oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Try capaths first, then referrals

Browse Source 
When looking for a ticket, use the capath codepath first when we know
the service's realm: because we might have local policy as to how to get
there.

Then, if that doesn't work, try referrals.  (For now unconditionally.)
This commit is contained in:
Nicolas Williams
2015-04-13 17:44:52 -05:00
parent bfc78d11dc
commit 7da08a658b
1 changed files with 24 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
lib/krb5/get_cred.c
View File

@@ -1152,28 +1152,31 @@ _krb5_get_cred_kdc_any(krb5_context context,
context->kdc_usec_offset = 0; context->kdc_usec_offset = 0;
} }
/* Try referrals */ if (strcmp(in_creds->server->realm, "") != 0) {
ret = get_cred_kdc_referral(context, /*
flags, * Non-empty realm? Try capaths first. We might have local
ccache, * policy (capaths) to honor.
in_creds, */
impersonate_principal, ret = get_cred_kdc_capath(context,
second_ticket, flags,
out_creds); ccache,
in_creds,
impersonate_principal,
second_ticket,
out_creds,
ret_tgts);
if (ret == 0)
return ret;
}
/* "Empty realm" -> only do referrals */ /* Otherwise try referrals */
if (ret == 0 || strcmp(in_creds->server->realm, "") == 0) return get_cred_kdc_referral(context,
return ret; flags,
ccache,
/* Try capaths */ in_creds,
return get_cred_kdc_capath(context, impersonate_principal,
flags, second_ticket,
ccache, out_creds);
in_creds,
impersonate_principal,
second_ticket,
out_creds,
ret_tgts);
} }
static krb5_error_code static krb5_error_code