Commit 2dfd99b2 authored by jan.koester's avatar jan.koester
Browse files

test

parent 32b9089b

src/krb5.cpp

+7 −2
Changes for src/krb5.cpp: 7 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -25,8 +25,12 @@ enum MsgType { AsReq = 10, AsRep = 11, TgsReq = 12, TgsRep = 13, KrbError = 30 } 
enum PaType { PaTgsReq = 1, PaEncTimestamp = 2, PaPwSalt = 3, PaEtypeInfo2 = 19 };

enum Usage { UsageEncTimestamp = 1, UsageAsRep = 3, UsageTgsReqCksum = 6, UsageTgsAuthenticator = 7, UsageTgsRep = 8 };



/* forwardable(1), renewable(8), canonicalize(15) */

constexpr uint32_t KdcOptions = 0x40810000;

/* canonicalize(15) only: adconnect neither forwards nor renews tickets

 * (it gets new ones), and Heimdal -- Samba AD's KDC -- refuses a TGS-REQ

 * asking for flags the TGT hasn't got (renewable without an rtime, or

 * forwardable for an account that may not delegate: KDC_ERR_BADOPTION),

 * forwardable even at the AS-REQ (KDC_ERR_POLICY) */

constexpr uint32_t KdcOptions = 0x00010000;

/* a ticket is renewed this long before it ends */

constexpr int RenewBefore = 300;

/* a KDC reply bigger than this is refused (tickets with a PAC: a few KiB) */
@@ -295,6 +299,7 @@ std::string errorText(int code) { 
    case 6: name = "KDC_ERR_C_PRINCIPAL_UNKNOWN"; why = "the account isn't known to the KDC"; break;

    case 7: name = "KDC_ERR_S_PRINCIPAL_UNKNOWN"; why = "no such service -- servers must be the DCs' DNS names, not addresses"; break;

    case 12: name = "KDC_ERR_POLICY"; why = "refused by the KDC's policy"; break;

    case 13: name = "KDC_ERR_BADOPTION"; why = "the KDC can't give a ticket with the options asked for"; break;

    case 14: name = "KDC_ERR_ETYPE_NOSUPP"; why = "no common encryption type -- the account needs AES keys (set its password once more)"; break;

    case 18: name = "KDC_ERR_CLIENT_REVOKED"; why = "the account is disabled, locked or expired"; break;

    case 23: name = "KDC_ERR_KEY_EXPIRED"; why = "the account's password has expired"; break;