sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-12 09:18:10 +03:00
Code

r10907: Handle the case when we can't verify the PAC signature because the

Browse Source 
ticket was encrypted using a DES key (and the Windows KDC still puts
CKSUMTYPE_HMAC_MD5_ARCFOUR in the PAC).

In that case, return to old behaviour and ignore the PAC.

Thanks to Chengjie Liu <chengjie.liu@datadomain.com>.

Guenther
(This used to be commit 48d8a9dd9f)
This commit is contained in:
Günther Deschner 2005-10-11 16:27:05 +00:00 committed by Gerald (Jerry) Carter
parent 47e297bc8d
commit 879eb0933e
2 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
source3/libads/kerberos_verify.c
View File

@ -272,6 +272,7 @@ NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
DATA_BLOB *session_key)
{
NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
NTSTATUS pac_ret;
DATA_BLOB auth_data;
krb5_context context = NULL;
krb5_auth_context auth_context = NULL;
@ -400,7 +401,8 @@ NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
#endif
/* continue when no PAC is retrieved
(like accounts that have the UF_NO_AUTH_DATA_REQUIRED flag set) */
(like accounts that have the UF_NO_AUTH_DATA_REQUIRED flag set,
or Kerberos tickets encryped using a DES key) - Guenther */
got_auth_data = get_auth_data_from_tkt(mem_ctx, &auth_data, tkt);
if (!got_auth_data) {
@ -409,10 +411,10 @@ NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
if (got_auth_data && pac_data != NULL) {
sret = decode_pac_data(mem_ctx, &auth_data, context, keyblock, client_principal, authtime, pac_data);
if (!NT_STATUS_IS_OK(sret)) {
DEBUG(0,("ads_verify_ticket: failed to decode PAC_DATA: %s\n", nt_errstr(sret)));
goto out;
pac_ret = decode_pac_data(mem_ctx, &auth_data, context, keyblock, client_principal, authtime, pac_data);
if (!NT_STATUS_IS_OK(pac_ret)) {
DEBUG(3,("ads_verify_ticket: failed to decode PAC_DATA: %s\n", nt_errstr(pac_ret)));
*pac_data = NULL;
}
data_blob_free(&auth_data);
}

6
source3/libsmb/clikrb5.c
View File

@ -689,6 +689,12 @@ failed:
&input,
cksum,
&checksum_valid);
if (ret) {
DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
error_message(ret)));
return ret;
}
if (!checksum_valid)
ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
}