WIP s3: Enable IAKerb

WIP s3:gse: Implement support for IAKerb

auth:gensec: Add definitions for IAKerb

s3:gse: Send GSS_C_NO_BUFFER on the first pass

Documentation you find for gss_init_sec_context() states for
input_token:

    Specifies the token received from the context acceptor.
    GSS_C_NO_BUFFER should be specified if this is the first call to the
    gss_init_sec_context() routine.

Some of them also allow GSS_C_EMPTY_BUFFER to be passed. So better use
GSS_C_NO_BUFFER to be safe.

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>

s3:gse: Use smb_gss_mech_import_cred() in gse_init_server()

s3:gse: Pass down the mech to gse_context_init()

lib:krb5_wrap: Implement smb_gss_mech_import_cred()

s3:gse: Implement gensec_gse_security_by_oid()

auth:gensec: Rename GENSEC_GSSAPI to GENSEC_GSS_KRB5

s4:auth:gensec: Remove trailing spaces in gensec_gssapi.c

Revert "HACK source4/lib/tls/tls_tstream.c gnutls_alpn_set_protocols(GNUTLS_ALPN_MANDATORY)"

This reverts commit 15ad5fcfc2c93dd7b3f96ce32f7ad095233f4c20.

HACK source4/lib/tls/tls_tstream.c gnutls_alpn_set_protocols(GNUTLS_ALPN_MANDATORY)

Revert "HACK simulate GNUTLS_FORCE_FIPS_MODE=1"

This reverts commit f01ebfb6674ed77557617841ad5b104d3685a255.

HACK simulate GNUTLS_FORCE_FIPS_MODE=1

Revert "HACK .gitlab-ci-main.yml only MIT fedora"

This reverts commit 8268cfb12e340d7b7d572f7de0f6eb86c177ba6a.

Revert "HACK debug smb_krb5_cc_get_lifetime"

This reverts commit a495d388e6a2b25af5467f60bcb23b548cd790c1.

Revert "DEBUG python/samba/tests/krb5/test_smb.py"

This reverts commit 3e463b6d3f7bac78c83015c211422e17c441693c.

DEBUG python/samba/tests/krb5/test_smb.py

HACK debug smb_krb5_cc_get_lifetime

HACK .gitlab-ci-main.yml only MIT fedora

Revert "TODO cli_session_creds_init use_global_krb5_ccache"

This reverts commit 1e82da22c043fe960a0a2d3028fd67fdcfb4d4cc.

TODO cli_session_creds_init use_global_krb5_ccache

Revert "TODO split KERB_AP_OPTIONS_CBT"

This reverts commit a659c0807ec02ff97588c1c5cd838d39cb2f8707.

Revert "third_party/heimdal/lib/asn1/krb5.asn1 fix KRB5-AUTHDATA-KERB-LOCAL KRB5-AUTHDATA-TOKEN-RESTRICTIONS"

This reverts commit b38fa8a12c33f2e9937b3b16b56fd6ea17e632bf.

Revert "source3/librpc/crypto/gse.c authenticator-ad-types 141, 142, 143, 144"

This reverts commit 45bdf4e51a1105243e8544f415503fd260ac6eb6.

Revert "source4/auth/gensec/gensec_gssapi.c authenticator-ad-types 141, 142, 143, 144"

This reverts commit fbe7878b1149322f1f445eaaa80bb984622f69dd.

Revert "third_party/heimdal/lib/asn1/krb5.asn1 gss_set_name_attribute("ticket-authz-data")"

This reverts commit bad3caa5f38938261746f45e4e21493b400e0364.

Revert "SPLIT GENSEC_FEATURE_UNVERIFIED_TARGET_NAME"

This reverts commit c77664e055ff3fe68c3136850a97ac65b244298b.

SPLIT GENSEC_FEATURE_UNVERIFIED_TARGET_NAME

third_party/heimdal/lib/asn1/krb5.asn1 gss_set_name_attribute("ticket-authz-data")

source4/auth/gensec/gensec_gssapi.c authenticator-ad-types 141, 142, 143, 144

source3/librpc/crypto/gse.c authenticator-ad-types 141, 142, 143, 144

third_party/heimdal/lib/asn1/krb5.asn1 fix KRB5-AUTHDATA-KERB-LOCAL KRB5-AUTHDATA-TOKEN-RESTRICTIONS

TODO split KERB_AP_OPTIONS_CBT

Revert "debug dcname winbind"

This reverts commit c1bfbc7ba752d27989239e36a070e4689e0a8f7c.

Revert "debug source4/rpc_server/netlogon/dcerpc_netlogon.c dsname"

This reverts commit 3d3400c2820f59bc054d828009a017c7c77e6466.

debug source4/rpc_server/netlogon/dcerpc_netlogon.c dsname

debug dcname winbind

Revert "selftest ldaps ad_member_idmap_ad"

This reverts commit 43d1232223f8c419ff7dece8491ffc3d297596b3.

selftest ldaps ad_member_idmap_ad

source4/dsdb/repl/drepl_out_helpers.c always go via dreplsrv_out_drsuapi_send() https://bugzilla.samba.org/show_bug.cgi?id=15573

to call dreplsrv_op_pull_source_get_changes_trigger

TODO: docs-xml/smbdotconf/security/clientusedefaultkrb5ccache.xml

source3/script/tests/test_smbclient_krb5.sh STEP3

source3/script/tests/test_smbclient_krb5.sh STEP2

source3/script/tests/test_smbclient_krb5.sh STEP 1

HACK testprogs/blackbox/test_kinit.sh force fail

testprogs/blackbox/test_kinit.sh also test --use-default-krb5-ccache

sq docs-xml/build/DTD/samba.entities

sq fix python/samba/getopt.py

fix python/samba/getopt.py

TODO-SPLIT add --use-default-krb5-ccache to select the default ccache

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15018

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Revert "lib/cmdline/cmdline.c --use-krb5-ccache= needs to export KRB5CCNAME"

This reverts commit e8d407360d1ac2cf835c6321bb94e55c4a5bb150.

lib/cmdline/cmdline.c --use-krb5-ccache= needs to export KRB5CCNAME

testprogs/blackbox/test_weak_disable_ntlmssp_ldap.sh sq s3:libads: let ads_sasl_spnego_bind() really use spnego to negotiate krb5/ntlmssp

testprogs/blackbox/test_weak_disable_ntlmssp_ldap.sh better names

sq lib/addns/dnsgss.c GENSEC_UPDATE_IS_NTERROR

sq source3/utils/net_rpc.c !c->explicit_credentials => NET_FLAGS_ANONYMOUS

source3/utils/net.c cli_credentials_get_principal_obtained => c->explicit_credentials

python/samba/tests/ntlm_auth.py fix test_ntlmssp_gss_spnego_cached_creds

move ads_simple_creds up

sq remove ads_legacy_creds source3/libads/ads_proto.h

sq ads_connect_simple_anon

sq ads_connect_cldap_only

remove ads_connect_no_bind

no ADS_AUTH_CLDAP_ONLY

split cldap_only

still ok

fix ADS_AUTH_GENERATE_KRB5_CONFIG recursion

still ok

still ok

still ok

still ok

sq sq s3:net_ads: make use of ads_connect_creds() in ads_startup_int() AND ads_connect_no_bind OK!

sq ads_connect_creds => ads_connect_internal

sq ads_connect_creds ADS_AUTH_NO_BIND no asserted creds OK!

sq s3:net_ads: make use of ads_connect_creds() in ads_startup_int()

sq ads_connect_machine ok?

sq ads_connect_anon() ok?

sq ADS_AUTH_GENERATE_KRB5_CONFIG ok?

works net_offline

Revert "sq ADS_AUTH_GENERATE_KRB5_CONFIG"

This reverts commit f3ea4a5ffe4f0adaa40e1bbdb6b5b4e7657f4d09.

Revert "sq ads_connect_anon"

This reverts commit 9ce6bdc773e1eaeb8983a6a5917a33f13dd6f3c6.

Revert "SQ??? ads_connect_creds allow NO/ANON_BIND upgrades"

This reverts commit 18064b62abe554ce08fd0e0ceed4cb0ff9a04a3e.

Revert "sq ads_connect_anon"

This reverts commit 8c81208038c88e7520d5a412b2bb89314405893a.

Revert "sq ads_connect_no_bind"

This reverts commit 080a38b93460e7930464ced893a5736cd2555a1a.

Revert "sq ads_connect_machine"

This reverts commit 232539c59ebf72d5671e13da0b340588bc7043b9.

sq ads_connect_machine

sq ads_connect_no_bind

sq ads_connect_anon

SQ??? ads_connect_creds allow NO/ANON_BIND upgrades

sq ads_connect_anon

sq ADS_AUTH_GENERATE_KRB5_CONFIG

SPLIT require explicit ccache

SPLIT??? kerberos_set_password ads_krb5_set_password no implicit ccache

s3:libsmb: fix lpcfg_gensec_settings() no memory check in auth_generic_client_prepare()

Signed-off-by: Stefan Metzmacher <metze@samba.org>

DoDNSUpdateNegotiateGensec GENSEC_FEATURE_SIGN why crash???

blackbox/test_kinit.sh: verify that --use-krb5-ccache= works without KRB5CCNAME

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:net: finally remove net_context->opt_{user_specified,user_name,password}

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:net_ads: use cli_credentials_get_principal() in order to call kerberos functions

This is better than the value from cli_credentials_get_username()...

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:net: remove useless net_prompt_pass() wrapper

Signed-off-by: Stefan Metzmacher <metze@samba.org>