oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

krb5: don't require krbtgt otherName match for Win2K

Browse Source 
Merged from Apple branch: when the Win2K PKINIT compatibility option is set, do
not require krbtgt otherName to match when validating KDC certificate.
This commit is contained in:
Luke Howard
2019-05-15 10:44:55 +10:00
committed by Jeffrey Altman
parent c634146b14
commit 8350f34a05
3 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
lib/krb5/krb5_locl.h
View File

@@ -214,6 +214,7 @@ struct _krb5_get_init_creds_opt_private {
#define KRB5_INIT_CREDS_NO_C_CANON_CHECK 2
#define KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK 4
#define KRB5_INIT_CREDS_PKINIT_KX_VALID 32
#define KRB5_INIT_CREDS_PKINIT_NO_KRBTGT_OTHERNAME_CHECK 64
struct {
krb5_gic_process_last_req func;
void *ctx;