oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc: allow anonymous AS requests with long-term keys

Browse Source 
RFC8062 section 4.1 allows clients with long-term KDC keys to set the anonymous
flag; in this case their identity is authenticated but the returned ticket
contains the anonymous principal name as the client name.

kdc: allow authenticated anonymous PKINIT

The KDC PKINIT code conflated the checks for authenticated and unauthenticated
anonymous by only looking at the anonymous KDC request option.
This commit is contained in:
Luke Howard
2019-05-02 17:05:25 +10:00
committed by Jeffrey Altman
parent 5c8f48495e
commit 63557427e0
2 changed files with 11 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
kdc/pkinit.c
View File

@@ -477,7 +477,7 @@ _kdc_pk_rd_padata(krb5_context context,
type = "PK-INIT-Win2k";
if (_kdc_is_anon_request(&req->req_body)) {
if (_kdc_is_anonymous(context, client->entry.principal)) {
ret = KRB5_KDC_ERR_PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED;
krb5_set_error_message(context, ret,
"Anon not supported in RSA mode");
@@ -623,7 +623,7 @@ _kdc_pk_rd_padata(krb5_context context,
hx509_certs signer_certs;
int flags = HX509_CMS_VS_ALLOW_DATA_OID_MISMATCH; /* BTMM */
if (_kdc_is_anon_request(&req->req_body))
if (_kdc_is_anonymous(context, client->entry.principal))
flags |= HX509_CMS_VS_ALLOW_ZERO_SIGNER;
ret = hx509_cms_verify_signed(context->hx509ctx,
@@ -708,7 +708,7 @@ _kdc_pk_rd_padata(krb5_context context,
goto out;
}
if (_kdc_is_anon_request(&req->req_body) &&
if (_kdc_is_anonymous(context, client->entry.principal) &&
ap.clientPublicValue == NULL) {
free_AuthPack(&ap);
ret = KRB5_KDC_ERR_PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED;
@@ -1676,8 +1676,10 @@ _kdc_pk_check_client(krb5_context context,
size_t i;
if (cp->cert == NULL) {
if (!_kdc_is_anonymous(context, client->entry.principal))
return KRB5KDC_ERR_BADOPTION;
*subject_name = strdup("anonymous client client");
*subject_name = strdup("<unauthenticated anonymous client>");
if (*subject_name == NULL)
return ENOMEM;
return 0;