sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-27 22:50:26 +03:00
Code

kdc: Fix S4U2Self handling with KRB5_NT_ENTERPRISE_PRINCIPAL containing a UPN

Browse Source 
This is now handled properly by samba_kdc_lookup_server() and this wrapper actually
breaks things.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Andrew Bartlett 2015-03-09 16:00:56 +13:00 committed by Stefan Metzmacher
parent 7bef5e4f0e
commit a1ddee8d2f
1 changed files with 0 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
source4/kdc/db-glue.c
View File

@ -1839,7 +1839,6 @@ samba_kdc_check_s4u2self(krb5_context context,
krb5_const_principal target_principal)
{
krb5_error_code ret;
krb5_principal enterprise_prinicpal = NULL;
struct ldb_dn *realm_dn;
struct ldb_message *msg;
struct dom_sid *orig_sid;
@ -1857,30 +1856,10 @@ samba_kdc_check_s4u2self(krb5_context context,
return ret;
}
if (target_principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
/* Need to reparse the enterprise principal to find the real target */
if (target_principal->name.name_string.len != 1) {
ret = KRB5_PARSE_MALFORMED;
krb5_set_error_message(context, ret, "samba_kdc_check_s4u2self: request for delegation to enterprise principal with wrong (%d) number of components",
target_principal->name.name_string.len);
talloc_free(mem_ctx);
return ret;
}
ret = krb5_parse_name(context, target_principal->name.name_string.val[0],
&enterprise_prinicpal);
if (ret) {
talloc_free(mem_ctx);
return ret;
}
target_principal = enterprise_prinicpal;
}
ret = samba_kdc_lookup_server(context, kdc_db_ctx, mem_ctx, target_principal,
HDB_F_GET_CLIENT|HDB_F_GET_SERVER,
delegation_check_attrs, &realm_dn, &msg);
krb5_free_principal(context, enterprise_prinicpal);
if (ret != 0) {
talloc_free(mem_ctx);
return ret;