2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "lib/util/util.h"
24 #include "kdc/kdc-policy.h"
25 #include "system/kerberos.h"
26 #include "auth/kerberos/kerberos.h"
27 #include "librpc/gen_ndr/lsa.h"
28 #include "param/param.h"
30 void kdc_get_policy(struct loadparm_context
*lp_ctx
,
31 struct smb_krb5_context
*smb_krb5_context
,
32 struct lsa_DomainInfoKerberos
*k
)
34 /* These should be set and stored via Group Policy, but until then, some defaults are in order */
36 /* Our KDC always re-validates the client */
37 k
->authentication_options
= LSA_POLICY_KERBEROS_VALIDATE_CLIENT
;
39 unix_to_nt_time(&k
->service_tkt_lifetime
,
40 lpcfg_parm_int(lp_ctx
, NULL
, "kdc", "service ticket lifefime", 10) * 60 * 60);
41 unix_to_nt_time(&k
->user_tkt_lifetime
,
42 lpcfg_parm_int(lp_ctx
, NULL
, "kdc", "user ticket lifefime", 10) * 60 * 60);
43 unix_to_nt_time(&k
->user_tkt_renewaltime
,
44 lpcfg_parm_int(lp_ctx
, NULL
, "kdc", "renewal lifefime", 24*7) * 60 * 60);
45 if (smb_krb5_context
) {
46 unix_to_nt_time(&k
->clock_skew
,
47 krb5_get_max_time_skew(smb_krb5_context
->krb5_context
));