Difference between revisions of "Projects/Samba4 Port"

Revision as of 09:54, 31 August 2009

Introduction

Samba4 aims to provide a complete OSS replacement for Active Directory. Samba4, like earlier versions of Samba, uses Heimdal Kerberos. The Samba4 Port project proposes to enable Samba4 to use MIT kerberos as an alternative. The near-term goal is that mixed krb5+AD deployments could use Samba4 to provide better interoperation between AD realms and MIT-krb5 realms.

Use case: For example, suppose a kerberos customer is deploying a network with mixed operating systems using kerberos and would want to use one KDC for all of them. In this case, a single MIT Kerberos deployment should be able to support both traditonal UNIX clients and servers, intermixed with Windows clients and Samba servers:

1. The Windows clients should be able to use the MIT KDC(s) as AD servers, so as to authenticate themselves to Samba file-servers and to Windows servers;
2. A Windows client's tickets will carry PACs, as usual for AD;
3. The UNIX clients should be able to access the KDC as a traditional non-AD-style KDC, so as to access UNIX services securely;
4. A UNIX client's ticket will not carry a PAC, except when the UNIX client accesses a Windows server.

The Samba4 team, the MIT Krb Consortium, RedHat, Ubuntu, and Sun all have shown some interest in this Samba4 Port project.

Key to the asterisks in the Table of Contents

1. No asterisks: Work that needs to be done.
2. *: Some work to be done, some already done.
3. **: Nothing much to do.
4. ***: Can be done later, if at all.

Concise to-do list

This is a condensed version of the task-list offered by Samba4's Andrew Bartlett, containing only what hasn't yet been done already by MIT.

The two big chunks of work are LDAP Driver and Replacing / improving MIT's DAL, but the DAL work may not be needed.

Replace the MIT KDC's LDAP driver

Samba4's LDAP driver for the MIT KDB needs to know how to do AD's intricate naming:

1. Canonicalization of server names, user-names, and realm names. MIT 1.7 already supports canonicalization.
2. AD-style aliases for HOST/ service names.
3. Implicit names for Win2k accounts.
4. Principal "types": client / server / krbtgs
5. Flexible server-naming
6. Keytabs & name-canonicalization

Most or all of Heimdal's LDAP driver code is in three Samba4 source files, ~1000 lines in all.

Small changes

Of the things on this list, only NTLM support is needed for the Samba4 KDC port. The other tasks are all application-library stuff, and arguably aren't needed at all, because Samba3 already works well with MIT application libraries.

1. MIT library changes
2. Samba4/AD libraries: NTLM support
3. Key-handling changes
4. Extra Krb library functions
5. Error-handling, logging, testing

Use 1.7's AD-support features

This stuff should already just work:

1. PAC handling;
2. AD-style name canonicalization;
3. NT-ENTERPRISE names, which carry two realms-suffixes;
4. CHECK_POLICY/AUDIT methods (needed for TGS access-control);
5. DCE_STYLE Challenge/Response handshakes: see Krb lib & GSSAPI.
6. Accept legacy Samba3 clients' bad GSSAPI checksums;
7. Principal-manipulation functions;
8. State-machine safety;

Controversial proposed changes for the port

Maybe: Improve or replace MIT's DAL

Rewrite the MIT KDC's Data-Abstraction Layer (DAL), mostly because the MIT KDC needs to see & manipulate more LDAP detail, on Samba4's behalf;

** Maybe not: Add a KDC-as-library API

Samba4 currently runs as a single process, and Samba4 invokes the Heimdal KDC via a libkdc interface (KDC as library).

1. Andrew Bartlett says this libkdc interface is "nice to have", but not essential.
2. Tom Yu says adding a libkdc interface to MIT's code would be a lot of work, but would tie naturally into code-cleanup work that MIT wants to do, anyway.
3. If we build a libkdc interface for MIT's KDC, Samba4 will need the KDC to use Samba's socket library correctly.

*** Later: TGS access-control

MIT krb will need to support these AD features, once Samba4 does. Alternatively, this could be seen as an opportunity for MIT-based Samba4 to surpass Heimdal-based Samba.

1. Add HBAC to the TGS, so that Samba4 can refuse TGTs to kinit, based on time-of-day & IP-addr constraints;
   1. DTD: This is natural; the TGS should enforce its own access-control, as all other services do.
   2. TGS-HBAC is part of the rationale for rewriting the DAL.
2. Failed-kinit counts: Add a KDC heuristic for tracking intervals between kinits, so that Samba4 can enforce AD's unified account-lockout on kinit. Samba4 already does lockouts for other PW-based authentication methods (NTLM, LDAP simple bind, etc).

Samba's use of Heimdal symbols, with MIT differences

This table shows the 253 Heimdal symbols that Samba4 uses.

Definition summary:

1. 125 of these 265 Heimdal symbols are more-or-less compatible with the corresponding MIT-krb versions having the same names.
2. 111 of the 265 symbols don't appear in the MIT-krb source-tree.
3. 25 of the 265 symbols have conflicting definitions in Heimdal & MIT-krb.
4. 3 of the 265 symbols are MIT-krb names that Samba3 also uses.
5. 1 of the 265 symbols doesn't appear in the Heimdal tree, but is a Samba3 kerberos-related name.

Samba Usage summary

1. 179 of the 265 symbols get used in Samba4's auth subtree.
2. 75 of the 265 symbols get used in Samba4's kdc subtree.
3. 25 of the 265 symbols get used in other Samba subtrees.

Together, these 3 figures exceed 265, because many Heimdal symbols get used in more than one Samba4 subtree.

Porting summary:

• "different" functions and struct-layouts are the biggest obstacles to the MIT port;
• "not MIT" isn't so straightforward as just porting or rewriting these functions, because MIT may have a similar (but hard-to-find) function with a different name;
• "not Heimdal" symbols should continue working for Samba4, insofar as they've worked before now;
• "same" & "same, almost" ought to be easiest, we hope.

Key to the table's "Similarity" column:

• same, almost: Structs are near-identical; functions have the same arguments and similar implementations.
• same: Structs are identical. None of these Heimdal functions are identical to MIT's versions.
• different: Structs have different layouts, functions have different parameters and / or behavior.
• not MIT: MIT's kerberos-tree lacks the symbol.
• not Heimdal: Heimdal has a function-prototype, but no function definition. Some of these appear in the Samba3 tree.

Please note:

• This table has 5 columns and 265 rows, and works best if you maximize your screen;
• You can click any column's header, to sort the rows by that column's field-contents.