oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

only resign PAC if there is a verified PAC on the way in

Browse Source
This commit is contained in:
Love Hornquist Astrand
2010-06-11 09:55:10 -07:00
parent 75c8250abf
commit a70b912972
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
kdc/krb5tgs.c
View File

@@ -332,19 +332,25 @@ check_PAC(krb5_context context,
} }
ret = _kdc_pac_verify(context, client_principal, ret = _kdc_pac_verify(context, client_principal,
client, server, &pac); client, server, &pac, signedpath);
if (ret) { if (ret) {
krb5_pac_free(context, pac); krb5_pac_free(context, pac);
return ret; return ret;
} }
*signedpath = 1;
ret = _krb5_pac_sign(context, pac, tkt->authtime, /*
client_principal, * Only re-sign PAC if we could verify it with the PAC
server_key, krbtgt_key, rspac); * function. The no-verify case happens when we get in
* a PAC from cross realm from a Windows domain and
* that there is no PAC verification function.
*/
if (*signedpath)
ret = _krb5_pac_sign(context, pac, tkt->authtime,
client_principal,
server_key, krbtgt_key, rspac);
krb5_pac_free(context, pac); krb5_pac_free(context, pac);
return ret; return ret;
} }
} }