sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

auth: Allow a NULL principal to be obtained from the credentials

Browse Source 
This is important when trying to let GSSAPI search the keytab.

Andrew Bartlett
This commit is contained in:
Andrew Bartlett 2011-12-06 15:56:44 +11:00 committed by Amitay Isaacs
parent b9f4febd40
commit 0344e7278b
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
source4/auth/gensec/gensec_krb5.c
View File

@ -521,7 +521,10 @@ static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security,
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
}
/* This ensures we lookup the correct entry in that keytab */
/* This ensures we lookup the correct entry in that
* keytab. A NULL principal is acceptable, and means
* that the krb5 libs should search the keytab at
* accept time for any matching key */
ret = principal_from_credentials(out_mem_ctx, gensec_get_credentials(gensec_security),
gensec_krb5_state->smb_krb5_context,
&server_in_keytab, &obtained, &error_string);

12
source4/auth/kerberos/kerberos_util.c
View File

@ -293,14 +293,16 @@ krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
krb5_error_code ret;
const char *princ_string;
TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
*obtained = CRED_UNINITIALISED;
if (!mem_ctx) {
(*error_string) = error_message(ENOMEM);
return ENOMEM;
}
princ_string = cli_credentials_get_principal_and_obtained(credentials, mem_ctx, obtained);
if (!princ_string) {
(*error_string) = error_message(ENOMEM);
return ENOMEM;
*princ = NULL;
return 0;
}
ret = parse_principal(parent_ctx, princ_string,
@ -359,6 +361,12 @@ krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
return ret;
}
if (princ == NULL) {
(*error_string) = talloc_asprintf(credentials, "principal, username or realm was not specified in the credentials");
talloc_free(mem_ctx);
return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
}
ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string);
if (ret) {
talloc_free(mem_ctx);