Roadmap MIT KDC: Difference between revisions

From SambaWiki
(Mark PKINIT as WIP)
(10 intermediate revisions by the same user not shown)
Line 1: Line 1:
= Samba AD with MIT KDC=
= Samba AD with MIT KDC=


This page lists tasks which need to be done to bring the MIT KDC support for Samba AP on the same functional level as we have with Heimdal. We need help to implement those features. Let us know if you want to pick up a talk, the Samba team is not actively working on those!
This page lists tasks which need to be done to bring the MIT KDC support for Samba AP on the same functional level as we have with Heimdal. We need help to implement those features. Let us know if you want to pick up a task, the Samba Team is not actively working on those!


== TODO ==
== TODO ==


* ([https://github.com/krb5/krb5/pull/1225 WIP]) Service for User to Self-service (S4U2self)
* Implement KDC-canon tests for MIT KDC -> source4/torture/krb5/kdc-canon-heimdal.c
* ([https://github.com/krb5/krb5/pull/1225 WIP]) Service for User to Proxy (S4U2proxy)
* Support for S4U2Self
* ([https://github.com/krb5/krb5/pull/1225 WIP]) Resource based constrained delegation
* Support for S4U2Proxy
* ([https://github.com/krb5/krb5/pull/1236 WIP]) PKINIT support required for using smart cards (tests are needed)
* Add tests for PKINIT support
* Add auth logging support ([https://git.samba.org/?p=asn/samba.git;a=shortlog;h=refs/heads/master-mit-kdc-ok WIP branch])
* Add auth logging support ([https://git.samba.org/?p=asn/samba.git;a=shortlog;h=refs/heads/master-mit-kdc-auditlog WIP branch])
* Allow starting the MIT KDC with multiple worker processes (<code>-w numworkers</code>)
* Computer GPO's are not applied, see [https://bugzilla.samba.org/show_bug.cgi?id=13516 Bug 13516]
* Define API for a libkdc in MIT Kerberos
* Define API for a libkdc in MIT Kerberos
* Running as a Read only domain controller (RODC)
* RODC support

Revision as of 13:48, 20 January 2022

Samba AD with MIT KDC

This page lists tasks which need to be done to bring the MIT KDC support for Samba AP on the same functional level as we have with Heimdal. We need help to implement those features. Let us know if you want to pick up a task, the Samba Team is not actively working on those!

TODO

  • (WIP) Service for User to Self-service (S4U2self)
  • (WIP) Service for User to Proxy (S4U2proxy)
  • (WIP) Resource based constrained delegation
  • (WIP) PKINIT support required for using smart cards (tests are needed)
  • Add auth logging support (WIP branch)
  • Allow starting the MIT KDC with multiple worker processes (-w numworkers)
  • Computer GPO's are not applied, see Bug 13516
  • Define API for a libkdc in MIT Kerberos
  • Running as a Read only domain controller (RODC)