s4-kerberos: obey the credentials setting for forwardable tickets

[metze/samba/wip.git] / source4 / auth / kerberos / kerberos.h

diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
index ca2833f1610af51b6623c168acbf8c5e43606e81..b58014f4930a6db309ebf4431f2f4725e3138393 100644 (file)
--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
@@ -6,7 +6,7 @@
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
@@ -15,8 +15,7 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 #if defined(HAVE_KRB5)
@@ -54,6 +53,9 @@ struct keytab_container {
 #define KRB5_KEY_DATA(k)       ((k)->contents)
 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
 
+#define ENC_ALL_TYPES (ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 |    \
+                      ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256)
+
 #ifndef HAVE_KRB5_SET_REAL_TIME
 krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds);
 #endif
@@ -81,45 +83,32 @@ int create_kerberos_key_from_string_direct(krb5_context context, krb5_principal
 krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt);
 krb5_error_code get_kerberos_allowed_etypes(krb5_context context, krb5_enctype **enctypes);
 void free_kerberos_etypes(krb5_context context, krb5_enctype *enctypes);
-BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, BOOL remote);
+bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote);
 krb5_error_code ads_krb5_mk_req(krb5_context context, 
                                krb5_auth_context *auth_context, 
                                const krb5_flags ap_req_options,
                                const char *principal,
                                krb5_ccache ccache, 
                                krb5_data *outbuf);
-BOOL get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
- NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx, 
-                           struct smb_krb5_context *smb_krb5_context,
-                           krb5_auth_context *auth_context,
-                           struct cli_credentials *machine_account,
-                           const char *service, 
-                           const DATA_BLOB *enc_ticket, 
-                           krb5_ticket **tkt,
-                           DATA_BLOB *ap_rep,
-                           krb5_keyblock **keyblock);
-int kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc, 
-                              krb5_principal principal, const char *password, 
-                              time_t *expire_time, time_t *kdc_time);
-int kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, 
-                              krb5_principal principal, krb5_keyblock *keyblock,
-                              time_t *expire_time, time_t *kdc_time);
+bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
+krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
+                                          krb5_principal principal, const char *password,
+                                          krb5_principal impersonate_principal, const char *target_service,
+                                          krb5_get_init_creds_opt *krb_options,
+                                          time_t *expire_time, time_t *kdc_time);
+krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
+                                          krb5_principal principal, krb5_keyblock *keyblock,
+                                          const char *target_service,
+                                          krb5_get_init_creds_opt *krb_options,
+                                          time_t *expire_time, time_t *kdc_time);
 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
                                                        krb5_principal host_princ,
                                                        int enctype);
 void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype);
-BOOL kerberos_compatible_enctypes(krb5_context context, krb5_enctype enctype1, krb5_enctype enctype2);
+bool kerberos_compatible_enctypes(krb5_context context, krb5_enctype enctype1, krb5_enctype enctype2);
 void kerberos_free_data_contents(krb5_context context, krb5_data *pdata);
 krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry);
 char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx);
- krb5_error_code kinit_to_ccache(TALLOC_CTX *parent_ctx,
-                         struct cli_credentials *credentials,
-                         struct smb_krb5_context *smb_krb5_context,
-                                krb5_ccache ccache);
-krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx, 
-                                          struct cli_credentials *credentials, 
-                                          struct smb_krb5_context *smb_krb5_context,
-                                          krb5_principal *princ);
 NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
                             struct PAC_DATA **pac_data_out,
                             DATA_BLOB blob,
@@ -152,6 +141,10 @@ NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
                                     krb5_principal client_principal,
                                     time_t tgs_authtime,
                                     DATA_BLOB *pac);
+struct loadparm_context;
+uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum);
+/* Translate between the Microsoft msDS-SupportedEncryptionTypes values and the IETF encryption type values */
+krb5_enctype kerberos_enctype_bitmap_to_enctype(uint32_t enctype_bitmap);
 
 #include "auth/kerberos/proto.h"