ticket: 4407

version_fixed: 1.5.2

pull up r18670 from trunk

 r18670@cathode-dark-space:  jaltman | 2006-10-09 14:08:10 -0400
 ticket: new
 subject: final commits for KFW 3.1 Beta 2
 tags: pullup
 
   krb5cred.dll (1.1.2.0)
   
   - Fix the control logic so that if the password is expired for an
     identity, the krb5 credentials provider will initiate a change
     password request.  Once the password is successfully changed, the
     new password will be used to obtain new credentials.
   
   - Fix an incorrect condition which caused the new credentials dialog
     to refresh custom prompts unnecessarily.
   
   - Removing an identity from the list of NetIDMgr identities now causes
     the corresponding principal to be removed from the LRU principals
     list.
   
   - Properly handle KMSG_CRED_PROCESS message when the user is
     cancelling out.
   
   - Add more debug output
   
   - Do not renew Kerberos tickets which are not initial tickets.
   
   - Fix whitespace in source code.
   
   - When providing identity selection controls, disable the realm
     selector when the user specifies the realm in the username control.
   
   - k5_ident_valiate_name() will refuse principal names with empty or
     unspecified realms.
   
   - When updating identity properties, the identity provider will
     correctly set the properties for identities that were destroyed.
     This fixes a problem where the values may be incorrect if an
     identity has two or more credential caches and one of them is
     destroyed.
   
   nidmgr32.dll (1.1.2.0)
   
   - Send out a separate notification if the configuration information
     associated with an identity is removed.
   
   - If an identity is being removed from the NetIDMgr identity list in
     the configuration panel, do not send out APPLY notifications to the
     subpanels after the configuration information has been removed.
     Otherwise this causes the configuration information to be reinstated
     and prevent the identity from being removed.
   
   - Properly initialize the new credentials blob including the UI
     context structure.
   
   netidmgr.exe (1.1.2.0)
   
   - When suppressing error messages, make sure that the final
     KMSG_CRED_END notification is sent.  Otherwise the new credentials
     acquisition operation will not be cleaned up.
   
   - Autoinit option now checks to see if there are identity credentials
     for the default identity and triggers the new credentials dialog if
     there aren't any.
   
   - Properly synchronize the configuration node list when applying
     changes (e.g.: when removing or adding an identity).
   
   - Fix a handle leak when removing an identity from the NetIDMgr
     identity list.
   
   - Refresh the properties for the active identities before calculating
     the renewal and expiration timers.  Otherwise the timestamps being
     used might be incorrect.
   
   - Add Identity dialog (in the configuration panel) now uses the
     identity selection controls provided by the identity provider.
   
   - Improve type safety when handling timer refreshes.
   
   - When getting the expiration times and issue times for an identity,
     the timer refresh code may fail over to the expiration and issue
     times for the credential it is currently looking at.  Now the code
     makes sure that both the issue and expiration times come from the
     identity or the credential but not mixed.
   
   - Not being able to get the time of issue of a credential now does not
     result in the credential being skipped from the timer refresh pass.
     However, not having a time of issue will result in the half-life
     algorithm not being applied for the renew timer.
   
   - Fix a bug which caused a credential to be abandoned from the timer
     refresh pass if the reamining lifetime of the credential is less
     than the renewal threshold.
   
   - Fix a bug where the vertical scroll bars for the hypertext window
     would not appear when the contents of the window changed.
   
   - Trigger a refresh of the configuration nodes when adding or removing
     an identity.
   
   source for (1.1.2.0)
   
   - Explicitly include <prsht.h> so that the SDK can be used in build
     environments that define WIN32_LEAN_AND_MEAN.
   
   
 



git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-5@18681 dc483132-0cff-0310-8789-dd5450dbe970

src/windows/identity/apiversion.txt

@@ -1,5 +1,4 @@
-# Copyright (c) 2004-2006 Massachusetts Institute of Technology
-# Copyright (c) 2006 Secure Endpoints Inc.
+# Copyright (c) 2004 Massachusetts Institute of Technology
 #
 # Permission is hereby granted, free of charge, to any person
 # obtaining a copy of this software and associated documentation files
@@ -213,3 +212,5 @@ Date=(TBD)
 !kcdb_buf_get_attrib(), kcdb_buf_get_attrib_string(), kcbd_buf_set_attrib()
 # attr_name is now a const pointer
 
++KCDB_OP_DELCONFIG
+# notification that the configuration information for an identity is to be removed.

src/windows/identity/config/Makefile

@@ -1,5 +1,6 @@
 #
-# Copyright (c) 2004 Massachusetts Institute of Technology
+# Copyright (c) 2004,2005,2006 Massachusetts Institute of Technology
+# Copyright (c) 2006 Secure Endpoints Inc.
 #
 # Permission is hereby granted, free of charge, to any person
 # obtaining a copy of this software and associated documentation files

src/windows/identity/config/Makefile.w2k

@@ -3,7 +3,7 @@
 #             This file will be included by all the makefiles
 #             in the build tree.
 #
-# Copyright (c) 2004,2005 Massachusetts Institute of Technology
+# Copyright (c) 2004,2005,2006 Massachusetts Institute of Technology
 # Copyright (c) 2006 Secure Endpoints Inc.
 #
 # Permission is hereby granted, free of charge, to any person
@@ -47,8 +47,8 @@ KHIMAIRA_WIN32_CONFIG=1
 # Version info
 NETIDMGR_VERSION_MAJOR=1
 NETIDMGR_VERSION_MINOR=1
-NETIDMGR_VERSION_PATCH=1
-NETIDMGR_VERSION_AUX=2
+NETIDMGR_VERSION_PATCH=2
+NETIDMGR_VERSION_AUX=0
 NETIDMGR_RELEASEDESC=
 
 # The API version.  This number must be incremented each time the API

src/windows/identity/config/Makefile.w32

@@ -47,8 +47,8 @@ KHIMAIRA_WIN32_CONFIG=1
 # Version info
 NETIDMGR_VERSION_MAJOR=1
 NETIDMGR_VERSION_MINOR=1
-NETIDMGR_VERSION_PATCH=0
-NETIDMGR_VERSION_AUX=2
+NETIDMGR_VERSION_PATCH=2
+NETIDMGR_VERSION_AUX=0
 NETIDMGR_RELEASEDESC=
 
 # The API version.  This number must be incremented each time the API

src/windows/identity/kcreddb/identity.c

@@ -617,9 +617,13 @@ kcdb_identity_get_config(khm_handle vid,
                             &hident);
 
         if(KHM_FAILED(rv)) {
+            khm_int32 oldflags;
             EnterCriticalSection(&cs_ident);
+            oldflags = id->flags;
             id->flags &= ~KCDB_IDENT_FLAG_CONFIG;
             LeaveCriticalSection(&cs_ident);
+            if (oldflags & KCDB_IDENT_FLAG_CONFIG)
+                kcdbint_ident_post_message(KCDB_OP_DELCONFIG, id);
             goto _exit;
         }
 

src/windows/identity/kcreddb/kcreddb.h

@@ -3310,6 +3310,7 @@ kcdb_buf_release(khm_handle record);
 #define KCDB_OP_SETSEARCH   8
 #define KCDB_OP_UNSETSEARCH 9
 #define KCDB_OP_NEW_DEFAULT 10
+#define KCDB_OP_DELCONFIG   11
 
 /*@}*/
 

src/windows/identity/plugins/krb5/krb5funcs.c

@@ -702,6 +702,19 @@ khm_krb5_renew_cred(khm_handle cred)
     khm_boolean		brenewIdentity = FALSE;
     khm_boolean		istgt = FALSE;
 
+    khm_int32           flags;
+
+    cbname = sizeof(wname);
+    kcdb_cred_get_name(cred, wname, &cbname);
+    _reportf(L"Krb5 renew cred for %s", wname);
+
+    kcdb_cred_get_flags(cred, &flags);
+
+    if (!(flags & KCDB_CRED_FLAG_INITIAL)) {
+        _reportf(L"Krb5 skipping renewal because this is not an initial credential");
+        return 0;
+    }
+
     memset(&in_creds, 0, sizeof(in_creds));
     memset(&cc_creds, 0, sizeof(cc_creds));
 
@@ -2161,80 +2174,79 @@ khm_krb5_changepwd(char * principal,
     if ( !pkrb5_init_context )
         goto cleanup;
 
-   if (rc = pkrb5_init_context(&context)) {
-       goto cleanup;
-   }
-
-   if (rc = pkrb5_parse_name(context, principal, &princ)) {
-       goto cleanup;
-   }
-
-   pkrb5_get_init_creds_opt_init(&opts);
-   pkrb5_get_init_creds_opt_set_tkt_life(&opts, 5*60);
-   pkrb5_get_init_creds_opt_set_renew_life(&opts, 0);
-   pkrb5_get_init_creds_opt_set_forwardable(&opts, 0);
-   pkrb5_get_init_creds_opt_set_proxiable(&opts, 0);
-   pkrb5_get_init_creds_opt_set_address_list(&opts,NULL);
-
-   if (rc = pkrb5_get_init_creds_password(context, &creds, princ, 
-                                          password, 0, 0, 0, 
-                                          "kadmin/changepw", &opts)) {
-       if (rc == KRB5KRB_AP_ERR_BAD_INTEGRITY) {
+    if (rc = pkrb5_init_context(&context)) {
+        goto cleanup;
+    }
+
+    if (rc = pkrb5_parse_name(context, principal, &princ)) {
+        goto cleanup;
+    }
+
+    pkrb5_get_init_creds_opt_init(&opts);
+    pkrb5_get_init_creds_opt_set_tkt_life(&opts, 5*60);
+    pkrb5_get_init_creds_opt_set_renew_life(&opts, 0);
+    pkrb5_get_init_creds_opt_set_forwardable(&opts, 0);
+    pkrb5_get_init_creds_opt_set_proxiable(&opts, 0);
+    pkrb5_get_init_creds_opt_set_address_list(&opts,NULL);
+
+    if (rc = pkrb5_get_init_creds_password(context, &creds, princ, 
+                                           password, 0, 0, 0, 
+                                           "kadmin/changepw", &opts)) {
+        if (rc == KRB5KRB_AP_ERR_BAD_INTEGRITY) {
 #if 0
-           com_err(argv[0], 0,
-                   "Password incorrect while getting initial ticket");
+            com_err(argv[0], 0,
+                    "Password incorrect while getting initial ticket");
 #endif
-       }
-       else {
+        } else {
 #if 0
-           com_err(argv[0], ret, "getting initial ticket");
+            com_err(argv[0], ret, "getting initial ticket");
 #endif
-       }
-       goto cleanup;
-   }
+        }
+        goto cleanup;
+    }
 
-   if (rc = pkrb5_change_password(context, &creds, newpassword,
-                                  &result_code, &result_code_string,
-                                  &result_string)) {
+    if (rc = pkrb5_change_password(context, &creds, newpassword,
+                                   &result_code, &result_code_string,
+                                   &result_string)) {
 #if 0
-       com_err(argv[0], ret, "changing password");
+        com_err(argv[0], ret, "changing password");
 #endif
-       goto cleanup;
-   }
-
-   if (result_code) {
-       int len = result_code_string.length + 
-           (result_string.length ? (sizeof(": ") - 1) : 0) +
-           result_string.length;
-       if (len && error_str) {
-           *error_str = PMALLOC(len + 1);
-           if (*error_str)
-               StringCchPrintfA(*error_str, len+1,
-                                "%.*s%s%.*s",
-                                result_code_string.length, 
-                                result_code_string.data,
-                                result_string.length?": ":"",
-                                result_string.length, 
-                                result_string.data);
-       }
-       rc = result_code;
-       goto cleanup;
-   }
+        goto cleanup;
+    }
+
+    if (result_code) {
+        int len = result_code_string.length + 
+            (result_string.length ? (sizeof(": ") - 1) : 0) +
+            result_string.length;
+        if (len && error_str) {
+            *error_str = PMALLOC(len + 1);
+            if (*error_str)
+                StringCchPrintfA(*error_str, len+1,
+                                 "%.*s%s%.*s",
+                                 result_code_string.length, 
+                                 result_code_string.data,
+                                 result_string.length?": ":"",
+                                 result_string.length, 
+                                 result_string.data);
+        }
+        rc = result_code;
+        goto cleanup;
+    }
 
  cleanup:
-   if (result_string.data)
-       pkrb5_free_data_contents(context, &result_string);
+    if (result_string.data)
+        pkrb5_free_data_contents(context, &result_string);
 
-   if (result_code_string.data)
-       pkrb5_free_data_contents(context, &result_code_string);
+    if (result_code_string.data)
+        pkrb5_free_data_contents(context, &result_code_string);
 
-   if (princ)
-       pkrb5_free_principal(context, princ);
+    if (princ)
+        pkrb5_free_principal(context, princ);
 
-   if (context)
-       pkrb5_free_context(context);
+    if (context)
+        pkrb5_free_context(context);
 
-   return rc;
+    return rc;
 }
 
 khm_int32 KHMAPI