oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

If we used GSS_C_DELEG_POLICY_FLAG, trust KDC, still trust realm configuration.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23481 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2008-08-11 09:57:56 +00:00
parent 7a77c27995
commit c69717db61
1 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
lib/gssapi/krb5/init_sec_context.c
View File

@@ -479,6 +479,7 @@ init_auth_restart
krb5_enctype enctype; krb5_enctype enctype;
krb5_data fwd_data, timedata; krb5_data fwd_data, timedata;
int32_t offset = 0, oldoffset; int32_t offset = 0, oldoffset;
int delegate = 0;
krb5_data_zero(&outbuf); krb5_data_zero(&outbuf);
krb5_data_zero(&fwd_data); krb5_data_zero(&fwd_data);
@@ -486,18 +487,13 @@ init_auth_restart
*minor_status = 0; *minor_status = 0;
/* /*
* If the credential doesn't have ok-as-delegate, check what local * If the credential doesn't have ok-as-delegate, check if there
* policy say about ok-as-delegate, default is FALSE that makes * is a realm setting and use that.
* code ignore the KDC setting and follow what the application
* requested. If it is TRUE, strip of the GSS_C_DELEG_FLAG if the
* KDC doesn't set ok-as-delegate.
*/ */
if (!ctx->kcred->flags.b.ok_as_delegate) { if (!ctx->kcred->flags.b.ok_as_delegate) {
krb5_boolean delegate, realm_setting; krb5_boolean realm_setting = FALSE;
krb5_data data; krb5_data data;
realm_setting = FALSE;
ret = krb5_cc_get_config(context, ctx->ccache, NULL, ret = krb5_cc_get_config(context, ctx->ccache, NULL,
"realm-config", &data); "realm-config", &data);
if (ret == 0) { if (ret == 0) {
@@ -506,17 +502,21 @@ init_auth_restart
realm_setting = TRUE; realm_setting = TRUE;
krb5_data_free(&data); krb5_data_free(&data);
} }
if (!realm_setting)
krb5_appdefault_boolean(context, "gssapi", ctx->target->realm,
"ok-as-delegate", realm_setting,
&delegate);
if (delegate)
req_flags &= ~GSS_C_DELEG_FLAG; req_flags &= ~GSS_C_DELEG_FLAG;
} }
/* if we used GSS_C_DELEG_POLICY_FLAG, trust KDC */
if (req_flags & GSS_C_DELEG_POLICY_FLAG)
delegate = ctx->kcred->flags.b.ok_as_delegate;
/* if there still is a GSS_C_DELEG_FLAG, use that */
if (req_flags & GSS_C_DELEG_FLAG)
delegate = 1;
flags = 0; flags = 0;
ap_options = 0; ap_options = 0;
if (req_flags & GSS_C_DELEG_FLAG) if (delegate)
do_delegation (context, do_delegation (context,
ctx->auth_context, ctx->auth_context,
ctx->ccache, ctx->kcred, ctx->target, ctx->ccache, ctx->kcred, ctx->target,