mirror of
https://github.com/samba-team/samba.git
synced 2025-02-02 09:47:23 +03:00
7b57cfb1a9
I’m not sure exactly how this check was supposed to work. But in any case, within fast_unwrap_request() the Heimdal KDC replaces the outer padata with the padata from the inner FAST request. Hence, this check does not accomplish anything useful: at no point should the KDC plugin see the outer padata. A couple of unwanted consequences resulted from this check. One was that a client who sent empty FX‐FAST padata within the inner FAST request would receive the *Authentication Authority* Asserted Identity SID instead of the *Service* Asserted Identity SID. Another consequence was that a client could in the same manner bypass the restriction on performing S4U2Self with an RODC‐issued TGT. Overall, samba_wdc_is_s4u2self_req() is somewhat of a hack. But the Heimdal plugin API gives us nothing better to work with. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 5c580dbdb3e6a70c8d2f5059e2b7293a7e780414) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15477