freeipa

#7879 Support S42Self for x.509 authentication and new MIT Krb5 ABI
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

When https://github.com/krb5/krb5/pull/887 is merged to MIT Kerberos, it will be possible to allow S4U2Self operations for clients using x.509 certificates.

To support this, MIT Kerberos bumps KDB API. Add support for new DAL version 7.1.

Note that this change actually comes with DAL version 8.0 which (unless something changes very soon) is what we'll have in 1.18. I'm working on a branch for DAL 8.0 support, but don't plan to do the work for s4u2self for x509 at this time. We can discuss what that looks like once the PR is up, but the problem is mostly the burden of keeping DAL version all the way back to 5 supported is catching up to us.
Edited by rharwood

master:

  • 1c787cc36c42f05fe945c4a8ae8551832e0e2c1d Handle the removal of KRB5_KDB_FLAG_ALIAS_OK
  • ff10f3fa18948971912bab9ad5bfbc3d36133a3b Support DAL version 8.0
  • 93e81cfd0c1d4d759985ed1ce3f4aa540dcf438e Drop support for DAL version 5.0

ipa-4-8:

  • d97cfd72721ed2f7e77f5c397a0ca7b389ea6d72 Handle the removal of KRB5_KDB_FLAG_ALIAS_OK
  • 089c47e212ac077dcd27bc60013d7ac7bf2270ee Support DAL version 8.0
  • 196350444ccab2b99e86accf7eb19ff8327a1e95 Drop support for DAL version 5.0

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • d92f21ae1b3051f96043c64320a768551de39d5a Fix DAL v8 support
  • c940f96b700d845afda014d41a0004068d379a9a Fix legacy S4U2Proxy in DAL v8 support

ipa-4-8:

  • 99a920cb69e213d211a6ff9622950e81c3e71c8d Fix DAL v8 support
  • 0806c1582b2f1dfaf04eb2e8fa222c190e24d818 Fix legacy S4U2Proxy in DAL v8 support
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.