source4/kdc/policy.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    KDC Policy
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "system/kerberos.h"
  24 #include "auth/kerberos/kerberos.h"
  25 #include "param/param.h"
  26 #include "kdc/kdc-policy.h"
  27
  28 void kdc_get_policy(struct loadparm_context *lp_ctx,
  29                     struct smb_krb5_context *smb_krb5_context,
  30                     struct lsa_DomainInfoKerberos *k)
  31 {
  32         time_t svc_tkt_lifetime;
  33         time_t usr_tkt_lifetime;
  34         time_t renewal_lifetime;
  35
  36         /* These should be set and stored via Group Policy, but until then, some defaults are in order */
  37
  38         /* Our KDC always re-validates the client */
  39         k->authentication_options = LSA_POLICY_KERBEROS_VALIDATE_CLIENT;
  40
  41         lpcfg_default_kdc_policy(lp_ctx, &svc_tkt_lifetime,
  42                                  &usr_tkt_lifetime, &renewal_lifetime);
  43
  44         unix_to_nt_time(&k->service_tkt_lifetime, svc_tkt_lifetime);
  45         unix_to_nt_time(&k->user_tkt_lifetime, usr_tkt_lifetime);
  46         unix_to_nt_time(&k->user_tkt_renewaltime, renewal_lifetime);
  47         if (smb_krb5_context) {
  48                 unix_to_nt_time(&k->clock_skew,
  49                                 krb5_get_max_time_skew(smb_krb5_context->krb5_context));
  50         }
  51         k->reserved = 0;
  52 }