s3-krb5: use and request AES keys in kerberos operations.

Guenther

diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index 1a5a71010ec47acb51e85b9885f8dc22f3d8d267..8037337d6e9bcce33575f75cb6d4bb1e08e267e8 100644 (file)
--- a/lib/krb5_wrap/krb5_samba.c
+++ b/lib/krb5_wrap/krb5_samba.c
@@ -688,6 +688,12 @@ int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx,
                ENCTYPE_ARCFOUR_HMAC,
                ENCTYPE_DES_CBC_MD5,
                ENCTYPE_DES_CBC_CRC,
+#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
+               ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+#endif
+#ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
+               ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+#endif
                ENCTYPE_NULL};
 
        initialize_krb5_error_table();

diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c
index 1093d12c2c672492226074860a24f3603e935a42..fd39394ba62dd87cd8c024ce793aa22259e4bc92 100644 (file)
--- a/source3/libads/kerberos.c
+++ b/source3/libads/kerberos.c
@@ -870,6 +870,7 @@ bool create_local_private_krb5_conf_for_domain(const char *realm,
                goto done;
        }
 
+       /* FIXME: add aes here - gd */
        file_contents = talloc_asprintf(fname,
                                        "[libdefaults]\n\tdefault_realm = %s\n"
                                        "\tdefault_tgs_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n"

diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
index eb2603b672093f64ad62112613ce3f3030cb43d4..b7df50dddf5e5fe08eb348ffb2866c5f855793cd 100644 (file)
--- a/source3/libads/kerberos_keytab.c
+++ b/source3/libads/kerberos_keytab.c
@@ -263,9 +263,15 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
        krb5_keytab keytab = NULL;
        krb5_data password;
        krb5_kvno kvno;
-        krb5_enctype enctypes[4] = {
+        krb5_enctype enctypes[6] = {
                ENCTYPE_DES_CBC_CRC,
                ENCTYPE_DES_CBC_MD5,
+#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
+               ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+#endif
+#ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
+               ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+#endif
                ENCTYPE_ARCFOUR_HMAC,
                0
        };