Unnamed repository; edit this file 'description' to name the repository. https://git.gnuabordo.com.br/debian/krb5-wallet.git/atom?h=release%2F0.10 2010-02-21T07:19:50+00:00 2010-02-21T07:19:50+00:00 Russ Allbery rra@stanford.edu 2010-02-21T07:19:50+00:00 urn:sha1:c4234b72a39b25122dbba769e028d1d105a4132e 2010-02-19T06:06:17+00:00 Russ Allbery rra@stanford.edu 2010-02-19T06:06:17+00:00 urn:sha1:93eb5f8fe8d05398dd6fb364680e40eb8dae23e4 Change the API for keytab_rekey to match keytab, returning the keytab as data instead of writing it to a file. This simplifies the wallet object implementation and moves the logic for reading the temporary file into Wallet::Kadmin and its child classes. (Eventually, there may be a kadmin backend that doesn't require using a temporary file.) Setting KEYTAB_TMP is now required to instantiate either the ::MIT or ::Heimdal Wallet::Kadmin classes. 2010-02-19T05:31:10+00:00 Russ Allbery rra@stanford.edu 2010-02-19T05:31:10+00:00 urn:sha1:a24d3ac3c7e8cb68fe2268f337a4edb599d5f881 Heimdal supports retrieving a keytab containing the existing keys over the kadmin protocol. Move the support for using remctl to retrieve an existing keytab into Wallet::Kadmin::MIT and provide two separate methods in the Wallet::Kadmin interface: one which rekeys and one which doesn't. Implement the non-rekeying interface for Heimdal. Expand the test suite for the unchanging keytabs to include tests for the Heimdal method. 2010-02-19T02:03:09+00:00 Russ Allbery rra@stanford.edu 2010-02-19T02:03:09+00:00 urn:sha1:2651ef4352c8cc782c4e0f3175257f7bb0c1e495 Now that we support multiple versions of Kerberos, use generic names for the functions in the Wallet::Kadmin interface rather than the commands from the MIT kadmin interface. 2010-02-10T02:42:26+00:00 Russ Allbery rra@stanford.edu 2010-02-10T02:42:26+00:00 urn:sha1:31c47c6f5efde6df930b11be281470f75e685324 2010-02-09T21:06:31+00:00 Russ Allbery rra@stanford.edu 2010-02-09T21:06:31+00:00 urn:sha1:59455fd5e6a47a66a2a84779f42928fd66ec9747 Remove kaserver synchronization support. It is no longer tested, and retaining the code was increasing the complexity of wallet, and some specific requirements (such as different realm names between kaserver and Kerberos v5 and the kvno handling) were Stanford-specific. Rather than using this support, AFS sites running kaserver will probably find deploying Heimdal with its internal kaserver compatibility is probably an easier transition approach. 2010-02-09T04:08:32+00:00 Russ Allbery rra@stanford.edu 2010-02-09T04:08:32+00:00 urn:sha1:954151bb1aeb8920b0077692db1705c39ff76eda Map the AES enctype to the full enctype name, which will work for both MIT and Heimdal. Fix the test count. Really test rollback from invalid enctypes (what we did before made no sense). Skip tests that will just fail if the enctype stuff is not working, since otherwise it confuses matters. 2010-02-09T03:59:26+00:00 Russ Allbery rra@stanford.edu 2010-02-09T03:59:26+00:00 urn:sha1:c2422d4f762b5db774c6e0fef2cb2de916904f0e We may have a different userspace than the Kerberos type, so always try klist -ke first and then fall back on ktutil if it fails. Also display the error message in a few more places if things fail, discovered as useful when debugging other problems. 2010-02-09T03:46:54+00:00 Russ Allbery rra@stanford.edu 2010-02-09T03:46:54+00:00 urn:sha1:a96f4abbbe8176101584e414be5139e244377025 Now that we have Wallet::Kadmin, use it, rather than running the kadmin client program. We may not have the same kadmin client program as the server that we're testing against. 2010-02-09T03:40:17+00:00 Russ Allbery rra@stanford.edu 2010-02-09T03:40:17+00:00 urn:sha1:b6cf2f78636970900015e74b03160e7280164e47 Don't use kadmin to check for principal existence. We want to verify that we can get tickets, not just look at kadmin. Use whatever is found on the user's PATH, not something based on the Kerberos type, since our userspace may not match the server implementation.