oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc: Constrained delegation requires a local delegating server

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15837

Signed-off-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Stefan Metzmacher
2025-03-20 00:22:34 +01:00
committed by Jeffrey Altman
parent c0f63fba5c
commit 225d1c4c0e
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
kdc/mssfu.c
View File

@@ -380,6 +380,19 @@ validate_constrained_delegation(astgs_request_t r)
goto out;
}
/*
* We require that the delegating server (r->client) is local
* and was found in the local database.
*/
if (r->client == NULL) {
ret = KRB5KDC_ERR_BADOPTION;
kdc_audit_addreason((kdc_request_t)r, "Remote delegating server");
kdc_log(r->context, r->config, 4,
"Constrained delegation without local delegating server, %s/%s",
r->cname, r->sname);
goto out;
}
t = &b->additional_tickets->val[0];
ret = hdb_enctype2key(r->context, r->client,