1[libdefaults]
2          default_realm = TEST.H5L.SE TEST2.H5L.SE
3          no-addresses = TRUE
4          allow_weak_crypto = @WEAK@
5          dns_lookup_kdc = no
6          dns_lookup_realm = no
7
8
9[appdefaults]
10          pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
11          reconnect-min = 2s
12          reconnect-backoff = 2s
13          reconnect-max = 10s
14
15[realms]
16          TEST.H5L.SE = {
17                    kdc = localhost:@port@
18                    admin_server = localhost:@admport@
19                    kpasswd_server = localhost:@pwport@
20          }
21          SUB.TEST.H5L.SE = {
22                    kdc = localhost:@port@
23          }
24          TEST2.H5L.SE = {
25                    kdc = localhost:@port@
26                    kpasswd_server = localhost:@pwport@
27          }
28          TEST3.H5L.SE = {
29                    kdc = localhost:@port@
30          }
31          TEST4.H5L.SE = {
32                    kdc = localhost:@port@
33          }
34          SOME-REALM5.FR = {
35                    kdc = localhost:@port@
36          }
37          SOME-REALM6.US = {
38                    kdc = localhost:@port@
39          }
40          SOME-REALM7.UK = {
41                    kdc = localhost:@port@
42          }
43          SOME-REALM8.UK = {
44                    kdc = localhost:@port@
45          }
46          TEST-HTTP.H5L.SE = {
47                    kdc = http/localhost:@port@
48          }
49          H1.TEST.H5L.SE = {
50                    kdc = localhost:@port@
51          }
52          H2.TEST.H5L.SE = {
53                    kdc = localhost:@port@
54          }
55          H3.H2.TEST.H5L.SE = {
56                    kdc = localhost:@port@
57          }
58          H4.H2.TEST.H5L.SE = {
59                    kdc = localhost:@port@
60          }
61
62[domain_realm]
63          .test.h5l.se = TEST.H5L.SE
64          .sub.test.h5l.se = SUB.TEST.H5L.SE
65          .h1.test.h5l.se = H1.TEST.H5L.SE
66          .h2.test.h5l.se = H2.TEST.H5L.SE
67          .h3.h2.test.h5l.se = H3.H2.TEST.H5L.SE
68          .h4.h2.test.h5l.se = H4.H2.TEST.H5L.SE
69          .example.com = TEST2.H5L.SE
70          localhost = TEST.H5L.SE
71          .localdomain = TEST.H5L.SE
72          localdomain = TEST.H5L.SE
73          .localdomain6 = TEST.H5L.SE
74          localdomain6 = TEST.H5L.SE
75
76
77[kdc]
78          enable-digest = true
79          allow-anonymous = true
80          digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2
81        strict-nametypes = true
82
83          enable-http = true
84
85          enable-pkinit = true
86          pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key
87          pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
88          pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt
89#         pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl
90          pkinit_mappings_file = @srcdir@/pki-mapping
91          pkinit_allow_proxy_certificate = true
92
93          database = {
94                    label = {
95                              dbname = @db_type@:@objdir@/current-db@kdc@
96                              realm = TEST.H5L.SE
97                              mkey_file = @objdir@/mkey.file
98                              acl_file = @srcdir@/heimdal.acl
99                              log_file = @objdir@/current@kdc@.log
100                    }
101                    label2 = {
102                              dbname = @db_type@:@objdir@/current-db@kdc@
103                              realm = TEST2.H5L.SE
104                              mkey_file = @objdir@/mkey.file
105                              acl_file = @srcdir@/heimdal.acl
106                              log_file = @objdir@/current@kdc@.log
107                    }
108                    label3 = {
109                              dbname = sqlite:@objdir@/current-db@kdc@.sqlite3
110                              realm = SOME-REALM5.FR
111                              mkey_file = @objdir@/mkey.file
112                              acl_file = @srcdir@/heimdal.acl
113                              log_file = @objdir@/current@kdc@.log
114                    }
115          }
116
117          signal_socket = @objdir@/signal
118          iprop-stats = @objdir@/iprop-stats
119          iprop-acl = @srcdir@/iprop-acl
120        log-max-size = 40000
121
122[hdb]
123          db-dir = @objdir@
124
125[logging]
126          kdc = 0-/FILE:@objdir@/messages.log
127          krb5 = 0-/FILE:@objdir@/messages.log
128          default = 0-/FILE:@objdir@/messages.log
129
130# If you are doing preformance measurements on OSX you want to change
131# the kdc LOG line from = to - below to keep the FILE open and avoid
132# open/write/close which is blocking (rdar:// ) on OSX.
133#         kdc = 0-/FILE=@objdir@/messages.log
134
135[kadmin]
136          save-password = true
137          default_key_rules = {
138                    */des3-only@* = des3-cbc-sha1:pw-salt
139                    */aes-only@* = aes256-cts-hmac-sha1-96:pw-salt
140          }
141          @dk@
142
143[capaths]
144          TEST.H5L.SE = {
145                    TEST2.H5L.SE = .
146                    SOME-REALM5.FR = 1
147                    TEST3.H5L.SE = TEST2.H5L.SE
148                    TEST4.H5L.SE = TEST2.H5L.SE
149                    TEST4.H5L.SE = TEST3.H5L.SE
150                    SOME-REALM6.US = SOME-REALM5.FR
151                    SOME-REALM7.UK = SOME-REALM6.US
152                    SOME-REALM7.UK = SOME-REALM5.FR
153                    SOME-REALM8.UK = SOME-REALM6.US
154          }
155        H4.H2.TEST.H5L.SE = {
156                H1.TEST.H5L.SE = H3.H2.TEST.H5L.SE
157                H1.TEST.H5L.SE = H2.TEST.H5L.SE
158                H1.TEST.H5L.SE = TEST.H5L.SE
159
160                TEST.H5L.SE = H3.H2.TEST.H5L.SE
161                TEST.H5L.SE = H2.TEST.H5L.SE
162
163                H2.TEST.H5L.SE = H3.H2.TEST.H5L.SE
164        }
165