5 IMPORTS EncryptionKey, KerberosTime, Principal FROM krb5;
7 HDB_DB_FORMAT INTEGER ::= 2 -- format of database,
8 -- update when making changes
10 -- these must have the same value as the pa-* counterparts
11 hdb-pw-salt INTEGER ::= 3
12 hdb-afs3-salt INTEGER ::= 10
15 type[0] INTEGER (0..4294967295),
17 opaque[2] OCTET STRING OPTIONAL
21 mkvno[0] INTEGER (0..4294967295) OPTIONAL, -- master key version number
28 principal[1] Principal OPTIONAL
31 HDBFlags ::= BIT STRING {
32 initial(0), -- require as-req
33 forwardable(1), -- may issue forwardable
34 proxiable(2), -- may issue proxiable
35 renewable(3), -- may issue renewable
36 postdate(4), -- may issue postdatable
37 server(5), -- may be server
38 client(6), -- may be client
39 invalid(7), -- entry is invalid
40 require-preauth(8), -- must use preauth
41 change-pw(9), -- change password service
42 require-hwauth(10), -- must use hwauth
43 ok-as-delegate(11), -- as in TicketFlags
44 user-to-user(12), -- may use user-to-user auth
45 immutable(13), -- may not be deleted
46 trusted-for-delegation(14), -- Trusted to print forwardabled tickets
47 allow-kerberos4(15), -- Allow Kerberos 4 requests
48 allow-digest(16), -- Allow digest requests
49 locked-out(17), -- Account is locked out,
50 -- authentication will be denied
51 do-not-store(31) -- Not to be modified and stored in HDB
54 GENERATION ::= SEQUENCE {
55 time[0] KerberosTime, -- timestamp
56 usec[1] INTEGER (0..4294967295), -- microseconds
57 gen[2] INTEGER (0..4294967295) -- generation number
60 HDB-Ext-PKINIT-acl ::= SEQUENCE OF SEQUENCE {
61 subject[0] UTF8String,
62 issuer[1] UTF8String OPTIONAL,
63 anchor[2] UTF8String OPTIONAL
66 HDB-Ext-PKINIT-hash ::= SEQUENCE OF SEQUENCE {
67 digest-type[0] OBJECT IDENTIFIER,
68 digest[1] OCTET STRING
71 HDB-Ext-PKINIT-cert ::= SEQUENCE OF SEQUENCE {
75 HDB-Ext-Constrained-delegation-acl ::= SEQUENCE OF Principal
77 -- hdb-ext-referrals ::= PA-SERVER-REFERRAL-DATA
79 HDB-Ext-Lan-Manager-OWF ::= OCTET STRING
81 HDB-Ext-Password ::= SEQUENCE {
82 mkvno[0] INTEGER (0..4294967295) OPTIONAL, -- master key version number
86 HDB-Ext-Aliases ::= SEQUENCE {
87 case-insensitive[0] BOOLEAN, -- case insensitive name allowed
88 aliases[1] SEQUENCE OF Principal -- all names, inc primary
91 Keys ::= SEQUENCE OF Key
93 hdb_keyset ::= SEQUENCE {
94 kvno[0] INTEGER (0..4294967295),
96 set-time[2] KerberosTime OPTIONAL, -- time this keyset was created/set
100 HDB-Ext-KeySet ::= SEQUENCE OF hdb_keyset
103 HDB-extension ::= SEQUENCE {
104 mandatory[0] BOOLEAN, -- kdc MUST understand this extension,
105 -- if not the whole entry must
108 pkinit-acl[0] HDB-Ext-PKINIT-acl,
109 pkinit-cert-hash[1] HDB-Ext-PKINIT-hash,
110 allowed-to-delegate-to[2] HDB-Ext-Constrained-delegation-acl,
111 -- referral-info[3] HDB-Ext-Referrals,
112 lm-owf[4] HDB-Ext-Lan-Manager-OWF,
113 password[5] HDB-Ext-Password,
114 aliases[6] HDB-Ext-Aliases,
115 last-pw-change[7] KerberosTime,
116 pkinit-cert[8] HDB-Ext-PKINIT-cert,
117 hist-keys[9] HDB-Ext-KeySet,
118 hist-kvno-diff-clnt[10] INTEGER (0..4294967295),
119 hist-kvno-diff-svc[11] INTEGER (0..4294967295),
120 policy[12] UTF8String,
126 HDB-extensions ::= SEQUENCE OF HDB-extension
128 hdb_entry ::= SEQUENCE {
129 principal[0] Principal OPTIONAL, -- this is optional only
130 -- for compatibility with libkrb5
131 kvno[1] INTEGER (0..4294967295),
134 modified-by[4] Event OPTIONAL,
135 valid-start[5] KerberosTime OPTIONAL,
136 valid-end[6] KerberosTime OPTIONAL,
137 pw-end[7] KerberosTime OPTIONAL,
138 max-life[8] INTEGER (0..4294967295) OPTIONAL,
139 max-renew[9] INTEGER (0..4294967295) OPTIONAL,
141 etypes[11] SEQUENCE OF INTEGER (0..4294967295) OPTIONAL,
142 generation[12] GENERATION OPTIONAL,
143 extensions[13] HDB-extensions OPTIONAL
146 hdb_entry_alias ::= [APPLICATION 0] SEQUENCE {
147 principal[0] Principal OPTIONAL