191d528d94
In addition, deprecate krb5-116 to retire one year after the release
of krb5-118: Feb 12, 2021.
Major changes in 1.18 (2020-02-12)
==================================
Administrator experience:
* Remove support for single-DES encryption types.
* Change the replay cache format to be more efficient and robust.
Replay cache filenames using the new format end with ".rcache2" by
default.
* setuid programs will automatically ignore environment variables that
normally affect krb5 API functions, even if the caller does not use
krb5_init_secure_context().
* Add an "enforce_ok_as_delegate" krb5.conf relation to disable
credential forwarding during GSSAPI authentication unless the KDC
sets the ok-as-delegate bit in the service ticket.
* Use the permitted_enctypes krb5.conf setting as the default value
for default_tkt_enctypes and default_tgs_enctypes.
Developer experience:
* Implement krb5_cc_remove_cred() for all credential cache types.
* Add the krb5_pac_get_client_info() API to get the client account
name from a PAC.
Protocol evolution:
* Add KDC support for S4U2Self requests where the user is identified
by X.509 certificate. (Requires support for certificate lookup from
a third-party KDB module.)
* Remove support for an old ("draft 9") variant of PKINIT.
* Add support for Microsoft NegoEx. (Requires one or more third-party
GSS modules implementing NegoEx mechanisms.)
* Honor the transited-policy-checked ticket flag on application
servers, eliminating the requirement to configure capaths on
servers in some scenarios.
User experience:
* Add support for "dns_canonicalize_hostname=fallback""`, causing
host-based principal names to be tried first without DNS
canonicalization, and again with DNS canonicalization if the
un-canonicalized server is not found.
* Expand single-component hostnames in host-based principal names when
DNS canonicalization is not used, adding the system's first DNS
search path as a suffix. Add a "qualify_shortname" krb5.conf
relation to override this suffix or disable expansion.
Code quality:
* The libkrb5 serialization code (used to export and import krb5 GSS
security contexts) has been simplified and made type-safe.
* The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
messages has been revised to conform to current coding practices.
* The test suite has been modified to work with macOS System Integrity
Protection enabled.
* The test suite incorporates soft-pkcs11 so that PKINIT PKCS11
support can always be tested.
27 lines
964 B
Text
27 lines
964 B
Text
--- config/pre.in.orig 2018-05-03 07:34:47.000000000 -0700
|
|
+++ config/pre.in 2018-07-01 20:36:56.770685000 -0700
|
|
@@ -181,9 +181,9 @@
|
|
INSTALL=@INSTALL@
|
|
INSTALL_STRIP=
|
|
INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
|
|
-INSTALL_SCRIPT=@INSTALL_PROGRAM@
|
|
+INSTALL_SCRIPT=@INSTALL_SCRIPT@
|
|
INSTALL_DATA=@INSTALL_DATA@
|
|
-INSTALL_SHLIB=@INSTALL_SHLIB@
|
|
+INSTALL_SHLIB=$(INSTALL_LIB)
|
|
INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
|
|
## This is needed because autoconf will sometimes define @exec_prefix@ to be
|
|
## ${prefix}.
|
|
@@ -200,10 +200,11 @@
|
|
ADMIN_BINDIR = @sbindir@
|
|
SERVER_BINDIR = @sbindir@
|
|
CLIENT_BINDIR =@bindir@
|
|
-PKGCONFIG_DIR = @libdir@/pkgconfig
|
|
+PKGCONFIG_DIR = $(prefix)/libdata/pkgconfig
|
|
ADMIN_MANDIR = $(KRB5MANROOT)/man8
|
|
SERVER_MANDIR = $(KRB5MANROOT)/man8
|
|
CLIENT_MANDIR = $(KRB5MANROOT)/man1
|
|
+SUBR_MANDIR = $(KRB5MANROOT)/man3
|
|
FILE_MANDIR = $(KRB5MANROOT)/man5
|
|
ADMIN_CATDIR = $(KRB5MANROOT)/cat8
|
|
SERVER_CATDIR = $(KRB5MANROOT)/cat8
|