Push PKINIT configuration into default_config.c

The interaction with Samba4 is subtle - it calls
krb5_kdc_get_config(), but not configure() - but must have PKINIT set
up.

Andrew Bartlett

diff --git a/kdc/config.c b/kdc/config.c
index 742e99211a277e6be7f6f7f858cce68096217617..49077474f43f7beb4f54ee90190e55f17e17caf6 100644 (file)
--- a/kdc/config.c
+++ b/kdc/config.c
@@ -333,34 +333,5 @@ configure(krb5_context context, int argc, char **argv)
 
     krb5_kdc_windc_init(context);
 
-#ifdef __APPLE__
-    config->enable_pkinit = 1;
-
-    if (config->pkinit_kdc_identity == NULL) {
-       if (config->pkinit_kdc_friendly_name == NULL)
-           config->pkinit_kdc_friendly_name = 
-               strdup("O=System Identity,CN=com.apple.kerberos.kdc");
-       config->pkinit_kdc_identity = strdup("KEYCHAIN:");
-    }
-    if (config->pkinit_kdc_anchors == NULL)
-       config->pkinit_kdc_anchors = strdup("KEYCHAIN:");
-
-#endif
-
-    if (config->enable_pkinit) {
-       if (config->pkinit_kdc_identity == NULL)
-           krb5_errx(context, 1, "pkinit enabled but no identity");
- 
-       if (config->pkinit_kdc_anchors == NULL)
-           krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
-
-       krb5_kdc_pk_initialize(context, config,
-                              config->pkinit_kdc_identity,
-                              config->pkinit_kdc_anchors,
-                              config->pkinit_kdc_cert_pool,
-                              config->pkinit_kdc_revoke);
-
-    }
-    
     return config;
 }

diff --git a/kdc/default_config.c b/kdc/default_config.c
index e376cbbddf82410d9732401c292a2ecbd0b439d4..118bdf97aa62723b56d626e69ca76e8a58d7c666 100644 (file)
--- a/kdc/default_config.c
+++ b/kdc/default_config.c
@@ -259,6 +259,35 @@ krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
                                    "kdc", "pkinit_dh_min_bits", NULL);
 
 
+#ifdef __APPLE__
+    c->enable_pkinit = 1;
+
+    if (c->pkinit_kdc_identity == NULL) {
+       if (c->pkinit_kdc_friendly_name == NULL)
+           c->pkinit_kdc_friendly_name =
+               strdup("O=System Identity,CN=com.apple.kerberos.kdc");
+       c->pkinit_kdc_identity = strdup("KEYCHAIN:");
+    }
+    if (c->pkinit_kdc_anchors == NULL)
+       c->pkinit_kdc_anchors = strdup("KEYCHAIN:");
+
+#endif
+
+    if (c->enable_pkinit) {
+       if (c->pkinit_kdc_identity == NULL)
+           krb5_errx(context, 1, "pkinit enabled but no identity");
+
+       if (c->pkinit_kdc_anchors == NULL)
+           krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
+
+       krb5_kdc_pk_initialize(context, c,
+                              c->pkinit_kdc_identity,
+                              c->pkinit_kdc_anchors,
+                              c->pkinit_kdc_cert_pool,
+                              c->pkinit_kdc_revoke);
+
+    }
+
     *config = c;
 
     return 0;