- drop netdb patch
- kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that the DISALLOW_ALL_TIX flag is set on an entry, for better interop with Fedora, Netscape, Red Hat Directory Server (Simo Sorce)
This commit is contained in:
parent
d64960eca0
commit
8e9e1c07b0
66
krb5-1.6.2-dirsrv-accountlock.patch
Normal file
66
krb5-1.6.2-dirsrv-accountlock.patch
Normal file
@ -0,0 +1,66 @@
|
||||
diff -ur krb5-1.6.2.orig/src/aclocal.m4 krb5-1.6.2/src/aclocal.m4
|
||||
--- krb5-1.6.2.orig/src/aclocal.m4 2007-11-20 11:39:51.000000000 -0500
|
||||
+++ krb5-1.6.2/src/aclocal.m4 2007-11-20 12:09:56.000000000 -0500
|
||||
@@ -1798,6 +1798,12 @@
|
||||
yes | no) ;;
|
||||
*) AC_MSG_ERROR(Invalid option value --with-edirectory="$withval") ;;
|
||||
esac], with_edirectory=no)dnl
|
||||
+AC_ARG_WITH([dirsrv],
|
||||
+[ --with-dirsrv compile Red Hat/Fedora/Netscape Directory Server database backend module],
|
||||
+[case "$withval" in
|
||||
+ yes | no) ;;
|
||||
+ *) AC_MSG_ERROR(Invalid option value --with-dirsrv="$withval") ;;
|
||||
+esac], with_dirsrv=no)dnl
|
||||
|
||||
if test $with_ldap = yes; then
|
||||
if test $with_edirectory = yes; then
|
||||
@@ -1809,6 +1815,10 @@
|
||||
AC_MSG_NOTICE(enabling eDirectory database backend module support)
|
||||
OPENLDAP_PLUGIN=yes
|
||||
AC_DEFINE(HAVE_EDIRECTORY,1,[Define if LDAP KDB interface should assume eDirectory.])
|
||||
+elif test $with_dirsrv = yes; then
|
||||
+ AC_MSG_NOTICE(enabling Red Hat/Fedora/Netscape Directory Server database backend module support)
|
||||
+ OPENLDAP_PLUGIN=yes
|
||||
+ AC_DEFINE(HAVE_DIRSRV,1,[Define if LDAP KDB interface should assume RHDS/FDS/NDS.])
|
||||
else
|
||||
: # neither enabled
|
||||
dnl AC_MSG_NOTICE(disabling ldap backend module support)
|
||||
diff -ur krb5-1.6.2.orig/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c krb5-1.6.2/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
|
||||
--- krb5-1.6.2.orig/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c 2006-12-21 23:28:09.000000000 -0500
|
||||
+++ krb5-1.6.2/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c 2007-11-20 12:04:10.000000000 -0500
|
||||
@@ -2141,6 +2141,22 @@
|
||||
}
|
||||
}
|
||||
#endif
|
||||
+#ifdef HAVE_DIRSRV
|
||||
+ {
|
||||
+ krb5_timestamp expiretime=0;
|
||||
+ char *is_login_disabled=NULL;
|
||||
+
|
||||
+ /* LOGIN DISABLED */
|
||||
+ if ((st=krb5_ldap_get_string(ld, ent, "nsaccountlock", &is_login_disabled,
|
||||
+ &attr_present)) != 0)
|
||||
+ goto cleanup;
|
||||
+ if (attr_present == TRUE) {
|
||||
+ if (strcasecmp(is_login_disabled, "TRUE")== 0)
|
||||
+ entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
|
||||
+ free (is_login_disabled);
|
||||
+ }
|
||||
+ }
|
||||
+#endif
|
||||
|
||||
if ((st=krb5_read_tkt_policy (context, ldap_context, entry, tktpolname)) !=0)
|
||||
goto cleanup;
|
||||
diff -ur krb5-1.6.2.orig/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c krb5-1.6.2/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
|
||||
--- krb5-1.6.2.orig/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c 2007-01-03 19:27:26.000000000 -0500
|
||||
+++ krb5-1.6.2/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c 2007-11-20 12:00:27.000000000 -0500
|
||||
@@ -57,6 +57,9 @@
|
||||
"loginexpirationtime",
|
||||
"logindisabled",
|
||||
#endif
|
||||
+#ifdef HAVE_DIRSRV
|
||||
+ "nsaccountlock",
|
||||
+#endif
|
||||
"loginexpirationtime",
|
||||
"logindisabled",
|
||||
"modifytimestamp",
|
27
krb5.spec
27
krb5.spec
@ -1,5 +1,6 @@
|
||||
%define WITH_LDAP 1
|
||||
%define WITH_OPENSSL 1
|
||||
%define WITH_DIRSRV 1
|
||||
|
||||
%define krb5prefix %{_prefix}/kerberos
|
||||
|
||||
@ -15,7 +16,7 @@
|
||||
Summary: The Kerberos network authentication system.
|
||||
Name: krb5
|
||||
Version: 1.6.3
|
||||
Release: 6%{?dist}
|
||||
Release: 7%{?dist}
|
||||
# Maybe we should explode from the now-available-to-everybody tarball instead?
|
||||
# http://web.mit.edu/kerberos/dist/krb5/1.6/krb5-1.6.2-signed.tar
|
||||
Source0: krb5-%{version}.tar.gz
|
||||
@ -94,7 +95,7 @@ Patch64: krb5-ok-as-delegate.patch
|
||||
Patch68: krb5-trunk-spnego_delegation.patch
|
||||
Patch69: krb5-trunk-seqnum.patch
|
||||
Patch70: krb5-trunk-kpasswd_tcp2.patch
|
||||
Patch71: krb5-1.6.3-netdb.patch
|
||||
Patch71: krb5-1.6.2-dirsrv-accountlock.patch
|
||||
|
||||
License: MIT, freely distributable.
|
||||
URL: http://web.mit.edu/kerberos/www/
|
||||
@ -225,6 +226,12 @@ to obtain initial credentials from a KDC using a private key and a
|
||||
certificate.
|
||||
|
||||
%changelog
|
||||
* Mon Feb 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-7
|
||||
- drop netdb patch
|
||||
- kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that
|
||||
the DISALLOW_ALL_TIX flag is set on an entry, for better interop with Fedora,
|
||||
Netscape, Red Hat Directory Server (Simo Sorce)
|
||||
|
||||
* Wed Feb 13 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-6
|
||||
- patch to avoid depending on <netdb.h> to define NI_MAXHOST and NI_MAXSERV
|
||||
|
||||
@ -1294,7 +1301,7 @@ popd
|
||||
%patch68 -p0 -b .spnego_delegation
|
||||
%patch69 -p0 -b .seqnum
|
||||
#%patch70 -p0 -b .kpasswd_tcp2
|
||||
%patch71 -p1 -b .netdb
|
||||
%patch71 -p1 -b .dirsrv-accountlock
|
||||
cp src/krb524/README README.krb524
|
||||
gzip doc/*.ps
|
||||
|
||||
@ -1350,12 +1357,6 @@ INCLUDES=-I%{_includedir}/et
|
||||
%ifarch %{ix86} s390 ppc sparc
|
||||
DEFINES="-D_FILE_OFFSET_BITS=64" ; export DEFINES
|
||||
%endif
|
||||
# Enable or disable the LDAP plugin.
|
||||
%if %{WITH_LDAP}
|
||||
OPENLDAP_PLUGIN=yes
|
||||
%else
|
||||
OPENLDAP_PLUGIN=""
|
||||
%endif
|
||||
# Enable or disable the PKINIT plugin. The configure script only checks for
|
||||
# the version of OpenSSL being okay, so for now we have to use that to control
|
||||
# whether or not it tries to build the module.
|
||||
@ -1371,7 +1372,6 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`"
|
||||
CC=%{__cc} \
|
||||
CFLAGS="$CFLAGS" \
|
||||
CPPFLAGS="$CPPFLAGS" \
|
||||
OPENLDAP_PLUGIN="$OPENLDAP_PLUGIN" \
|
||||
SS_LIB="-lss -lcurses" \
|
||||
--enable-shared \
|
||||
%if %{build_static}
|
||||
@ -1388,6 +1388,13 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`"
|
||||
--with-netlib=-lresolv \
|
||||
--without-tcl \
|
||||
--enable-dns \
|
||||
%if %{WITH_LDAP}
|
||||
%if %{WITH_DIRSRV}
|
||||
--with-dirsrv \
|
||||
%else
|
||||
--with-ldap \
|
||||
%endif
|
||||
%endif
|
||||
--with-pam \
|
||||
--with-pam-login-service=%{login_pam_service} \
|
||||
--with-selinux
|
||||
|
Loading…
Reference in New Issue
Block a user