source4/kdc/policy.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    KDC Policy
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "lib/util/util.h"
  24 #include "kdc/kdc-policy.h"
  25 #include "system/kerberos.h"
  26 #include "auth/kerberos/kerberos.h"
  27 #include "librpc/gen_ndr/lsa.h"
  28 #include "param/param.h"
  29
  30 void kdc_get_policy(struct loadparm_context *lp_ctx,
  31                     struct smb_krb5_context *smb_krb5_context,
  32                     struct lsa_DomainInfoKerberos *k)
  33 {
  34         /* These should be set and stored via Group Policy, but until then, some defaults are in order */
  35
  36         /* Our KDC always re-validates the client */
  37         k->authentication_options = LSA_POLICY_KERBEROS_VALIDATE_CLIENT;
  38
  39         unix_to_nt_time(&k->service_tkt_lifetime,
  40                         lpcfg_parm_int(lp_ctx, NULL, "kdc", "service ticket lifefime", 10) * 60 * 60);
  41         unix_to_nt_time(&k->user_tkt_lifetime,
  42                         lpcfg_parm_int(lp_ctx, NULL, "kdc", "user ticket lifefime", 10) * 60 * 60);
  43         unix_to_nt_time(&k->user_tkt_renewaltime,
  44                         lpcfg_parm_int(lp_ctx, NULL, "kdc", "renewal lifefime", 24*7) * 60 * 60);
  45         if (smb_krb5_context) {
  46                 unix_to_nt_time(&k->clock_skew,
  47                                 krb5_get_max_time_skew(smb_krb5_context->krb5_context));
  48         }
  49         k->reserved = 0;
  50 }