[SCM] Samba Shared Repository - branch master updated
Andrew Bartlett
abartlet at samba.org
Sat Jul 23 01:19:04 UTC 2016
The branch, master has been updated
via 32a254d s4:dsdb/replicated_objects: don't skip notifications on resolved conflicts
via 049b507 s4:dsdb/repl_meta_data: remember originating updates when applying replicated changes
via 54d32c2 s4:kdc: provide a PAC_UPN_DNS_INFO element for logons
via 8b1f5ca auth/auth_sam_reply: fill user_principal_* and dns_domain_name in make_user_info_dc_pac()
via 1854252 WHATSNEW: add SmartCard/PKINIT improvements
via 661e1a2 s4:selftest: run the pkinit test in the ad_dc and ad_dc_ntvfs environment
via 4ab5365 s4:selftest: run test_pkinit_pac_heimdal.sh test
via 82726ac testprogs/blackbox: add test_pkinit_pac_heimdal.sh
via 3039062 test_pkinit_heimdal.sh: add some more tests regarding the UF_SMARTCARD_REQUIRED behavior
via b3f8270 selftest/Samba: copy pkinit@$DOMAIN certificates to the environment
via d4af9e4 selftest/manage-ca: update manage-CA-samba.example.com.sh
via 0860b13 selftest/manage-ca: add certificates for pkinit@[addom.]samba.example.com
via 763baa6 selftest/Samba: remove compat admincert* files
via f1bb8f6 s4:dsdb/tests: add UF_SMARTCARD_REQUIRED tests
via acb2086 s4:dsdb/password_hash: add the UF_SMARTCARD_REQUIRED password reset magic
via af4dc22 s4:kdc: provide a PAC_CREDENTIAL_INFO element for PKINIT logons
via c2b7bac s4:kdc: correctly update the PAC in samba_wdc_reget_pac()
via 6762d6b s4:kdc: hook into heimdal's windc.pac_pk_generate hook
via 0022ea9 HEIMDAL:kdc: add krb5plugin_windc_pac_pk_generate() hook
via f618330 HEIMDAL:kdc: reset e_text after successful pre-auth verification
via 08ead28 HEIMDAL:lib/krb5: allow predefined PAC_{LOGON_NAME,PRIVSVR_CHECKSUM,SERVER_CHECKSUM} elements in _krb5_pac_sign()
via fbd0610 s4:torture/remote_pac: verify the order of PAC elements
via 2d9958e auth/credentials: also do a shallow copy of the krb5_ccache.
from 0dd1c65 tevent: Add overflow protection to tevent_req_create
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 32a254d1dd7a6b0b873bec3d002da08f94187e48
Author: Stefan Metzmacher <metze at samba.org>
Date: Wed Jul 13 08:17:15 2016 +0200
s4:dsdb/replicated_objects: don't skip notifications on resolved conflicts
We should propagate resolved conflicts immediately.
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet at samba.org>
Autobuild-Date(master): Sat Jul 23 03:18:58 CEST 2016 on sn-devel-144
commit 049b50766ab623b47f79335d905dd03048a7bbfe
Author: Stefan Metzmacher <metze at samba.org>
Date: Wed Jul 13 08:15:20 2016 +0200
s4:dsdb/repl_meta_data: remember originating updates when applying replicated changes
The caller needs to know about them in order to decide about possible
notifications.
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 54d32c262bcab2bbe82a30909c5820fbcfa7a444
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri May 13 00:13:33 2016 +0200
s4:kdc: provide a PAC_UPN_DNS_INFO element for logons
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 8b1f5cad958a4022edc947b6abdb198ffad1a525
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Jan 7 14:55:07 2016 +0100
auth/auth_sam_reply: fill user_principal_* and dns_domain_name in make_user_info_dc_pac()
This is required in order to support netr_SamInfo6 and PAC_UPN_DNS_INFO
correctly.
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 1854252816bf19b9afd104098e750d8495ad85b6
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Jul 22 12:58:00 2016 +0200
WHATSNEW: add SmartCard/PKINIT improvements
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 661e1a229e85f566c5fc5d43ea03fbb29847439a
Author: Stefan Metzmacher <metze at samba.org>
Date: Sat Jan 16 14:25:18 2016 +0100
s4:selftest: run the pkinit test in the ad_dc and ad_dc_ntvfs environment
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 4ab53657cbe4a1fc2d9d676c67dac0fb039623e4
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Jul 21 15:35:40 2016 +0200
s4:selftest: run test_pkinit_pac_heimdal.sh test
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 82726acf143a90f9caf5fa9c4bcb5e901b4a4ef1
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Jul 21 15:34:50 2016 +0200
testprogs/blackbox: add test_pkinit_pac_heimdal.sh
This verifies that we have a PAC_CREDENTIAL_INFO element in the PAC
when using pkinit.
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 303906225a3cfc57a67d39e437924c5c6066a621
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Jun 2 18:24:18 2016 +0200
test_pkinit_heimdal.sh: add some more tests regarding the UF_SMARTCARD_REQUIRED behavior
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit b3f827009b2d8cfb71218a8cf640ea879d4da821
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Jun 3 21:46:13 2016 +0200
selftest/Samba: copy pkinit@$DOMAIN certificates to the environment
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit d4af9e4961777fb6f9f664fd21cebc3b755dddef
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Jun 3 21:32:04 2016 +0200
selftest/manage-ca: update manage-CA-samba.example.com.sh
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 0860b1379895909b413f11cc72c615199c71bd0c
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Jun 3 21:32:04 2016 +0200
selftest/manage-ca: add certificates for pkinit@[addom.]samba.example.com
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 763baa632af08da5181b3454d502add5226494c8
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Jun 3 21:46:13 2016 +0200
selftest/Samba: remove compat admincert* files
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit f1bb8f69dfbbaa8564c6a96a31f9e261ac8acd1b
Author: Stefan Metzmacher <metze at samba.org>
Date: Tue May 24 02:40:00 2016 +0200
s4:dsdb/tests: add UF_SMARTCARD_REQUIRED tests
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit acb208625b43191db44e3969b67d80d32436e79e
Author: Stefan Metzmacher <metze at samba.org>
Date: Tue May 31 16:39:06 2016 +0200
s4:dsdb/password_hash: add the UF_SMARTCARD_REQUIRED password reset magic
When UF_SMARTCARD_REQUIRED is set to an account we need to remove
the current password and add random NT and LM hashes (without updating
the pwdLastSet field.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit af4dc2231446b292cec91b1853a991df7c97b8e2
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu May 12 23:20:39 2016 +0200
s4:kdc: provide a PAC_CREDENTIAL_INFO element for PKINIT logons
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit c2b7bac37927d2532e1ca0ddc15780ebd5557533
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Jan 7 17:25:26 2016 +0100
s4:kdc: correctly update the PAC in samba_wdc_reget_pac()
We need to keep unknown PAC elements and just copy them.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 6762d6b5910e07aa82a3f50f5a4e6fccadc77194
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri May 20 09:48:41 2016 +0200
s4:kdc: hook into heimdal's windc.pac_pk_generate hook
This allows PAC_CRENDENTIAL_INFO to be added to the PAC
when using PKINIT. In that case PAC_CRENDENTIAL_INFO contains
an encrypted PAC_CRENDENTIAL_DATA.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 0022ea9efb0e7809fa2d060b294320eb0479cdd2
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri May 20 08:29:30 2016 +0200
HEIMDAL:kdc: add krb5plugin_windc_pac_pk_generate() hook
This allows PAC_CRENDENTIAL_INFO to be added to the PAC
when using PKINIT. In that case PAC_CRENDENTIAL_INFO contains
an encrypted PAC_CRENDENTIAL_DATA.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit f61833082ad5370bf67d316ec2f0a37e55d4eb60
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri May 20 14:57:57 2016 +0200
HEIMDAL:kdc: reset e_text after successful pre-auth verification
This is already fixed in upstream heimdal.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 08ead28c6996b4e6bf51b2fd9214217724fe01be
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Jan 7 14:12:14 2016 +0100
HEIMDAL:lib/krb5: allow predefined PAC_{LOGON_NAME,PRIVSVR_CHECKSUM,SERVER_CHECKSUM} elements in _krb5_pac_sign()
A caller may want to specify an explicit order of PAC elements,
e.g. the PAC_UPN_DNS_INFO element should be placed after the PAC_LOGON_NAME
element.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
This is commit 7cd40a610569d5e54ebe323672794fb6415b5dac in heimdal master.
commit fbd061095396b986be297061bc5108cc30eb57ad
Author: Stefan Metzmacher <metze at samba.org>
Date: Wed Jul 20 10:12:45 2016 +0200
s4:torture/remote_pac: verify the order of PAC elements
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
commit 2d9958e46c2e66d0476cc9ec3934ed16a352c077
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Jul 21 15:08:32 2016 +0200
auth/credentials: also do a shallow copy of the krb5_ccache.
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
-----------------------------------------------------------------------
Summary of changes:
WHATSNEW.txt | 22 +
auth/auth_sam_reply.c | 22 +
auth/auth_sam_reply.h | 1 +
auth/credentials/credentials.c | 15 -
auth/credentials/credentials.h | 3 -
auth/credentials/credentials_krb5.c | 67 +++
auth/credentials/credentials_krb5.h | 4 +
.../manage-ca/CA-samba.example.com/NewCerts/04.pem | 168 ++++++++
.../manage-ca/CA-samba.example.com/NewCerts/05.pem | 168 ++++++++
.../Private/CA-samba.example.com-index.txt | 2 +
.../Private/CA-samba.example.com-index.txt.old | 2 +
.../Private/CA-samba.example.com-serial.txt | 2 +-
.../Private/CA-samba.example.com-serial.txt.old | 2 +-
...SER-pkinit at addom.samba.example.com-S05-cert.cer | Bin 0 -> 2300 bytes
...SER-pkinit at addom.samba.example.com-S05-cert.pem | 168 ++++++++
...USER-pkinit at addom.samba.example.com-S05-key.pem | 30 ++
...-pkinit at addom.samba.example.com-S05-openssl.cnf | 242 +++++++++++
...nit at addom.samba.example.com-S05-private-key.pem | 27 ++
...-pkinit at addom.samba.example.com-S05-private.p12 | Bin 0 -> 3901 bytes
...USER-pkinit at addom.samba.example.com-S05-req.pem | 19 +
.../USER-pkinit at addom.samba.example.com-cert.pem | 1 +
...-pkinit at addom.samba.example.com-private-key.pem | 1 +
.../USER-pkinit at samba.example.com-S04-cert.cer | Bin 0 -> 2270 bytes
.../USER-pkinit at samba.example.com-S04-cert.pem | 168 ++++++++
.../USER-pkinit at samba.example.com-S04-key.pem | 30 ++
.../USER-pkinit at samba.example.com-S04-openssl.cnf | 242 +++++++++++
...ER-pkinit at samba.example.com-S04-private-key.pem | 27 ++
.../USER-pkinit at samba.example.com-S04-private.p12 | Bin 0 -> 3869 bytes
.../USER-pkinit at samba.example.com-S04-req.pem | 18 +
.../USER-pkinit at samba.example.com-cert.pem | 1 +
.../USER-pkinit at samba.example.com-private-key.pem | 1 +
selftest/manage-ca/manage-CA-samba.example.com.sh | 3 +
selftest/target/Samba.pm | 36 +-
source4/auth/kerberos/kerberos_pac.c | 35 ++
source4/dsdb/repl/replicated_objects.c | 20 +-
source4/dsdb/samdb/ldb_modules/password_hash.c | 133 ++++++
source4/dsdb/samdb/ldb_modules/repl_meta_data.c | 17 +-
source4/dsdb/samdb/samdb.h | 4 +-
source4/dsdb/tests/python/sam.py | 466 ++++++++++++++++++++-
source4/heimdal/kdc/kerberos5.c | 12 +-
source4/heimdal/kdc/krb5tgs.c | 2 +-
source4/heimdal/kdc/windc.c | 4 +
source4/heimdal/kdc/windc_plugin.h | 10 +-
source4/heimdal/lib/krb5/pac.c | 34 ++
source4/kdc/pac-glue.c | 425 +++++++++++++++++--
source4/kdc/pac-glue.h | 19 +-
source4/kdc/wdc-samba4.c | 308 +++++++++++++-
source4/selftest/tests.py | 4 +-
source4/torture/rpc/remote_pac.c | 70 +++-
source4/torture/rpc/schannel.c | 1 +
source4/torture/smb2/session.c | 1 +
testprogs/blackbox/test_pkinit_heimdal.sh | 113 ++++-
testprogs/blackbox/test_pkinit_pac_heimdal.sh | 53 +++
53 files changed, 3124 insertions(+), 99 deletions(-)
create mode 100644 selftest/manage-ca/CA-samba.example.com/NewCerts/04.pem
create mode 100644 selftest/manage-ca/CA-samba.example.com/NewCerts/05.pem
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at addom.samba.example.com/USER-pkinit at addom.samba.example.com-S05-cert.cer
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at addom.samba.example.com/USER-pkinit at addom.samba.example.com-S05-cert.pem
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at addom.samba.example.com/USER-pkinit at addom.samba.example.com-S05-key.pem
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at addom.samba.example.com/USER-pkinit at addom.samba.example.com-S05-openssl.cnf
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at addom.samba.example.com/USER-pkinit at addom.samba.example.com-S05-private-key.pem
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at addom.samba.example.com/USER-pkinit at addom.samba.example.com-S05-private.p12
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at addom.samba.example.com/USER-pkinit at addom.samba.example.com-S05-req.pem
create mode 120000 selftest/manage-ca/CA-samba.example.com/Users/pkinit at addom.samba.example.com/USER-pkinit at addom.samba.example.com-cert.pem
create mode 120000 selftest/manage-ca/CA-samba.example.com/Users/pkinit at addom.samba.example.com/USER-pkinit at addom.samba.example.com-private-key.pem
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at samba.example.com/USER-pkinit at samba.example.com-S04-cert.cer
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at samba.example.com/USER-pkinit at samba.example.com-S04-cert.pem
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at samba.example.com/USER-pkinit at samba.example.com-S04-key.pem
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at samba.example.com/USER-pkinit at samba.example.com-S04-openssl.cnf
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at samba.example.com/USER-pkinit at samba.example.com-S04-private-key.pem
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at samba.example.com/USER-pkinit at samba.example.com-S04-private.p12
create mode 100644 selftest/manage-ca/CA-samba.example.com/Users/pkinit at samba.example.com/USER-pkinit at samba.example.com-S04-req.pem
create mode 120000 selftest/manage-ca/CA-samba.example.com/Users/pkinit at samba.example.com/USER-pkinit at samba.example.com-cert.pem
create mode 120000 selftest/manage-ca/CA-samba.example.com/Users/pkinit at samba.example.com/USER-pkinit at samba.example.com-private-key.pem
create mode 100755 testprogs/blackbox/test_pkinit_pac_heimdal.sh
Changeset truncated at 500 lines:
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 505d28b..ad10514 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -177,6 +177,28 @@ Python crypto requirements
Some samba-tool subcommands require python-crypto and/or
python-m2crypto packages to be installed.
+SmartCard/PKINIT improvements
+-----------------------------
+
+"samba-tool user create" accepts --smartcard-required
+and "samba-tool user setpassword" accepts --smartcard-required
+and --clear-smartcard-required.
+
+Specifying --smartcard-required results in the UF_SMARTCARD_REQUIRED
+flags being set in the userAccountControl attribute.
+At the same time the account password is reset to a random
+NTHASH value.
+
+Interactive password logons are rejected, if the UF_SMARTCARD_REQUIRED
+bit is set in the userAccountControl attribute of a user.
+
+When doing a PKINIT based kerberos logon the KDC adds the
+required PAC_CREDENTIAL_INFO element to the authorization data.
+That means the NTHASH is shared between the PKINIT based client and
+the domain controller, which allows the client to do NTLM based
+authentication on behalf of the user. It also allows on offline
+logon using a smartcard to work on Windows clients.
+
REMOVED FEATURES
================
diff --git a/auth/auth_sam_reply.c b/auth/auth_sam_reply.c
index 1929cd9..15d17b0 100644
--- a/auth/auth_sam_reply.c
+++ b/auth/auth_sam_reply.c
@@ -506,6 +506,7 @@ NTSTATUS make_user_info_dc_netlogon_validation(TALLOC_CTX *mem_ctx,
*/
NTSTATUS make_user_info_dc_pac(TALLOC_CTX *mem_ctx,
const struct PAC_LOGON_INFO *pac_logon_info,
+ const struct PAC_UPN_DNS_INFO *pac_upn_dns_info,
struct auth_user_info_dc **_user_info_dc)
{
uint32_t i;
@@ -574,6 +575,27 @@ NTSTATUS make_user_info_dc_pac(TALLOC_CTX *mem_ctx,
user_info_dc->num_sids++;
}
}
+
+ if (pac_upn_dns_info != NULL) {
+ user_info_dc->info->user_principal_name =
+ talloc_strdup(user_info_dc->info,
+ pac_upn_dns_info->upn_name);
+ if (user_info_dc->info->user_principal_name == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ user_info_dc->info->dns_domain_name =
+ talloc_strdup(user_info_dc->info,
+ pac_upn_dns_info->dns_domain_name);
+ if (user_info_dc->info->dns_domain_name == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (pac_upn_dns_info->flags & PAC_UPN_DNS_FLAG_CONSTRUCTED) {
+ user_info_dc->info->user_principal_constructed = true;
+ }
+ }
+
*_user_info_dc = user_info_dc;
return NT_STATUS_OK;
}
diff --git a/auth/auth_sam_reply.h b/auth/auth_sam_reply.h
index 5d86830..617fae7 100644
--- a/auth/auth_sam_reply.h
+++ b/auth/auth_sam_reply.h
@@ -63,6 +63,7 @@ NTSTATUS make_user_info_dc_netlogon_validation(TALLOC_CTX *mem_ctx,
*/
NTSTATUS make_user_info_dc_pac(TALLOC_CTX *mem_ctx,
const struct PAC_LOGON_INFO *pac_logon_info,
+ const struct PAC_UPN_DNS_INFO *pac_upn_dns_info,
struct auth_user_info_dc **_user_info_dc);
/* The following definitions come from auth/wbc_auth_util.c */
diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
index 3b7d42a..bfa397c 100644
--- a/auth/credentials/credentials.c
+++ b/auth/credentials/credentials.c
@@ -129,21 +129,6 @@ _PUBLIC_ void *_cli_credentials_callback_data(struct cli_credentials *cred)
return cred->priv_data;
}
-_PUBLIC_ struct cli_credentials *cli_credentials_shallow_copy(TALLOC_CTX *mem_ctx,
- struct cli_credentials *src)
-{
- struct cli_credentials *dst;
-
- dst = talloc(mem_ctx, struct cli_credentials);
- if (dst == NULL) {
- return NULL;
- }
-
- *dst = *src;
-
- return dst;
-}
-
/**
* Create a new anonymous credential
* @param mem_ctx TALLOC_CTX parent for credentials structure
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
index 3779ec0..523793f 100644
--- a/auth/credentials/credentials.h
+++ b/auth/credentials/credentials.h
@@ -286,9 +286,6 @@ void *_cli_credentials_callback_data(struct cli_credentials *cred);
#define cli_credentials_callback_data_void(_cred) \
_cli_credentials_callback_data(_cred)
-struct cli_credentials *cli_credentials_shallow_copy(TALLOC_CTX *mem_ctx,
- struct cli_credentials *src);
-
/**
* Return attached NETLOGON credentials
*/
diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index 6d0ef6f..0bd6595 100644
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -731,6 +731,73 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
return ret;
}
+static int cli_credentials_shallow_ccache(struct cli_credentials *cred)
+{
+ krb5_error_code ret;
+ const struct ccache_container *old_ccc = NULL;
+ struct ccache_container *ccc = NULL;
+ char *ccache_name = NULL;
+
+ old_ccc = cred->ccache;
+ if (old_ccc == NULL) {
+ return 0;
+ }
+
+ ccc = talloc(cred, struct ccache_container);
+ if (ccc == NULL) {
+ return ENOMEM;
+ }
+ *ccc = *old_ccc;
+ ccc->ccache = NULL;
+
+ ccache_name = talloc_asprintf(ccc, "MEMORY:%p", ccc);
+
+ ret = krb5_cc_resolve(ccc->smb_krb5_context->krb5_context,
+ ccache_name, &ccc->ccache);
+ if (ret != 0) {
+ TALLOC_FREE(ccc);
+ return ret;
+ }
+
+ talloc_set_destructor(ccc, free_mccache);
+
+ TALLOC_FREE(ccache_name);
+
+ ret = krb5_cc_copy_cache(ccc->smb_krb5_context->krb5_context,
+ old_ccc->ccache, ccc->ccache);
+ if (ret != 0) {
+ TALLOC_FREE(ccc);
+ return ret;
+ }
+
+ cred->ccache = ccc;
+ cred->client_gss_creds = NULL;
+ cred->client_gss_creds_obtained = CRED_UNINITIALISED;
+ return ret;
+}
+
+_PUBLIC_ struct cli_credentials *cli_credentials_shallow_copy(TALLOC_CTX *mem_ctx,
+ struct cli_credentials *src)
+{
+ struct cli_credentials *dst;
+ int ret;
+
+ dst = talloc(mem_ctx, struct cli_credentials);
+ if (dst == NULL) {
+ return NULL;
+ }
+
+ *dst = *src;
+
+ ret = cli_credentials_shallow_ccache(dst);
+ if (ret != 0) {
+ TALLOC_FREE(dst);
+ return NULL;
+ }
+
+ return dst;
+}
+
static int smb_krb5_create_salt_principal(TALLOC_CTX *mem_ctx,
const char *samAccountName,
const char *realm,
diff --git a/auth/credentials/credentials_krb5.h b/auth/credentials/credentials_krb5.h
index fc7d0be..ae60104 100644
--- a/auth/credentials/credentials_krb5.h
+++ b/auth/credentials/credentials_krb5.h
@@ -38,4 +38,8 @@ int cli_credentials_set_client_gss_creds(struct cli_credentials *cred,
enum credentials_obtained obtained,
const char **error_string);
+struct cli_credentials *cli_credentials_shallow_copy(TALLOC_CTX *mem_ctx,
+ struct cli_credentials *src);
+
+
#endif /* __CREDENTIALS_KRB5_H__ */
diff --git a/selftest/manage-ca/CA-samba.example.com/NewCerts/04.pem b/selftest/manage-ca/CA-samba.example.com/NewCerts/04.pem
new file mode 100644
index 0000000..730b824
--- /dev/null
+++ b/selftest/manage-ca/CA-samba.example.com/NewCerts/04.pem
@@ -0,0 +1,168 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 4 (0x4)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: C=US, ST=SambaState, L=SambaCity, O=SambaSelfTesting, OU=CA Administration, CN=CA of samba.example.com/emailAddress=ca-samba.example.com at samba.example.com
+ Validity
+ Not Before: Jun 3 19:30:29 2016 GMT
+ Not After : May 29 19:30:29 2036 GMT
+ Subject: C=US, ST=SambaState, O=SambaSelfTesting, OU=Users, CN=pkinit at samba.example.com/emailAddress=pkinit at samba.example.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (2048 bit)
+ Modulus:
+ 00:dd:c4:48:44:a5:e9:6b:b4:41:03:6a:dc:34:1f:
+ d6:41:ce:f7:cb:b2:44:a7:a3:0e:89:16:ff:0d:62:
+ 23:e0:8b:24:db:82:82:68:29:22:1b:57:44:12:c6:
+ ea:10:2d:6f:3a:4b:75:b1:2e:76:62:01:62:ff:ba:
+ 3d:67:e1:39:0d:12:38:b0:fc:b3:e5:0e:dd:77:73:
+ 2b:99:25:86:d5:15:84:08:be:b0:8b:38:d7:64:9d:
+ d6:e7:dc:4d:9a:fb:ea:17:41:bb:d1:cf:1a:b9:5b:
+ 0b:8a:e5:8c:5a:b7:2d:ab:bd:f7:c3:91:ae:26:c2:
+ e3:97:27:ea:3f:be:c9:22:af:d6:76:35:45:b0:72:
+ 86:f2:bd:bf:e2:d3:e3:e3:68:52:26:db:f0:a6:6a:
+ 0e:63:05:9b:17:6d:13:ee:c4:15:41:96:27:06:90:
+ fd:10:b5:f9:6c:74:be:b0:a8:bb:70:f7:a2:25:da:
+ f7:f1:91:c2:69:6c:40:c4:63:e8:06:83:e0:1d:b7:
+ 2b:29:d3:75:d1:df:c1:d2:90:af:b9:81:47:78:f3:
+ f1:1a:c9:20:e3:1b:6f:e4:fd:2e:0b:65:a7:6f:b1:
+ b2:a0:d3:e3:d2:2f:2b:ef:fd:01:5b:27:e7:1b:c1:
+ 0e:bc:bd:f0:7b:b2:34:a9:9b:4d:2c:c8:65:33:c8:
+ 33:17
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ X509v3 CRL Distribution Points:
+
+ Full Name:
+ URI:http://www.samba.example.com/crls/CA-samba.example.com-crl.crl
+
+ Netscape Cert Type:
+ SSL Client, S/MIME
+ X509v3 Key Usage:
+ Digital Signature, Non Repudiation, Key Encipherment
+ Netscape Comment:
+ Smart Card Login Certificate for pkinit at samba.example.com
+ X509v3 Subject Key Identifier:
+ E9:67:66:B8:3D:F1:39:AB:1A:4D:00:9D:EC:CE:FF:4B:50:D8:5D:A2
+ X509v3 Authority Key Identifier:
+ keyid:A2:3E:02:2A:A3:A7:4D:39:B4:08:4D:99:CC:0C:75:36:EA:27:C3:3E
+
+ X509v3 Subject Alternative Name:
+ email:pkinit at samba.example.com, othername:<unsupported>
+ X509v3 Issuer Alternative Name:
+ email:ca-samba.example.com at samba.example.com
+ Netscape CA Revocation Url:
+ http://www.samba.example.com/crls/CA-samba.example.com-crl.crl
+ X509v3 Extended Key Usage:
+ TLS Web Client Authentication, scardLogin
+ Signature Algorithm: sha256WithRSAEncryption
+ 88:3e:f3:98:08:ef:cd:53:3a:07:d5:1c:fd:26:7c:f1:96:2e:
+ b9:06:87:f2:5b:e2:be:d1:04:6e:38:59:14:49:9d:46:ef:7e:
+ 6c:08:02:3e:18:09:09:61:a8:1d:a9:da:59:40:58:5f:d2:ca:
+ 4f:76:0e:7e:01:db:05:03:fb:78:c7:89:86:aa:1b:dc:02:bb:
+ 86:a5:02:7c:01:54:dd:ad:e0:43:c5:d9:ec:86:c2:47:b5:5a:
+ 1c:8c:06:0e:fe:11:ad:a5:57:37:f5:0a:35:65:a4:f2:27:14:
+ 2f:bf:53:48:66:e1:da:b9:58:95:a2:d1:95:9c:ae:0a:ca:29:
+ a6:ef:7a:58:74:86:40:ea:2a:c6:18:9f:1a:d9:70:e2:a8:aa:
+ 8d:f1:22:bf:b6:e4:61:d4:21:ee:bf:17:e1:aa:d1:cf:0b:35:
+ 82:c7:3f:a1:be:d1:a5:bd:4e:04:0d:cf:11:2d:d6:0c:7e:47:
+ 5c:5e:84:d2:10:60:7e:97:d7:52:be:a1:cd:2d:85:da:b2:dd:
+ 68:88:12:a4:88:5f:16:0c:ae:6f:60:7f:da:58:5f:91:bd:8d:
+ 15:20:c2:74:94:0b:93:65:80:7c:77:15:a2:70:bb:98:be:41:
+ 1a:2e:c5:78:52:64:e7:44:03:3f:64:97:10:a9:1b:17:f3:79:
+ f9:51:0c:4c:58:e7:03:e7:bb:fd:34:ff:c0:4a:ad:b1:7a:ba:
+ 97:3c:f8:e0:9e:30:3d:e7:5f:be:ac:6a:b3:c1:1e:50:7c:cd:
+ ce:18:bd:96:73:fb:9c:90:e7:ae:e0:be:c5:65:29:9a:1c:da:
+ c3:64:2a:99:dc:93:61:32:9a:70:1a:45:83:72:38:0f:57:de:
+ 0d:f5:64:71:97:de:b5:64:99:43:30:6d:3f:25:82:b5:3e:a1:
+ ba:39:d2:fc:b8:df:7e:57:da:fc:be:c2:84:2e:99:41:52:a2:
+ 18:f4:99:c7:e2:b9:af:2a:84:32:5c:cb:ba:26:86:6b:8e:58:
+ 30:d8:4f:5b:60:34:fd:30:de:c5:a0:7a:8c:e7:34:2b:bc:81:
+ 6d:4c:a8:b5:ba:b5:52:b9:42:e5:d8:7e:be:31:a3:8e:b0:c3:
+ f6:16:28:92:e7:9d:3f:c8:cf:a0:4a:b0:3a:ae:75:59:ab:19:
+ 91:e4:2e:76:57:3f:58:88:5f:2e:7b:c5:8f:11:25:0f:cd:8f:
+ e3:91:80:2f:d4:7b:5a:80:c3:c9:7c:0a:aa:01:bf:5c:8c:0e:
+ 57:84:bf:72:ad:7b:0a:b9:95:27:0f:aa:9b:96:08:8e:bb:63:
+ 56:5a:1d:ad:0c:5b:1c:04:38:ae:2b:88:d4:d1:68:20:f2:a0:
+ 9b:77:9c:95:db:17:cb:cf:79:4a:13:66:c9:34:36:f6:c6:f9:
+ 8b:4b:92:5e:59:a3:5d:75:4e:fa:f2:fa:d5:d9:66:80:82:a4:
+ 8d:e2:d8:b6:ed:c5:a3:ca:a2:70:64:9c:b9:1c:49:b2:2f:46:
+ b3:13:3b:88:a7:5a:8e:22:b7:90:f5:74:27:21:06:a4:94:bb:
+ b1:cb:e7:e4:92:f0:e9:80:15:94:82:1a:97:34:d0:cf:aa:37:
+ b1:27:a5:38:39:7c:8d:ba:a1:12:dd:30:48:44:90:0c:35:0f:
+ cc:e6:13:e7:c9:06:36:1d:b0:c9:be:28:0f:47:1c:b0:47:a3:
+ 20:d1:bb:a1:85:1a:80:c2:9b:70:61:9f:a7:82:46:3c:80:28:
+ 0c:17:f6:fc:75:83:be:ff:5c:da:bc:be:2c:65:a6:c0:fc:c1:
+ 32:ae:9a:bf:d1:7c:fb:b3:26:3b:77:03:fe:a9:e9:ae:4c:72:
+ 58:a9:6e:ce:ad:c0:1f:30:b2:06:32:65:af:5f:db:3d:2b:ab:
+ c5:46:5c:0a:df:50:b5:7e:31:c8:b0:7e:50:e2:aa:d8:01:8e:
+ ea:e7:3c:8b:90:73:de:77:9f:47:ea:af:16:0d:a5:c0:89:6f:
+ 86:a4:84:f7:1f:03:fd:7d:f8:a8:7d:9c:9a:f1:13:c8:d5:5b:
+ 9c:2f:71:c1:c0:c2:17:89:39:6d:28:2d:20:31:ca:60:cf:7f:
+ 78:42:5c:a3:28:76:19:a8:ca:e6:07:22:6d:7f:04:b1:20:ab:
+ 70:40:33:e9:a3:fa:da:b5:7c:ee:70:0b:c6:a2:6a:90:1a:10:
+ fe:8a:9b:56:5c:44:85:f1:b4:41:67:0b:c1:a3:68:2f:ff:b1:
+ 48:f3:38:4b:28:4e:52:36:0c:9b:37:aa:7e:82:63:c3:61:33:
+ a9:05:b3:af:13:07:b3:9e:4d:4c:3c:c4:47:34:ce:f3:6e:55:
+ 69:d7:af:dc:e4:82:34:9b:fe:cc:d9:db:1f:08:3e:3c:3a:9b:
+ ac:a7:7e:61:3f:5f:01:0c:d8:f3:63:31:31:07:e2:05:84:30:
+ 65:f4:b0:a6:cc:ad:63:fe:06:db:d7:e9:2f:9d:db:2c:64:af:
+ d6:d1:cc:9e:c3:11:09:ad:7d:e2:06:6d:21:ad:a5:4f:a6:87:
+ 9b:ee:db:6c:e9:69:a7:6a:eb:93:67:e2:e9:6f:23:f8:2e:95:
+ 78:5f:a8:66:ae:7e:2c:5e:6b:07:3e:02:ad:20:af:61:9c:0e:
+ 1d:c6:7a:31:5a:33:bd:61:1a:67:5b:a9:42:3c:17:67:f8:dd:
+ 80:e3:ab:62:a0:42:53:33:1f:f7:79:ea:32:d1:26:dd:bb:c6:
+ 26:aa:2c:ac:16:7e:24:b4:ae:7d:ce:77:e8:5f:2d:97
+-----BEGIN CERTIFICATE-----
+MIII2jCCBMKgAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBxjELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMClNhbWJhU3RhdGUxEjAQBgNVBAcMCVNhbWJhQ2l0eTEZMBcGA1UE
+CgwQU2FtYmFTZWxmVGVzdGluZzEaMBgGA1UECwwRQ0EgQWRtaW5pc3RyYXRpb24x
+IDAeBgNVBAMMF0NBIG9mIHNhbWJhLmV4YW1wbGUuY29tMTUwMwYJKoZIhvcNAQkB
+FiZjYS1zYW1iYS5leGFtcGxlLmNvbUBzYW1iYS5leGFtcGxlLmNvbTAeFw0xNjA2
+MDMxOTMwMjlaFw0zNjA1MjkxOTMwMjlaMIGZMQswCQYDVQQGEwJVUzETMBEGA1UE
+CAwKU2FtYmFTdGF0ZTEZMBcGA1UECgwQU2FtYmFTZWxmVGVzdGluZzEOMAwGA1UE
+CwwFVXNlcnMxITAfBgNVBAMMGHBraW5pdEBzYW1iYS5leGFtcGxlLmNvbTEnMCUG
+CSqGSIb3DQEJARYYcGtpbml0QHNhbWJhLmV4YW1wbGUuY29tMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3cRIRKXpa7RBA2rcNB/WQc73y7JEp6MOiRb/
+DWIj4Isk24KCaCkiG1dEEsbqEC1vOkt1sS52YgFi/7o9Z+E5DRI4sPyz5Q7dd3Mr
+mSWG1RWECL6wizjXZJ3W59xNmvvqF0G70c8auVsLiuWMWrctq733w5GuJsLjlyfq
+P77JIq/WdjVFsHKG8r2/4tPj42hSJtvwpmoOYwWbF20T7sQVQZYnBpD9ELX5bHS+
+sKi7cPeiJdr38ZHCaWxAxGPoBoPgHbcrKdN10d/B0pCvuYFHePPxGskg4xtv5P0u
+C2Wnb7GyoNPj0i8r7/0BWyfnG8EOvL3we7I0qZtNLMhlM8gzFwIDAQABo4IB/DCC
+AfgwCQYDVR0TBAIwADBPBgNVHR8ESDBGMESgQqBAhj5odHRwOi8vd3d3LnNhbWJh
+LmV4YW1wbGUuY29tL2NybHMvQ0Etc2FtYmEuZXhhbXBsZS5jb20tY3JsLmNybDAR
+BglghkgBhvhCAQEEBAMCBaAwCwYDVR0PBAQDAgXgMEgGCWCGSAGG+EIBDQQ7FjlT
+bWFydCBDYXJkIExvZ2luIENlcnRpZmljYXRlIGZvciBwa2luaXRAc2FtYmEuZXhh
+bXBsZS5jb20wHQYDVR0OBBYEFOlnZrg98TmrGk0AnezO/0tQ2F2iMB8GA1UdIwQY
+MBaAFKI+Aiqjp005tAhNmcwMdTbqJ8M+ME0GA1UdEQRGMESBGHBraW5pdEBzYW1i
+YS5leGFtcGxlLmNvbaAoBgorBgEEAYI3FAIDoBoMGHBraW5pdEBzYW1iYS5leGFt
+cGxlLmNvbTAxBgNVHRIEKjAogSZjYS1zYW1iYS5leGFtcGxlLmNvbUBzYW1iYS5l
+eGFtcGxlLmNvbTBNBglghkgBhvhCAQQEQBY+aHR0cDovL3d3dy5zYW1iYS5leGFt
+cGxlLmNvbS9jcmxzL0NBLXNhbWJhLmV4YW1wbGUuY29tLWNybC5jcmwwHwYDVR0l
+BBgwFgYIKwYBBQUHAwIGCisGAQQBgjcUAgIwDQYJKoZIhvcNAQELBQADggQBAIg+
+85gI781TOgfVHP0mfPGWLrkGh/Jb4r7RBG44WRRJnUbvfmwIAj4YCQlhqB2p2llA
+WF/Syk92Dn4B2wUD+3jHiYaqG9wCu4alAnwBVN2t4EPF2eyGwke1WhyMBg7+Ea2l
+Vzf1CjVlpPInFC+/U0hm4dq5WJWi0ZWcrgrKKabvelh0hkDqKsYYnxrZcOKoqo3x
+Ir+25GHUIe6/F+Gq0c8LNYLHP6G+0aW9TgQNzxEt1gx+R1xehNIQYH6X11K+oc0t
+hdqy3WiIEqSIXxYMrm9gf9pYX5G9jRUgwnSUC5NlgHx3FaJwu5i+QRouxXhSZOdE
+Az9klxCpGxfzeflRDExY5wPnu/00/8BKrbF6upc8+OCeMD3nX76sarPBHlB8zc4Y
+vZZz+5yQ567gvsVlKZoc2sNkKpnck2EymnAaRYNyOA9X3g31ZHGX3rVkmUMwbT8l
+grU+obo50vy4335X2vy+woQumUFSohj0mcfiua8qhDJcy7omhmuOWDDYT1tgNP0w
+3sWgeoznNCu8gW1MqLW6tVK5QuXYfr4xo46ww/YWKJLnnT/Iz6BKsDqudVmrGZHk
+LnZXP1iIXy57xY8RJQ/Nj+ORgC/Ue1qAw8l8CqoBv1yMDleEv3Ktewq5lScPqpuW
+CI67Y1ZaHa0MWxwEOK4riNTRaCDyoJt3nJXbF8vPeUoTZsk0NvbG+YtLkl5Zo111
+Tvry+tXZZoCCpI3i2LbtxaPKonBknLkcSbIvRrMTO4inWo4it5D1dCchBqSUu7HL
+5+SS8OmAFZSCGpc00M+qN7EnpTg5fI26oRLdMEhEkAw1D8zmE+fJBjYdsMm+KA9H
+HLBHoyDRu6GFGoDCm3Bhn6eCRjyAKAwX9vx1g77/XNq8vixlpsD8wTKumr/RfPuz
+Jjt3A/6p6a5Mclipbs6twB8wsgYyZa9f2z0rq8VGXArfULV+MciwflDiqtgBjurn
+PIuQc953n0fqrxYNpcCJb4akhPcfA/19+Kh9nJrxE8jVW5wvccHAwheJOW0oLSAx
+ymDPf3hCXKModhmoyuYHIm1/BLEgq3BAM+mj+tq1fO5wC8aiapAaEP6Km1ZcRIXx
+tEFnC8GjaC//sUjzOEsoTlI2DJs3qn6CY8NhM6kFs68TB7OeTUw8xEc0zvNuVWnX
+r9zkgjSb/szZ2x8IPjw6m6ynfmE/XwEM2PNjMTEH4gWEMGX0sKbMrWP+BtvX6S+d
+2yxkr9bRzJ7DEQmtfeIGbSGtpU+mh5vu22zpaadq65Nn4ulvI/gulXhfqGaufixe
+awc+Aq0gr2GcDh3GejFaM71hGmdbqUI8F2f43YDjq2KgQlMzH/d56jLRJt27xiaq
+LKwWfiS0rn3Od+hfLZc=
+-----END CERTIFICATE-----
diff --git a/selftest/manage-ca/CA-samba.example.com/NewCerts/05.pem b/selftest/manage-ca/CA-samba.example.com/NewCerts/05.pem
new file mode 100644
index 0000000..997dfd3
--- /dev/null
+++ b/selftest/manage-ca/CA-samba.example.com/NewCerts/05.pem
@@ -0,0 +1,168 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 5 (0x5)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: C=US, ST=SambaState, L=SambaCity, O=SambaSelfTesting, OU=CA Administration, CN=CA of samba.example.com/emailAddress=ca-samba.example.com at samba.example.com
+ Validity
+ Not Before: Jun 3 19:30:47 2016 GMT
+ Not After : May 29 19:30:47 2036 GMT
+ Subject: C=US, ST=SambaState, O=SambaSelfTesting, OU=Users, CN=pkinit at addom.samba.example.com/emailAddress=pkinit at addom.samba.example.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (2048 bit)
+ Modulus:
+ 00:b3:a4:e8:bd:c8:4f:6a:71:c6:15:a8:dd:00:d6:
+ 61:74:00:e4:8f:b5:c4:0e:98:d9:51:aa:aa:4f:c7:
+ 8c:f9:6c:37:5c:60:55:da:7c:55:9c:d3:cd:e2:f1:
+ ed:51:39:25:d5:fa:69:7e:a7:67:9c:a9:61:1b:5c:
+ 73:50:d0:6f:ba:ce:3a:df:fe:ae:95:95:8e:97:ab:
+ c6:bb:6a:c3:60:0b:ca:c2:9c:31:ff:c6:2f:52:bb:
+ cb:2f:f6:2c:4d:be:20:e1:16:49:d3:22:36:66:4f:
+ 5c:c4:30:12:07:34:8b:00:4e:5b:51:7d:40:35:81:
+ dc:5c:0e:af:be:78:63:80:69:67:87:53:97:d0:3f:
+ d7:66:8d:26:8a:0a:24:95:f9:db:dd:93:0e:48:54:
+ c8:30:e4:77:0d:65:ef:a4:6a:de:29:91:77:97:40:
+ 5c:2e:ed:35:5e:b9:0f:37:ad:d9:70:76:99:77:45:
+ 8c:4a:65:63:13:72:d5:c4:53:37:57:85:0a:6d:74:
+ 30:8c:69:7f:83:f0:7f:f5:67:05:79:80:27:d4:38:
+ 6d:49:2f:8d:2a:97:2e:33:1f:d0:e0:c1:76:1b:bf:
+ bf:b1:75:8a:c9:b1:3f:3f:f2:4e:c5:b0:68:5e:76:
+ 8a:7e:9c:57:b2:ec:3d:18:83:e2:65:d5:30:5e:b5:
+ f4:c7
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ X509v3 CRL Distribution Points:
+
+ Full Name:
+ URI:http://www.samba.example.com/crls/CA-samba.example.com-crl.crl
+
+ Netscape Cert Type:
+ SSL Client, S/MIME
+ X509v3 Key Usage:
+ Digital Signature, Non Repudiation, Key Encipherment
+ Netscape Comment:
+ Smart Card Login Certificate for pkinit at addom.samba.example.com
+ X509v3 Subject Key Identifier:
+ 3E:81:65:A1:E3:7E:18:BE:80:FE:15:93:CC:20:15:FD:08:D4:A4:3D
+ X509v3 Authority Key Identifier:
+ keyid:A2:3E:02:2A:A3:A7:4D:39:B4:08:4D:99:CC:0C:75:36:EA:27:C3:3E
+
+ X509v3 Subject Alternative Name:
+ email:pkinit at addom.samba.example.com, othername:<unsupported>
+ X509v3 Issuer Alternative Name:
+ email:ca-samba.example.com at samba.example.com
+ Netscape CA Revocation Url:
+ http://www.samba.example.com/crls/CA-samba.example.com-crl.crl
+ X509v3 Extended Key Usage:
+ TLS Web Client Authentication, scardLogin
+ Signature Algorithm: sha256WithRSAEncryption
+ 7b:47:4c:55:7c:77:8b:8f:ca:23:3e:51:6a:51:c1:49:44:0d:
+ 72:56:27:79:f7:54:48:ef:74:37:5e:2a:33:68:dc:04:8a:de:
+ b2:8e:7b:26:6f:67:f5:bc:0a:e1:ec:74:12:86:5a:6b:56:7d:
+ 75:24:d0:df:c7:1e:c4:28:e8:a5:c0:e5:3a:a0:74:f8:95:70:
+ 61:44:a1:9c:e3:54:d8:cf:1b:e2:2f:35:d3:ca:1a:5f:07:e9:
+ ce:fe:79:e1:20:ac:9e:94:74:a5:80:2e:38:75:bc:bc:d7:2d:
+ e0:54:c1:17:9a:8e:07:42:7e:5f:2e:17:93:63:ab:ae:ed:c6:
+ 29:0f:91:c8:8a:99:ad:21:5b:52:a7:dd:0c:2f:32:dc:0d:36:
+ 9c:98:02:aa:eb:8f:2d:3a:86:1a:cf:f8:f5:da:0b:70:7e:14:
+ 9c:79:bc:8a:6c:c7:06:8d:3e:3b:26:2a:50:a1:05:ca:47:79:
+ d1:ba:55:06:cd:d2:3a:10:27:8d:cb:ee:b4:f7:90:ff:f2:fb:
+ 67:f0:73:0b:4f:51:5e:0b:8d:e4:94:cb:da:56:2d:18:91:b8:
+ 51:0f:ee:48:99:cc:ae:8b:6b:ac:d8:38:1e:5e:5e:d9:1a:29:
+ 52:04:52:49:49:30:60:3b:fa:4e:c9:0c:a0:67:20:e1:4a:9f:
+ 84:44:c8:ca:35:d5:28:a6:06:7e:dc:c3:81:8d:40:12:3d:ae:
+ 0d:51:42:5a:16:92:78:2e:70:0b:ba:7f:8e:52:b7:2e:a8:f1:
+ 72:32:ba:6f:30:92:1e:40:0f:bf:09:14:5b:63:c6:1d:b3:ac:
+ eb:e7:69:f0:1b:3c:b8:4a:ec:a2:22:e2:58:ad:ef:22:77:9c:
+ e2:51:ec:38:bf:47:d8:1e:43:77:61:3d:60:54:c7:ba:6a:be:
+ 87:ea:f7:9e:46:74:90:70:c3:d9:74:21:be:90:78:12:2f:30:
+ d2:56:3b:9a:24:27:17:1b:d0:8c:49:e7:65:a8:d2:d9:0f:f8:
+ e9:5e:51:8c:97:cf:90:37:e5:ad:dc:88:ac:c1:54:57:7a:9a:
+ f4:5a:80:25:85:7c:d0:b7:17:03:8c:b3:43:20:59:c7:f3:68:
+ 72:f5:53:75:df:a0:00:12:f0:28:d5:dc:70:ec:9e:c2:33:bd:
+ 73:e9:8c:62:b8:2f:0d:55:a3:3d:d2:21:59:4f:3a:d7:50:aa:
+ 43:72:25:05:a0:2f:e0:f1:79:59:2a:57:e6:b9:91:21:b9:9f:
+ 07:f9:49:fc:d7:97:f7:be:a7:81:69:ac:6c:9a:7c:25:5e:6b:
+ 48:37:90:89:ac:37:02:b5:be:41:01:56:93:71:f4:e9:75:3c:
+ aa:0a:9b:d6:a3:09:64:51:30:d7:2c:1a:dd:bc:83:2e:45:b5:
+ 90:a5:ad:16:ba:18:56:1c:88:73:b5:ee:77:6d:65:3e:11:dc:
+ 36:45:6a:08:99:5d:24:86:93:da:45:95:2a:de:80:96:2e:db:
+ d7:87:b3:f1:70:3c:b5:56:eb:ca:62:dc:3c:49:84:3c:f8:6d:
+ d9:44:e0:81:33:5e:f7:22:27:8b:09:05:12:a6:c1:79:56:c7:
+ 7f:e2:80:d6:ab:4d:e5:1a:ff:ae:9a:fd:3b:7b:aa:15:ca:10:
+ c2:6a:98:c4:70:63:6e:7d:94:8e:87:0a:24:bd:b1:59:85:67:
+ 5b:e8:2e:ff:d7:43:8c:46:06:1a:a8:ba:72:e7:0d:ef:5f:6c:
+ 2d:5c:14:56:ad:5d:56:a5:21:09:7b:16:44:4a:74:9d:1a:03:
+ aa:1a:41:29:e5:78:e4:7c:9e:53:18:61:d8:5a:d1:e8:a8:0e:
+ f4:d3:40:d6:6b:cd:c9:e4:a3:3d:51:54:c3:d6:09:4c:48:9e:
+ 34:2a:23:ad:83:ab:9a:99:c2:bf:7b:85:98:d7:b6:21:fc:c4:
+ 17:6c:56:46:95:98:da:e8:6c:f3:67:4e:33:fc:68:b8:af:86:
+ 07:8b:8e:f3:16:2c:ec:82:e7:b8:47:64:5c:f5:bd:37:75:b5:
+ 94:d3:09:3c:3d:6a:6d:47:81:e0:1b:df:5e:d7:6c:92:7d:23:
--
Samba Shared Repository
More information about the samba-cvs
mailing list