From 33fccb8bbec20b8a01263b629571404662b3a9c3 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 30 Jun 2021 21:57:28 +1200 Subject: [PATCH] heimdal: Match windows and return KRB5KDC_ERR_CLIENT_REVOKED when the account is locked out Windows does not check the password on an account that has been locked. Heimdal does not implement locked_out, however the Samba hdb backend does, and needs this checked before passwords (for bad password lockout), not after in kdc_check_access(). Based on work to update Samba to current Heimdal by Gary Lockyer and including cherry-pick of Samba commit 580a705b83014e94556b9d5a8877406816e02190 which noted that we need to return KRB5KDC_ERR_CLIENT_REVOKED to match Windows. Signed-off-by: Andrew Bartlett --- kdc/kerberos5.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c index a5632eb91..c57c1c3a7 100644 --- a/kdc/kerberos5.c +++ b/kdc/kerberos5.c @@ -580,6 +580,13 @@ pa_enc_chal_validate(astgs_request_t r, const PA_DATA *pa) return ret; } + if (r->client->entry.flags.locked_out) { + ret = KRB5KDC_ERR_CLIENT_REVOKED; + kdc_log(r->context, r->config, 0, + "Client (%s) is locked out", r->cname); + return ret; + } + ret = decode_EncryptedData(pa->padata_value.data, pa->padata_value.length, &enc_data, @@ -722,6 +729,13 @@ pa_enc_ts_validate(astgs_request_t r, const PA_DATA *pa) Key *pa_key; char *str; + if (r->client->entry.flags.locked_out) { + ret = KRB5KDC_ERR_CLIENT_REVOKED; + kdc_log(r->context, r->config, 0, + "Client (%s) is locked out", r->cname); + return ret; + } + ret = decode_EncryptedData(pa->padata_value.data, pa->padata_value.length, &enc_data,