1.6pre1
start of 1.6 release notes
Windows 1.6 pre1

The Windows version number for 1.6pre1 is 1.6.1.0.
The PRERELEASE option is still set.

Change-Id: I206336e1b0f25dd38c9e84f49addb50fe38d7bfa
Fix krb5's gss_pseudo_random() (n is big-endian)

The first enctype RFC3961 prf output length's bytes are correct because
the little- and big-endian representations of unsigned zero are the
same.  The second block of output was wrong because the counter was not
being encoded as big-endian.

This change could break applications.  But those applications would not
have been interoperating with other implementations anyways (in
particular: MIT's).
check that e have sane values
Minor language problems
Fix never valid error condition in KDC

The TGS was incorrectly using authtime to compute renew_till for new
tickets, which was in turn leading to endtime potentially being equal to
starttime, which caused the TGS to return KRB5KDC_ERR_NEVER_VALID.

This happens when the TGT renewal lifetime is longer than the max renew
lifetime of any other services, after that much time (target services'
max renew life) passes.  The TGT is still good but TGS-REQs fail.
kx509: Create certs for principals with slashes

kx509 fails to create certs for principals with slashes in them.  For
example:

    client% kinit foo/admin
    foo/admin@EXAMPLE.COM's Password:
    client% kx509
    Timed out waiting on KCA

The KCA reports: "Principal is not a user."  However, there is a use
case set out in this post:

https://thestaticvoid.com/post/2012/10/25/protecting-puppet-with-kerberos/

that would create a kx509 cert for a host principal for authenticating
against a secure HTTP service.  This commit modifies the certificate
creation code to allow principals with slashes in them.
Add heimdal-krb5.pc file, with krb5.pc depending on it.

This makes it easier to install Heimdal and MIT kerberos on
the same system by just providing the heimdal-krb5.pc file;
the krb5.pc file is provided by both.

This is similar to what's done with heimdal-gssapi.pc/krb5-gssapi.pc.

Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
spelling
use heimdal-krb5 instead of krb5 as dependency
kx509: Prevent double free

Patchset 750a09bca2183415be3ca3b8784e3417f484794b introduced the
potential for a double free of 'name'.

Change-Id: I23bd4ddb7d9b41cbb3948ab06245f4052b309971
Also validate kdigest hacks

Add validation of the kdigest configuration parameters
kx509: Create certs for principals with slashes

kx509 fails to create certs for principals with slashes in them.  For
example:

    client% kinit foo/admin
    foo/admin@EXAMPLE.COM's Password:
    client% kx509
    Timed out waiting on KCA

The KCA reports: "Principal is not a user."  However, there is a use
case set out in this post:

https://thestaticvoid.com/post/2012/10/25/protecting-puppet-with-kerberos/

that would create a kx509 cert for a host principal for authenticating
against a secure HTTP service.  This commit modifies the certificate
creation code to allow principals with slashes in them.

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
kx509: Prevent double free

Patchset 750a09bca2183415be3ca3b8784e3417f484794b introduced the
potential for a double free of 'name'.

Change-Id: I23bd4ddb7d9b41cbb3948ab06245f4052b309971
Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
add --policy documentation

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Fix kx509 to include realm

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Add option to require initial kca_service tickets

Default to TRUE, and allow setting it on a per-realm basis.

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Document kx509 parameters

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>
Add heimdal-kadm-{client,server} with kadm-{client,server} depending on
them.

Signed-off-by: Love Hörnquist Åstrand <lha@apple.com>