sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

mit-kdb: Do not allow to get a kadmin ticket as a client.

Browse Source 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Andreas Schneider 2014-08-06 15:32:13 +02:00 committed by Andrew Bartlett
parent e13e9c54f5
commit 742b4c3da8
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source4/kdc/mit-kdb/kdb_samba_policies.c
View File

@ -90,6 +90,10 @@ krb5_error_code kdb_samba_db_check_policy_as(krb5_context context,
return KRB5_KDB_DBNOTINITED; return KRB5_KDB_DBNOTINITED;
} }
if (ks_is_kadmin(context, kdcreq->client)) {
return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
}
if (krb5_princ_size(context, kdcreq->server) == 2 && if (krb5_princ_size(context, kdcreq->server) == 2 &&
ks_is_kadmin_changepw(context, kdcreq->server)) { ks_is_kadmin_changepw(context, kdcreq->server)) {
code = krb5_get_default_realm(context, &realm); code = krb5_get_default_realm(context, &realm);