third_party/heimdal/tests/kdc/krb5-bx509.conf.in

   1 [libdefaults]
   2         default_realm = TEST.H5L.SE
   3         no-addresses = TRUE
   4         allow_weak_crypto = TRUE
   5         rdns = false
   6         fcache_strict_checking = false
   7         name_canon_rules = as-is:realm=TEST.H5L.SE
   8
   9 [appdefaults]
  10         pkinit_anchors = FILE:@objdir@/pkinit-anchor.pem
  11         pkinit_pool = FILE:@objdir@/pkinit-anchor.pem
  12
  13 [realms]
  14         TEST.H5L.SE = {
  15                 kdc = localhost:@port@
  16                 pkinit_win2k = @w2k@
  17         }
  18
  19 [kdc]
  20         check-ticket-addresses = no
  21         warn_ticket_addresses = yes
  22         num-kdc-processes = 1
  23         strict-nametypes = true
  24         enable-pkinit = true
  25         pkinit_identity = PEM-FILE:@objdir@/user-issuer.pem
  26         pkinit_anchors = PEM-FILE:@objdir@/pkinit-anchor.pem
  27         pkinit_mappings_file = @srcdir@/pki-mapping
  28
  29         # Locate kdc plugins for testing
  30         plugin_dir =  @objdir@/../../kdc/.libs
  31
  32         # Configure kdc plugins for testing
  33         simple_csr_authorizer_directory = @objdir@/simple_csr_authz
  34
  35         enable-pkinit = true
  36         pkinit_identity = PEM-FILE:@objdir@/user-issuer.pem
  37         pkinit_anchors = PEM-FILE:@objdir@/pkinit-anchor.pem
  38         pkinit_mappings_file = @srcdir@/pki-mapping
  39         pkinit_max_life_from_cert = 5d
  40
  41         database = {
  42                 dbname = @objdir@/current-db
  43                 realm = TEST.H5L.SE
  44                 mkey_file = @objdir@/mkey.file
  45                 log_file = @objdir@/log.current-db.log
  46         }
  47
  48         negotiate_token_validator = {
  49                 keytab = FILE:@objdir@/kt
  50         }
  51
  52         realms = {
  53                 TEST.H5L.SE = {
  54                         kx509 = {
  55                                 user = {
  56                                         include_pkinit_san = true
  57                                         subject_name = CN=${principal-name-without-realm},DC=test,DC=h5l,DC=se
  58                                         ekus = 1.3.6.1.5.5.7.3.2
  59                                         ca = PEM-FILE:@objdir@/user-issuer.pem
  60                                 }
  61                                 hostbased_service = {
  62                                         HTTP = {
  63                                                 include_dnsname_san = true
  64                                                 ekus = 1.3.6.1.5.5.7.3.1
  65                                                 ca = PEM-FILE:@objdir@/server-issuer.pem
  66                                         }
  67                                 }
  68                                 client = {
  69                                         ekus = 1.3.6.1.5.5.7.3.2
  70                                         ca = PEM-FILE:@objdir@/user-issuer.pem
  71                                 }
  72                                 server = {
  73                                         ekus = 1.3.6.1.5.5.7.3.1
  74                                         ca = PEM-FILE:@objdir@/server-issuer.pem
  75                                 }
  76                                 mixed = {
  77                                         ekus = 1.3.6.1.5.5.7.3.1
  78                                         ekus = 1.3.6.1.5.5.7.3.2
  79                                         ca = PEM-FILE:@objdir@/mixed-issuer.pem
  80                                 }
  81                         }
  82                 }
  83         }
  84
  85 [hdb]
  86         db-dir = @objdir@
  87
  88 [bx509]
  89         simple_csr_authorizer_directory = @objdir@/simple_csr_authz
  90         realms = {
  91                 TEST.H5L.SE = {
  92                         # Default (no cert exts requested)
  93                         user = {
  94                                 # Use an issuer for user certs:
  95                                 ca = PEM-FILE:@objdir@/user-issuer.pem
  96                                 subject_name = CN=${principal-name-without-realm},DC=test,DC=h5l,DC=se
  97                                 ekus = 1.3.6.1.5.5.7.3.2
  98                                 include_pkinit_san = true
  99                         }
 100                         hostbased_service = {
 101                                 # Only for HTTP services
 102                                 HTTP = {
 103                                         # Use an issuer for server certs:
 104                                         ca = PEM-FILE:@objdir@/server-issuer.pem
 105                                         include_dnsname_san = true
 106                                         # Don't bother with a template
 107                                 }
 108                         }
 109                         # Non-default certs (extensions requested)
 110                         #
 111                         # Use no templates -- get empty subject names,
 112                         # use SANs.
 113                         #
 114                         # Use appropriate issuers.
 115                         client = {
 116                                 ca = PEM-FILE:@objdir@/user-issuer.pem
 117                         }
 118                         server = {
 119                                 ca = PEM-FILE:@objdir@/server-issuer.pem
 120                         }
 121                         mixed = {
 122                                 ca = PEM-FILE:@objdir@/mixed-issuer.pem
 123                         }
 124                 }
 125         }
 126
 127 [get-tgt]
 128         no_addresses = true
 129         allow_addresses = true
 130         simple_csr_authorizer_directory = @objdir@/simple_csr_authz
 131         realms = {
 132                 TEST.H5L.SE = {
 133                         # Default (no cert exts requested)
 134                         client = {
 135                                 # Use an issuer for user certs:
 136                                 ca = PEM-FILE:@objdir@/user-issuer.pem
 137                                 subject_name = CN=${principal-name-without-realm},DC=test,DC=h5l,DC=se
 138                                 ekus = 1.3.6.1.5.5.7.3.2
 139                                 include_pkinit_san = true
 140                                 allow_extra_lifetime = true
 141                                 max_cert_lifetime = 7d
 142                                 force_cert_lifetime = 2d
 143                         }
 144                         user = {
 145                                 # Use an issuer for user certs:
 146                                 ca = PEM-FILE:@objdir@/user-issuer.pem
 147                                 subject_name = CN=${principal-name-without-realm},DC=test,DC=h5l,DC=se
 148                                 ekus = 1.3.6.1.5.5.7.3.2
 149                                 include_pkinit_san = true
 150                                 allow_extra_lifetime = true
 151                                 max_cert_lifetime = 7d
 152                                 force_cert_lifetime = 2d
 153                         }
 154                         hostbased_service = {
 155                                 # Only for HTTP services
 156                                 HTTP = {
 157                                         # Use an issuer for server certs:
 158                                         ca = PEM-FILE:@objdir@/server-issuer.pem
 159                                         include_dnsname_san = true
 160                                         # Don't bother with a template
 161                                 }
 162                         }
 163                         # Non-default certs (extensions requested)
 164                         #
 165                         # Use no templates -- get empty subject names,
 166                         # use SANs.
 167                         #
 168                         # Use appropriate issuers.
 169                         client = {
 170                                 ca = PEM-FILE:@objdir@/user-issuer.pem
 171                         }
 172                         server = {
 173                                 ca = PEM-FILE:@objdir@/server-issuer.pem
 174                         }
 175                         mixed = {
 176                                 ca = PEM-FILE:@objdir@/mixed-issuer.pem
 177                         }
 178                 }
 179         }
 180
 181 [logging]
 182         kdc = 0-/FILE:@objdir@/messages.log
 183         bx509d = 0-/FILE:@objdir@/messages.log
 184         default = 0-/FILE:@objdir@/messages.log
 185
 186 [domain_realm]
 187         . = TEST.H5L.SE