1 diff --git a/src/external/krb5.m4 b/src/external/krb5.m4
2 index 1a50bf1..54c5883 100644
3 --- a/src/external/krb5.m4
4 +++ b/src/external/krb5.m4
5 @@ -37,8 +37,8 @@ SAVE_CFLAGS=$CFLAGS
7 CFLAGS="$CFLAGS $KRB5_CFLAGS"
8 LIBS="$LIBS $KRB5_LIBS"
9 -AC_CHECK_HEADERS([krb5.h krb5/krb5.h])
10 -AC_CHECK_TYPES([krb5_ticket_times, krb5_times, krb5_trace_info], [], [],
11 +AC_CHECK_HEADERS([krb5.h krb5/krb5.h profile.h])
12 +AC_CHECK_TYPES([krb5_ticket_times, krb5_times, krb5_trace_info, krb5_authdatatype], [], [],
13 [ #ifdef HAVE_KRB5_KRB5_H
14 #include <krb5/krb5.h>
16 @@ -46,6 +46,7 @@ AC_CHECK_TYPES([krb5_ticket_times, krb5_
19 AC_CHECK_FUNCS([krb5_get_init_creds_opt_alloc krb5_get_error_message \
20 + krb5_unparse_name_ext \
21 krb5_free_unparsed_name \
22 krb5_get_init_creds_opt_set_expire_callback \
23 krb5_get_init_creds_opt_set_fast_ccache_name \
24 @@ -65,7 +66,28 @@ AC_CHECK_FUNCS([krb5_get_init_creds_opt_
25 krb5_set_trace_callback \
27 krb5_kt_have_content \
28 + krb5_get_kdc_sec_offset \
31 krb5_cc_get_full_name])
33 +AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #ifdef HAVE_KRB5_KRB5_H
34 + #include <krb5/krb5.h>
39 + [[ krb5_get_init_creds_opt_set_canonicalize(NULL, 0); ]])],
40 + [AC_DEFINE([KRB5_GET_INIT_CREDS_OPT_SET_CANONICALIZE_ARGS], [2], [number of arguments])])
41 +AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #ifdef HAVE_KRB5_KRB5_H
42 + #include <krb5/krb5.h>
47 + [[ krb5_get_init_creds_opt_set_canonicalize(NULL, NULL, 0); ]])],
48 + [AC_DEFINE([KRB5_GET_INIT_CREDS_OPT_SET_CANONICALIZE_ARGS], [3], [number of arguments])])
52 CFLAGS="$CFLAGS $KRB5_CFLAGS"
53 diff --git a/src/krb5_plugin/sssd_krb5_locator_plugin.c b/src/krb5_plugin/sssd_krb5_locator_plugin.c
54 index 725687d..586c7dd 100644
55 --- a/src/krb5_plugin/sssd_krb5_locator_plugin.c
56 +++ b/src/krb5_plugin/sssd_krb5_locator_plugin.c
57 @@ -340,6 +340,7 @@ krb5_error_code sssd_krb5_locator_lookup(void *private_data,
64 return KRB5_PLUGIN_NO_HANDLE;
65 @@ -374,7 +375,7 @@ krb5_error_code sssd_krb5_locator_lookup(void *private_data,
66 ai->ai_family, ai->ai_socktype));
68 if ((family == AF_UNSPEC || ai->ai_family == family) &&
69 - ai->ai_socktype == socktype) {
70 + (ai->ai_socktype == socktype || socktype == 0)) {
72 ret = cbfunc(cbdata, socktype, ai->ai_addr);
74 --- sssd-1.11.6/src/providers/ad/ad_common.c.orig 2014-06-03 16:31:33.000000000 +0200
75 +++ sssd-1.11.6/src/providers/ad/ad_common.c 2014-06-18 21:33:34.690734956 +0200
76 @@ -536,7 +536,7 @@ errno_t
77 ad_failover_init(TALLOC_CTX *mem_ctx, struct be_ctx *bectx,
78 const char *primary_servers,
79 const char *backup_servers,
80 - const char *krb5_realm,
81 + const char *krb5_realm_str,
82 const char *ad_service,
83 const char *ad_gc_service,
84 const char *ad_domain,
85 @@ -596,13 +596,13 @@ ad_failover_init(TALLOC_CTX *mem_ctx, st
86 service->sdap->kinit_service_name = service->krb5_service->name;
87 service->gc->kinit_service_name = service->krb5_service->name;
90 + if (!krb5_realm_str) {
91 DEBUG(SSSDBG_CRIT_FAILURE, "No Kerberos realm set\n");
95 service->krb5_service->realm =
96 - talloc_strdup(service->krb5_service, krb5_realm);
97 + talloc_strdup(service->krb5_service, krb5_realm_str);
98 if (!service->krb5_service->realm) {
101 @@ -810,7 +810,7 @@ ad_set_ad_id_options(struct ad_options *
102 struct sdap_options *id_opts)
106 + char *krb5_realm_str;
109 /* We only support Kerberos password policy with AD, so
110 @@ -825,20 +825,20 @@ ad_set_ad_id_options(struct ad_options *
113 /* Set the Kerberos Realm for GSSAPI */
114 - krb5_realm = dp_opt_get_string(ad_opts->basic, AD_KRB5_REALM);
116 + krb5_realm_str = dp_opt_get_string(ad_opts->basic, AD_KRB5_REALM);
117 + if (!krb5_realm_str) {
118 /* Should be impossible, this is set in ad_get_common_options() */
119 DEBUG(SSSDBG_FATAL_FAILURE, "No Kerberos realm\n");
124 - ret = dp_opt_set_string(id_opts->basic, SDAP_KRB5_REALM, krb5_realm);
125 + ret = dp_opt_set_string(id_opts->basic, SDAP_KRB5_REALM, krb5_realm_str);
126 if (ret != EOK) goto done;
127 DEBUG(SSSDBG_CONF_SETTINGS,
128 "Option %s set to %s\n",
129 id_opts->basic[SDAP_KRB5_REALM].opt_name,
133 keytab_path = dp_opt_get_string(ad_opts->basic, AD_KEYTAB);
135 @@ -998,7 +998,7 @@ ad_get_auth_options(TALLOC_CTX *mem_ctx,
137 struct dp_option *krb5_options;
138 const char *ad_servers;
139 - const char *krb5_realm;
140 + const char *krb5_realm_str;
142 TALLOC_CTX *tmp_ctx = talloc_new(NULL);
143 if (!tmp_ctx) return ENOMEM;
144 @@ -1025,8 +1025,8 @@ ad_get_auth_options(TALLOC_CTX *mem_ctx,
147 /* Set the Kerberos Realm for GSSAPI */
148 - krb5_realm = dp_opt_get_string(ad_opts->basic, AD_KRB5_REALM);
150 + krb5_realm_str = dp_opt_get_string(ad_opts->basic, AD_KRB5_REALM);
151 + if (!krb5_realm_str) {
152 /* Should be impossible, this is set in ad_get_common_options() */
153 DEBUG(SSSDBG_FATAL_FAILURE, "No Kerberos realm\n");
155 @@ -1036,12 +1036,12 @@ ad_get_auth_options(TALLOC_CTX *mem_ctx,
156 /* Force the kerberos realm to match the AD_KRB5_REALM (which may have
157 * been upper-cased in ad_common_options()
159 - ret = dp_opt_set_string(krb5_options, KRB5_REALM, krb5_realm);
160 + ret = dp_opt_set_string(krb5_options, KRB5_REALM, krb5_realm_str);
161 if (ret != EOK) goto done;
162 DEBUG(SSSDBG_CONF_SETTINGS,
163 "Option %s set to %s\n",
164 krb5_options[KRB5_REALM].opt_name,
168 /* Set flag that controls whether we want to write the
169 * kdcinfo files at all
170 --- sssd-1.12.3/src/providers/krb5/krb5_child.c.orig 2015-01-08 18:19:45.000000000 +0100
171 +++ sssd-1.12.3/src/providers/krb5/krb5_child.c 2015-01-12 16:19:43.242398934 +0100
172 @@ -133,7 +133,7 @@ static krb5_error_code set_lifetime_opti
176 -static void set_canonicalize_option(krb5_get_init_creds_opt *opts)
177 +static void set_canonicalize_option(krb5_context ctx, krb5_get_init_creds_opt *opts)
179 int canonicalize = 0;
181 @@ -144,23 +144,23 @@ static void set_canonicalize_option(krb5
183 DEBUG(SSSDBG_CONF_SETTINGS, "%s is set to [%s]\n",
184 SSSD_KRB5_CANONICALIZE, tmp_str ? tmp_str : "not set");
185 - sss_krb5_get_init_creds_opt_set_canonicalize(opts, canonicalize);
186 + sss_krb5_get_init_creds_opt_set_canonicalize(ctx, opts, canonicalize);
189 -static void set_changepw_options(krb5_get_init_creds_opt *options)
190 +static void set_changepw_options(krb5_context ctx, krb5_get_init_creds_opt *options)
192 - sss_krb5_get_init_creds_opt_set_canonicalize(options, 0);
193 + sss_krb5_get_init_creds_opt_set_canonicalize(ctx, options, 0);
194 krb5_get_init_creds_opt_set_forwardable(options, 0);
195 krb5_get_init_creds_opt_set_proxiable(options, 0);
196 krb5_get_init_creds_opt_set_renew_life(options, 0);
197 krb5_get_init_creds_opt_set_tkt_life(options, 5*60);
200 -static void revert_changepw_options(krb5_get_init_creds_opt *options)
201 +static void revert_changepw_options(krb5_context ctx, krb5_get_init_creds_opt *options)
203 krb5_error_code kerr;
205 - set_canonicalize_option(options);
206 + set_canonicalize_option(ctx, options);
208 /* Currently we do not set forwardable and proxiable explicitly, the flags
209 * must be removed so that libkrb5 can take the defaults from krb5.conf */
210 @@ -174,6 +174,7 @@ static void revert_changepw_options(krb5
214 +#ifdef HAVE_PAC_RESPONDER
215 static errno_t sss_send_pac(krb5_authdata **pac_authdata)
217 struct sss_cli_req_data sss_data;
218 @@ -193,6 +194,7 @@ static errno_t sss_send_pac(krb5_authdat
222 +#endif /* HAVE_PAC_RESPONDER */
224 static void sss_krb5_expire_callback_func(krb5_context context, void *data,
225 krb5_timestamp password_expiration,
226 @@ -484,7 +486,8 @@ static krb5_error_code create_empty_cred
228 krb5_error_code kerr;
229 krb5_creds *cred = NULL;
230 - krb5_data *krb5_realm;
231 + const char *realm_name;
234 cred = calloc(sizeof(krb5_creds), 1);
236 @@ -498,12 +501,12 @@ static krb5_error_code create_empty_cred
240 - krb5_realm = krb5_princ_realm(ctx, princ);
241 + sss_krb5_princ_realm(ctx, princ, &realm_name, &realm_length);
243 kerr = krb5_build_principal_ext(ctx, &cred->server,
244 - krb5_realm->length, krb5_realm->data,
245 + realm_length, realm_name,
246 KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME,
247 - krb5_realm->length, krb5_realm->data, 0);
248 + realm_length, realm_name, 0);
250 DEBUG(SSSDBG_CRIT_FAILURE, "krb5_build_principal_ext failed.\n");
252 @@ -762,7 +765,8 @@ static errno_t add_ticket_times_and_upn_
256 - kerr = krb5_unparse_name_ext(kr->ctx, kr->creds->client, &upn, &upn_len);
257 + kerr = sss_krb5_unparse_name_ext(kr->ctx, kr->creds->client,
260 DEBUG(SSSDBG_OP_FAILURE, "krb5_unparse_name failed.\n");
262 @@ -770,7 +774,7 @@ static errno_t add_ticket_times_and_upn_
264 ret = pam_add_response(kr->pd, SSS_KRB5_INFO_UPN, upn_len,
266 - krb5_free_unparsed_name(kr->ctx, upn);
267 + sss_krb5_free_unparsed_name(kr->ctx, upn);
269 DEBUG(SSSDBG_CRIT_FAILURE, "pack_response_packet failed.\n");
271 @@ -792,7 +796,9 @@ static krb5_error_code validate_tgt(stru
272 krb5_principal validation_princ = NULL;
273 bool realm_entry_found = false;
274 krb5_ccache validation_ccache = NULL;
275 +#ifdef HAVE_PAC_RESPONDER
276 krb5_authdata **pac_authdata = NULL;
279 memset(&keytab, 0, sizeof(keytab));
280 kerr = krb5_kt_resolve(kr->ctx, kr->keytab, &keytab);
281 @@ -886,6 +892,7 @@ static krb5_error_code validate_tgt(stru
285 +#ifdef HAVE_PAC_RESPONDER
286 /* Try to find and send the PAC to the PAC responder.
287 * Failures are not critical. */
289 @@ -908,6 +915,7 @@ static krb5_error_code validate_tgt(stru
293 +#endif /* HAVE_PAC_RESPONDER */
296 if (validation_ccache != NULL) {
297 @@ -943,7 +951,7 @@ static krb5_error_code get_and_save_tgt_
298 krb5_get_init_creds_opt_set_address_list(&options, NULL);
299 krb5_get_init_creds_opt_set_forwardable(&options, 0);
300 krb5_get_init_creds_opt_set_proxiable(&options, 0);
301 - set_canonicalize_option(&options);
302 + set_canonicalize_option(ctx, &options);
304 kerr = krb5_get_init_creds_keytab(ctx, &creds, princ, keytab, 0, NULL,
306 @@ -1149,7 +1157,7 @@ static errno_t changepw_child(struct krb
307 prompter = sss_krb5_prompter;
310 - set_changepw_options(kr->options);
311 + set_changepw_options(kr->ctx, kr->options);
312 sss_krb5_princ_realm(kr->ctx, kr->princ, &realm_name, &realm_length);
313 if (realm_length == 0) {
314 DEBUG(SSSDBG_CRIT_FAILURE, "sss_krb5_princ_realm failed.\n");
315 @@ -1201,9 +1209,9 @@ static errno_t changepw_child(struct krb
317 memset(&result_code_string, 0, sizeof(krb5_data));
318 memset(&result_string, 0, sizeof(krb5_data));
319 - kerr = krb5_change_password(kr->ctx, kr->creds,
320 - discard_const(newpassword), &result_code,
321 - &result_code_string, &result_string);
322 + kerr = krb5_set_password(kr->ctx, kr->creds,
323 + discard_const(newpassword), NULL,
324 + &result_code, &result_code_string, &result_string);
326 if (kerr == KRB5_KDC_UNREACH) {
327 return ERR_NETWORK_IO;
328 @@ -1217,7 +1225,7 @@ static errno_t changepw_child(struct krb
329 if (result_code_string.length > 0) {
330 DEBUG(SSSDBG_CRIT_FAILURE,
331 "krb5_change_password failed [%d][%.*s].\n", result_code,
332 - result_code_string.length, result_code_string.data);
333 + (int) result_code_string.length, (char *) result_code_string.data);
334 user_error_message = talloc_strndup(kr->pd, result_code_string.data,
335 result_code_string.length);
336 if (user_error_message == NULL) {
337 @@ -1225,10 +1233,10 @@ static errno_t changepw_child(struct krb
341 - if (result_string.length > 0 && result_string.data[0] != '\0') {
342 + if (result_string.length > 0 && ((char *) result_string.data)[0] != '\0') {
343 DEBUG(SSSDBG_CRIT_FAILURE,
344 "krb5_change_password failed [%d][%.*s].\n", result_code,
345 - result_string.length, result_string.data);
346 + (int) result_string.length, (char *) result_string.data);
347 talloc_free(user_error_message);
348 user_error_message = talloc_strndup(kr->pd, result_string.data,
349 result_string.length);
350 @@ -1279,7 +1287,7 @@ static errno_t changepw_child(struct krb
352 /* We changed some of the gic options for the password change, now we have
353 * to change them back to get a fresh TGT. */
354 - revert_changepw_options(kr->options);
355 + revert_changepw_options(kr->ctx, kr->options);
357 kerr = get_and_save_tgt(kr, newpassword);
359 @@ -1339,7 +1347,7 @@ static errno_t tgt_req_child(struct krb5
360 "Failed to unset expire callback, continue ...\n");
363 - set_changepw_options(kr->options);
364 + set_changepw_options(kr->ctx, kr->options);
365 kerr = krb5_get_init_creds_password(kr->ctx, kr->creds, kr->princ,
366 discard_const(password),
367 sss_krb5_prompter, kr, 0,
368 @@ -1919,7 +1927,8 @@ static errno_t k5c_recv_data(struct krb5
369 static int k5c_setup_fast(struct krb5_req *kr, bool demand)
371 krb5_principal fast_princ_struct;
372 - krb5_data *realm_data;
373 + const char *realm_name;
375 char *fast_principal_realm;
376 char *fast_principal;
377 krb5_error_code kerr;
378 @@ -1948,8 +1957,11 @@ static int k5c_setup_fast(struct krb5_re
379 return KRB5KRB_ERR_GENERIC;
382 - realm_data = krb5_princ_realm(kr->ctx, fast_princ_struct);
383 - fast_principal_realm = talloc_asprintf(kr, "%.*s", realm_data->length, realm_data->data);
384 + sss_krb5_princ_realm(kr->ctx, fast_princ_struct,
385 + &realm_name, &realm_length);
387 + fast_principal_realm = talloc_asprintf(kr, "%.*s",
388 + realm_length, realm_name);
389 if (!fast_principal_realm) {
390 DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");
392 @@ -2235,7 +2247,7 @@ static int k5c_setup(struct krb5_req *kr
396 - set_canonicalize_option(kr->options);
397 + set_canonicalize_option(kr->ctx, kr->options);
400 /* TODO: set options, e.g.
401 --- sssd-1.11.6/src/providers/krb5/krb5_common.c.orig 2014-06-03 16:31:33.000000000 +0200
402 +++ sssd-1.11.6/src/providers/krb5/krb5_common.c 2014-06-18 22:23:18.480672769 +0200
404 #include "providers/krb5/krb5_opts.h"
405 #include "providers/krb5/krb5_utils.h"
407 -#ifdef HAVE_KRB5_CC_COLLECTION
408 +#ifdef HAVE_PROFILE_H
409 /* krb5 profile functions */
412 @@ -91,7 +91,7 @@ done:
416 -#ifdef HAVE_KRB5_CC_COLLECTION
417 +#ifdef HAVE_PROFILE_H
418 /* source default_ccache_name from krb5.conf */
419 static errno_t sss_get_system_ccname_template(TALLOC_CTX *mem_ctx,
421 @@ -912,7 +912,7 @@ errno_t krb5_install_offline_callback(st
424 struct remove_info_files_ctx *ctx;
425 - const char *krb5_realm;
426 + const char *krb5_realm_str;
428 if (krb5_ctx->service == NULL || krb5_ctx->service->name == NULL) {
429 DEBUG(SSSDBG_CRIT_FAILURE, "Missing KDC service name!\n");
430 @@ -925,14 +925,14 @@ errno_t krb5_install_offline_callback(st
434 - krb5_realm = dp_opt_get_cstring(krb5_ctx->opts, KRB5_REALM);
435 - if (krb5_realm == NULL) {
436 + krb5_realm_str = dp_opt_get_cstring(krb5_ctx->opts, KRB5_REALM);
437 + if (krb5_realm_str == NULL) {
438 DEBUG(SSSDBG_CRIT_FAILURE, "Missing krb5_realm option!\n");
443 - ctx->realm = talloc_strdup(ctx, krb5_realm);
444 + ctx->realm = talloc_strdup(ctx, krb5_realm_str);
445 if (ctx->realm == NULL) {
446 DEBUG(SSSDBG_CRIT_FAILURE, "talloc_strdup failed!\n");
448 @@ -967,19 +967,19 @@ done:
449 errno_t krb5_install_sigterm_handler(struct tevent_context *ev,
450 struct krb5_ctx *krb5_ctx)
452 - const char *krb5_realm;
453 + const char *krb5_realm_str;
455 struct tevent_signal *sige;
457 BlockSignals(false, SIGTERM);
459 - krb5_realm = dp_opt_get_cstring(krb5_ctx->opts, KRB5_REALM);
460 - if (krb5_realm == NULL) {
461 + krb5_realm_str = dp_opt_get_cstring(krb5_ctx->opts, KRB5_REALM);
462 + if (krb5_realm_str == NULL) {
463 DEBUG(SSSDBG_CRIT_FAILURE, "Missing krb5_realm option!\n");
467 - sig_realm = talloc_strdup(krb5_ctx, krb5_realm);
468 + sig_realm = talloc_strdup(krb5_ctx, krb5_realm_str);
469 if (sig_realm == NULL) {
470 DEBUG(SSSDBG_CRIT_FAILURE, "talloc_strdup failed!\n");
472 --- sssd-1.11.6/src/providers/krb5/krb5_init.c.orig 2014-06-03 16:31:33.000000000 +0200
473 +++ sssd-1.11.6/src/providers/krb5/krb5_init.c 2014-06-18 22:43:53.080647036 +0200
474 @@ -64,7 +64,7 @@ int sssm_krb5_auth_init(struct be_ctx *b
475 const char *krb5_backup_servers;
476 const char *krb5_kpasswd_servers;
477 const char *krb5_backup_kpasswd_servers;
478 - const char *krb5_realm;
479 + const char *krb5_realm_str;
483 @@ -103,15 +103,15 @@ int sssm_krb5_auth_init(struct be_ctx *b
484 krb5_servers = dp_opt_get_string(ctx->opts, KRB5_KDC);
485 krb5_backup_servers = dp_opt_get_string(ctx->opts, KRB5_BACKUP_KDC);
487 - krb5_realm = dp_opt_get_string(ctx->opts, KRB5_REALM);
488 - if (krb5_realm == NULL) {
489 + krb5_realm_str = dp_opt_get_string(ctx->opts, KRB5_REALM);
490 + if (krb5_realm_str == NULL) {
491 DEBUG(SSSDBG_FATAL_FAILURE, "Missing krb5_realm option!\n");
495 ret = krb5_service_init(ctx, bectx,
496 SSS_KRB5KDC_FO_SRV, krb5_servers,
497 - krb5_backup_servers, krb5_realm,
498 + krb5_backup_servers, krb5_realm_str,
499 dp_opt_get_bool(krb5_options->opts,
502 @@ -138,7 +138,7 @@ int sssm_krb5_auth_init(struct be_ctx *b
504 ret = krb5_service_init(ctx, bectx,
505 SSS_KRB5KPASSWD_FO_SRV, krb5_kpasswd_servers,
506 - krb5_backup_kpasswd_servers, krb5_realm,
507 + krb5_backup_kpasswd_servers, krb5_realm_str,
508 dp_opt_get_bool(krb5_options->opts,
510 &ctx->kpasswd_service);
511 --- sssd-1.12.3/src/providers/ldap/ldap_child.c.orig 2015-01-08 18:19:45.000000000 +0100
512 +++ sssd-1.12.3/src/providers/ldap/ldap_child.c 2015-01-12 16:27:54.035711695 +0100
513 @@ -99,7 +99,7 @@ static errno_t unpack_buffer(uint8_t *bu
515 /* ticket lifetime */
516 SAFEALIGN_COPY_UINT32_CHECK(&ibuf->lifetime, buf + p, size, &p);
517 - DEBUG(SSSDBG_TRACE_LIBS, "lifetime: %u\n", ibuf->lifetime);
518 + DEBUG(SSSDBG_TRACE_LIBS, "lifetime: %ld\n", (long)(ibuf->lifetime));
520 /* UID and GID to run as */
521 SAFEALIGN_COPY_UINT32_CHECK(&ibuf->uid, buf + p, size, &p);
522 @@ -386,7 +386,8 @@ static krb5_error_code ldap_child_get_tg
523 DEBUG(SSSDBG_CONF_SETTINGS, "Will canonicalize principals\n");
526 - sss_krb5_get_init_creds_opt_set_canonicalize(&options, canonicalize);
527 + sss_krb5_get_init_creds_opt_set_canonicalize(context,
528 + &options, canonicalize);
530 ccname_file = talloc_asprintf(tmp_ctx, "%s/ccache_%s",
531 DB_PATH, realm_name);
532 @@ -462,8 +463,7 @@ static krb5_error_code ldap_child_get_tg
534 DEBUG(SSSDBG_TRACE_INTERNAL, "credentials stored\n");
536 -#ifdef HAVE_KRB5_GET_TIME_OFFSETS
537 - krberr = krb5_get_time_offsets(context, &kdc_time_offset,
538 + krberr = sss_krb5_get_time_offsets(context, &kdc_time_offset,
539 &kdc_time_offset_usec);
541 DEBUG(SSSDBG_OP_FAILURE, "Failed to get KDC time offset: %s\n",
542 @@ -475,10 +475,6 @@ static krb5_error_code ldap_child_get_tg
545 DEBUG(SSSDBG_TRACE_INTERNAL, "Got KDC time offset\n");
547 - /* If we don't have this function, just assume no offset */
548 - kdc_time_offset = 0;
551 DEBUG(SSSDBG_TRACE_INTERNAL,
552 "Renaming [%s] to [%s]\n", ccname_file_dummy, ccname_file);
553 --- sssd-1.11.6/src/providers/ldap/ldap_common.c.orig 2014-06-03 16:31:33.000000000 +0200
554 +++ sssd-1.11.6/src/providers/ldap/ldap_common.c 2014-06-19 07:33:38.193317867 +0200
555 @@ -1303,7 +1303,7 @@ done:
557 sdap_gssapi_get_default_realm(TALLOC_CTX *mem_ctx)
559 - char *krb5_realm = NULL;
560 + char *krb5_realm_str = NULL;
561 const char *realm = NULL;
562 krb5_error_code krberr;
563 krb5_context context = NULL;
564 @@ -1314,15 +1314,15 @@ sdap_gssapi_get_default_realm(TALLOC_CTX
568 - krberr = krb5_get_default_realm(context, &krb5_realm);
569 + krberr = krb5_get_default_realm(context, &krb5_realm_str);
571 DEBUG(SSSDBG_OP_FAILURE, "Failed to get default realm name: %s\n",
572 sss_krb5_get_error_message(context, krberr));
576 - realm = talloc_strdup(mem_ctx, krb5_realm);
577 - krb5_free_default_realm(context, krb5_realm);
578 + realm = talloc_strdup(mem_ctx, krb5_realm_str);
579 + krb5_free_default_realm(context, krb5_realm_str);
581 DEBUG(SSSDBG_FATAL_FAILURE, "Out of memory\n");
583 @@ -1343,7 +1343,7 @@ int sdap_gssapi_init(TALLOC_CTX *mem_ctx
585 const char *krb5_servers;
586 const char *krb5_backup_servers;
587 - const char *krb5_realm;
588 + const char *krb5_realm_str;
589 const char *krb5_opt_realm;
590 struct krb5_service *service = NULL;
592 @@ -1358,16 +1358,16 @@ int sdap_gssapi_init(TALLOC_CTX *mem_ctx
593 if (krb5_opt_realm == NULL) {
594 DEBUG(SSSDBG_OP_FAILURE,
595 "Missing krb5_realm option, will use libkrb default\n");
596 - krb5_realm = sdap_gssapi_get_default_realm(tmp_ctx);
597 - if (krb5_realm == NULL) {
598 + krb5_realm_str = sdap_gssapi_get_default_realm(tmp_ctx);
599 + if (krb5_realm_str == NULL) {
600 DEBUG(SSSDBG_FATAL_FAILURE,
601 "Cannot determine the Kerberos realm, aborting\n");
606 - krb5_realm = talloc_strdup(tmp_ctx, krb5_opt_realm);
607 - if (krb5_realm == NULL) {
608 + krb5_realm_str = talloc_strdup(tmp_ctx, krb5_opt_realm);
609 + if (krb5_realm_str == NULL) {
613 @@ -1375,7 +1375,7 @@ int sdap_gssapi_init(TALLOC_CTX *mem_ctx
615 ret = krb5_service_init(mem_ctx, bectx,
616 SSS_KRB5KDC_FO_SRV, krb5_servers,
617 - krb5_backup_servers, krb5_realm,
618 + krb5_backup_servers, krb5_realm_str,
619 dp_opt_get_bool(opts,
620 SDAP_KRB5_USE_KDCINFO),
622 @@ -1384,14 +1384,14 @@ int sdap_gssapi_init(TALLOC_CTX *mem_ctx
626 - ret = sdap_install_sigterm_handler(mem_ctx, bectx->ev, krb5_realm);
627 + ret = sdap_install_sigterm_handler(mem_ctx, bectx->ev, krb5_realm_str);
629 DEBUG(SSSDBG_FATAL_FAILURE, "Failed to install sigterm handler\n");
633 ret = sdap_install_offline_callback(mem_ctx, bectx,
634 - krb5_realm, SSS_KRB5KDC_FO_SRV);
635 + krb5_realm_str, SSS_KRB5KDC_FO_SRV);
637 DEBUG(SSSDBG_FATAL_FAILURE, "Failed to install sigterm handler\n");
639 diff --git a/src/tests/krb5_child-test.c b/src/tests/krb5_child-test.c
640 index 0c6b68b..102827e 100644
641 --- a/src/tests/krb5_child-test.c
642 +++ b/src/tests/krb5_child-test.c
643 @@ -290,17 +290,17 @@ child_done(struct tevent_req *req)
645 printtime(krb5_timestamp ts)
647 +#ifdef HAVE_KRB5_TIMESTAMP_TO_SFSTRING
648 krb5_error_code kret;
649 char timestring[BUFSIZ];
652 -#ifdef HAVE_KRB5_TIMESTAMP_TO_SFSTRING
653 kret = krb5_timestamp_to_sfstring(ts, timestring, BUFSIZ, &fill);
655 KRB5_CHILD_TEST_DEBUG(SSSDBG_OP_FAILURE, kret);
657 printf("%s", timestring);
659 +#elif defined(HAVE_KRB5_FORMAT_TIME)
660 printf("%s", ctime(&ts));
661 #endif /* HAVE_KRB5_TIMESTAMP_TO_SFSTRING */
663 @@ -333,8 +333,8 @@ print_creds(krb5_context kcontext, krb5_creds *cred, const char *defname)
667 - krb5_free_unparsed_name(kcontext, name);
668 - krb5_free_unparsed_name(kcontext, sname);
669 + sss_krb5_free_unparsed_name(kcontext, name);
670 + sss_krb5_free_unparsed_name(kcontext, sname);
674 @@ -381,7 +381,7 @@ print_ccache(const char *cc)
677 krb5_cc_close(kcontext, cache);
678 - krb5_free_unparsed_name(kcontext, defname);
679 + sss_krb5_free_unparsed_name(kcontext, defname);
680 krb5_free_principal(kcontext, princ);
681 krb5_free_context(kcontext);
683 --- sssd-1.13.4/src/util/sss_krb5.c.orig 2016-04-13 16:48:41.000000000 +0200
684 +++ sssd-1.13.4/src/util/sss_krb5.c 2016-06-28 16:50:29.169609569 +0200
689 +#ifdef HAVE_PROFILE_H
697 void KRB5_CALLCONV sss_krb5_free_unparsed_name(krb5_context context, char *name)
699 -#ifdef HAVE_KRB5_FREE_UNPARSED_NAME
700 +#ifdef HAVE_KRB5_XFREE
702 +#elif HAVE_KRB5_FREE_UNPARSED_NAME
703 krb5_free_unparsed_name(context, name);
710 +void KRB5_CALLCONV sss_krb5_free_string(krb5_context ctx, char *val)
712 +/* TODO: ensure at least on is available in krb5.m4 */
713 +#ifdef HAVE_KRB5_FREE_STRING
714 + krb5_free_string(ctx, val);
715 +#elif HAVE_KRB5_XFREE
716 + (void) krb5_xfree(val);
720 krb5_error_code KRB5_CALLCONV sss_krb5_get_init_creds_opt_set_expire_callback(
721 krb5_context context,
722 @@ -753,15 +766,16 @@
723 #endif /* HAVE_KRB5_UNPARSE_NAME_FLAGS */
726 -void sss_krb5_get_init_creds_opt_set_canonicalize(krb5_get_init_creds_opt *opts,
727 +void sss_krb5_get_init_creds_opt_set_canonicalize(krb5_context ctx,
728 + krb5_get_init_creds_opt *opts,
731 - /* FIXME: The extra check for HAVE_KRB5_TICKET_TIMES is a workaround due to Heimdal
732 - * defining krb5_get_init_creds_opt_set_canonicalize() with a different set of
733 - * arguments. We should use a better configure check in the future.
735 -#if defined(HAVE_KRB5_GET_INIT_CREDS_OPT_SET_CANONICALIZE) && defined(HAVE_KRB5_TICKET_TIMES)
736 +#if defined(HAVE_KRB5_GET_INIT_CREDS_OPT_SET_CANONICALIZE) && \
737 + KRB5_GET_INIT_CREDS_OPT_SET_CANONICALIZE_ARGS == 2
738 krb5_get_init_creds_opt_set_canonicalize(opts, canonicalize);
739 +#elif defined(HAVE_KRB5_GET_INIT_CREDS_OPT_SET_CANONICALIZE) && \
740 + KRB5_GET_INIT_CREDS_OPT_SET_CANONICALIZE_ARGS == 3
741 + (void) krb5_get_init_creds_opt_set_canonicalize(ctx, opts, canonicalize);
743 DEBUG(SSSDBG_OP_FAILURE, "Kerberos principal canonicalization is not available!\n");
745 @@ -1023,7 +1037,7 @@
746 KRB5_DEBUG(SSSDBG_MINOR_FAILURE, ctx, kerr);
749 - krb5_free_string(ctx, tmp_ccname);
750 + sss_krb5_free_string(ctx, tmp_ccname);
754 @@ -1076,6 +1090,7 @@
756 bool sss_krb5_realm_has_proxy(const char *realm)
758 +#ifdef HAVE_PROFILE_H
759 krb5_context context = NULL;
760 krb5_error_code kerr;
761 struct _profile_t *profile = NULL;
762 @@ -1128,4 +1143,48 @@
763 krb5_free_context(context);
771 +krb5_error_code KRB5_CALLCONV
772 +sss_krb5_unparse_name_ext(krb5_context ctx,
773 + krb5_const_principal principal,
777 + krb5_error_code kerr;
779 +#ifdef HAVE_KRB5_UNPARSE_NAME_EXT
780 + kerr = krb5_unparse_name_ext(ctx, principal, name, len);
782 + kerr = krb5_unparse_name(ctx, principal, name);
783 + if (kerr == 0 && *name)
784 + *len = strlen(*name);
785 +#endif /* HAVE_KRB5_UNPARSE_NAME_EXT */
790 +krb5_error_code KRB5_CALLCONV
791 +sss_krb5_get_time_offsets(krb5_context ctx,
792 + krb5_timestamp *seconds,
793 + int32_t *microseconds)
795 +#if defined(HAVE_KRB5_GET_TIME_OFFSETS)
796 + return krb5_get_time_offsets(ctx, seconds, microseconds);
797 +#elif defined(HAVE_KRB5_GET_KDC_SEC_OFFSET)
799 + krb5_error_code ret;
801 + ret = krb5_get_kdc_sec_offset(ctx, &_seconds, microseconds);
802 + *seconds = _seconds;
811 --- sssd-1.13.4/src/util/sss_krb5.h~ 2016-05-01 12:23:18.000000000 +0300
812 +++ sssd-1.13.4/src/util/sss_krb5.h 2016-05-01 12:24:04.615247459 +0300
813 @@ -70,6 +70,8 @@ void KRB5_CALLCONV sss_krb5_get_init_cre
815 void KRB5_CALLCONV sss_krb5_free_unparsed_name(krb5_context context, char *name);
817 +void KRB5_CALLCONV sss_krb5_free_string(krb5_context ctx, char *val);
819 krb5_error_code find_principal_in_keytab(krb5_context ctx,
821 const char *pattern_primary,
822 @@ -133,7 +135,8 @@ krb5_error_code
823 sss_krb5_unparse_name_flags(krb5_context context, krb5_const_principal principal,
824 int flags, char **name);
826 -void sss_krb5_get_init_creds_opt_set_canonicalize(krb5_get_init_creds_opt *opts,
827 +void sss_krb5_get_init_creds_opt_set_canonicalize(krb5_context ctx,
828 + krb5_get_init_creds_opt *opts,
831 enum sss_krb5_cc_type {
832 @@ -164,6 +167,10 @@ typedef krb5_times sss_krb5_ticket_times
833 /* Redirect libkrb5 tracing towards our DEBUG statements */
834 errno_t sss_child_set_krb5_tracing(krb5_context ctx);
836 +#ifndef HAVE_KRB5_AUTHDATATYPE
837 +typedef int32_t krb5_authdatatype;
840 krb5_error_code sss_krb5_find_authdata(krb5_context context,
841 krb5_authdata *const *ticket_authdata,
842 krb5_authdata *const *ap_req_authdata,
846 bool sss_krb5_realm_has_proxy(const char *realm);
848 +krb5_error_code KRB5_CALLCONV
849 +sss_krb5_unparse_name_ext(krb5_context ctx,
850 + krb5_const_principal principal,
852 + unsigned int *len);
853 +krb5_error_code KRB5_CALLCONV
854 +sss_krb5_get_time_offsets(krb5_context ctx,
855 + krb5_timestamp *seconds,
856 + int32_t *microseconds);
857 #endif /* __SSS_KRB5_H__ */
858 --- sssd-1.12.3/src/providers/krb5/krb5_keytab.c.orig 2015-01-08 18:19:45.000000000 +0100
859 +++ sssd-1.12.3/src/providers/krb5/krb5_keytab.c 2015-01-12 18:14:26.452110024 +0100
861 #include "util/util.h"
862 #include "util/sss_krb5.h"
864 +#ifndef MAX_KEYTAB_NAME_LEN
865 +#define MAX_KEYTAB_NAME_LEN 1100
868 krb5_error_code copy_keytab_into_memory(TALLOC_CTX *mem_ctx, krb5_context kctx,
869 char *inp_keytab_file,
871 #--- sssd-1.13.4/src/external/pac_responder.m4.orig 2016-04-13 16:48:41.000000000 +0200
872 #+++ sssd-1.13.4/src/external/pac_responder.m4 2016-06-28 17:56:26.774836046 +0200
874 # AC_MSG_CHECKING(for supported MIT krb5 version)
875 # KRB5_VERSION="`$KRB5_CONFIG --version`"
876 # case $KRB5_VERSION in
878 # Kerberos\ 5\ release\ 1.9* | \
879 # Kerberos\ 5\ release\ 1.10* | \
880 # Kerberos\ 5\ release\ 1.11* | \