sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-08 05:57:51 +03:00
Code

s3:libads/kerberos: always use the canonicalized principal after kinit

Browse Source 
We should always use krb5_get_init_creds_opt_set_canonicalize()
and krb5_get_init_creds_opt_set_win2k() for heimdal
and expect the client principal to be changed.

There's no reason to have a different logic between MIT and Heimdal.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14124

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 0bced73bed481a8846a6b3e68be85941914390ba)
This commit is contained in:
Stefan Metzmacher 2019-09-13 16:04:30 +02:00 committed by Karolin Seeger
parent aeaffacb9c
commit 03477632b6
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
source3/libads/kerberos.c
View File

@ -167,7 +167,10 @@ int kerberos_kinit_password_ext(const char *given_principal,
krb5_get_init_creds_opt_set_forwardable(opt, True);
/* Turn on canonicalization for lower case realm support */
#ifndef SAMBA4_USES_HEIMDAL /* MIT */
#ifdef SAMBA4_USES_HEIMDAL
krb5_get_init_creds_opt_set_win2k(ctx, opt, true);
krb5_get_init_creds_opt_set_canonicalize(ctx, opt, true);
#else /* MIT */
krb5_get_init_creds_opt_set_canonicalize(opt, true);
#endif /* MIT */
#if 0
@ -196,11 +199,7 @@ int kerberos_kinit_password_ext(const char *given_principal,
goto out;
}
#ifndef SAMBA4_USES_HEIMDAL /* MIT */
canon_princ = my_creds.client;
#else
canon_princ = me;
#endif /* MIT */
code = smb_krb5_unparse_name(frame,
ctx,