From 12cd2c9cbd1ca027a3ef9ac7ab3e79526b1348ae Mon Sep 17 00:00:00 2001 From: Nicolas Williams Date: Tue, 11 Oct 2011 23:57:58 -0500 Subject: [PATCH] Fix TGS ticket enc-part key selection When I added support for configuring how the KDC selects session, reply, and ticket enc-part keys I accidentally had the KDC use the session key selection algorithm for selecting the ticket enc-part key. This becomes a problem when using a Heimdal KDC with an MIT KDB as the HDB backend and when the krbtgt keys are not in strongest-to-weakest order, in which case forwardable tickets minted by the Heimdal KDC will not be accepted by MIT KDCs with the same KDB. --- kdc/krb5tgs.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c index 15ea5b050..983c9dd4a 100644 --- a/kdc/krb5tgs.c +++ b/kdc/krb5tgs.c @@ -1699,17 +1699,14 @@ server_lookup: } else { Key *skey; - ret = _kdc_find_etype(context, - config->tgs_use_strongest_session_key, FALSE, - server, b->etype.val, b->etype.len, NULL, - &skey); + ret = _kdc_get_preferred_key(context, config, server, spn, + &etype, &skey); if(ret) { kdc_log(context, config, 0, "Server (%s) has no support for etypes", spn); goto out; } ekey = &skey->key; - etype = skey->key.keytype; kvno = server->entry.kvno; }