oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Better support for kinit -k when client have subset of enctypes compared to KDC

Browse Source 
Get the list of enctypes and use that to calculate the list of client supported
enctypes when talking to the KDC, this to make sure that KDC doesn't send
pw-challanges to the client for enctypes that the client software support
but there is no entry in the keytab.
This commit is contained in:
Love Hornquist Astrand
2009-08-30 13:25:38 -07:00
parent 54e10a2a13
commit 20001366aa
2 changed files with 76 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
tests/kdc/check-kdc.in
View File

@@ -113,6 +113,7 @@ ${kadmin} add -p bar --use-defaults bar@${R} || exit 1
${kadmin} add -p foo --use-defaults remove@${R} || exit 1
${kadmin} add -p kaka --use-defaults ${server}@${R} || exit 1
${kadmin} add -p kaka --use-defaults ${server}-des3@${R} || exit 1
${kadmin} add -p kaka --use-defaults kt-des3@${R} || exit 1
${kadmin} add -p foo --use-defaults ${ps} || exit 1
${kadmin} modify --attributes=+trusted-for-delegation ${ps} || exit 1
${kadmin} modify --constrained-delegation=${server} ${ps} || exit 1
@@ -157,6 +158,12 @@ enctypes=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's
enctype_sans_aes=`echo $enctypes | sed 's/aes[^ ]*//g'`
enctype_sans_des3=`echo $enctypes | sed 's/des3-cbc-sha1//g'`
echo "deleting all but des enctypes on kt-des3 in keytab"
${kadmin} ext -k ${keytab} kt-des3@${R} || exit 1
for a in ${enctype_sans_des3} ; do
${ktutil} -k ${keytab} remove -p kt-des3@${R} -e $a
done
echo foo > ${objdir}/foopassword
echo Starting kdc
@@ -274,6 +281,12 @@ ${klist} | grep "Principal: ${server}" > /dev/null || \
{ ec=1 ; eval "${testfailed}"; }
${kdestroy}
echo "Getting key for key that are a subset in keytab compared to kdb"
${kinit} --keytab=${keytab} kt-des3@${R}
${klist} | grep "Principal: kt-des3" > /dev/null || \
{ ec=1 ; eval "${testfailed}"; }
${kdestroy}
echo "initial tickets for deleted user test case"; > messages.log
${kinit} --password-file=${objdir}/foopassword remove@$R || \
{ ec=1 ; eval "${testfailed}"; }