_unparse_name_flags.html | 5 +- .../refs/api/krb5_unparse_name_flags_ext.html | 5 +- doc/html/appdev/refs/api/krb5_us_timeofday.html | 5 +- doc/html/appdev/refs/api/krb5_use_enctype.html | 5 +- .../refs/api/krb5_verify_authdata_kdc_issued.html | 5 +- doc/html/appdev/refs/api/krb5_verify_checksum.html | 5 +- .../appdev/refs/api/krb5_verify_init_creds.html | 5 +- .../refs/api/krb5_verify_init_creds_opt_init.html | 5 +- ...b5_verify_init_creds_opt_set_ap_req_nofail.html | 5 +- .../refs/api/krb5_vprepend_error_message.html | 5 +- .../appdev/refs/api/krb5_vset_error_message.html | 5 +- .../appdev/refs/api/krb5_vwrap_error_message.html | 5 +- .../appdev/refs/api/krb5_wrap_error_message.html | 5 +- doc/html/appdev/refs/index.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_ADDRPORT.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_CHAOS.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_DDP.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_INET.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_INET6.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_IPPORT.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_ISO.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_IS_LOCAL.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_NETBIOS.html | 5 +- doc/html/appdev/refs/macros/ADDRTYPE_XNS.html | 5 +- doc/html/appdev/refs/macros/AD_TYPE_EXTERNAL.html | 5 +- .../refs/macros/AD_TYPE_FIELD_TYPE_MASK.html | 5 +- .../appdev/refs/macros/AD_TYPE_REGISTERED.html | 5 +- doc/html/appdev/refs/macros/AD_TYPE_RESERVED.html | 5 +- .../refs/macros/AP_OPTS_ETYPE_NEGOTIATION.html | 5 +- .../refs/macros/AP_OPTS_MUTUAL_REQUIRED.html | 5 +- doc/html/appdev/refs/macros/AP_OPTS_RESERVED.html | 5 +- .../refs/macros/AP_OPTS_USE_SESSION_KEY.html | 5 +- .../appdev/refs/macros/AP_OPTS_USE_SUBKEY.html | 5 +- doc/html/appdev/refs/macros/AP_OPTS_WIRE_MASK.html | 5 +- .../refs/macros/CKSUMTYPE_CMAC_CAMELLIA128.html | 5 +- .../refs/macros/CKSUMTYPE_CMAC_CAMELLIA256.html | 5 +- doc/html/appdev/refs/macros/CKSUMTYPE_CRC32.html | 5 +- doc/html/appdev/refs/macros/CKSUMTYPE_DESCBC.html | 5 +- .../refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR.html | 5 +- .../refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128.html | 5 +- .../refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256.html | 5 +- .../refs/macros/CKSUMTYPE_HMAC_SHA1_DES3.html | 5 +- .../macros/CKSUMTYPE_HMAC_SHA256_128_AES128.html | 5 +- .../macros/CKSUMTYPE_HMAC_SHA384_192_AES256.html | 5 +- .../refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR.html | 5 +- .../appdev/refs/macros/CKSUMTYPE_NIST_SHA.html | 5 +- doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD4.html | 5 +- .../appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES.html | 5 +- doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD5.html | 5 +- .../appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES.html | 5 +- .../macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96.html | 5 +- .../macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128.html | 5 +- .../macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96.html | 5 +- .../macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192.html | 5 +- .../appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC.html | 5 +- .../refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP.html | 5 +- .../refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC.html | 5 +- .../refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC.html | 5 +- .../appdev/refs/macros/ENCTYPE_DES3_CBC_ENV.html | 5 +- .../appdev/refs/macros/ENCTYPE_DES3_CBC_RAW.html | 5 +- .../appdev/refs/macros/ENCTYPE_DES3_CBC_SHA.html | 5 +- .../appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1.html | 5 +- .../appdev/refs/macros/ENCTYPE_DES_CBC_CRC.html | 5 +- .../appdev/refs/macros/ENCTYPE_DES_CBC_MD4.html | 5 +- .../appdev/refs/macros/ENCTYPE_DES_CBC_MD5.html | 5 +- .../appdev/refs/macros/ENCTYPE_DES_CBC_RAW.html | 5 +- .../appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1.html | 5 +- .../appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS.html | 5 +- .../appdev/refs/macros/ENCTYPE_MD5_RSA_CMS.html | 5 +- doc/html/appdev/refs/macros/ENCTYPE_NULL.html | 5 +- .../appdev/refs/macros/ENCTYPE_RC2_CBC_ENV.html | 5 +- doc/html/appdev/refs/macros/ENCTYPE_RSA_ENV.html | 5 +- .../refs/macros/ENCTYPE_RSA_ES_OAEP_ENV.html | 5 +- .../appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS.html | 5 +- doc/html/appdev/refs/macros/ENCTYPE_UNKNOWN.html | 5 +- .../appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE.html | 5 +- .../appdev/refs/macros/KDC_OPT_CANONICALIZE.html | 5 +- .../refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT.html | 5 +- .../macros/KDC_OPT_DISABLE_TRANSITED_CHECK.html | 5 +- .../refs/macros/KDC_OPT_ENC_TKT_IN_SKEY.html | 5 +- .../appdev/refs/macros/KDC_OPT_FORWARDABLE.html | 5 +- doc/html/appdev/refs/macros/KDC_OPT_FORWARDED.html | 5 +- doc/html/appdev/refs/macros/KDC_OPT_POSTDATED.html | 5 +- doc/html/appdev/refs/macros/KDC_OPT_PROXIABLE.html | 5 +- doc/html/appdev/refs/macros/KDC_OPT_PROXY.html | 5 +- doc/html/appdev/refs/macros/KDC_OPT_RENEW.html | 5 +- doc/html/appdev/refs/macros/KDC_OPT_RENEWABLE.html | 5 +- .../appdev/refs/macros/KDC_OPT_RENEWABLE_OK.html | 5 +- .../refs/macros/KDC_OPT_REQUEST_ANONYMOUS.html | 5 +- doc/html/appdev/refs/macros/KDC_OPT_VALIDATE.html | 5 +- .../appdev/refs/macros/KDC_TKT_COMMON_MASK.html | 5 +- .../KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE.html | 5 +- .../refs/macros/KRB5_ANONYMOUS_PRINCSTR.html | 5 +- .../refs/macros/KRB5_ANONYMOUS_REALMSTR.html | 5 +- doc/html/appdev/refs/macros/KRB5_AP_REP.html | 5 +- doc/html/appdev/refs/macros/KRB5_AP_REQ.html | 5 +- doc/html/appdev/refs/macros/KRB5_AS_REP.html | 5 +- doc/html/appdev/refs/macros/KRB5_AS_REQ.html | 5 +- .../appdev/refs/macros/KRB5_AUTHDATA_AND_OR.html | 5 +- .../refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR.html | 5 +- .../appdev/refs/macros/KRB5_AUTHDATA_CAMMAC.html | 5 +- .../macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION.html | 5 +- .../appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR.html | 5 +- .../refs/macros/KRB5_AUTHDATA_IF_RELEVANT.html | 5 +- .../macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS.html | 5 +- .../refs/macros/KRB5_AUTHDATA_KDC_ISSUED.html | 5 +- .../macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC.html | 5 +- .../appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE.html | 5 +- .../appdev/refs/macros/KRB5_AUTHDATA_SESAME.html | 5 +- .../refs/macros/KRB5_AUTHDATA_SIGNTICKET.html | 5 +- .../refs/macros/KRB5_AUTHDATA_WIN2K_PAC.html | 5 +- .../refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE.html | 5 +- .../refs/macros/KRB5_AUTH_CONTEXT_DO_TIME.html | 5 +- .../KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR.html | 5 +- ...KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR.html | 5 +- .../KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR.html | 5 +- ...RB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR.html | 5 +- .../refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL.html | 5 +- .../macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE.html | 5 +- .../refs/macros/KRB5_AUTH_CONTEXT_RET_TIME.html | 5 +- .../refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY.html | 5 +- doc/html/appdev/refs/macros/KRB5_CRED.html | 5 +- .../refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM.html | 5 +- .../appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA.html | 5 +- .../appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY.html | 5 +- .../refs/macros/KRB5_CRYPTO_TYPE_HEADER.html | 5 +- .../refs/macros/KRB5_CRYPTO_TYPE_PADDING.html | 5 +- .../refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY.html | 5 +- .../refs/macros/KRB5_CRYPTO_TYPE_STREAM.html | 5 +- .../refs/macros/KRB5_CRYPTO_TYPE_TRAILER.html | 5 +- .../refs/macros/KRB5_CYBERSAFE_SECUREID.html | 5 +- .../refs/macros/KRB5_DOMAIN_X500_COMPRESS.html | 5 +- .../refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP.html | 5 +- doc/html/appdev/refs/macros/KRB5_ERROR.html | 5 +- .../appdev/refs/macros/KRB5_FAST_REQUIRED.html | 5 +- doc/html/appdev/refs/macros/KRB5_GC_CACHED.html | 5 +- .../appdev/refs/macros/KRB5_GC_CANONICALIZE.html | 5 +- .../macros/KRB5_GC_CONSTRAINED_DELEGATION.html | 5 +- .../appdev/refs/macros/KRB5_GC_FORWARDABLE.html | 5 +- doc/html/appdev/refs/macros/KRB5_GC_NO_STORE.html | 5 +- .../refs/macros/KRB5_GC_NO_TRANSIT_CHECK.html | 5 +- doc/html/appdev/refs/macros/KRB5_GC_USER_USER.html | 5 +- .../KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST.html | 5 +- .../macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS.html | 5 +- .../KRB5_GET_INIT_CREDS_OPT_CANONICALIZE.html | 5 +- .../KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT.html | 5 +- .../macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST.html | 5 +- .../KRB5_GET_INIT_CREDS_OPT_FORWARDABLE.html | 5 +- .../KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST.html | 5 +- .../macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE.html | 5 +- .../macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE.html | 5 +- .../refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT.html | 5 +- .../macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE.html | 5 +- .../appdev/refs/macros/KRB5_INIT_CONTEXT_KDC.html | 5 +- .../refs/macros/KRB5_INIT_CONTEXT_SECURE.html | 5 +- .../macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE.html | 5 +- doc/html/appdev/refs/macros/KRB5_INT16_MAX.html | 5 +- doc/html/appdev/refs/macros/KRB5_INT16_MIN.html | 5 +- doc/html/appdev/refs/macros/KRB5_INT32_MAX.html | 5 +- doc/html/appdev/refs/macros/KRB5_INT32_MIN.html | 5 +- .../appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE.html | 5 +- .../macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM.html | 5 +- .../appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM.html | 5 +- .../macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH.html | 5 +- .../macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART.html | 5 +- .../appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ.html | 5 +- .../macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS.html | 5 +- .../appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC.html | 5 +- .../macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT.html | 5 +- .../macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC.html | 5 +- .../appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_FAST_FINISHED.html | 5 +- .../appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC.html | 5 +- .../macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG.html | 5 +- .../macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET.html | 5 +- .../macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM.html | 5 +- .../macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX.html | 5 +- .../KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY.html | 5 +- .../KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST.html | 5 +- .../KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM.html | 5 +- .../KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE.html | 5 +- .../KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY.html | 5 +- .../KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY.html | 5 +- .../macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY.html | 5 +- .../macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY.html | 5 +- .../refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH.html | 5 +- .../macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM.html | 5 +- .../refs/macros/KRB5_KPASSWD_ACCESSDENIED.html | 5 +- .../appdev/refs/macros/KRB5_KPASSWD_AUTHERROR.html | 5 +- .../refs/macros/KRB5_KPASSWD_BAD_VERSION.html | 5 +- .../appdev/refs/macros/KRB5_KPASSWD_HARDERROR.html | 5 +- .../macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED.html | 5 +- .../appdev/refs/macros/KRB5_KPASSWD_MALFORMED.html | 5 +- .../appdev/refs/macros/KRB5_KPASSWD_SOFTERROR.html | 5 +- .../appdev/refs/macros/KRB5_KPASSWD_SUCCESS.html | 5 +- .../refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME.html | 5 +- .../refs/macros/KRB5_LRQ_ALL_LAST_INITIAL.html | 5 +- .../refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL.html | 5 +- .../appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ.html | 5 +- .../appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT.html | 5 +- .../refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED.html | 5 +- .../refs/macros/KRB5_LRQ_ALL_PW_EXPTIME.html | 5 +- doc/html/appdev/refs/macros/KRB5_LRQ_NONE.html | 5 +- .../refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME.html | 5 +- .../refs/macros/KRB5_LRQ_ONE_LAST_INITIAL.html | 5 +- .../refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL.html | 5 +- .../appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ.html | 5 +- .../appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT.html | 5 +- .../refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED.html | 5 +- .../refs/macros/KRB5_LRQ_ONE_PW_EXPTIME.html | 5 +- .../refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL.html | 5 +- .../refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID.html | 5 +- .../appdev/refs/macros/KRB5_NT_MS_PRINCIPAL.html | 5 +- .../refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID.html | 5 +- doc/html/appdev/refs/macros/KRB5_NT_PRINCIPAL.html | 5 +- doc/html/appdev/refs/macros/KRB5_NT_SMTP_NAME.html | 5 +- doc/html/appdev/refs/macros/KRB5_NT_SRV_HST.html | 5 +- doc/html/appdev/refs/macros/KRB5_NT_SRV_INST.html | 5 +- doc/html/appdev/refs/macros/KRB5_NT_SRV_XHST.html | 5 +- doc/html/appdev/refs/macros/KRB5_NT_UID.html | 5 +- doc/html/appdev/refs/macros/KRB5_NT_UNKNOWN.html | 5 +- doc/html/appdev/refs/macros/KRB5_NT_WELLKNOWN.html | 5 +- .../appdev/refs/macros/KRB5_NT_X500_PRINCIPAL.html | 5 +- .../appdev/refs/macros/KRB5_PAC_CLIENT_INFO.html | 5 +- .../refs/macros/KRB5_PAC_CREDENTIALS_INFO.html | 5 +- .../refs/macros/KRB5_PAC_DELEGATION_INFO.html | 5 +- .../appdev/refs/macros/KRB5_PAC_LOGON_INFO.html | 5 +- .../refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM.html | 5 +- .../refs/macros/KRB5_PAC_SERVER_CHECKSUM.html | 5 +- .../appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_AFS3_SALT.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_AP_REQ.html | 5 +- .../refs/macros/KRB5_PADATA_AS_CHECKSUM.html | 5 +- .../macros/KRB5_PADATA_ENCRYPTED_CHALLENGE.html | 5 +- .../macros/KRB5_PADATA_ENC_SANDIA_SECURID.html | 5 +- .../refs/macros/KRB5_PADATA_ENC_TIMESTAMP.html | 5 +- .../refs/macros/KRB5_PADATA_ENC_UNIX_TIME.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_ETYPE_INFO.html | 5 +- .../refs/macros/KRB5_PADATA_ETYPE_INFO2.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_FOR_USER.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_FX_COOKIE.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_FX_ERROR.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_FX_FAST.html | 5 +- .../macros/KRB5_PADATA_GET_FROM_TYPED_DATA.html | 5 +- doc/html/appdev/refs/macros/KRB5_PADATA_NONE.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_OSF_DCE.html | 5 +- .../refs/macros/KRB5_PADATA_OTP_CHALLENGE.html | 5 +- .../refs/macros/KRB5_PADATA_OTP_PIN_CHANGE.html | 5 +- .../refs/macros/KRB5_PADATA_OTP_REQUEST.html | 5 +- .../refs/macros/KRB5_PADATA_PAC_REQUEST.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_PKINIT_KX.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_PK_AS_REP.html | 5 +- .../refs/macros/KRB5_PADATA_PK_AS_REP_OLD.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_PK_AS_REQ.html | 5 +- .../refs/macros/KRB5_PADATA_PK_AS_REQ_OLD.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_PW_SALT.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_REFERRAL.html | 5 +- .../refs/macros/KRB5_PADATA_S4U_X509_USER.html | 5 +- .../refs/macros/KRB5_PADATA_SAM_CHALLENGE.html | 5 +- .../refs/macros/KRB5_PADATA_SAM_CHALLENGE_2.html | 5 +- .../refs/macros/KRB5_PADATA_SAM_REDIRECT.html | 5 +- .../refs/macros/KRB5_PADATA_SAM_RESPONSE.html | 5 +- .../refs/macros/KRB5_PADATA_SAM_RESPONSE_2.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_SESAME.html | 5 +- .../refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO.html | 5 +- .../appdev/refs/macros/KRB5_PADATA_TGS_REQ.html | 5 +- .../macros/KRB5_PADATA_USE_SPECIFIED_KVNO.html | 5 +- .../macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD.html | 5 +- .../macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE.html | 5 +- .../KRB5_PRINCIPAL_COMPARE_IGNORE_REALM.html | 5 +- .../refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8.html | 5 +- .../macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE.html | 5 +- .../macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM.html | 5 +- .../refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM.html | 5 +- .../macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM.html | 5 +- .../macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY.html | 5 +- .../macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM.html | 5 +- .../refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT.html | 5 +- doc/html/appdev/refs/macros/KRB5_PRIV.html | 5 +- .../refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD.html | 5 +- .../KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN.html | 5 +- .../refs/macros/KRB5_PROMPT_TYPE_PASSWORD.html | 5 +- .../refs/macros/KRB5_PROMPT_TYPE_PREAUTH.html | 5 +- doc/html/appdev/refs/macros/KRB5_PVNO.html | 5 +- .../appdev/refs/macros/KRB5_REALM_BRANCH_CHAR.html | 5 +- .../refs/macros/KRB5_RECVAUTH_BADAUTHVERS.html | 5 +- .../refs/macros/KRB5_RECVAUTH_SKIP_VERSION.html | 5 +- .../appdev/refs/macros/KRB5_REFERRAL_REALM.html | 5 +- .../KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN.html | 5 +- .../KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN.html | 5 +- .../macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP.html | 5 +- .../KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN.html | 5 +- .../KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC.html | 5 +- .../macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL.html | 5 +- .../KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL.html | 5 +- ...NDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW.html | 5 +- ...NDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY.html | 5 +- ...SPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED.html | 5 +- .../refs/macros/KRB5_RESPONDER_QUESTION_OTP.html | 5 +- .../macros/KRB5_RESPONDER_QUESTION_PASSWORD.html | 5 +- .../macros/KRB5_RESPONDER_QUESTION_PKINIT.html | 5 +- doc/html/appdev/refs/macros/KRB5_SAFE.html | 5 +- .../refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD.html | 5 +- .../refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD.html | 5 +- .../refs/macros/KRB5_SAM_USE_SAD_AS_KEY.html | 5 +- .../appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT.html | 5 +- .../appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA.html | 5 +- .../appdev/refs/macros/KRB5_TC_MATCH_FLAGS.html | 5 +- .../refs/macros/KRB5_TC_MATCH_FLAGS_EXACT.html | 5 +- .../appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY.html | 5 +- .../appdev/refs/macros/KRB5_TC_MATCH_KTYPE.html | 5 +- .../refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY.html | 5 +- .../appdev/refs/macros/KRB5_TC_MATCH_TIMES.html | 5 +- .../refs/macros/KRB5_TC_MATCH_TIMES_EXACT.html | 5 +- doc/html/appdev/refs/macros/KRB5_TC_NOTICKET.html | 5 +- doc/html/appdev/refs/macros/KRB5_TC_OPENCLOSE.html | 5 +- .../refs/macros/KRB5_TC_SUPPORTED_KTYPES.html | 5 +- doc/html/appdev/refs/macros/KRB5_TGS_NAME.html | 5 +- .../appdev/refs/macros/KRB5_TGS_NAME_SIZE.html | 5 +- doc/html/appdev/refs/macros/KRB5_TGS_REP.html | 5 +- doc/html/appdev/refs/macros/KRB5_TGS_REQ.html | 5 +- .../macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE.html | 5 +- .../KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL.html | 5 +- .../appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR.html | 5 +- .../refs/macros/LR_TYPE_INTERPRETATION_MASK.html | 5 +- .../refs/macros/LR_TYPE_THIS_SERVER_ONLY.html | 5 +- .../appdev/refs/macros/MAX_KEYTAB_NAME_LEN.html | 5 +- doc/html/appdev/refs/macros/MSEC_DIRBIT.html | 5 +- doc/html/appdev/refs/macros/MSEC_VAL_MASK.html | 5 +- .../appdev/refs/macros/SALT_TYPE_AFS_LENGTH.html | 5 +- .../appdev/refs/macros/SALT_TYPE_NO_LENGTH.html | 5 +- doc/html/appdev/refs/macros/THREEPARAMOPEN.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_ANONYMOUS.html | 5 +- .../appdev/refs/macros/TKT_FLG_ENC_PA_REP.html | 5 +- .../appdev/refs/macros/TKT_FLG_FORWARDABLE.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_FORWARDED.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_HW_AUTH.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_INITIAL.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_INVALID.html | 5 +- .../appdev/refs/macros/TKT_FLG_MAY_POSTDATE.html | 5 +- .../appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_POSTDATED.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_PRE_AUTH.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_PROXIABLE.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_PROXY.html | 5 +- doc/html/appdev/refs/macros/TKT_FLG_RENEWABLE.html | 5 +- .../macros/TKT_FLG_TRANSIT_POLICY_CHECKED.html | 5 +- doc/html/appdev/refs/macros/VALID_INT_BITS.html | 5 +- doc/html/appdev/refs/macros/VALID_UINT_BITS.html | 5 +- doc/html/appdev/refs/macros/index.html | 5 +- .../refs/macros/krb524_convert_creds_kdc.html | 5 +- doc/html/appdev/refs/macros/krb524_init_ets.html | 5 +- doc/html/appdev/refs/macros/krb5_const.html | 5 +- .../appdev/refs/macros/krb5_princ_component.html | 5 +- doc/html/appdev/refs/macros/krb5_princ_name.html | 5 +- doc/html/appdev/refs/macros/krb5_princ_realm.html | 5 +- .../appdev/refs/macros/krb5_princ_set_realm.html | 5 +- .../refs/macros/krb5_princ_set_realm_data.html | 5 +- .../refs/macros/krb5_princ_set_realm_length.html | 5 +- doc/html/appdev/refs/macros/krb5_princ_size.html | 5 +- doc/html/appdev/refs/macros/krb5_princ_type.html | 5 +- doc/html/appdev/refs/macros/krb5_roundup.html | 5 +- doc/html/appdev/refs/macros/krb5_x.html | 5 +- doc/html/appdev/refs/macros/krb5_xc.html | 5 +- doc/html/appdev/refs/types/index.html | 5 +- doc/html/appdev/refs/types/krb5_address.html | 5 +- doc/html/appdev/refs/types/krb5_addrtype.html | 5 +- doc/html/appdev/refs/types/krb5_ap_rep.html | 5 +- .../appdev/refs/types/krb5_ap_rep_enc_part.html | 5 +- doc/html/appdev/refs/types/krb5_ap_req.html | 5 +- doc/html/appdev/refs/types/krb5_auth_context.html | 5 +- doc/html/appdev/refs/types/krb5_authdata.html | 5 +- doc/html/appdev/refs/types/krb5_authdatatype.html | 5 +- doc/html/appdev/refs/types/krb5_authenticator.html | 5 +- doc/html/appdev/refs/types/krb5_boolean.html | 5 +- doc/html/appdev/refs/types/krb5_cc_cursor.html | 5 +- doc/html/appdev/refs/types/krb5_ccache.html | 5 +- doc/html/appdev/refs/types/krb5_cccol_cursor.html | 5 +- doc/html/appdev/refs/types/krb5_checksum.html | 5 +- doc/html/appdev/refs/types/krb5_cksumtype.html | 5 +- doc/html/appdev/refs/types/krb5_const_pointer.html | 5 +- .../appdev/refs/types/krb5_const_principal.html | 5 +- doc/html/appdev/refs/types/krb5_context.html | 5 +- doc/html/appdev/refs/types/krb5_cred.html | 5 +- doc/html/appdev/refs/types/krb5_cred_enc_part.html | 5 +- doc/html/appdev/refs/types/krb5_cred_info.html | 5 +- doc/html/appdev/refs/types/krb5_creds.html | 5 +- doc/html/appdev/refs/types/krb5_crypto_iov.html | 5 +- doc/html/appdev/refs/types/krb5_cryptotype.html | 5 +- doc/html/appdev/refs/types/krb5_data.html | 5 +- doc/html/appdev/refs/types/krb5_deltat.html | 5 +- doc/html/appdev/refs/types/krb5_enc_data.html | 5 +- .../appdev/refs/types/krb5_enc_kdc_rep_part.html | 5 +- doc/html/appdev/refs/types/krb5_enc_tkt_part.html | 5 +- doc/html/appdev/refs/types/krb5_encrypt_block.html | 5 +- doc/html/appdev/refs/types/krb5_enctype.html | 5 +- doc/html/appdev/refs/types/krb5_error.html | 5 +- doc/html/appdev/refs/types/krb5_error_code.html | 5 +- .../refs/types/krb5_expire_callback_func.html | 5 +- doc/html/appdev/refs/types/krb5_flags.html | 5 +- .../appdev/refs/types/krb5_get_init_creds_opt.html | 5 +- .../appdev/refs/types/krb5_gic_opt_pa_data.html | 5 +- .../appdev/refs/types/krb5_init_creds_context.html | 5 +- doc/html/appdev/refs/types/krb5_int16.html | 5 +- doc/html/appdev/refs/types/krb5_int32.html | 5 +- doc/html/appdev/refs/types/krb5_kdc_rep.html | 5 +- doc/html/appdev/refs/types/krb5_kdc_req.html | 5 +- doc/html/appdev/refs/types/krb5_key.html | 5 +- doc/html/appdev/refs/types/krb5_keyblock.html | 5 +- doc/html/appdev/refs/types/krb5_keytab.html | 5 +- doc/html/appdev/refs/types/krb5_keytab_entry.html | 5 +- doc/html/appdev/refs/types/krb5_keyusage.html | 5 +- doc/html/appdev/refs/types/krb5_kt_cursor.html | 5 +- doc/html/appdev/refs/types/krb5_kvno.html | 5 +- .../appdev/refs/types/krb5_last_req_entry.html | 5 +- doc/html/appdev/refs/types/krb5_magic.html | 5 +- .../refs/types/krb5_mk_req_checksum_func.html | 5 +- doc/html/appdev/refs/types/krb5_msgtype.html | 5 +- doc/html/appdev/refs/types/krb5_octet.html | 5 +- doc/html/appdev/refs/types/krb5_pa_data.html | 5 +- doc/html/appdev/refs/types/krb5_pa_pac_req.html | 5 +- .../refs/types/krb5_pa_server_referral_data.html | 5 +- .../refs/types/krb5_pa_svr_referral_data.html | 5 +- doc/html/appdev/refs/types/krb5_pac.html | 5 +- doc/html/appdev/refs/types/krb5_pointer.html | 5 +- doc/html/appdev/refs/types/krb5_post_recv_fn.html | 5 +- doc/html/appdev/refs/types/krb5_pre_send_fn.html | 5 +- doc/html/appdev/refs/types/krb5_preauthtype.html | 5 +- doc/html/appdev/refs/types/krb5_principal.html | 5 +- .../appdev/refs/types/krb5_principal_data.html | 5 +- doc/html/appdev/refs/types/krb5_prompt.html | 5 +- doc/html/appdev/refs/types/krb5_prompt_type.html | 5 +- doc/html/appdev/refs/types/krb5_prompter_fct.html | 5 +- doc/html/appdev/refs/types/krb5_pwd_data.html | 5 +- doc/html/appdev/refs/types/krb5_rcache.html | 5 +- doc/html/appdev/refs/types/krb5_replay_data.html | 5 +- .../appdev/refs/types/krb5_responder_context.html | 5 +- doc/html/appdev/refs/types/krb5_responder_fn.html | 5 +- .../refs/types/krb5_responder_otp_challenge.html | 5 +- .../refs/types/krb5_responder_otp_tokeninfo.html | 5 +- .../types/krb5_responder_pkinit_challenge.html | 5 +- .../refs/types/krb5_responder_pkinit_identity.html | 5 +- doc/html/appdev/refs/types/krb5_response.html | 5 +- doc/html/appdev/refs/types/krb5_ticket.html | 5 +- doc/html/appdev/refs/types/krb5_ticket_times.html | 5 +- doc/html/appdev/refs/types/krb5_timestamp.html | 7 +- doc/html/appdev/refs/types/krb5_tkt_authent.html | 5 +- .../appdev/refs/types/krb5_tkt_creds_context.html | 5 +- .../appdev/refs/types/krb5_trace_callback.html | 5 +- doc/html/appdev/refs/types/krb5_trace_info.html | 5 +- doc/html/appdev/refs/types/krb5_transited.html | 5 +- doc/html/appdev/refs/types/krb5_typed_data.html | 5 +- doc/html/appdev/refs/types/krb5_ui_2.html | 5 +- doc/html/appdev/refs/types/krb5_ui_4.html | 5 +- .../refs/types/krb5_verify_init_creds_opt.html | 5 +- .../appdev/refs/types/passwd_phrase_element.html | 5 +- doc/html/appdev/y2038.html | 165 + doc/html/basic/ccache_def.html | 6 +- doc/html/basic/date_format.html | 4 +- doc/html/basic/index.html | 4 +- doc/html/basic/keytab_def.html | 4 +- doc/html/basic/rcache_def.html | 4 +- doc/html/basic/stash_file_def.html | 4 +- doc/html/build/directory_org.html | 4 +- doc/html/build/doing_build.html | 4 +- doc/html/build/index.html | 10 +- doc/html/build/options2configure.html | 7 +- doc/html/build/osconf.html | 4 +- doc/html/build_this.html | 4 +- doc/html/copyright.html | 4 +- doc/html/formats/ccache_file_format.html | 4 +- doc/html/formats/cookie.html | 4 +- doc/html/formats/index.html | 4 +- doc/html/formats/keytab_file_format.html | 4 +- doc/html/genindex-A.html | 4 +- doc/html/genindex-C.html | 4 +- doc/html/genindex-E.html | 4 +- doc/html/genindex-K.html | 4 +- doc/html/genindex-L.html | 4 +- doc/html/genindex-M.html | 4 +- doc/html/genindex-P.html | 4 +- doc/html/genindex-R.html | 4 +- doc/html/genindex-S.html | 4 +- doc/html/genindex-T.html | 4 +- doc/html/genindex-V.html | 4 +- doc/html/genindex-all.html | 4 +- doc/html/genindex.html | 4 +- doc/html/index.html | 14 +- doc/html/mitK5defaults.html | 6 +- doc/html/mitK5features.html | 82 +- doc/html/mitK5license.html | 6 +- doc/html/objects.inv | Bin 24130 -> 24220 bytes doc/html/plugindev/ccselect.html | 7 +- doc/html/plugindev/certauth.html | 170 + doc/html/plugindev/clpreauth.html | 7 +- doc/html/plugindev/general.html | 7 +- doc/html/plugindev/gssapi.html | 7 +- doc/html/plugindev/hostrealm.html | 13 +- doc/html/plugindev/index.html | 10 +- doc/html/plugindev/internal.html | 13 +- doc/html/plugindev/kadm5_auth.html | 177 + doc/html/plugindev/kadm5_hook.html | 13 +- doc/html/plugindev/kdcpolicy.html | 168 + doc/html/plugindev/kdcpreauth.html | 7 +- doc/html/plugindev/localauth.html | 7 +- doc/html/plugindev/locate.html | 7 +- doc/html/plugindev/profile.html | 7 +- doc/html/plugindev/pwqual.html | 7 +- doc/html/resources.html | 4 +- doc/html/search.html | 4 +- doc/html/searchindex.js | 2 +- doc/html/user/index.html | 10 +- doc/html/user/pwd_mgmt.html | 4 +- doc/html/user/tkt_mgmt.html | 4 +- doc/html/user/user_commands/index.html | 4 +- doc/html/user/user_commands/kdestroy.html | 4 +- doc/html/user/user_commands/kinit.html | 4 +- doc/html/user/user_commands/klist.html | 4 +- doc/html/user/user_commands/kpasswd.html | 4 +- doc/html/user/user_commands/krb5-config.html | 4 +- doc/html/user/user_commands/ksu.html | 4 +- doc/html/user/user_commands/kswitch.html | 4 +- doc/html/user/user_commands/kvno.html | 4 +- doc/html/user/user_commands/sclient.html | 4 +- doc/html/user/user_config/index.html | 4 +- doc/html/user/user_config/k5identity.html | 4 +- doc/html/user/user_config/k5login.html | 4 +- doc/mitK5features.rst | 95 +- doc/notice.rst | 2 +- doc/pdf/admin.pdf | Bin 742854 -> 748562 bytes doc/pdf/admin.tex | 163 +- doc/pdf/appdev.pdf | Bin 1445440 -> 1452407 bytes doc/pdf/appdev.tex | 98 +- doc/pdf/basic.pdf | Bin 138064 -> 138061 bytes doc/pdf/basic.tex | 4 +- doc/pdf/build.pdf | Bin 153561 -> 153476 bytes doc/pdf/build.tex | 6 +- doc/pdf/plugindev.pdf | Bin 140040 -> 145446 bytes doc/pdf/plugindev.tex | 85 +- doc/pdf/user.pdf | Bin 200228 -> 200216 bytes doc/pdf/user.tex | 2 +- doc/plugindev/certauth.rst | 27 + doc/plugindev/index.rst | 3 + doc/plugindev/kadm5_auth.rst | 35 + doc/plugindev/kdcpolicy.rst | 24 + src/Makefile.in | 6 +- src/aclocal.m4 | 41 +- src/appl/gss-sample/t_gss_sample.py | 18 +- src/appl/simple/client/sim_client.c | 2 +- src/appl/simple/server/sim_server.c | 3 +- src/appl/user_user/t_user2user.py | 6 +- src/ccapi/server/mac/ccs_os_pipe.c | 4 +- src/clients/kcpytkt/kcpytkt.c | 48 +- src/clients/kdeltkt/kdeltkt.c | 37 +- src/clients/kdestroy/kdestroy.c | 95 +- src/clients/kinit/kinit.c | 490 +- src/clients/kinit/kinit_kdb.c | 34 +- src/clients/klist/klist.c | 462 +- src/clients/kpasswd/Makefile.in | 10 +- src/clients/kpasswd/deps | 4 - src/clients/kpasswd/kpasswd.c | 110 +- src/clients/kpasswd/ksetpwd.c | 309 - src/clients/ksu/ccache.c | 22 +- src/clients/ksu/ksu.h | 2 +- src/clients/ksu/main.c | 2 +- src/clients/kvno/kvno.c | 299 +- src/config/ac-archive/README | 52 +- src/config/ac-archive/acx_pthread.m4 | 239 - src/config/ac-archive/ax_pthread.m4 | 485 + src/config/ac-archive/ax_recursive_eval.m4 | 56 + src/config/ac-archive/relpaths.m4 | 155 - src/config/config.guess | 119 +- src/config/config.sub | 73 +- src/config/post.in | 4 +- src/config/pre.in | 13 +- src/configure | 1198 ++- src/configure.in | 97 +- src/include/Makefile.in | 3 + src/include/autoconf.h.in | 35 +- src/include/fake-addrinfo.h | 2 +- src/include/k5-cmocka.h | 16 + src/include/k5-input.h | 6 +- src/include/k5-int.h | 51 +- src/include/k5-platform.h | 32 +- src/include/k5-thread.h | 16 + src/include/k5-trace.h | 47 +- src/include/k5-utf8.h | 61 +- src/include/kdb.h | 8 +- src/include/kdb_log.h | 5 +- src/include/krb5/certauth_plugin.h | 128 + src/include/krb5/kadm5_auth_plugin.h | 306 + src/include/krb5/kdcpolicy_plugin.h | 128 + src/include/krb5/kdcpreauth_plugin.h | 21 +- src/include/krb5/krb5.hin | 54 +- src/include/net-server.h | 2 +- src/include/socket-utils.h | 11 + src/include/win-mac.h | 2 - src/kadmin/cli/deps | 13 +- src/kadmin/cli/getdate.y | 7 +- src/kadmin/cli/kadmin.c | 5 +- src/kadmin/dbutil/dump.c | 41 +- src/kadmin/dbutil/kdb5_mkey.c | 6 +- src/kadmin/dbutil/tabdump.c | 2 +- src/kadmin/ktutil/ktutil.c | 17 +- src/kadmin/ktutil/ktutil.h | 3 +- src/kadmin/ktutil/ktutil_funcs.c | 17 +- src/kadmin/server/Makefile.in | 6 +- src/kadmin/server/auth.c | 314 + src/kadmin/server/auth.h | 85 + src/kadmin/server/auth_acl.c | 755 ++ src/kadmin/server/auth_self.c | 77 + src/kadmin/server/deps | 109 +- src/kadmin/server/ipropd_svc.c | 38 +- src/kadmin/server/misc.c | 127 +- src/kadmin/server/misc.h | 17 - src/kadmin/server/ovsec_kadmd.c | 8 +- src/kadmin/server/schpw.c | 49 +- src/kadmin/server/server_stubs.c | 340 +- src/kadmin/testing/util/tcl_kadm5.c | 12 +- src/kdc/deps | 40 +- src/kdc/dispatch.c | 19 +- src/kdc/do_as_req.c | 90 +- src/kdc/do_tgs_req.c | 70 +- src/kdc/extern.c | 4 +- src/kdc/fast_util.c | 4 +- src/kdc/kdc_log.c | 29 +- src/kdc/kdc_preauth.c | 35 +- src/kdc/kdc_preauth_ec.c | 41 +- src/kdc/kdc_preauth_encts.c | 9 +- src/kdc/kdc_util.c | 57 +- src/kdc/kdc_util.h | 21 +- src/kdc/main.c | 8 + src/kdc/policy.c | 267 +- src/kdc/policy.h | 19 +- src/kdc/replay.c | 2 +- src/kdc/t_emptytgt.py | 5 +- src/kdc/t_replay.c | 13 +- src/kdc/tgs_policy.c | 13 +- src/lib/apputils/net-server.c | 254 +- src/lib/apputils/udppktinfo.c | 14 +- src/lib/apputils/udppktinfo.h | 2 +- src/lib/crypto/builtin/des/des_int.h | 2 +- src/lib/crypto/builtin/des/destest.c | 3 +- src/lib/crypto/builtin/enc_provider/rc4.c | 2 +- src/lib/crypto/builtin/sha2/sha256.c | 4 +- src/lib/crypto/builtin/sha2/sha512.c | 4 +- src/lib/crypto/krb/Makefile.in | 2 +- src/lib/crypto/krb/crypto_int.h | 1 + src/lib/crypto/krb/enctype_util.c | 16 + src/lib/crypto/krb/etypes.c | 33 +- src/lib/crypto/krb/s2k_des.c | 4 +- src/lib/crypto/krb/s2k_pbkdf2.c | 4 +- src/lib/crypto/krb/s2k_rc4.c | 8 +- src/lib/crypto/krb/string_to_key.c | 7 +- src/lib/crypto/krb/t_fortuna.c | 2 +- src/lib/crypto/libk5crypto.exports | 1 + src/lib/gssapi/generic/gssapi_ext.h | 11 + src/lib/gssapi/generic/gssapi_generic.c | 9 + src/lib/gssapi/krb5/accept_sec_context.c | 8 +- src/lib/gssapi/krb5/acquire_cred.c | 13 +- src/lib/gssapi/krb5/context_time.c | 5 +- src/lib/gssapi/krb5/copy_ccache.c | 10 +- src/lib/gssapi/krb5/export_cred.c | 5 +- src/lib/gssapi/krb5/gssapiP_krb5.h | 12 + src/lib/gssapi/krb5/gssapi_krb5.c | 20 +- src/lib/gssapi/krb5/gssapi_krb5.h | 14 + src/lib/gssapi/krb5/iakerb.c | 4 +- src/lib/gssapi/krb5/init_sec_context.c | 13 +- src/lib/gssapi/krb5/inq_context.c | 29 +- src/lib/gssapi/krb5/inq_cred.c | 46 +- src/lib/gssapi/krb5/k5sealv3.c | 10 +- src/lib/gssapi/krb5/k5unseal.c | 2 +- src/lib/gssapi/krb5/naming_exts.c | 40 +- src/lib/gssapi/krb5/s4u_gss_glue.c | 2 +- src/lib/gssapi/libgssapi_krb5.exports | 2 + src/lib/gssapi/mechglue/g_accept_sec_context.c | 22 +- src/lib/gssapi/mechglue/g_complete_auth_token.c | 2 + src/lib/gssapi/mechglue/g_context_time.c | 2 + src/lib/gssapi/mechglue/g_delete_sec_context.c | 14 +- src/lib/gssapi/mechglue/g_dup_name.c | 2 +- src/lib/gssapi/mechglue/g_exp_sec_context.c | 2 + src/lib/gssapi/mechglue/g_glue.c | 20 +- src/lib/gssapi/mechglue/g_init_sec_context.c | 19 +- src/lib/gssapi/mechglue/g_inq_context.c | 2 + src/lib/gssapi/mechglue/g_inq_cred_oid.c | 5 - src/lib/gssapi/mechglue/g_prf.c | 2 + src/lib/gssapi/mechglue/g_process_context.c | 2 + src/lib/gssapi/mechglue/g_seal.c | 4 + src/lib/gssapi/mechglue/g_sign.c | 2 + src/lib/gssapi/mechglue/g_unseal.c | 2 + src/lib/gssapi/mechglue/g_unwrap_aead.c | 2 + src/lib/gssapi/mechglue/g_unwrap_iov.c | 4 + src/lib/gssapi/mechglue/g_verify.c | 2 + src/lib/gssapi/mechglue/g_wrap_aead.c | 2 + src/lib/gssapi/mechglue/g_wrap_iov.c | 8 + src/lib/gssapi32.def | 3 + src/lib/kadm5/chpass_util.c | 8 +- src/lib/kadm5/deps | 14 +- src/lib/kadm5/kadm_err.et | 1 + src/lib/kadm5/srv/Makefile.in | 20 +- src/lib/kadm5/srv/deps | 21 - src/lib/kadm5/srv/libkadm5srv_mit.exports | 5 - src/lib/kadm5/srv/server_acl.c | 823 -- src/lib/kadm5/srv/server_acl.h | 100 - src/lib/kadm5/srv/server_kdb.c | 2 +- src/lib/kadm5/srv/server_misc.c | 14 + src/lib/kadm5/srv/svr_principal.c | 88 +- src/lib/kadm5/unit-test/setkey-test.c | 3 +- src/lib/kdb/Makefile.in | 2 +- src/lib/kdb/deps | 3 +- src/lib/kdb/kdb5.c | 25 +- src/lib/kdb/kdb_convert.c | 4 +- src/lib/kdb/kdb_default.c | 2 +- src/lib/kdb/t_sort_key_data.c | 5 +- src/lib/krb5/asn.1/asn1_k_encode.c | 3 +- src/lib/krb5/ccache/Makefile.in | 3 + src/lib/krb5/ccache/cc-int.h | 4 + src/lib/krb5/ccache/cc_kcm.c | 4 +- src/lib/krb5/ccache/cc_keyring.c | 14 +- src/lib/krb5/ccache/cc_memory.c | 4 +- src/lib/krb5/ccache/cc_mslsa.c | 1 + src/lib/krb5/ccache/cc_retr.c | 5 +- src/lib/krb5/ccache/ccapi/stdcc_util.c | 40 +- src/lib/krb5/ccache/cccursor.c | 49 +- src/lib/krb5/ccache/ccmarshal.c | 2 +- src/lib/krb5/ccache/ccselect.c | 52 +- src/lib/krb5/ccache/ccselect_hostname.c | 146 + src/lib/krb5/ccache/deps | 11 + src/lib/krb5/keytab/kt_file.c | 8 +- src/lib/krb5/keytab/kt_memory.c | 2 +- src/lib/krb5/keytab/kt_srvtab.c | 2 +- src/lib/krb5/krb/Makefile.in | 14 +- src/lib/krb5/krb/deltat.c | 75 +- src/lib/krb5/krb/deps | 38 +- src/lib/krb5/krb/fwd_tgt.c | 28 +- src/lib/krb5/krb/gc_via_tkt.c | 11 +- src/lib/krb5/krb/gen_save_subkey.c | 3 +- src/lib/krb5/krb/get_creds.c | 15 +- src/lib/krb5/krb/get_in_tkt.c | 294 +- src/lib/krb5/krb/gic_opt.c | 2 +- src/lib/krb5/krb/gic_pwd.c | 4 +- src/lib/krb5/krb/init_creds_ctx.h | 9 +- src/lib/krb5/krb/init_ctx.c | 3 +- src/lib/krb5/krb/int-proto.h | 22 +- src/lib/krb5/krb/mk_req.c | 5 +- src/lib/krb5/krb/pac.c | 9 +- src/lib/krb5/krb/pac_sign.c | 21 +- src/lib/krb5/krb/plugin.c | 5 +- src/lib/krb5/krb/preauth2.c | 311 +- src/lib/krb5/krb/preauth_ec.c | 2 + src/lib/krb5/krb/send_tgs.c | 24 +- src/lib/krb5/krb/sendauth.c | 23 +- src/lib/krb5/krb/str_conv.c | 4 +- src/lib/krb5/krb/t_expire_warn.py | 13 +- src/lib/krb5/krb/t_kerb.c | 12 +- src/lib/krb5/krb/t_parse_host_string.c | 5 +- src/lib/krb5/krb/t_valid_times.c | 109 + src/lib/krb5/krb/valid_times.c | 4 +- src/lib/krb5/krb/vfy_increds.c | 2 +- src/lib/krb5/krb/x-deltat.y | 1 - src/lib/krb5/os/Makefile.in | 2 +- src/lib/krb5/os/accessor.c | 13 +- src/lib/krb5/os/c_ustime.c | 15 +- src/lib/krb5/os/dnsglue.c | 2 +- src/lib/krb5/os/dnsglue.h | 19 +- src/lib/krb5/os/dnssrv.c | 18 +- src/lib/krb5/os/expand_path.c | 2 +- src/lib/krb5/os/genaddrs.c | 8 +- src/lib/krb5/os/hostaddr.c | 4 +- src/lib/krb5/os/localaddr.c | 24 +- src/lib/krb5/os/locate_kdc.c | 43 +- src/lib/krb5/os/sendto_kdc.c | 5 +- src/lib/krb5/os/t_locate_kdc.c | 2 +- src/lib/krb5/os/timeofday.c | 2 +- src/lib/krb5/os/toffset.c | 5 +- src/lib/krb5/os/trace.c | 7 +- src/lib/krb5/os/ustime.c | 9 +- src/lib/krb5/rcache/rc_dfl.c | 15 +- src/lib/krb5/rcache/ser_rc.c | 2 +- src/lib/krb5/rcache/t_replay.c | 8 +- src/lib/krb5/unicode/ure/ure.c | 2 +- src/lib/krb5_32.def | 3 + src/lib/rpc/deps | 3 +- src/lib/rpc/pmap_rmt.c | 6 +- src/man/k5identity.man | 2 +- src/man/k5login.man | 2 +- src/man/k5srvutil.man | 2 +- src/man/kadm5.acl.man | 38 +- src/man/kadmin.man | 9 +- src/man/kadmind.man | 2 +- src/man/kdb5_ldap_util.man | 2 +- src/man/kdb5_util.man | 2 +- src/man/kdc.conf.man | 19 +- src/man/kdestroy.man | 2 +- src/man/kinit.man | 2 +- src/man/klist.man | 2 +- src/man/kpasswd.man | 2 +- src/man/kprop.man | 2 +- src/man/kpropd.man | 7 +- src/man/kproplog.man | 2 +- src/man/krb5-config.man | 2 +- src/man/krb5.conf.man | 63 +- src/man/krb5kdc.man | 2 +- src/man/ksu.man | 2 +- src/man/kswitch.man | 2 +- src/man/ktutil.man | 4 +- src/man/kvno.man | 2 +- src/man/sclient.man | 2 +- src/man/sserver.man | 2 +- src/patchlevel.h | 8 +- src/plugins/audit/kdc_j_encode.c | 29 +- src/plugins/certauth/test/Makefile.in | 20 + src/plugins/certauth/test/certauth_test.exports | 2 + src/plugins/certauth/test/deps | 14 + src/plugins/certauth/test/main.c | 211 + src/plugins/kadm5_auth/test/Makefile.in | 20 + src/plugins/kadm5_auth/test/deps | 22 + .../kadm5_auth/test/kadm5_auth_test.exports | 2 + src/plugins/kadm5_auth/test/main.c | 305 + src/plugins/kdb/db2/db2_exp.c | 5 +- src/plugins/kdb/db2/kdb_db2.c | 13 +- src/plugins/kdb/db2/kdb_db2.h | 5 +- src/plugins/kdb/db2/libdb2/hash/hash.c | 19 +- src/plugins/kdb/db2/lockout.c | 8 +- src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c | 6 +- src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h | 16 +- src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c | 1 - .../kdb/ldap/libkdb_ldap/kerberos.openldap.ldif | 68 + src/plugins/kdb/ldap/libkdb_ldap/ldap_handle.c | 68 - src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c | 98 +- src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 2 +- src/plugins/kdb/ldap/libkdb_ldap/ldap_tkt_policy.c | 2 +- src/plugins/kdb/ldap/libkdb_ldap/lockout.c | 8 +- src/plugins/kdcpolicy/test/Makefile.in | 20 + src/plugins/kdcpolicy/test/deps | 14 + src/plugins/kdcpolicy/test/kdcpolicy_test.exports | 1 + src/plugins/kdcpolicy/test/main.c | 111 + src/plugins/preauth/otp/main.c | 3 +- src/plugins/preauth/pkinit/Makefile.in | 8 +- src/plugins/preauth/pkinit/deps | 11 +- src/plugins/preauth/pkinit/pkinit.h | 10 +- src/plugins/preauth/pkinit/pkinit_clnt.c | 7 + src/plugins/preauth/pkinit/pkinit_crypto.h | 88 +- src/plugins/preauth/pkinit/pkinit_crypto_nss.c | 5800 ------------ src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 838 +- src/plugins/preauth/pkinit/pkinit_crypto_openssl.h | 19 - src/plugins/preauth/pkinit/pkinit_identity.c | 32 - src/plugins/preauth/pkinit/pkinit_matching.c | 177 +- src/plugins/preauth/pkinit/pkinit_srv.c | 448 +- src/plugins/preauth/pkinit/pkinit_trace.h | 78 +- src/plugins/preauth/test/Makefile.in | 4 +- src/plugins/preauth/test/cltest.c | 86 +- src/plugins/preauth/test/common.c | 61 + src/plugins/preauth/test/common.h | 41 + src/plugins/preauth/test/deps | 14 +- src/plugins/preauth/test/kdctest.c | 96 +- src/po/Makefile.in | 2 +- src/po/de.po | 9301 ++++++++++++++++++++ src/po/mit-krb5.pot | 1592 ++-- src/slave/kprop.c | 68 +- src/slave/kprop_util.c | 4 +- src/slave/kpropd.c | 203 +- src/tests/Makefile.in | 27 +- src/tests/create/kdb5_mkdums.c | 2 +- src/tests/dejagnu/pkinit-certs/ca.pem | 54 +- src/tests/dejagnu/pkinit-certs/generic.p12 | Bin 0 -> 2477 bytes src/tests/dejagnu/pkinit-certs/generic.pem | 21 + src/tests/dejagnu/pkinit-certs/kdc.pem | 50 +- src/tests/dejagnu/pkinit-certs/make-certs.sh | 69 +- src/tests/dejagnu/pkinit-certs/privkey-enc.pem | 52 +- src/tests/dejagnu/pkinit-certs/privkey.pem | 50 +- src/tests/dejagnu/pkinit-certs/user-enc.p12 | Bin 3029 -> 2837 bytes src/tests/dejagnu/pkinit-certs/user-upn.p12 | Bin 0 -> 2829 bytes src/tests/dejagnu/pkinit-certs/user-upn.pem | 28 + src/tests/dejagnu/pkinit-certs/user-upn2.p12 | Bin 0 -> 2813 bytes src/tests/dejagnu/pkinit-certs/user-upn2.pem | 28 + src/tests/dejagnu/pkinit-certs/user-upn3.p12 | Bin 0 -> 2829 bytes src/tests/dejagnu/pkinit-certs/user-upn3.pem | 28 + src/tests/dejagnu/pkinit-certs/user.p12 | Bin 3104 -> 2837 bytes src/tests/dejagnu/pkinit-certs/user.pem | 56 +- src/tests/deps | 16 +- src/tests/gssapi/Makefile.in | 27 +- src/tests/gssapi/deps | 7 +- src/tests/gssapi/t_authind.py | 20 +- src/tests/gssapi/t_ccselect.py | 69 +- src/tests/gssapi/t_client_keytab.py | 60 +- src/tests/gssapi/t_enctypes.c | 14 + src/tests/gssapi/t_enctypes.py | 4 +- src/tests/gssapi/t_export_cred.py | 4 +- src/tests/gssapi/t_gssapi.py | 130 +- src/tests/gssapi/t_invalid.c | 57 +- src/tests/gssapi/t_lifetime.c | 140 + src/tests/gssapi/t_s4u.c | 20 + src/tests/gssapi/t_s4u.py | 21 +- src/tests/hammer/kdc5_hammer.c | 47 +- src/tests/icinterleave.c | 128 + src/tests/icred.c | 67 +- src/tests/kdbtest.c | 5 +- src/tests/responder.c | 2 +- src/tests/t_audit.py | 11 +- src/tests/t_authdata.py | 66 +- src/tests/t_ccache.py | 60 +- src/tests/t_certauth.py | 47 + src/tests/t_crossrealm.py | 49 +- src/tests/t_dump.py | 31 +- src/tests/t_general.py | 37 +- src/tests/t_hostrealm.py | 5 +- src/tests/t_iprop.py | 103 +- src/tests/t_kadm5_auth.py | 81 + src/tests/t_kadm5_hook.py | 10 +- src/tests/t_kadmin_acl.py | 269 +- src/tests/t_kadmin_parsing.py | 30 +- src/tests/t_kdb.py | 219 +- src/tests/t_kdb_locking.py | 5 +- src/tests/t_kdcpolicy.py | 62 + src/tests/t_keydata.py | 16 +- src/tests/t_keyrollover.py | 16 +- src/tests/t_keytab.py | 50 +- src/tests/t_kprop.py | 13 +- src/tests/t_localauth.py | 5 +- src/tests/t_mkey.py | 45 +- src/tests/t_otp.py | 10 +- src/tests/t_pkinit.py | 154 +- src/tests/t_policy.py | 101 +- src/tests/t_preauth.py | 183 +- src/tests/t_pwqual.py | 25 +- src/tests/t_referral.py | 18 +- src/tests/t_renew.py | 78 +- src/tests/t_salt.py | 12 +- src/tests/t_skew.py | 22 +- src/tests/t_stringattr.py | 4 +- src/tests/t_y2038.py | 75 + src/util/depfix.pl | 2 +- src/util/k5test.py | 37 +- src/util/profile/prof_parse.c | 6 +- src/util/profile/profile_tcl.c | 2 - src/util/ss/data.c | 3 - src/util/support/Makefile.in | 10 +- src/util/support/cache-addrinfo.h | 12 +- src/util/support/deps | 6 +- src/util/support/fake-addrinfo.c | 16 +- src/util/support/gmt_mktime.c | 17 +- src/util/support/libkrb5support-fixed.exports | 5 +- src/util/support/plugins.c | 5 +- src/util/support/t_utf16.c | 117 + src/util/support/threads.c | 6 - src/util/support/utf8.c | 2 +- src/util/support/utf8_conv.c | 475 +- src/util/verto/README | 2 +- src/util/verto/libverto.exports | 1 + src/util/verto/verto-k5ev.c | 24 +- src/util/verto/verto-libev.c | 5 + src/util/verto/verto.c | 131 +- src/util/verto/verto.h | 20 +- src/windows/cns/tktlist.c | 10 +- src/windows/include/leashwin.h | 12 +- src/windows/leash/KrbListTickets.cpp | 12 +- src/windows/leash/LeashView.cpp | 22 +- src/windows/leashdll/lshfunc.c | 2 +- src/windows/ms2mit/ms2mit.c | 2 +- 1424 files changed, 26823 insertions(+), 16546 deletions(-) create mode 100644 .travis.yml create mode 100644 doc/appdev/y2038.rst create mode 100644 doc/html/_sources/appdev/y2038.txt create mode 100644 doc/html/_sources/plugindev/certauth.txt create mode 100644 doc/html/_sources/plugindev/kadm5_auth.txt create mode 100644 doc/html/_sources/plugindev/kdcpolicy.txt create mode 100644 doc/html/appdev/y2038.html create mode 100644 doc/html/plugindev/certauth.html create mode 100644 doc/html/plugindev/kadm5_auth.html create mode 100644 doc/html/plugindev/kdcpolicy.html create mode 100644 doc/plugindev/certauth.rst create mode 100644 doc/plugindev/kadm5_auth.rst create mode 100644 doc/plugindev/kdcpolicy.rst delete mode 100644 src/clients/kpasswd/ksetpwd.c delete mode 100644 src/config/ac-archive/acx_pthread.m4 create mode 100644 src/config/ac-archive/ax_pthread.m4 create mode 100644 src/config/ac-archive/ax_recursive_eval.m4 delete mode 100644 src/config/ac-archive/relpaths.m4 create mode 100644 src/include/k5-cmocka.h create mode 100644 src/include/krb5/certauth_plugin.h create mode 100644 src/include/krb5/kadm5_auth_plugin.h create mode 100644 src/include/krb5/kdcpolicy_plugin.h create mode 100644 src/kadmin/server/auth.c create mode 100644 src/kadmin/server/auth.h create mode 100644 src/kadmin/server/auth_acl.c create mode 100644 src/kadmin/server/auth_self.c delete mode 100644 src/lib/kadm5/srv/server_acl.c delete mode 100644 src/lib/kadm5/srv/server_acl.h create mode 100644 src/lib/krb5/ccache/ccselect_hostname.c create mode 100644 src/lib/krb5/krb/t_valid_times.c create mode 100644 src/plugins/certauth/test/Makefile.in create mode 100644 src/plugins/certauth/test/certauth_test.exports create mode 100644 src/plugins/certauth/test/deps create mode 100644 src/plugins/certauth/test/main.c create mode 100644 src/plugins/kadm5_auth/test/Makefile.in create mode 100644 src/plugins/kadm5_auth/test/deps create mode 100644 src/plugins/kadm5_auth/test/kadm5_auth_test.exports create mode 100644 src/plugins/kadm5_auth/test/main.c create mode 100644 src/plugins/kdb/ldap/libkdb_ldap/kerberos.openldap.ldif create mode 100644 src/plugins/kdcpolicy/test/Makefile.in create mode 100644 src/plugins/kdcpolicy/test/deps create mode 100644 src/plugins/kdcpolicy/test/kdcpolicy_test.exports create mode 100644 src/plugins/kdcpolicy/test/main.c delete mode 100644 src/plugins/preauth/pkinit/pkinit_crypto_nss.c create mode 100644 src/plugins/preauth/test/common.c create mode 100644 src/plugins/preauth/test/common.h create mode 100644 src/po/de.po create mode 100644 src/tests/dejagnu/pkinit-certs/generic.p12 create mode 100644 src/tests/dejagnu/pkinit-certs/generic.pem create mode 100644 src/tests/dejagnu/pkinit-certs/user-upn.p12 create mode 100644 src/tests/dejagnu/pkinit-certs/user-upn.pem create mode 100644 src/tests/dejagnu/pkinit-certs/user-upn2.p12 create mode 100644 src/tests/dejagnu/pkinit-certs/user-upn2.pem create mode 100644 src/tests/dejagnu/pkinit-certs/user-upn3.p12 create mode 100644 src/tests/dejagnu/pkinit-certs/user-upn3.pem create mode 100644 src/tests/gssapi/t_lifetime.c create mode 100644 src/tests/icinterleave.c create mode 100644 src/tests/t_certauth.py create mode 100644 src/tests/t_kadm5_auth.py create mode 100644 src/tests/t_kdcpolicy.py create mode 100644 src/tests/t_y2038.py create mode 100644 src/util/support/t_utf16.c diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 000000000000..ec170eda02b9 --- /dev/null +++ b/.travis.yml @@ -0,0 +1,26 @@ +language: c++ + +sudo: required + +dist: xenial + +matrix: + include: + - compiler: clang + env: MAKEVARS=CPPFLAGS=-Werror + - compiler: gcc + +before_install: + - sudo apt-get update -qq + - sudo apt-get install -y bison dejagnu gettext keyutils ldap-utils libldap2-dev libkeyutils-dev libssl-dev python-cjson python-paste python-pyrad slapd tcl-dev tcsh + - mkdir -p cmocka/build + - cd cmocka + - wget https://cmocka.org/files/1.1/cmocka-1.1.1.tar.xz + - tar -xvf cmocka-1.1.1.tar.xz + - cd build + - cmake ../cmocka-1.1.1 -DCMAKE_INSTALL_PREFIX=/usr + - make + - sudo make install + - cd ../.. + +script: cd src && autoreconf && ./configure --enable-maintainer-mode --with-ldap && make $MAKEVARS && make check diff --git a/NOTICE b/NOTICE index ff102ff3f113..1db2420a7e09 100644 --- a/NOTICE +++ b/NOTICE @@ -583,7 +583,7 @@ Marked test programs in src/lib/krb5/krb have the following copyright: ====================================================================== -The KCM Mach RPC definition file used on OS X has the following +The KCM Mach RPC definition file used on macOS has the following copyright: Copyright (C) 2009 Kungliga Tekniska Högskola diff --git a/README b/README index a8eabd5ab9e2..f702e486b45d 100644 --- a/README +++ b/README @@ -1,4 +1,4 @@ - Kerberos Version 5, Release 1.15 + Kerberos Version 5, Release 1.16 Release Notes The MIT Kerberos Team @@ -73,192 +73,149 @@ from using single-DES cryptosystems. Among these is a configuration variable that enables "weak" enctypes, which defaults to "false" beginning with krb5-1.8. -Major changes in 1.15.1 (2017-03-01) ------------------------------------- +Major changes in 1.16 (2017-12-05) +---------------------------------- -This is a bug fix release. +Administrator experience: -* Allow KDB modules to determine how the e_data field of principal - fields is freed +* The KDC can match PKINIT client certificates against the + "pkinit_cert_match" string attribute on the client principal entry, + using the same syntax as the existing "pkinit_cert_match" profile + option. -* Fix udp_preference_limit when the KDC location is configured with - SRV records +* The ktutil addent command supports the "-k 0" option to ignore the + key version, and the "-s" option to use a non-default salt string. -* Fix KDC and kadmind startup on some IPv4-only systems +* kpropd supports a --pid-file option to write a pid file at startup, + when it is run in standalone mode. -* Fix the processing of PKINIT certificate matching rules which have - two components and no explicit relation +* The "encrypted_challenge_indicator" realm option can be used to + attach an authentication indicator to tickets obtained using FAST + encrypted challenge pre-authentication. -* Improve documentation +* Localization support can be disabled at build time with the + --disable-nls configure option. -krb5-1.15.1 changes by ticket ID --------------------------------- +Developer experience: -7940 PKINIT docs only work for one-component client principals -8523 Add krbPwdPolicy attributes to kerberos.ldif -8524 Add caveats to krbtgt change documentation -8525 Fix error handling in PKINIT decode_data() -8530 KDC/kadmind explicit wildcard listener addresses do not use pktinfo -8531 KDC/kadmind may fail to start on IPv4-only systems -8532 Fix GSSAPI authind attribute name in docs -8538 Need a way to free KDB module e_data -8540 Document default realm and login authorization -8552 Add GSSAPI S4U documentation -8553 Fix PKINIT two-component matching rule parsing -8554 udp_preference_limit fails with SRV records +* The kdcpolicy pluggable interface allows modules control whether + tickets are issued by the KDC. +* The kadm5_auth pluggable interface allows modules to control whether + kadmind grants access to a kadmin request. -Major changes in 1.15 (2016-12-01) ----------------------------------- - -Administrator experience: +* The certauth pluggable interface allows modules to control which + PKINIT client certificates can authenticate to which client + principals. -* Improve support for multihomed Kerberos servers by adding options - for specifying restricted listening addresses for the KDC and - kadmind. +* KDB modules can use the client and KDC interface IP addresses to + determine whether to allow an AS request. -* Add support to kadmin for remote extraction of current keys without - changing them (requires a special kadmin permission that is excluded - from the wildcard permission), with the exception of highly - protected keys. +* GSS applications can query the bit strength of a krb5 GSS context + using the GSS_C_SEC_CONTEXT_SASL_SSF OID with + gss_inquire_sec_context_by_oid(). -* Add a lockdown_keys principal attribute to prevent retrieval of the - principal's keys (old or new) via the kadmin protocol. In newly - created databases, this attribute is set on the krbtgt and kadmin - principals. +* GSS applications can query the impersonator name of a krb5 GSS + credential using the GSS_KRB5_GET_CRED_IMPERSONATOR OID with + gss_inquire_cred_by_oid(). -* Restore recursive dump capability for DB2 back end, so sites can - more easily recover from database corruption resulting from power - failure events. +* kdcpreauth modules can query the KDC for the canonicalized requested + client principal name, or match a principal name against the + requested client principal name with canonicalization. -* Add DNS auto-discovery of KDC and kpasswd servers from URI records, - in addition to SRV records. URI records can convey TCP and UDP - servers and master KDC status in a single DNS lookup, and can also - point to HTTPS proxy servers. +Protocol evolution: -* Add support for password history to the LDAP back end. +* The client library will continue to try pre-authentication + mechanisms after most failure conditions. -* Add support for principal renaming to the LDAP back end. +* The KDC will issue trivially renewable tickets (where the renewable + lifetime is equal to or less than the ticket lifetime) if requested + by the client, to be friendlier to scripts. -* Use the getrandom system call on supported Linux kernels to avoid - blocking problems when getting entropy from the operating system. +* The client library will use a random nonce for TGS requests instead + of the current system time. -* In the PKINIT client, use the correct DigestInfo encoding for PKCS - #1 signatures, so that some especially strict smart cards will work. +* For the RC4 string-to-key or PAC operations, UTF-16 is supported + (previously only UCS-2 was supported). -Code quality: +* When matching PKINIT client certificates, UPN SANs will be matched + correctly as UPNs, with canonicalization. -* Clean up numerous compilation warnings. +User experience: -* Remove various infrequently built modules, including some preauth - modules that were not built by default. +* Dates after the year 2038 are accepted (provided that the platform + time facilities support them), through the year 2106. -Developer experience: +* Automatic credential cache selection based on the client realm will + take into account the fallback realm and the service hostname. -* Add support for building with OpenSSL 1.1. +* Referral and alternate cross-realm TGTs will not be cached, avoiding + some scenarios where they can be added to the credential cache + multiple times. -* Use SHA-256 instead of MD5 for (non-cryptographic) hashing of - authenticators in the replay cache. This helps sites that must - build with FIPS 140 conformant libraries that lack MD5. +* A German translation has been added. -* Eliminate util/reconf and allow the use of autoreconf alone to - regenerate the configure script. +Code quality: -Protocol evolution: +* The build is warning-clean under clang with the configured warning + options. -* Add support for the AES-SHA2 enctypes, which allows sites to conform - to Suite B crypto requirements. +* The automated test suite runs cleanly under AddressSanitizer. -krb5-1.15 changes by ticket ID +krb5-1.16 changes by ticket ID ------------------------------ -1093 KDC could use feature to limit listening interfaces -5889 password history doesn't work with LDAP KDB -6666 some non-default plugin directories don't build in 1.8 branch -7852 kadmin.local's ktadd -norandkey does not handle multiple kvnos - in the KDB -7985 Add krb5_get_init_creds_opt_set_pac_request -8065 Renaming principals with LDAP KDB deletes the principal -8277 iprop can choose wrong realm -8278 Add krb5_expand_hostname() API -8280 Fix impersonate_name to work with interposers -8295 kdb5_ldap_stash_service_password() stash file logic needs tweaking -8297 jsonwalker.py test fails -8298 Audit Test fails when system has IPV6 address -8299 Remove util/reconf -8329 Only run export-check.pl in maintainer mode -8344 Create KDC and kadmind log files with mode 0640 -8345 Remove nss libk5crypto implementation -8348 Remove workaround when binding to udp addresses and pktinfo - isn't supported by the system -8353 Replace MD5 use in rcache with SHA-256 -8354 Only store latest keys in key history entry -8355 Add kadm5_setkey_principal_4 RPC to kadmin -8364 Add get_principal_keys RPC to kadmin -8365 Add the ability to lock down principal keys -8366 Increase initial DNS buffer size -8368 Remove hdb KDB module -8371 Improve libkadm5 client RPC thread safety -8372 Use cached S4U2Proxy tickets in GSSAPI -8374 Interoperate with incomplete SPNEGO responses -8375 Allow zero cksumtype in krb5_k_verify_checksum() -8379 Add auth indicator handling to libkdb_ldap -8381 Don't fall back to master on password read error -8386 Add KDC pre-send and post-receive KDC hooks -8388 Remove port 750 from the KDC default ports -8389 Make profile includedir accept all *.conf files -8391 Add kinit long option support for all platforms -8393 Password Expiration "Never" Inconsistently Applied -8394 Add debug message filtering to krb5_klog_syslog -8396 Skip password prompt when running ksu as root -8398 Add libk5crypto support for OpenSSL 1.1.0 -8399 Unconstify some krb5 GSS OIDs -8403 kinit documentation page -8404 Remove non-DFSG documentation -8405 Work around python-ldap bug in kerberos.ldif -8412 Link correct VS2015 C libraries for debug builds -8414 Use library malloc for principal, policy entries -8418 Add libkdb function to specialize principal's salt -8419 Do not indicate deprecated GSS mechanisms -8423 Add SPNEGO special case for NTLMSSP+MechListMIC -8425 Add auth-indicator authdata module -8426 test_check_allowed_to_delegate() should free unparsed princ output -8428 Minimize timing leaks in PKINIT decryption -8429 Fix Makefile for paths containing '+' character -8434 Fix memory leak in old gssrpc authentication -8436 Update libev sources to 4.22 -8446 Fix leak in key change operations -8451 Add hints for -A flag to kdestroy -8456 Add the kprop-port option to kadmind -8462 Better handle failures to resolve client keytab -8464 Set prompt type for OTP preauth prompt -8465 Improve bad password inference in kinit -8466 Rename k5-queue.h macros -8471 Change KDC error for encrypted timestamp preauth -8476 Restore recursive dump functionality -8478 usability improvements for bttest -8488 Stop generating doc/CHANGES -8490 Add aes-sha2 enctype support -8494 Add krb5_db_register_keytab() -8496 Add KDC discovery from URI records -8498 Potential memory leak in prepare_error_as() -8499 Use getrandom system call on recent Linux kernels -8500 Document krb5_kt_next_entry() requirement -8502 ret_boolean in profile_get_boolean() should be krb5_boolean * - instead of int * -8504 Properly handle EOF condition on libkrad sockets -8506 PKINIT fails with PKCS#11 middlware that implements PKCS#1 V2.1 -8507 Suggest unlocked iteration for mkey rollover -8508 Clarify krb5_kt_resolve() API documentation -8509 Leak in krb5_cccol_have_content with truncated ccache -8510 Update features list for 1.15 -8512 Fix detection of libaceclnt for securid_sam2 -8513 Add doxygen comments for RFC 8009, RFC 4757 -8514 Make zap() more reliable -8516 Fix declaration without type in t_shs3.c -8520 Relicense ccapi/common/win/OldCC/autolock.hxx -8521 Allow slapd path configuration in t_kdb.py - +3349 Allow keytab entries to ignore the key version +7647 let ktutil support non-default salts +7877 Interleaved init_creds operations use same per-request preauth context +8352 Year 2038 fixes +8515 Add German translation +8517 Add KRB5_TRACE calls for DNS lookups +8518 Remove redeclaration of ttyname() in ksu +8526 Constify service and hostname in krb5_mk_req() +8527 Clean up memory handling in krb5_fwd_tgt_creds() +8528 Improve PKINIT UPN SAN matching +8529 Add OpenLDAP LDIF file for Kerberos schema +8533 Bug in src/tests/responder.c +8534 Add configure option to disable nls support +8537 Preauthentication should continue after failure +8539 Preauth tryagain should copy KDC cookie +8544 Wrong PKCS11 PIN can trigger PKINIT draft9 code +8548 Add OID to inquire GSS cred impersonator name +8549 Use fallback realm for GSSAPI ccache selection +8558 kvno memory leak (1.15.1) +8561 Add certauth pluggable interface +8562 Add the certauth dbmatch module +8568 Convert some pkiDebug messages to TRACE macros +8569 Add support to query the SSF of a GSS context +8570 Add the client_name() kdcpreauth callback +8571 Use the canonical client principal name for OTP +8572 Un-deprecate krb5_auth_con_initivector() +8575 Add FAST encrypted challenge auth indicator +8577 Replace UCS-2 conversions with UTF-16 +8578 Add various bound checks +8579 duplicate caching of some cross-realm TGTs +8582 Use a random nonce in TGS requests +8583 Pass client address to DAL audit_as_req +8592 Parse all kadm5.acl fields at startup +8595 Pluggable interface for kadmin authorization +8597 acx_pthread.m4 needs to be updated +8602 Make ccache name work for klist/kdestroy -A +8603 Remove incomplete PKINIT OCSP support +8606 Add KDC policy pluggable interface +8607 kpropd should write a pidfile when started in standalone mode... +8608 Fix AIX build issues +8609 Renewed tickets can be marked renewable with no renewable endtime +8610 Don't set ctime in KDC error replies +8612 Bump bundled libverto for 0.3.0 release +8613 Add hostname-based ccselect module +8615 Abort client preauth on keyboard interrupt +8616 Fix default enctype order in docs +8617 PKINIT matching can crash for certs with long issuer and subject +8620 Length check when parsing GSS token encapsulation +8621 Expose context errors in pkinit_server_plugin_init +8623 Update features list for 1.16 +8624 Update config.guess, config.sub Acknowledgements ---------------- @@ -349,7 +306,7 @@ Past and present members of the Kerberos Team at MIT: Zhanna Tsitkova Ted Ts'o Marshall Vale - Tom Yu + Taylor Yu The following external contributors have provided code, patches, bug reports, suggestions, and valuable resources: @@ -372,7 +329,9 @@ reports, suggestions, and valuable resources: Radoslav Bodo Sumit Bose Emmanuel Bouillon + Isaac Boukris Philip Brown + Samuel Cabrero Michael Calmer Andrea Campi Julien Chaffraix @@ -396,7 +355,9 @@ reports, suggestions, and valuable resources: Mark Deneen Günther Deschner John Devitofranceschi + Marc Dionne Roland Dowdeswell + Dorian Ducournau Viktor Dukhovni Jason Edgecombe Mark Eichin @@ -421,6 +382,7 @@ reports, suggestions, and valuable resources: Philip Guenther Dominic Hargreaves Robbie Harwood + John Hascall Jakob Haufe Matthieu Hautreux Jochen Hein @@ -441,18 +403,25 @@ reports, suggestions, and valuable resources: Pavel Jindra Brian Johannesmeyer Joel Johnson + Alexander Karaivanov Anders Kaseorg + Bar Katz + Zentaro Kavanagh + Mubashir Kazia W. Trevor King Patrik Kis + Martin Kittel Mikkel Kruse Reinhard Kugler Tomas Kuthan Pierre Labastie + Chris Leick Volker Lendecke Jan iankko Lieskovsky Todd Lipcon Oliver Loch Kevin Longfellow + Frank Lonigro Jon Looney Nuno Lopes Ryan Lynch @@ -486,6 +455,7 @@ reports, suggestions, and valuable resources: Jonathan Reams Jonathan Reed Robert Relyea + Tony Reix Martin Rex Jason Rogers Matt Rogers @@ -493,10 +463,13 @@ reports, suggestions, and valuable resources: Solly Ross Mike Roszkowski Guillaume Rousse + Joshua Schaeffer Andreas Schneider Tom Shaw Jim Shi Peter Shoults + Richard Silverman + Cel Skeggs Simo Sorce Michael Spang Michael Ströder diff --git a/doc/admin/admin_commands/kadmin_local.rst b/doc/admin/admin_commands/kadmin_local.rst index 50c3b99ea428..9b5ccf4e911a 100644 --- a/doc/admin/admin_commands/kadmin_local.rst +++ b/doc/admin/admin_commands/kadmin_local.rst @@ -661,6 +661,13 @@ KDC: *principal*. The *value* is a JSON string representing an array of objects, each having optional ``type`` and ``username`` fields. +**pkinit_cert_match** + Specifies a matching expression that defines the certificate + attributes required for the client certificate used by the + principal during PKINIT authentication. The matching expression + is in the same format as those used by the **pkinit_cert_match** + option in :ref:`krb5.conf(5)`. (New in release 1.16.) + This command requires the **modify** privilege. Alias: **setstr** diff --git a/doc/admin/admin_commands/kpropd.rst b/doc/admin/admin_commands/kpropd.rst index 5e01e2f14bc1..5468b06754e1 100644 --- a/doc/admin/admin_commands/kpropd.rst +++ b/doc/admin/admin_commands/kpropd.rst @@ -14,6 +14,7 @@ SYNOPSIS [**-F** *principal_database*] [**-p** *kdb5_util_prog*] [**-P** *port*] +[**--pid-file**\ =\ *pid_file*] [**-d**] [**-t**] @@ -104,6 +105,10 @@ OPTIONS Allows the user to specify the path to the kpropd.acl file; by default the path used is |kdcdir|\ ``/kpropd.acl``. +**--pid-file**\ =\ *pid_file* + In standalone mode, write the process ID of the daemon into + *pid_file*. + ENVIRONMENT ----------- diff --git a/doc/admin/admin_commands/ktutil.rst b/doc/admin/admin_commands/ktutil.rst index d55ddc8944c6..2eb19ded2769 100644 --- a/doc/admin/admin_commands/ktutil.rst +++ b/doc/admin/admin_commands/ktutil.rst @@ -87,7 +87,7 @@ add_entry ~~~~~~~~~ **add_entry** {**-key**\|\ **-password**} **-p** *principal* - **-k** *kvno* **-e** *enctype* + **-k** *kvno* **-e** *enctype* [**-s** *salt*] Add *principal* to keylist using key or password. diff --git a/doc/admin/conf_files/kadm5_acl.rst b/doc/admin/conf_files/kadm5_acl.rst index d23fb8a5789e..290bf0e037a7 100644 --- a/doc/admin/conf_files/kadm5_acl.rst +++ b/doc/admin/conf_files/kadm5_acl.rst @@ -116,16 +116,17 @@ Here is an example of a kadm5.acl file:: */root@ATHENA.MIT.EDU l * # line 5 sms@ATHENA.MIT.EDU x * -maxlife 9h -postdateable # line 6 -(line 1) Any principal in the ``ATHENA.MIT.EDU`` realm with -an ``admin`` instance has all administrative privileges. - -(lines 1-3) The user ``joeadmin`` has all permissions with his -``admin`` instance, ``joeadmin/admin@ATHENA.MIT.EDU`` (matches line -1). He has no permissions at all with his null instance, -``joeadmin@ATHENA.MIT.EDU`` (matches line 2). His ``root`` and other -non-``admin``, non-null instances (e.g., ``extra`` or ``dbadmin``) have -inquire permissions with any principal that has the instance ``root`` -(matches line 3). +(line 1) Any principal in the ``ATHENA.MIT.EDU`` realm with an +``admin`` instance has all administrative privileges except extracting +keys. + +(lines 1-3) The user ``joeadmin`` has all permissions except +extracting keys with his ``admin`` instance, +``joeadmin/admin@ATHENA.MIT.EDU`` (matches line 1). He has no +permissions at all with his null instance, ``joeadmin@ATHENA.MIT.EDU`` +(matches line 2). His ``root`` and other non-``admin``, non-null +instances (e.g., ``extra`` or ``dbadmin``) have inquire permissions +with any principal that has the instance ``root`` (matches line 3). (line 4) Any ``root`` principal in ``ATHENA.MIT.EDU`` can inquire or change the password of their null instance, but not any other @@ -139,9 +140,22 @@ permission can only be granted globally, not to specific target principals. (line 6) Finally, the Service Management System principal -``sms@ATHENA.MIT.EDU`` has all permissions, but any principal that it -creates or modifies will not be able to get postdateable tickets or -tickets with a life of longer than 9 hours. +``sms@ATHENA.MIT.EDU`` has all permissions except extracting keys, but +any principal that it creates or modifies will not be able to get +postdateable tickets or tickets with a life of longer than 9 hours. + +MODULE BEHAVIOR +--------------- + +The ACL file can coexist with other authorization modules in release +1.16 and later, as configured in the :ref:`kadm5_auth` section of +:ref:`krb5.conf(5)`. The ACL file will positively authorize +operations according to the rules above, but will never +authoritatively deny an operation, so other modules can authorize +operations in addition to those authorized by the ACL file. + +To operate without an ACL file, set the *acl_file* variable in +:ref:`kdc.conf(5)` to the empty string with ``acl_file = ""``. SEE ALSO -------- diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst index 13077ecf4bc2..3af1c3796e6b 100644 --- a/doc/admin/conf_files/kdc_conf.rst +++ b/doc/admin/conf_files/kdc_conf.rst @@ -86,9 +86,10 @@ The following tags may be specified in a [realms] subsection: **acl_file** (String.) Location of the access control list file that :ref:`kadmind(8)` uses to determine which principals are allowed - which permissions on the Kerberos database. The default value is - |kdcdir|\ ``/kadm5.acl``. For more information on Kerberos ACL - file see :ref:`kadm5.acl(5)`. + which permissions on the Kerberos database. To operate without an + ACL file, set this relation to the empty string with ``acl_file = + ""``. The default value is |kdcdir|\ ``/kadm5.acl``. For more + information on Kerberos ACL file see :ref:`kadm5.acl(5)`. **database_module** (String.) This relation indicates the name of the configuration @@ -198,6 +199,11 @@ The following tags may be specified in a [realms] subsection: if there is no policy assigned to the principal, no dictionary checks of passwords will be performed. +**encrypted_challenge_indicator** + (String.) Specifies the authentication indicator value that the KDC + asserts into tickets obtained using FAST encrypted challenge + pre-authentication. New in 1.16. + **host_based_services** (Whitespace- or comma-separated list.) Lists services which will get host-based referral processing even if the server principal is @@ -765,9 +771,6 @@ For information about the syntax of some of these options, see pkinit is used to authenticate. This option may be specified multiple times. (New in release 1.14.) -**pkinit_kdc_ocsp** - Specifies the location of the KDC's OCSP. - **pkinit_pool** Specifies the location of intermediate certificates which may be used by the KDC to complete the trust chain between a client's @@ -824,7 +827,7 @@ camellia256-cts-cmac camellia256-cts Camellia-256 CTS mode with camellia128-cts-cmac camellia128-cts Camellia-128 CTS mode with CMAC des The DES family: des-cbc-crc, des-cbc-md5, and des-cbc-md4 (weak) des3 The triple DES family: des3-cbc-sha1 -aes The AES family: aes256-cts-hmac-sha1-96 and aes128-cts-hmac-sha1-96 +aes The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128 rc4 The RC4 family: arcfour-hmac camellia The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac ==================================================== ========================================================= diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst index 653aad613cbc..4ed9832c7b17 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst @@ -55,9 +55,10 @@ following directives at the beginning of a line:: directory must exist and be readable. Including a directory includes all files within the directory whose names consist solely of alphanumeric characters, dashes, or underscores. Starting in release -1.15, files with names ending in ".conf" are also included. Included -profile files are syntactically independent of their parents, so each -included file must begin with a section header. +1.15, files with names ending in ".conf" are also included, unless the +name begins with ".". Included profile files are syntactically +independent of their parents, so each included file must begin with a +section header. The krb5.conf file can specify that configuration should be obtained from a loadable module, rather than the file itself, using the @@ -262,7 +263,7 @@ The libdefaults section may contain any of the following relations: the local user or by root. **kcm_mach_service** - On OS X only, determines the name of the bootstrap service used to + On macOS only, determines the name of the bootstrap service used to contact the KCM daemon for the KCM credential cache type. If the value is ``-``, Mach RPC will not be used to contact the KCM daemon. The default value is ``org.h5l.kcm``. @@ -744,6 +745,10 @@ disabled with the disable tag): Uses the service realm to guess an appropriate cache from the collection +**hostname** + If the service principal is host-based, uses the service hostname + to guess an appropriate cache from the collection + .. _pwqual: pwqual interface @@ -777,6 +782,26 @@ interface can be used to write a plugin to synchronize MIT Kerberos with another database such as Active Directory. No plugins are built in for this interface. +.. _kadm5_auth: + +kadm5_auth interface +#################### + +The kadm5_auth section (introduced in release 1.16) controls modules +for the kadmin authorization interface, which determines whether a +client principal is allowed to perform a kadmin operation. The +following built-in modules exist for this interface: + +**acl** + This module reads the :ref:`kadm5.acl(5)` file, and authorizes + operations which are allowed according to the rules in the file. + +**self** + This module authorizes self-service operations including password + changes, creation of new random keys, fetching the client's + principal record or string attributes, and fetching the policy + record associated with the client principal. + .. _clpreauth: .. _kdcpreauth: @@ -858,6 +883,32 @@ built-in modules exist for this interface: This module authorizes a principal to a local account if the principal name maps to the local account name. +.. _certauth: + +certauth interface +################## + +The certauth section (introduced in release 1.16) controls modules for +the certificate authorization interface, which determines whether a +certificate is allowed to preauthenticate a user via PKINIT. The +following built-in modules exist for this interface: + +**pkinit_san** + This module authorizes the certificate if it contains a PKINIT + Subject Alternative Name for the requested client principal, or a + Microsoft UPN SAN matching the principal if **pkinit_allow_upn** + is set to true for the realm. + +**pkinit_eku** + This module rejects the certificate if it does not contain an + Extended Key Usage attribute consistent with the + **pkinit_eku_checking** value for the realm. + +**dbmatch** + This module authorizes or rejects the certificate according to + whether it matches the **pkinit_cert_match** string attribute on + the client principal, if that attribute is present. + PKINIT options -------------- diff --git a/doc/admin/pkinit.rst b/doc/admin/pkinit.rst index 460d75d1e2be..c601c5c9ebba 100644 --- a/doc/admin/pkinit.rst +++ b/doc/admin/pkinit.rst @@ -223,6 +223,26 @@ time as follows:: kadmin -q 'add_principal +requires_preauth -nokey YOUR_PRINCNAME' +By default, the KDC requires PKINIT client certificates to have the +standard Extended Key Usage and Subject Alternative Name attributes +for PKINIT. Starting in release 1.16, it is possible to authorize +client certificates based on the subject or other criteria instead of +the standard PKINIT Subject Alternative Name, by setting the +**pkinit_cert_match** string attribute on each client principal entry. +For example:: + + kadmin set_string user@REALM pkinit_cert_match "CN=user@REALM$" + +The **pkinit_cert_match** string attribute follows the syntax used by +the :ref:`krb5.conf(5)` **pkinit_cert_match** relation. To allow the +use of non-PKINIT client certificates, it will also be necessary to +disable key usage checking using the **pkinit_eku_checking** relation; +for example:: + + [kdcdefaults] + pkinit_eku_checking = none + + Configuring the clients ----------------------- diff --git a/doc/admin/realm_config.rst b/doc/admin/realm_config.rst index c016d720fded..c7d9164f5e78 100644 --- a/doc/admin/realm_config.rst +++ b/doc/admin/realm_config.rst @@ -207,7 +207,7 @@ convey more information about a realm's KDCs with a single query. The client performs a query for the following URI records: -* ``_kerberos.REALM`` for fiding KDCs. +* ``_kerberos.REALM`` for finding KDCs. * ``_kerberos-adm.REALM`` for finding kadmin services. * ``_kpasswd.REALM`` for finding password services. diff --git a/doc/appdev/gssapi.rst b/doc/appdev/gssapi.rst index 0258f793b99b..c39bbddb9738 100644 --- a/doc/appdev/gssapi.rst +++ b/doc/appdev/gssapi.rst @@ -312,6 +312,25 @@ issue a ticket from the client to the target service. The GSSAPI library will then use this ticket to authenticate to the target service. +If an application needs to find out whether a credential it holds is a +proxy credential and the name of the intermediate service, it can +query the credential with the **GSS_KRB5_GET_CRED_IMPERSONATOR** OID +(new in release 1.16, declared in ````) using +the gss_inquire_cred_by_oid extension (declared in +````):: + + OM_uint32 gss_inquire_cred_by_oid(OM_uint32 *minor_status, + const gss_cred_id_t cred_handle, + gss_OID desired_object, + gss_buffer_set_t *data_set); + +If the call succeeds and *cred_handle* is a proxy credential, +*data_set* will be set to a single-element buffer set containing the +unparsed principal name of the intermediate service. If *cred_handle* +is not a proxy credential, *data_set* will be set to an empty buffer +set. If the library does not support the query, +gss_inquire_cred_by_oid will return **GSS_S_UNAVAILABLE**. + AEAD message wrapping --------------------- diff --git a/doc/appdev/index.rst b/doc/appdev/index.rst index 3d62045ca870..961bb1e9e23a 100644 --- a/doc/appdev/index.rst +++ b/doc/appdev/index.rst @@ -5,6 +5,7 @@ For application developers :maxdepth: 1 gssapi.rst + y2038.rst h5l_mit_apidiff.rst init_creds.rst princ_handle.rst diff --git a/doc/appdev/y2038.rst b/doc/appdev/y2038.rst new file mode 100644 index 000000000000..bc4122dad0a4 --- /dev/null +++ b/doc/appdev/y2038.rst @@ -0,0 +1,28 @@ +Year 2038 considerations for uses of krb5_timestamp +=================================================== + +POSIX time values, which measure the number of seconds since January 1 +1970, will exceed the maximum value representable in a signed 32-bit +integer in January 2038. This documentation describes considerations +for consumers of the MIT krb5 libraries. + +Applications or libraries which use libkrb5 and consume the timestamps +included in credentials or other structures make use of the +:c:type:`krb5_timestamp` type. For historical reasons, krb5_timestamp +is a signed 32-bit integer, even on platforms where a larger type is +natively used to represent time values. To behave properly for time +values after January 2038, calling code should cast krb5_timestamp +values to uint32_t, and then to time_t:: + + (time_t)(uint32_t)timestamp + +Used in this way, krb5_timestamp values can represent time values up +until February 2106, provided that the platform uses a 64-bit or +larger time_t type. This usage will also remain safe if a later +version of MIT krb5 changes krb5_timestamp to an unsigned 32-bit +integer. + +The GSSAPI only uses representations of time intervals, not absolute +times. Callers of the GSSAPI should require no changes to behave +correctly after January 2038, provided that they use MIT krb5 release +1.16 or later. diff --git a/doc/basic/ccache_def.rst b/doc/basic/ccache_def.rst index ff857f4f9422..d147f0d7aa99 100644 --- a/doc/basic/ccache_def.rst +++ b/doc/basic/ccache_def.rst @@ -64,7 +64,7 @@ library. KCM client support is new in release 1.13. A KCM daemon has not yet been implemented in MIT krb5, but the client will interoperate - with the KCM daemon implemented by Heimdal. OS X 10.7 and higher + with the KCM daemon implemented by Heimdal. macOS 10.7 and higher provides a KCM daemon as part of the operating system, and the **KCM** cache type is used as the default cache on that platform in a default build. diff --git a/doc/build/options2configure.rst b/doc/build/options2configure.rst index 0fd03072cd2d..ac1a8b9515b0 100644 --- a/doc/build/options2configure.rst +++ b/doc/build/options2configure.rst @@ -350,10 +350,6 @@ Optional packages prng specify ``--with-prng-alg=os``. The default is ``fortuna``. (See :ref:`mitK5features`) -**-**\ **-with-pkinit-crypto-impl=**\ *IMPL* - Use the specified pkinit crypto implementation *IMPL*. - Defaults to using OpenSSL. - **-**\ **-without-libedit** Do not compile and link against libedit. Some utilities will no longer offer command history or completion in interactive mode if diff --git a/doc/conf.py b/doc/conf.py index 3ee2df6301f5..ccd02d6b7e6e 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -272,7 +272,7 @@ else: rst_epilog += ''' .. |krb5conf| replace:: ``/etc/krb5.conf`` .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal des3-cbc-sha1:normal arcfour-hmac-md5:normal`` -.. |defetypes| replace:: ``aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4`` +.. |defetypes| replace:: ``aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4`` .. |defmkey| replace:: ``aes256-cts-hmac-sha1-96`` .. |copy| unicode:: U+000A9 ''' diff --git a/doc/html/_sources/admin/admin_commands/kadmin_local.txt b/doc/html/_sources/admin/admin_commands/kadmin_local.txt index 50c3b99ea428..9b5ccf4e911a 100644 --- a/doc/html/_sources/admin/admin_commands/kadmin_local.txt +++ b/doc/html/_sources/admin/admin_commands/kadmin_local.txt @@ -661,6 +661,13 @@ KDC: *principal*. The *value* is a JSON string representing an array of objects, each having optional ``type`` and ``username`` fields. +**pkinit_cert_match** + Specifies a matching expression that defines the certificate + attributes required for the client certificate used by the + principal during PKINIT authentication. The matching expression + is in the same format as those used by the **pkinit_cert_match** + option in :ref:`krb5.conf(5)`. (New in release 1.16.) + This command requires the **modify** privilege. Alias: **setstr** diff --git a/doc/html/_sources/admin/admin_commands/kpropd.txt b/doc/html/_sources/admin/admin_commands/kpropd.txt index 5e01e2f14bc1..5468b06754e1 100644 --- a/doc/html/_sources/admin/admin_commands/kpropd.txt +++ b/doc/html/_sources/admin/admin_commands/kpropd.txt @@ -14,6 +14,7 @@ SYNOPSIS [**-F** *principal_database*] [**-p** *kdb5_util_prog*] [**-P** *port*] +[**--pid-file**\ =\ *pid_file*] [**-d**] [**-t**] @@ -104,6 +105,10 @@ OPTIONS Allows the user to specify the path to the kpropd.acl file; by default the path used is |kdcdir|\ ``/kpropd.acl``. +**--pid-file**\ =\ *pid_file* + In standalone mode, write the process ID of the daemon into + *pid_file*. + ENVIRONMENT ----------- diff --git a/doc/html/_sources/admin/admin_commands/ktutil.txt b/doc/html/_sources/admin/admin_commands/ktutil.txt index d55ddc8944c6..2eb19ded2769 100644 --- a/doc/html/_sources/admin/admin_commands/ktutil.txt +++ b/doc/html/_sources/admin/admin_commands/ktutil.txt @@ -87,7 +87,7 @@ add_entry ~~~~~~~~~ **add_entry** {**-key**\|\ **-password**} **-p** *principal* - **-k** *kvno* **-e** *enctype* + **-k** *kvno* **-e** *enctype* [**-s** *salt*] Add *principal* to keylist using key or password. diff --git a/doc/html/_sources/admin/conf_files/kadm5_acl.txt b/doc/html/_sources/admin/conf_files/kadm5_acl.txt index d23fb8a5789e..290bf0e037a7 100644 --- a/doc/html/_sources/admin/conf_files/kadm5_acl.txt +++ b/doc/html/_sources/admin/conf_files/kadm5_acl.txt @@ -116,16 +116,17 @@ Here is an example of a kadm5.acl file:: */root@ATHENA.MIT.EDU l * # line 5 sms@ATHENA.MIT.EDU x * -maxlife 9h -postdateable # line 6 -(line 1) Any principal in the ``ATHENA.MIT.EDU`` realm with -an ``admin`` instance has all administrative privileges. - -(lines 1-3) The user ``joeadmin`` has all permissions with his -``admin`` instance, ``joeadmin/admin@ATHENA.MIT.EDU`` (matches line -1). He has no permissions at all with his null instance, -``joeadmin@ATHENA.MIT.EDU`` (matches line 2). His ``root`` and other -non-``admin``, non-null instances (e.g., ``extra`` or ``dbadmin``) have -inquire permissions with any principal that has the instance ``root`` -(matches line 3). +(line 1) Any principal in the ``ATHENA.MIT.EDU`` realm with an +``admin`` instance has all administrative privileges except extracting +keys. + +(lines 1-3) The user ``joeadmin`` has all permissions except +extracting keys with his ``admin`` instance, +``joeadmin/admin@ATHENA.MIT.EDU`` (matches line 1). He has no +permissions at all with his null instance, ``joeadmin@ATHENA.MIT.EDU`` +(matches line 2). His ``root`` and other non-``admin``, non-null +instances (e.g., ``extra`` or ``dbadmin``) have inquire permissions +with any principal that has the instance ``root`` (matches line 3). (line 4) Any ``root`` principal in ``ATHENA.MIT.EDU`` can inquire or change the password of their null instance, but not any other @@ -139,9 +140,22 @@ permission can only be granted globally, not to specific target principals. (line 6) Finally, the Service Management System principal -``sms@ATHENA.MIT.EDU`` has all permissions, but any principal that it -creates or modifies will not be able to get postdateable tickets or -tickets with a life of longer than 9 hours. +``sms@ATHENA.MIT.EDU`` has all permissions except extracting keys, but +any principal that it creates or modifies will not be able to get +postdateable tickets or tickets with a life of longer than 9 hours. + +MODULE BEHAVIOR +--------------- + +The ACL file can coexist with other authorization modules in release +1.16 and later, as configured in the :ref:`kadm5_auth` section of +:ref:`krb5.conf(5)`. The ACL file will positively authorize +operations according to the rules above, but will never +authoritatively deny an operation, so other modules can authorize +operations in addition to those authorized by the ACL file. + +To operate without an ACL file, set the *acl_file* variable in +:ref:`kdc.conf(5)` to the empty string with ``acl_file = ""``. SEE ALSO -------- diff --git a/doc/html/_sources/admin/conf_files/kdc_conf.txt b/doc/html/_sources/admin/conf_files/kdc_conf.txt index 13077ecf4bc2..3af1c3796e6b 100644 --- a/doc/html/_sources/admin/conf_files/kdc_conf.txt +++ b/doc/html/_sources/admin/conf_files/kdc_conf.txt @@ -86,9 +86,10 @@ The following tags may be specified in a [realms] subsection: **acl_file** (String.) Location of the access control list file that :ref:`kadmind(8)` uses to determine which principals are allowed - which permissions on the Kerberos database. The default value is - |kdcdir|\ ``/kadm5.acl``. For more information on Kerberos ACL - file see :ref:`kadm5.acl(5)`. + which permissions on the Kerberos database. To operate without an + ACL file, set this relation to the empty string with ``acl_file = + ""``. The default value is |kdcdir|\ ``/kadm5.acl``. For more + information on Kerberos ACL file see :ref:`kadm5.acl(5)`. **database_module** (String.) This relation indicates the name of the configuration @@ -198,6 +199,11 @@ The following tags may be specified in a [realms] subsection: if there is no policy assigned to the principal, no dictionary checks of passwords will be performed. +**encrypted_challenge_indicator** + (String.) Specifies the authentication indicator value that the KDC + asserts into tickets obtained using FAST encrypted challenge + pre-authentication. New in 1.16. + **host_based_services** (Whitespace- or comma-separated list.) Lists services which will get host-based referral processing even if the server principal is @@ -765,9 +771,6 @@ For information about the syntax of some of these options, see pkinit is used to authenticate. This option may be specified multiple times. (New in release 1.14.) -**pkinit_kdc_ocsp** - Specifies the location of the KDC's OCSP. - **pkinit_pool** Specifies the location of intermediate certificates which may be used by the KDC to complete the trust chain between a client's @@ -824,7 +827,7 @@ camellia256-cts-cmac camellia256-cts Camellia-256 CTS mode with camellia128-cts-cmac camellia128-cts Camellia-128 CTS mode with CMAC des The DES family: des-cbc-crc, des-cbc-md5, and des-cbc-md4 (weak) des3 The triple DES family: des3-cbc-sha1 -aes The AES family: aes256-cts-hmac-sha1-96 and aes128-cts-hmac-sha1-96 +aes The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128 rc4 The RC4 family: arcfour-hmac camellia The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac ==================================================== ========================================================= diff --git a/doc/html/_sources/admin/conf_files/krb5_conf.txt b/doc/html/_sources/admin/conf_files/krb5_conf.txt index 653aad613cbc..4ed9832c7b17 100644 --- a/doc/html/_sources/admin/conf_files/krb5_conf.txt +++ b/doc/html/_sources/admin/conf_files/krb5_conf.txt @@ -55,9 +55,10 @@ following directives at the beginning of a line:: directory must exist and be readable. Including a directory includes all files within the directory whose names consist solely of alphanumeric characters, dashes, or underscores. Starting in release -1.15, files with names ending in ".conf" are also included. Included -profile files are syntactically independent of their parents, so each -included file must begin with a section header. +1.15, files with names ending in ".conf" are also included, unless the +name begins with ".". Included profile files are syntactically +independent of their parents, so each included file must begin with a +section header. The krb5.conf file can specify that configuration should be obtained from a loadable module, rather than the file itself, using the @@ -262,7 +263,7 @@ The libdefaults section may contain any of the following relations: the local user or by root. **kcm_mach_service** - On OS X only, determines the name of the bootstrap service used to + On macOS only, determines the name of the bootstrap service used to contact the KCM daemon for the KCM credential cache type. If the value is ``-``, Mach RPC will not be used to contact the KCM daemon. The default value is ``org.h5l.kcm``. @@ -744,6 +745,10 @@ disabled with the disable tag): Uses the service realm to guess an appropriate cache from the collection +**hostname** + If the service principal is host-based, uses the service hostname + to guess an appropriate cache from the collection + .. _pwqual: pwqual interface @@ -777,6 +782,26 @@ interface can be used to write a plugin to synchronize MIT Kerberos with another database such as Active Directory. No plugins are built in for this interface. +.. _kadm5_auth: + +kadm5_auth interface +#################### + +The kadm5_auth section (introduced in release 1.16) controls modules +for the kadmin authorization interface, which determines whether a +client principal is allowed to perform a kadmin operation. The +following built-in modules exist for this interface: + +**acl** + This module reads the :ref:`kadm5.acl(5)` file, and authorizes + operations which are allowed according to the rules in the file. + +**self** + This module authorizes self-service operations including password + changes, creation of new random keys, fetching the client's + principal record or string attributes, and fetching the policy + record associated with the client principal. + .. _clpreauth: .. _kdcpreauth: @@ -858,6 +883,32 @@ built-in modules exist for this interface: This module authorizes a principal to a local account if the principal name maps to the local account name. +.. _certauth: + +certauth interface +################## + +The certauth section (introduced in release 1.16) controls modules for +the certificate authorization interface, which determines whether a +certificate is allowed to preauthenticate a user via PKINIT. The +following built-in modules exist for this interface: + +**pkinit_san** + This module authorizes the certificate if it contains a PKINIT + Subject Alternative Name for the requested client principal, or a + Microsoft UPN SAN matching the principal if **pkinit_allow_upn** + is set to true for the realm. + +**pkinit_eku** + This module rejects the certificate if it does not contain an + Extended Key Usage attribute consistent with the + **pkinit_eku_checking** value for the realm. + +**dbmatch** + This module authorizes or rejects the certificate according to + whether it matches the **pkinit_cert_match** string attribute on + the client principal, if that attribute is present. + PKINIT options -------------- diff --git a/doc/html/_sources/admin/pkinit.txt b/doc/html/_sources/admin/pkinit.txt index 460d75d1e2be..c601c5c9ebba 100644 --- a/doc/html/_sources/admin/pkinit.txt +++ b/doc/html/_sources/admin/pkinit.txt @@ -223,6 +223,26 @@ time as follows:: kadmin -q 'add_principal +requires_preauth -nokey YOUR_PRINCNAME' +By default, the KDC requires PKINIT client certificates to have the +standard Extended Key Usage and Subject Alternative Name attributes +for PKINIT. Starting in release 1.16, it is possible to authorize +client certificates based on the subject or other criteria instead of +the standard PKINIT Subject Alternative Name, by setting the +**pkinit_cert_match** string attribute on each client principal entry. +For example:: + + kadmin set_string user@REALM pkinit_cert_match "CN=user@REALM$" + +The **pkinit_cert_match** string attribute follows the syntax used by +the :ref:`krb5.conf(5)` **pkinit_cert_match** relation. To allow the +use of non-PKINIT client certificates, it will also be necessary to +disable key usage checking using the **pkinit_eku_checking** relation; +for example:: + + [kdcdefaults] + pkinit_eku_checking = none + + Configuring the clients ----------------------- diff --git a/doc/html/_sources/admin/realm_config.txt b/doc/html/_sources/admin/realm_config.txt index c016d720fded..c7d9164f5e78 100644 --- a/doc/html/_sources/admin/realm_config.txt +++ b/doc/html/_sources/admin/realm_config.txt @@ -207,7 +207,7 @@ convey more information about a realm's KDCs with a single query. The client performs a query for the following URI records: -* ``_kerberos.REALM`` for fiding KDCs. +* ``_kerberos.REALM`` for finding KDCs. * ``_kerberos-adm.REALM`` for finding kadmin services. * ``_kpasswd.REALM`` for finding password services. diff --git a/doc/html/_sources/appdev/gssapi.txt b/doc/html/_sources/appdev/gssapi.txt index 0258f793b99b..c39bbddb9738 100644 --- a/doc/html/_sources/appdev/gssapi.txt +++ b/doc/html/_sources/appdev/gssapi.txt @@ -312,6 +312,25 @@ issue a ticket from the client to the target service. The GSSAPI library will then use this ticket to authenticate to the target service. +If an application needs to find out whether a credential it holds is a +proxy credential and the name of the intermediate service, it can +query the credential with the **GSS_KRB5_GET_CRED_IMPERSONATOR** OID +(new in release 1.16, declared in ````) using +the gss_inquire_cred_by_oid extension (declared in +````):: + + OM_uint32 gss_inquire_cred_by_oid(OM_uint32 *minor_status, + const gss_cred_id_t cred_handle, + gss_OID desired_object, + gss_buffer_set_t *data_set); + +If the call succeeds and *cred_handle* is a proxy credential, +*data_set* will be set to a single-element buffer set containing the +unparsed principal name of the intermediate service. If *cred_handle* +is not a proxy credential, *data_set* will be set to an empty buffer +set. If the library does not support the query, +gss_inquire_cred_by_oid will return **GSS_S_UNAVAILABLE**. + AEAD message wrapping --------------------- diff --git a/doc/html/_sources/appdev/index.txt b/doc/html/_sources/appdev/index.txt index 3d62045ca870..961bb1e9e23a 100644 --- a/doc/html/_sources/appdev/index.txt +++ b/doc/html/_sources/appdev/index.txt @@ -5,6 +5,7 @@ For application developers :maxdepth: 1 gssapi.rst + y2038.rst h5l_mit_apidiff.rst init_creds.rst princ_handle.rst diff --git a/doc/html/_sources/appdev/refs/api/krb5_auth_con_initivector.txt b/doc/html/_sources/appdev/refs/api/krb5_auth_con_initivector.txt index 7d5bf4cf03ee..4dc9e0afb9a0 100644 --- a/doc/html/_sources/appdev/refs/api/krb5_auth_con_initivector.txt +++ b/doc/html/_sources/appdev/refs/api/krb5_auth_con_initivector.txt @@ -1,5 +1,5 @@ -krb5_auth_con_initivector -========================= +krb5_auth_con_initivector - Cause an auth context to use cipher state. +======================================================================== .. @@ -10,30 +10,31 @@ krb5_auth_con_initivector :param: - **context** + **[in]** **context** - Library context - **auth_context** + **[in]** **auth_context** - Authentication context .. +:retval: + - 0 Success; otherwise - Kerberos error codes -.. +.. -DEPRECATED Not replaced. +Prepare *auth_context* to use cipher state when :c:func:`krb5_mk_priv()` or :c:func:`krb5_rd_priv()` encrypt or decrypt data. -RFC 4120 doesn't have anything like the initvector concept; only really old protocols may need this API. diff --git a/doc/html/_sources/appdev/refs/api/krb5_fwd_tgt_creds.txt b/doc/html/_sources/appdev/refs/api/krb5_fwd_tgt_creds.txt index a6273bbb2c75..fab6d70594f3 100644 --- a/doc/html/_sources/appdev/refs/api/krb5_fwd_tgt_creds.txt +++ b/doc/html/_sources/appdev/refs/api/krb5_fwd_tgt_creds.txt @@ -3,7 +3,7 @@ krb5_fwd_tgt_creds - Get a forwarded TGT and format a KRB-CRED message. .. -.. c:function:: krb5_error_code krb5_fwd_tgt_creds(krb5_context context, krb5_auth_context auth_context, char * rhost, krb5_principal client, krb5_principal server, krb5_ccache cc, int forwardable, krb5_data * outbuf) +.. c:function:: krb5_error_code krb5_fwd_tgt_creds(krb5_context context, krb5_auth_context auth_context, const char * rhost, krb5_principal client, krb5_principal server, krb5_ccache cc, int forwardable, krb5_data * outbuf) .. diff --git a/doc/html/_sources/appdev/refs/api/krb5_init_creds_free.txt b/doc/html/_sources/appdev/refs/api/krb5_init_creds_free.txt index 85efec065a5e..011fe47837fd 100644 --- a/doc/html/_sources/appdev/refs/api/krb5_init_creds_free.txt +++ b/doc/html/_sources/appdev/refs/api/krb5_init_creds_free.txt @@ -27,7 +27,7 @@ krb5_init_creds_free - Free an initial credentials context. - + *context* must be the same as the one passed to :c:func:`krb5_init_creds_init()` for this initial credentials context. diff --git a/doc/html/_sources/appdev/refs/api/krb5_init_creds_get.txt b/doc/html/_sources/appdev/refs/api/krb5_init_creds_get.txt index 05c26f3759b4..291fa509269d 100644 --- a/doc/html/_sources/appdev/refs/api/krb5_init_creds_get.txt +++ b/doc/html/_sources/appdev/refs/api/krb5_init_creds_get.txt @@ -34,6 +34,10 @@ This function synchronously obtains credentials using a context created by :c:fu + *context* must be the same as the one passed to :c:func:`krb5_init_creds_init()` for this initial credentials context. + + + diff --git a/doc/html/_sources/appdev/refs/api/krb5_init_creds_init.txt b/doc/html/_sources/appdev/refs/api/krb5_init_creds_init.txt index 6bbbeed869e4..c703124106db 100644 --- a/doc/html/_sources/appdev/refs/api/krb5_init_creds_init.txt +++ b/doc/html/_sources/appdev/refs/api/krb5_init_creds_init.txt @@ -44,6 +44,10 @@ This function creates a new context for acquiring initial credentials. Use :c:fu +Any subsequent calls to :c:func:`krb5_init_creds_step()` , :c:func:`krb5_init_creds_get()` , or :c:func:`krb5_init_creds_free()` for this initial credentials context must use the same *context* argument as the one passed to this function. + + + diff --git a/doc/html/_sources/appdev/refs/api/krb5_init_creds_set_service.txt b/doc/html/_sources/appdev/refs/api/krb5_init_creds_set_service.txt index d08ffc7d629d..67b9b5d6de0b 100644 --- a/doc/html/_sources/appdev/refs/api/krb5_init_creds_set_service.txt +++ b/doc/html/_sources/appdev/refs/api/krb5_init_creds_set_service.txt @@ -32,7 +32,7 @@ krb5_init_creds_set_service - Specify a service principal for acquiring initial -This function supplies a service principal string to acquire initial credentials for instead of the default krbtgt service. *service* is parsed as a principal name; any realm part is ignored. +Thisfunction supplies a service principal string to acquire initial credentials for instead of the default krbtgt service. *service* is parsed as a principal name; any realm part is ignored. diff --git a/doc/html/_sources/appdev/refs/api/krb5_init_creds_step.txt b/doc/html/_sources/appdev/refs/api/krb5_init_creds_step.txt index c4e8a202aa53..8008e6724f1a 100644 --- a/doc/html/_sources/appdev/refs/api/krb5_init_creds_step.txt +++ b/doc/html/_sources/appdev/refs/api/krb5_init_creds_step.txt @@ -50,6 +50,10 @@ If this function returns **KRB5KRB_ERR_RESPONSE_TOO_BIG** , the caller should tr + *context* must be the same as the one passed to :c:func:`krb5_init_creds_init()` for this initial credentials context. + + + diff --git a/doc/html/_sources/appdev/refs/api/krb5_mk_req.txt b/doc/html/_sources/appdev/refs/api/krb5_mk_req.txt index e3a5da424a8d..695eb79399cb 100644 --- a/doc/html/_sources/appdev/refs/api/krb5_mk_req.txt +++ b/doc/html/_sources/appdev/refs/api/krb5_mk_req.txt @@ -3,7 +3,7 @@ krb5_mk_req - Create a KRB_AP_REQ message. .. -.. c:function:: krb5_error_code krb5_mk_req(krb5_context context, krb5_auth_context * auth_context, krb5_flags ap_req_options, char * service, char * hostname, krb5_data * in_data, krb5_ccache ccache, krb5_data * outbuf) +.. c:function:: krb5_error_code krb5_mk_req(krb5_context context, krb5_auth_context * auth_context, krb5_flags ap_req_options, const char * service, const char * hostname, krb5_data * in_data, krb5_ccache ccache, krb5_data * outbuf) .. diff --git a/doc/html/_sources/appdev/refs/api/krb5_pac_verify.txt b/doc/html/_sources/appdev/refs/api/krb5_pac_verify.txt index d9af52f770ab..338b43a1453e 100644 --- a/doc/html/_sources/appdev/refs/api/krb5_pac_verify.txt +++ b/doc/html/_sources/appdev/refs/api/krb5_pac_verify.txt @@ -62,7 +62,7 @@ If successful, *pac* is marked as verified. .. note:: - A checksum mismatch can occur if the PAC was copied from a cross-realm TGT by an ignorant KDC; also Apple Mac OS X Server Open Directory (as of 10.6) generates PACs with no server checksum at all. One should consider not failing the whole authentication because of this reason, but, instead, treating the ticket as if it did not contain a PAC or marking the PAC information as non-verified. + A checksum mismatch can occur if the PAC was copied from a cross-realm TGT by an ignorant KDC; also macOS Server Open Directory (as of 10.6) generates PACs with no server checksum at all. One should consider not failing the whole authentication because of this reason, but, instead, treating the ticket as if it did not contain a PAC or marking the PAC information as non-verified. diff --git a/doc/html/_sources/appdev/refs/types/krb5_timestamp.txt b/doc/html/_sources/appdev/refs/types/krb5_timestamp.txt index e9263e49d1b7..dc3e9eee79ab 100644 --- a/doc/html/_sources/appdev/refs/types/krb5_timestamp.txt +++ b/doc/html/_sources/appdev/refs/types/krb5_timestamp.txt @@ -9,8 +9,9 @@ krb5_timestamp .. c:type:: krb5_timestamp .. +Represents a timestamp in seconds since the POSIX epoch. - +This legacy type is used frequently in the ABI, but cannot represent timestamps after 2038 as a positive number. Code which uses this type should cast values of it to uint32_t so that negative values are treated as timestamps between 2038 and 2106 on platforms with 64-bit time_t. Declaration ------------ diff --git a/doc/html/_sources/appdev/y2038.txt b/doc/html/_sources/appdev/y2038.txt new file mode 100644 index 000000000000..bc4122dad0a4 --- /dev/null +++ b/doc/html/_sources/appdev/y2038.txt @@ -0,0 +1,28 @@ +Year 2038 considerations for uses of krb5_timestamp +=================================================== + +POSIX time values, which measure the number of seconds since January 1 +1970, will exceed the maximum value representable in a signed 32-bit +integer in January 2038. This documentation describes considerations +for consumers of the MIT krb5 libraries. + +Applications or libraries which use libkrb5 and consume the timestamps +included in credentials or other structures make use of the +:c:type:`krb5_timestamp` type. For historical reasons, krb5_timestamp +is a signed 32-bit integer, even on platforms where a larger type is +natively used to represent time values. To behave properly for time +values after January 2038, calling code should cast krb5_timestamp +values to uint32_t, and then to time_t:: + + (time_t)(uint32_t)timestamp + +Used in this way, krb5_timestamp values can represent time values up +until February 2106, provided that the platform uses a 64-bit or +larger time_t type. This usage will also remain safe if a later +version of MIT krb5 changes krb5_timestamp to an unsigned 32-bit +integer. + +The GSSAPI only uses representations of time intervals, not absolute +times. Callers of the GSSAPI should require no changes to behave +correctly after January 2038, provided that they use MIT krb5 release +1.16 or later. diff --git a/doc/html/_sources/basic/ccache_def.txt b/doc/html/_sources/basic/ccache_def.txt index ff857f4f9422..d147f0d7aa99 100644 --- a/doc/html/_sources/basic/ccache_def.txt +++ b/doc/html/_sources/basic/ccache_def.txt @@ -64,7 +64,7 @@ library. KCM client support is new in release 1.13. A KCM daemon has not yet been implemented in MIT krb5, but the client will interoperate - with the KCM daemon implemented by Heimdal. OS X 10.7 and higher + with the KCM daemon implemented by Heimdal. macOS 10.7 and higher provides a KCM daemon as part of the operating system, and the **KCM** cache type is used as the default cache on that platform in a default build. diff --git a/doc/html/_sources/build/options2configure.txt b/doc/html/_sources/build/options2configure.txt index 0fd03072cd2d..ac1a8b9515b0 100644 --- a/doc/html/_sources/build/options2configure.txt +++ b/doc/html/_sources/build/options2configure.txt @@ -350,10 +350,6 @@ Optional packages prng specify ``--with-prng-alg=os``. The default is ``fortuna``. (See :ref:`mitK5features`) -**-**\ **-with-pkinit-crypto-impl=**\ *IMPL* - Use the specified pkinit crypto implementation *IMPL*. - Defaults to using OpenSSL. - **-**\ **-without-libedit** Do not compile and link against libedit. Some utilities will no longer offer command history or completion in interactive mode if diff --git a/doc/html/_sources/mitK5features.txt b/doc/html/_sources/mitK5features.txt index b4e4b8b9b780..9df7e34d65be 100644 --- a/doc/html/_sources/mitK5features.txt +++ b/doc/html/_sources/mitK5features.txt @@ -19,8 +19,8 @@ Quick facts License - :ref:`mitK5license` Releases: - - Latest stable: http://web.mit.edu/kerberos/krb5-1.15/ - - Supported: http://web.mit.edu/kerberos/krb5-1.14/ + - Latest stable: http://web.mit.edu/kerberos/krb5-1.16/ + - Supported: http://web.mit.edu/kerberos/krb5-1.15/ - Release cycle: 9 -- 12 months Supported platforms \/ OS distributions: @@ -162,7 +162,7 @@ Release 1.13 - Add client support for the Kerberos Cache Manager protocol. If the host is running a Heimdal kcm daemon, caches served by the daemon can be accessed with the KCM: cache type. - - When built on OS X 10.7 and higher, use "KCM:" as the default + - When built on macOS 10.7 and higher, use "KCM:" as the default cachetype, unless overridden by command-line options or krb5-config values. - Add support for doing unlocked database dumps for the DB2 KDC @@ -309,6 +309,95 @@ Release 1.15 - Add support for the AES-SHA2 enctypes, which allows sites to conform to Suite B crypto requirements. +Release 1.16 + +* Administrator experience: + + - The KDC can match PKINIT client certificates against the + "pkinit_cert_match" string attribute on the client principal + entry, using the same syntax as the existing "pkinit_cert_match" + profile option. + + - The ktutil addent command supports the "-k 0" option to ignore the + key version, and the "-s" option to use a non-default salt string. + + - kpropd supports a --pid-file option to write a pid file at + startup, when it is run in standalone mode. + + - The "encrypted_challenge_indicator" realm option can be used to + attach an authentication indicator to tickets obtained using FAST + encrypted challenge pre-authentication. + + - Localization support can be disabled at build time with the + --disable-nls configure option. + +* Developer experience: + + - The kdcpolicy pluggable interface allows modules control whether + tickets are issued by the KDC. + + - The kadm5_auth pluggable interface allows modules to control + whether kadmind grants access to a kadmin request. + + - The certauth pluggable interface allows modules to control which + PKINIT client certificates can authenticate to which client + principals. + + - KDB modules can use the client and KDC interface IP addresses to + determine whether to allow an AS request. + + - GSS applications can query the bit strength of a krb5 GSS context + using the GSS_C_SEC_CONTEXT_SASL_SSF OID with + gss_inquire_sec_context_by_oid(). + + - GSS applications can query the impersonator name of a krb5 GSS + credential using the GSS_KRB5_GET_CRED_IMPERSONATOR OID with + gss_inquire_cred_by_oid(). + + - kdcpreauth modules can query the KDC for the canonicalized + requested client principal name, or match a principal name against + the requested client principal name with canonicalization. + +* Protocol evolution: + + - The client library will continue to try pre-authentication + mechanisms after most failure conditions. + + - The KDC will issue trivially renewable tickets (where the + renewable lifetime is equal to or less than the ticket lifetime) + if requested by the client, to be friendlier to scripts. + + - The client library will use a random nonce for TGS requests + instead of the current system time. + + - For the RC4 string-to-key or PAC operations, UTF-16 is supported + (previously only UCS-2 was supported). + + - When matching PKINIT client certificates, UPN SANs will be matched + correctly as UPNs, with canonicalization. + +* User experience: + + - Dates after the year 2038 are accepted (provided that the platform + time facilities support them), through the year 2106. + + - Automatic credential cache selection based on the client realm + will take into account the fallback realm and the service + hostname. + + - Referral and alternate cross-realm TGTs will not be cached, + avoiding some scenarios where they can be added to the credential + cache multiple times. + + - A German translation has been added. + +* Code quality: + + - The build is warning-clean under clang with the configured warning + options. + + - The automated test suite runs cleanly under AddressSanitizer. + `Pre-authentication mechanisms` - PW-SALT :rfc:`4120#section-5.2.7.3` diff --git a/doc/html/_sources/plugindev/certauth.txt b/doc/html/_sources/plugindev/certauth.txt new file mode 100644 index 000000000000..8a7f7c5ebad6 --- /dev/null +++ b/doc/html/_sources/plugindev/certauth.txt @@ -0,0 +1,27 @@ +.. _certauth_plugin: + +PKINIT certificate authorization interface (certauth) +===================================================== + +The certauth interface was first introduced in release 1.16. It +allows customization of the X.509 certificate attribute requirements +placed on certificates used by PKINIT enabled clients. For a detailed +description of the certauth interface, see the header file +```` + +A certauth module implements the **authorize** method to determine +whether a client's certificate is authorized to authenticate a client +principal. **authorize** receives the DER-encoded certificate, the +requested client principal, and a pointer to the client's +krb5_db_entry (for modules that link against libkdb5). It returns the +authorization status and optionally outputs a list of authentication +indicator strings to be added to the ticket. A module must use its +own internal or library-provided ASN.1 certificate decoder. + +A module can optionally create and destroy module data with the +**init** and **fini** methods. Module data objects last for the +lifetime of the KDC process. + +If a module allocates and returns a list of authentication indicators +from **authorize**, it must also implement the **free_ind** method +to free the list. diff --git a/doc/html/_sources/plugindev/index.txt b/doc/html/_sources/plugindev/index.txt index 3fb921778cb5..5e7834635f42 100644 --- a/doc/html/_sources/plugindev/index.txt +++ b/doc/html/_sources/plugindev/index.txt @@ -25,11 +25,14 @@ Contents ccselect.rst pwqual.rst kadm5_hook.rst + kadm5_auth.rst hostrealm.rst localauth.rst locate.rst profile.rst gssapi.rst internal.rst + certauth.rst + kdcpolicy.rst .. TODO: GSSAPI mechanism plugins diff --git a/doc/html/_sources/plugindev/kadm5_auth.txt b/doc/html/_sources/plugindev/kadm5_auth.txt new file mode 100644 index 000000000000..b4839617bd2f --- /dev/null +++ b/doc/html/_sources/plugindev/kadm5_auth.txt @@ -0,0 +1,35 @@ +.. _kadm5_auth_plugin: + +kadmin authorization interface (kadm5_auth) +=========================================== + +The kadm5_auth interface (new in release 1.16) allows modules to +determine whether a client principal is authorized to perform an +operation in the kadmin protocol, and to apply restrictions to +principal operations. For a detailed description of the kadm5_auth +interface, see the header file ````. + +A module can create and destroy per-process state objects by +implementing the **init** and **fini** methods. State objects have +the type kadm5_auth_modinfo, which is an abstract pointer type. A +module should typically cast this to an internal type for the state +object. + +The kadm5_auth interface has one method for each kadmin operation, +with parameters specific to the operation. Each method can return +either 0 to authorize access, KRB5_PLUGIN_NO_HANDLE to defer the +decision to other modules, or another error (canonically EPERM) to +authoritatively deny access. Access is granted if at least one module +grants access and no module authoritatively denies access. + +The **addprinc** and **modprinc** methods can also impose restrictions +on the principal operation by returning a ``struct +kadm5_auth_restrictions`` object. The module should also implement +the **free_restrictions** method if it dynamically allocates +restrictions objects for principal operations. + +kadm5_auth modules can optionally inspect principal or policy objects. +To do this, the module must also include ```` to gain +access to the structure definitions for those objects. As the kadmin +interface is explicitly not as stable as other public interfaces, +modules which do this may not retain compatibility across releases. diff --git a/doc/html/_sources/plugindev/kdcpolicy.txt b/doc/html/_sources/plugindev/kdcpolicy.txt new file mode 100644 index 000000000000..74f21f08fbf4 --- /dev/null +++ b/doc/html/_sources/plugindev/kdcpolicy.txt @@ -0,0 +1,24 @@ +.. _kdcpolicy_plugin: + +KDC policy interface (kdcpolicy) +================================ + +The kdcpolicy interface was first introduced in release 1.16. It +allows modules to veto otherwise valid AS and TGS requests or restrict +the lifetime and renew time of the resulting ticket. For a detailed +description of the kdcpolicy interface, see the header file +````. + +The optional **check_as** and **check_tgs** functions allow the module +to perform access control. Additionally, a module can create and +destroy module data with the **init** and **fini** methods. Module +data objects last for the lifetime of the KDC process, and are +provided to all other methods. The data has the type +krb5_kdcpolicy_moddata, which should be cast to the appropriate +internal type. + +kdcpolicy modules can optionally inspect principal entries. To do +this, the module must also include ```` to gain access to the +principal entry structure definition. As the KDB interface is +explicitly not as stable as other public interfaces, modules which do +this may not retain compatibility across releases. diff --git a/doc/html/about.html b/doc/html/about.html index 7b9f23462bea..d1e3a2e86e87 100644 --- a/doc/html/about.html +++ b/doc/html/about.html @@ -15,7 +15,7 @@ + + + + + + + + + + + +
+
+ + +

MIT Kerberos Documentation

+ +
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ +
+
+
+ +
+
+
+ +
+

Year 2038 considerations for uses of krb5_timestamp

+

POSIX time values, which measure the number of seconds since January 1 +1970, will exceed the maximum value representable in a signed 32-bit +integer in January 2038. This documentation describes considerations +for consumers of the MIT krb5 libraries.

+

Applications or libraries which use libkrb5 and consume the timestamps +included in credentials or other structures make use of the +krb5_timestamp type. For historical reasons, krb5_timestamp +is a signed 32-bit integer, even on platforms where a larger type is +natively used to represent time values. To behave properly for time +values after January 2038, calling code should cast krb5_timestamp +values to uint32_t, and then to time_t:

+
(time_t)(uint32_t)timestamp
+
+
+

Used in this way, krb5_timestamp values can represent time values up +until February 2106, provided that the platform uses a 64-bit or +larger time_t type. This usage will also remain safe if a later +version of MIT krb5 changes krb5_timestamp to an unsigned 32-bit +integer.

+

The GSSAPI only uses representations of time intervals, not absolute +times. Callers of the GSSAPI should require no changes to behave +correctly after January 2038, provided that they use MIT krb5 release +1.16 or later.

+
+ + +
+
+
+
+
+

On this page

+ + +
+

Table of contents

+ + +
+

Full Table of Contents

+

Search

+
+ + + + +
+
+
+
+
+ +
+
+
Release: 1.16
+ © Copyright 1985-2017, MIT. +
+
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ + + \ No newline at end of file diff --git a/doc/html/basic/ccache_def.html b/doc/html/basic/ccache_def.html index 6f4a8924e7ba..0ba9c7215668 100644 --- a/doc/html/basic/ccache_def.html +++ b/doc/html/basic/ccache_def.html @@ -15,7 +15,7 @@ + + + + + + + + + + + +
+
+ + +

MIT Kerberos Documentation

+ +
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ +
+
+
+ +
+
+
+ +
+

PKINIT certificate authorization interface (certauth)

+

The certauth interface was first introduced in release 1.16. It +allows customization of the X.509 certificate attribute requirements +placed on certificates used by PKINIT enabled clients. For a detailed +description of the certauth interface, see the header file +<krb5/certauth_plugin.h>

+

A certauth module implements the authorize method to determine +whether a client’s certificate is authorized to authenticate a client +principal. authorize receives the DER-encoded certificate, the +requested client principal, and a pointer to the client’s +krb5_db_entry (for modules that link against libkdb5). It returns the +authorization status and optionally outputs a list of authentication +indicator strings to be added to the ticket. A module must use its +own internal or library-provided ASN.1 certificate decoder.

+

A module can optionally create and destroy module data with the +init and fini methods. Module data objects last for the +lifetime of the KDC process.

+

If a module allocates and returns a list of authentication indicators +from authorize, it must also implement the free_ind method +to free the list.

+
+ + +
+
+
+
+
+

On this page

+ + +
+

Table of contents

+ + +
+

Full Table of Contents

+

Search

+
+ + + + +
+
+
+
+
+ +
+
+
Release: 1.16
+ © Copyright 1985-2017, MIT. +
+
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ + + \ No newline at end of file diff --git a/doc/html/plugindev/clpreauth.html b/doc/html/plugindev/clpreauth.html index 66af218e96cd..5b951fd2b0d2 100644 --- a/doc/html/plugindev/clpreauth.html +++ b/doc/html/plugindev/clpreauth.html @@ -15,7 +15,7 @@ + + + + + + + + + + + +
+
+ + +

MIT Kerberos Documentation

+ +
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ +
+
+
+ +
+
+
+ +
+

kadmin authorization interface (kadm5_auth)

+

The kadm5_auth interface (new in release 1.16) allows modules to +determine whether a client principal is authorized to perform an +operation in the kadmin protocol, and to apply restrictions to +principal operations. For a detailed description of the kadm5_auth +interface, see the header file <krb5/kadm5_auth_plugin.h>.

+

A module can create and destroy per-process state objects by +implementing the init and fini methods. State objects have +the type kadm5_auth_modinfo, which is an abstract pointer type. A +module should typically cast this to an internal type for the state +object.

+

The kadm5_auth interface has one method for each kadmin operation, +with parameters specific to the operation. Each method can return +either 0 to authorize access, KRB5_PLUGIN_NO_HANDLE to defer the +decision to other modules, or another error (canonically EPERM) to +authoritatively deny access. Access is granted if at least one module +grants access and no module authoritatively denies access.

+

The addprinc and modprinc methods can also impose restrictions +on the principal operation by returning a struct +kadm5_auth_restrictions object. The module should also implement +the free_restrictions method if it dynamically allocates +restrictions objects for principal operations.

+

kadm5_auth modules can optionally inspect principal or policy objects. +To do this, the module must also include <kadm5/admin.h> to gain +access to the structure definitions for those objects. As the kadmin +interface is explicitly not as stable as other public interfaces, +modules which do this may not retain compatibility across releases.

+
+ + +
+
+
+
+
+

On this page

+ + +
+

Table of contents

+ + +
+

Full Table of Contents

+

Search

+
+ + + + +
+
+
+
+
+ +
+
+
Release: 1.16
+ © Copyright 1985-2017, MIT. +
+
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ + + \ No newline at end of file diff --git a/doc/html/plugindev/kadm5_hook.html b/doc/html/plugindev/kadm5_hook.html index 35f076822d52..2ed57799b7a1 100644 --- a/doc/html/plugindev/kadm5_hook.html +++ b/doc/html/plugindev/kadm5_hook.html @@ -15,7 +15,7 @@ + + + + + + + + + + + +
+
+ + +

MIT Kerberos Documentation

+ +
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ +
+
+
+ +
+
+
+ +
+

KDC policy interface (kdcpolicy)

+

The kdcpolicy interface was first introduced in release 1.16. It +allows modules to veto otherwise valid AS and TGS requests or restrict +the lifetime and renew time of the resulting ticket. For a detailed +description of the kdcpolicy interface, see the header file +<krb5/kdcpolicy_plugin.h>.

+

The optional check_as and check_tgs functions allow the module +to perform access control. Additionally, a module can create and +destroy module data with the init and fini methods. Module +data objects last for the lifetime of the KDC process, and are +provided to all other methods. The data has the type +krb5_kdcpolicy_moddata, which should be cast to the appropriate +internal type.

+

kdcpolicy modules can optionally inspect principal entries. To do +this, the module must also include <kdb.h> to gain access to the +principal entry structure definition. As the KDB interface is +explicitly not as stable as other public interfaces, modules which do +this may not retain compatibility across releases.

+
+ + +
+
+
+
+
+

On this page

+ + +
+

Table of contents

+ + +
+

Full Table of Contents

+

Search

+
+ + + + +
+
+
+
+
+ +
+
+
Release: 1.16
+ © Copyright 1985-2017, MIT. +
+
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ + + \ No newline at end of file diff --git a/doc/html/plugindev/kdcpreauth.html b/doc/html/plugindev/kdcpreauth.html index b0566cfeb190..a755232152c2 100644 --- a/doc/html/plugindev/kdcpreauth.html +++ b/doc/html/plugindev/kdcpreauth.html @@ -15,7 +15,7 @@