oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Make work for constrained delegation and impersonation.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22758 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2008-03-24 12:08:43 +00:00
parent 70f23b007a
commit 526b428c75
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
lib/krb5/get_cred.c
View File

@@ -521,6 +521,7 @@ get_cred_kdc(krb5_context context,
memset(&rep, 0, sizeof(rep)); memset(&rep, 0, sizeof(rep));
if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0) { if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0) {
unsigned eflags = 0;
ret = krb5_copy_principal(context, ret = krb5_copy_principal(context,
in_creds->client, in_creds->client,
@@ -535,6 +536,10 @@ get_cred_kdc(krb5_context context,
/* this should go someplace else */ /* this should go someplace else */
out_creds->times.endtime = in_creds->times.endtime; out_creds->times.endtime = in_creds->times.endtime;
/* XXX should do better testing */
if (flags.b.constrained_delegation || impersonate_principal)
eflags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
ret = _krb5_extract_ticket(context, ret = _krb5_extract_ticket(context,
&rep, &rep,
out_creds, out_creds,
@@ -543,8 +548,7 @@ get_cred_kdc(krb5_context context,
KRB5_KU_TGS_REP_ENC_PART_SESSION, KRB5_KU_TGS_REP_ENC_PART_SESSION,
&krbtgt->addresses, &krbtgt->addresses,
nonce, nonce,
EXTRACT_TICKET_ALLOW_CNAME_MISMATCH| eflags,
EXTRACT_TICKET_ALLOW_SERVER_MISMATCH,
decrypt_tkt_with_subkey, decrypt_tkt_with_subkey,
subkey); subkey);
out2: out2:
@@ -869,7 +873,7 @@ get_cred_kdc_referral(krb5_context context,
krb5_creds tgt, referral, ticket; krb5_creds tgt, referral, ticket;
int loop = 0; int loop = 0;
flags.b.canonicalize = 1; flags.b.canonicalize = 1; /* XXX */
memset(&tgt, 0, sizeof(tgt)); memset(&tgt, 0, sizeof(tgt));
memset(&ticket, 0, sizeof(ticket)); memset(&ticket, 0, sizeof(ticket));