Module Name:	krb5
Committed By:	jaltman
Date:		Fri Dec 12 22:22:36 UTC 2003

Modified Files:
	 krb5/src/lib/ChangeLog krb5/src/lib/Makefile.in
		krb5/src/lib/krb5/ccache/ChangeLog
		krb5/src/lib/krb5/ccache/Makefile.in
		krb5/src/lib/krb5/ccache/ccbase.c
		krb5/src/lib/krb5/error_tables/ChangeLog
		krb5/src/lib/krb5/error_tables/krb5_err.et
		krb5/src/windows/ms2mit/ChangeLog
		krb5/src/windows/ms2mit/Makefile.in
		krb5/src/windows/ms2mit/ms2mit.c
Added Files:
	 krb5/src/lib/krb5/ccache/cc_mslsa.c
Removed Files:


Log Message
ticket: 2049
target_version: 1.3.2
tags: pullup

 * Added new krb5_ccache type "MSLSA" for Windows only.
   This new ccache type provides an interface for the MIT krb5_cc api
   functions to be used to access the contents of the MS Kerberos LSA
   cache.  The ccache type is read-only because the MS Kerberos LSA
   does not allow third party applications to insert credentials into
   the cache.

   The primary motivation of this work was to encapsulate the complex
   operations necessary to manipulate the MS Kerberos LSA.  The code
   was far from trivial and was often implemented incorrectly.  Worse
   still was the fact that each version of Windows since W2K modified
   the use of the LSA API.

   The code which was originally donated in the form of ms2mit.c had
   many memory and handle leaks which were acceptable for a one time
   application such as ms2mit.c. Unfortunately, this code has started
   to appear in many other applications: KfW's Leash, the AFS Wake
   systray tool, and others.

   By using the new MSLSA ccache the implementation of ms2mit.c went
   from 890 lines to 50 lines of code and comments.  All that is necessary
   is for the MSLSA ccache to be resolved and for its contents to be
   copied with krb5_cc_copy_creds to the default ccache.

   The MSLSA ccache implements all of the functions of a ccache except
   those which would be used to store data into the ccache.  When a
   write attempt is performed the new error KRB5_CC_READONLY is returned.

   The residual portion of the MSLSA ccache name is current ignored
   but preserved.  If you ask for ccache "MSLSA:myname" you will be
   given access to the LSA cache for the current Logon Session.  If
   you later ask for the name of the ccache you will be returned the
   same name.  In the future, the residual might be used to provide
   information necessary to identify a specific logon session whose
   cache it is desired to access.  If this is ever done, the applications
   which use it will have to possess the SeTcbPrivilege privilege.

   Using KfW's Leash it is now possible to set the Krb5 credential
   cache to "MSLSA:" and use it to monitor the contents of the
   MS Kerberos LSA cache.

   As part of adding this functionality, krb5_32.dll is not linked
   against the "secur32.lib" library as the Lsa security sdk routines
   are stored in the SECUR32.DLL file.


To generate a diff of this commit:
	cvs diff -r1.127 -r1.128 krb5/src/lib/ChangeLog
	cvs diff -r1.77 -r1.78 krb5/src/lib/Makefile.in
	cvs diff -r5.86 -r5.87 krb5/src/lib/krb5/ccache/ChangeLog
	cvs diff -r1.53 -r1.54 krb5/src/lib/krb5/ccache/Makefile.in
	cvs diff -r5.21 -r5.22 krb5/src/lib/krb5/ccache/ccbase.c
	cvs diff -r5.95 -r5.96 krb5/src/lib/krb5/error_tables/ChangeLog
	cvs diff -r5.73 -r5.74 krb5/src/lib/krb5/error_tables/krb5_err.et
	cvs diff -r1.6 -r1.7 krb5/src/windows/ms2mit/ChangeLog
	cvs diff -r1.3 -r1.4 krb5/src/windows/ms2mit/Makefile.in
	cvs diff -r1.5 -r1.6 krb5/src/windows/ms2mit/ms2mit.c
	cvs diff -r0 -r5.1 krb5/src/lib/krb5/ccache/cc_mslsa.c