krb5: Import MIT 1.21.3 - src - FreeBSD source tree

diff options


context:
space:
mode:

author	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
committer	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
commit	8f7d3ef26dec89a92ec0665de84a5936310a5574 (patch)
tree	9a465418bd4056bf0d369751320a414eaed29fa4 /doc/html/admin/auth_indicator.html
parent	1a79b20663ca26acc2998b90ea2ff2aefd8af5b1 (diff)

Diffstat (limited to 'doc/html/admin/auth_indicator.html')

-rw-r--r--

doc/html/admin/auth_indicator.html

1 files changed, 24 insertions, 30 deletions

diff --git a/doc/html/admin/auth_indicator.html b/doc/html/admin/auth_indicator.html
index beb777d6f268..1ac39373b5ff 100644
--- a/doc/html/admin/auth_indicator.html
+++ b/doc/html/admin/auth_indicator.html

@@ -1,35 +1,26 @@

-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<!DOCTYPE html>

-<html xmlns="http://www.w3.org/1999/xhtml">

+<html>

<head>

- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <meta charset="utf-8" />

+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />

<title>Authentication indicators — MIT Kerberos Documentation</title>

- <link rel="stylesheet" href="../_static/agogo.css" type="text/css" />

- <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />

- <link rel="stylesheet" href="../_static/kerb.css" type="text/css" />

- <script type="text/javascript">

- var DOCUMENTATION_OPTIONS = {

- URL_ROOT: '../',

- VERSION: '1.21.2',

- COLLAPSE_INDEX: false,

- FILE_SUFFIX: '.html',

- HAS_SOURCE: true,

- SOURCELINK_SUFFIX: '.txt'

- };

- </script>

- <script type="text/javascript" src="../_static/jquery.js"></script>

- <script type="text/javascript" src="../_static/underscore.js"></script>

- <script type="text/javascript" src="../_static/doctools.js"></script>

+ <link rel="stylesheet" type="text/css" href="../_static/pygments.css" />

+ <link rel="stylesheet" type="text/css" href="../_static/agogo.css" />

+ <link rel="stylesheet" type="text/css" href="../_static/kerb.css" />

+ <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>

+ <script src="../_static/jquery.js"></script>

+ <script src="../_static/underscore.js"></script>

+ <script src="../_static/doctools.js"></script>

- </head>

- <body>

+ </head><body>

@@ -61,7 +52,7 @@

- <div class="section" id="authentication-indicators">

+ <section id="authentication-indicators">

<span id="auth-indicator"></span><h1>Authentication indicators<a class="headerlink" href="#authentication-indicators" title="Permalink to this headline">¶</a></h1>

<p>As of release 1.14, the KDC can be configured to annotate tickets if

the client authenticated using a stronger preauthentication mechanism

@@ -85,24 +76,24 @@ indicator values separated by spaces.</p>

<p>For example, a realm could be configured to set the authentication

indicator value “strong” when PKINIT is used to authenticate, using a

setting in the <a class="reference internal" href="conf_files/kdc_conf.html#kdc-realms"><span class="std std-ref">[realms]</span></a> subsection:</p>

-<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">pkinit_indicator</span> <span class="o">=</span> <span class="n">strong</span>

+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_indicator</span> <span class="o">=</span> <span class="n">strong</span>

</pre></div>

</div>

<p>A service principal could be configured to require the “strong”

authentication indicator value:</p>

-<div class="highlight-default"><div class="highlight"><pre><span></span>$ kadmin setstr host/high.value.server require_auth strong

+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kadmin setstr host/high.value.server require_auth strong

Password for user/admin@KRBTEST.COM:

</pre></div>

</div>

<p>A user who authenticates with PKINIT would be able to obtain a ticket

for the service principal:</p>

-<div class="highlight-default"><div class="highlight"><pre><span></span>$ kinit -X X509_user_identity=FILE:/my/cert.pem,/my/key.pem user

+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kinit -X X509_user_identity=FILE:/my/cert.pem,/my/key.pem user

$ kvno host/high.value.server

host/high.value.server@KRBTEST.COM: kvno = 1

</pre></div>

</div>

<p>but a user who authenticates with a password would not:</p>

-<div class="highlight-default"><div class="highlight"><pre><span></span>$ kinit user

+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kinit user

Password for user@KRBTEST.COM:

$ kvno host/high.value.server

kvno: KDC policy rejects request while getting credentials for

@@ -112,14 +103,16 @@ kvno: KDC policy rejects request while getting credentials for

<p>GSSAPI server applications can inspect authentication indicators

through the <a class="reference internal" href="../appdev/gssapi.html#gssapi-authind-attr"><span class="std std-ref">auth-indicators</span></a> name

attribute.</p>

-</div>

+</section>

+ <div class="clearer"></div>

</div>

<ul>

<li><a class="reference internal" href="#">Authentication indicators</a></li>

@@ -176,6 +169,7 @@ attribute.</p>

</form>

</div>

</div>

@@ -183,8 +177,8 @@ attribute.</p>

- <div class="right" ><i>Release: 1.21.2</i><br />

+ <div class="right" ><i>Release: 1.21.3</i><br />

</div>