Intergrate Heimdal's hdb-ldap and Samba

Love lha at
Mon Mar 1 12:57:20 GMT 2004

Andrew Bartlett <abartlet at> writes:

>> Reading the ldap patch I think you break backward compatibility with the
>> old code, like you changed how the Key was stored, to hex encoded data from
>> raw octets.
> sambaNTpassword is hex encoded, but the krb5Key should still be raw
> octects.  It should be raw octets inside HDBEntry.  Can you point out
> exactly what you mean here?

Oh, sorry, it was a comment. I've still to get used to this "new" c99

> The only backward compatibility issue is that older Heimdal
> installations that query the same directory will not see the type-23
> key, as it is in the sambaNTpassword.  But this only happens when there
> is a sambaSamAccount on the entry.

Shouldn't type-23 keys be stored in both entries ?

>> The hdb-structure is slighty entrenched into libkadm5 and the hprop/iprop
>> protocols. Also the kdc uses the hdb interface, so doing a new api seem to
>> be somewhat painful (based from a 2 min code review)
> What I was instead thinking was to continue expanding HDBEntry, but use
> a HDBEntry2OldHDBEntry function for db storage.

The "real" way of solving this should be doing something like this:

hdb-extension ::= CHOICE {
	some-value[0]	SomeType,
	some-value2[0]	SomeType2,

hdb-extensions ::= SEQUENCE OF SEQUENCE ::= {
	mandatory[0]	INTEGER,	-- kdc MUST understand this extension
	extension[1]  	hdb-extension

and make sure sure that the asn1 library supports ... for CHOICE (and thus
preserved data).

Then the structure would be extented in and forward compatibility maner
that old kdc would understand.

However, the asn1 lib on head doesn't support CHOICE, thus by idea of using
OCTET STRING instead. The joda-asn1-branch asn1_compile (used for pkinit)
support CHOICE, but I'm not completely trust it since I'm not sure since
the branch was done 2 years ago and all changes might not he pulled over
From head.

The db really need to store all the data, so using something like
HDBEntry2OldHDBEntry wouldn't work.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 477 bytes
Desc: not available
Url :

More information about the samba-technical mailing list