kdc/kdc.h

   1 /*
   2  * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  *
   5  * Copyright (c) 2005 Andrew Bartlett <abartlet@samba.org>
   6  *
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  *
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  *
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  *
  20  * 3. Neither the name of the Institute nor the names of its contributors
  21  *    may be used to endorse or promote products derived from this software
  22  *    without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  */
  36
  37 /*
  38  * $Id$
  39  */
  40
  41 #ifndef __KDC_H__
  42 #define __KDC_H__
  43
  44 #include <hdb.h>
  45 #include <krb5.h>
  46 #include <kx509_asn1.h>
  47
  48 enum krb5_kdc_trpolicy {
  49     TRPOLICY_ALWAYS_CHECK,
  50     TRPOLICY_ALLOW_PER_PRINCIPAL,
  51     TRPOLICY_ALWAYS_HONOUR_REQUEST
  52 };
  53
  54 typedef struct krb5_kdc_configuration {
  55     krb5_boolean require_preauth; /* require preauth for all principals */
  56     time_t kdc_warn_pwexpire; /* time before expiration to print a warning */
  57
  58     struct HDB **db;
  59     int num_db;
  60
  61     int num_kdc_processes;
  62
  63     krb5_boolean encode_as_rep_as_tgs_rep; /* bug compatibility */
  64
  65     /*
  66      * Windows 2019 (and earlier versions) always sends the salt
  67      * and Samba has testsuites that check this behaviour, so a
  68      * Samba AD DC will set this flag to match the AS-REP packet
  69      * exactly.
  70      */
  71     krb5_boolean force_include_pa_etype_salt;
  72
  73     krb5_boolean tgt_use_strongest_session_key;
  74     krb5_boolean preauth_use_strongest_session_key;
  75     krb5_boolean svc_use_strongest_session_key;
  76     krb5_boolean use_strongest_server_key;
  77
  78     krb5_boolean check_ticket_addresses;
  79     krb5_boolean warn_ticket_addresses;
  80     krb5_boolean allow_null_ticket_addresses;
  81     krb5_boolean allow_anonymous;
  82     krb5_boolean historical_anon_realm;
  83     krb5_boolean strict_nametypes;
  84     enum krb5_kdc_trpolicy trpolicy;
  85
  86     krb5_boolean enable_pkinit;
  87     krb5_boolean pkinit_princ_in_cert;
  88     const char *pkinit_kdc_identity;
  89     const char *pkinit_kdc_anchors;
  90     const char *pkinit_kdc_friendly_name;
  91     const char *pkinit_kdc_ocsp_file;
  92     char **pkinit_kdc_cert_pool;
  93     char **pkinit_kdc_revoke;
  94     int pkinit_dh_min_bits;
  95     /* XXX Turn these into bit-fields */
  96     int pkinit_require_binding;
  97     int pkinit_allow_proxy_certs;
  98     int synthetic_clients;
  99     int pkinit_max_life_from_cert_extension;
 100     krb5_timestamp pkinit_max_life_from_cert;
 101     krb5_timestamp pkinit_max_life_bound;
 102     krb5_timestamp synthetic_clients_max_life;
 103     krb5_timestamp synthetic_clients_max_renew;
 104
 105     krb5_log_facility *logf;
 106
 107     int enable_digest;
 108     int digests_allowed;
 109
 110     size_t max_datagram_reply_length;
 111
 112     int enable_kx509;
 113
 114     const char *app;
 115 } krb5_kdc_configuration;
 116
 117 typedef struct kdc_request_desc *kdc_request_t;
 118 typedef struct astgs_request_desc *astgs_request_t;
 119 typedef struct kx509_req_context_desc *kx509_req_context;
 120
 121 struct krb5_kdc_service {
 122     unsigned int flags;
 123 #define KS_KRB5         1
 124 #define KS_NO_LENGTH    2
 125     const char *name;
 126     krb5_error_code (*process)(kdc_request_t *, int *claim);
 127 };
 128
 129 #include <kdc-protos.h>
 130
 131 #endif