1[libdefaults] 2 default_realm = TEST.H5L.SE TEST2.H5L.SE 3 no-addresses = TRUE 4 allow_weak_crypto = @WEAK@ 5 dns_lookup_kdc = no 6 dns_lookup_realm = no 7 8 9[appdefaults] 10 pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt 11 reconnect-min = 2s 12 reconnect-backoff = 2s 13 reconnect-max = 10s 14 15[realms] 16 TEST.H5L.SE = { 17 kdc = localhost:@port@ 18 admin_server = localhost:@admport@ 19 kpasswd_server = localhost:@pwport@ 20 } 21 SUB.TEST.H5L.SE = { 22 kdc = localhost:@port@ 23 } 24 TEST2.H5L.SE = { 25 kdc = localhost:@port@ 26 kpasswd_server = localhost:@pwport@ 27 } 28 TEST3.H5L.SE = { 29 kdc = localhost:@port@ 30 } 31 TEST4.H5L.SE = { 32 kdc = localhost:@port@ 33 } 34 SOME-REALM5.FR = { 35 kdc = localhost:@port@ 36 } 37 SOME-REALM6.US = { 38 kdc = localhost:@port@ 39 } 40 SOME-REALM7.UK = { 41 kdc = localhost:@port@ 42 } 43 SOME-REALM8.UK = { 44 kdc = localhost:@port@ 45 } 46 TEST-HTTP.H5L.SE = { 47 kdc = http/localhost:@port@ 48 } 49 H1.TEST.H5L.SE = { 50 kdc = localhost:@port@ 51 } 52 H2.TEST.H5L.SE = { 53 kdc = localhost:@port@ 54 } 55 H3.H2.TEST.H5L.SE = { 56 kdc = localhost:@port@ 57 } 58 H4.H2.TEST.H5L.SE = { 59 kdc = localhost:@port@ 60 } 61 62[domain_realm] 63 .test.h5l.se = TEST.H5L.SE 64 .sub.test.h5l.se = SUB.TEST.H5L.SE 65 .h1.test.h5l.se = H1.TEST.H5L.SE 66 .h2.test.h5l.se = H2.TEST.H5L.SE 67 .h3.h2.test.h5l.se = H3.H2.TEST.H5L.SE 68 .h4.h2.test.h5l.se = H4.H2.TEST.H5L.SE 69 .example.com = TEST2.H5L.SE 70 localhost = TEST.H5L.SE 71 .localdomain = TEST.H5L.SE 72 localdomain = TEST.H5L.SE 73 .localdomain6 = TEST.H5L.SE 74 localdomain6 = TEST.H5L.SE 75 76 77[kdc] 78 enable-digest = true 79 allow-anonymous = true 80 digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2 81 strict-nametypes = true 82 83 enable-http = true 84 85 enable-pkinit = true 86 pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key 87 pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt 88 pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt 89# pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl 90 pkinit_mappings_file = @srcdir@/pki-mapping 91 pkinit_allow_proxy_certificate = true 92 93 database = { 94 label = { 95 dbname = @db_type@:@objdir@/current-db@kdc@ 96 realm = TEST.H5L.SE 97 mkey_file = @objdir@/mkey.file 98 acl_file = @srcdir@/heimdal.acl 99 log_file = @objdir@/current@kdc@.log 100 } 101 label2 = { 102 dbname = @db_type@:@objdir@/current-db@kdc@ 103 realm = TEST2.H5L.SE 104 mkey_file = @objdir@/mkey.file 105 acl_file = @srcdir@/heimdal.acl 106 log_file = @objdir@/current@kdc@.log 107 } 108 label3 = { 109 dbname = sqlite:@objdir@/current-db@kdc@.sqlite3 110 realm = SOME-REALM5.FR 111 mkey_file = @objdir@/mkey.file 112 acl_file = @srcdir@/heimdal.acl 113 log_file = @objdir@/current@kdc@.log 114 } 115 } 116 117 signal_socket = @objdir@/signal 118 iprop-stats = @objdir@/iprop-stats 119 iprop-acl = @srcdir@/iprop-acl 120 log-max-size = 40000 121 122[hdb] 123 db-dir = @objdir@ 124 125[logging] 126 kdc = 0-/FILE:@objdir@/messages.log 127 krb5 = 0-/FILE:@objdir@/messages.log 128 default = 0-/FILE:@objdir@/messages.log 129 130# If you are doing preformance measurements on OSX you want to change 131# the kdc LOG line from = to - below to keep the FILE open and avoid 132# open/write/close which is blocking (rdar:// ) on OSX. 133# kdc = 0-/FILE=@objdir@/messages.log 134 135[kadmin] 136 save-password = true 137 default_key_rules = { 138 */des3-only@* = des3-cbc-sha1:pw-salt 139 */aes-only@* = aes256-cts-hmac-sha1-96:pw-salt 140 } 141 @dk@ 142 143[capaths] 144 TEST.H5L.SE = { 145 TEST2.H5L.SE = . 146 SOME-REALM5.FR = 1 147 TEST3.H5L.SE = TEST2.H5L.SE 148 TEST4.H5L.SE = TEST2.H5L.SE 149 TEST4.H5L.SE = TEST3.H5L.SE 150 SOME-REALM6.US = SOME-REALM5.FR 151 SOME-REALM7.UK = SOME-REALM6.US 152 SOME-REALM7.UK = SOME-REALM5.FR 153 SOME-REALM8.UK = SOME-REALM6.US 154 } 155 H4.H2.TEST.H5L.SE = { 156 H1.TEST.H5L.SE = H3.H2.TEST.H5L.SE 157 H1.TEST.H5L.SE = H2.TEST.H5L.SE 158 H1.TEST.H5L.SE = TEST.H5L.SE 159 160 TEST.H5L.SE = H3.H2.TEST.H5L.SE 161 TEST.H5L.SE = H2.TEST.H5L.SE 162 163 H2.TEST.H5L.SE = H3.H2.TEST.H5L.SE 164 } 165