oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Add option to require initial kca_service tickets

Browse Source 
Default to TRUE, and allow setting it on a per-realm basis.
This commit is contained in:
Nicolas Williams
2013-12-04 16:35:26 -06:00
parent 5807540e1b
commit 2c265a8182
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
kdc/kx509.c
View File

@@ -342,6 +342,7 @@ _kdc_do_kx509(krb5_context context,
Kx509Response rep; Kx509Response rep;
size_t size; size_t size;
krb5_keyblock *key = NULL; krb5_keyblock *key = NULL;
krb5_boolean def_bool;
krb5_data_zero(reply); krb5_data_zero(reply);
memset(&rep, 0, sizeof(rep)); memset(&rep, 0, sizeof(rep));
@@ -374,6 +375,18 @@ _kdc_do_kx509(krb5_context context,
if (ret) if (ret)
goto out; goto out;
def_bool = krb5_config_get_bool_default(context, NULL, TRUE, "kdc",
"require_initial_kca_tickets",
NULL);
if (!ticket->ticket.flags.initial &&
krb5_config_get_bool_default(context, NULL, def_bool, "kdc",
krb5_principal_get_realm(context,
cprincipal),
"require_initial_kca_tickets", NULL)) {
ret = KRB5KDC_ERR_POLICY;
goto out;
}
ret = krb5_unparse_name(context, cprincipal, &cname); ret = krb5_unparse_name(context, cprincipal, &cname);
if (ret) if (ret)
goto out; goto out;