Alexander Bokovoy
d551e853fc
Kerberos principal aliases lookup had a long-standing TODO item to support server referrals for host-based aliases. This commit implements server referrals for hosts belonging to trusted domains. The use-case is a part of S4U processing in a two-way trust when an IPA service requests a ticket to a host in a trusted domain (e.g. service on AD DC). In such situation, the server principal in TGS request will be a normal principal in our domain and KDC needs to respond with a server referral. This referral can be issued by a KDB driver or by the KDC itself, using 'domain_realms' section of krb5.conf. Since KDB knows all suffixes associated with the trusted domains, implement the logic there. Fixes: https://pagure.io/freeipa/issue/9164 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Julien Rische <jrische@redhat.com>
This is the ipa krb5kdc database backend. As the KDB interfaces heavily with krb5, we inherit its code style as well. However, note the following changes: - no modelines (and different file preamble) - return types don't require their own line - single-statement blocks may optionally be braced - /* and */ do not ever get their own line - C99 for-loops are permitted (and encouraged) - a restricted set of other C99 features are permitted In particular, variable-length arrays, flexible array members, compound literals, universal character names, and //-style comments are not permitted. Use of regular malloc/free is preferred over talloc for new code. By and large, existing code mostly conforms to these requirements. New code must conform to them.