Alexander Bokovoy
f78dc0b163
Resource-based constrained delegation (RBCD) is implemented with a new callback used by the KDC. This callback is called when a server asks for S4U2Proxy TGS request and passes a ticket that contains RBCD PAC options. The callback is supposed to take a client and a server principals, a PAC and a target service database entry. Using the target service database entry it then needs to decide whether a server principal is allowed to delegate the client credentials to the target service. The callback can also cross-check whether the client principal can be limited in delegating own tickets but this is not implemented in the current version. Fixes: https://pagure.io/freeipa/issue/9354 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This is the ipa krb5kdc database backend. As the KDB interfaces heavily with krb5, we inherit its code style as well. However, note the following changes: - no modelines (and different file preamble) - return types don't require their own line - single-statement blocks may optionally be braced - /* and */ do not ever get their own line - C99 for-loops are permitted (and encouraged) - a restricted set of other C99 features are permitted In particular, variable-length arrays, flexible array members, compound literals, universal character names, and //-style comments are not permitted. Use of regular malloc/free is preferred over talloc for new code. By and large, existing code mostly conforms to these requirements. New code must conform to them.