sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-03 13:47:25 +03:00
Code

s4:kdc: Remove device PAC validation

Browse Source 
In the first place, this check was only applicable to the Heimdal KDC,
the MIT KDC not having support for compounded authentication. Secondly,
it was redundant, because _kdc_fast_check_armor_pac() would have already
been called to verify the armor ticket; a second round of validation
achieved nothing. And finally, the check was flawed: it checked only
*explicitly* armored PACs, and so would have done nothing for an armored
*AS‐REQ*.

In short, this check was useless; remove it.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Joseph Sutton 2023-09-29 12:44:08 +13:00 committed by Joseph Sutton
parent 989fb00985
commit 3358b04a58
1 changed files with 0 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
source4/kdc/pac-glue.c
View File

@ -2125,21 +2125,6 @@ krb5_error_code samba_kdc_verify_pac(TALLOC_CTX *mem_ctx,
}
}
if (device != NULL) {
SMB_ASSERT(*device_pac != NULL);
/*
* Check the objectSID of the device and pac data are the same.
* Does a parse and SID check, but no crypto.
*/
code = samba_kdc_validate_pac_blob(context,
device,
*device_pac);
if (code != 0) {
goto done;
}
}
if (!is_trusted) {
const struct auth_user_info_dc *user_info_dc = NULL;
WERROR werr;