oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

(_kdc_pk_check_client): use the acl in the kerberos database

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@17830 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2006-07-13 18:32:45 +00:00
parent c0c59a96f2
commit fea203a708
1 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
kdc/pkinit.c
View File

@@ -1194,6 +1194,7 @@ _kdc_pk_check_client(krb5_context context,
pk_client_params *client_params, pk_client_params *client_params,
char **subject_name) char **subject_name)
{ {
const HDB_Ext_PKINIT_acl *acl;
krb5_error_code ret; krb5_error_code ret;
hx509_name name; hx509_name name;
int i; int i;
@@ -1224,6 +1225,28 @@ _kdc_pk_check_client(krb5_context context,
} }
} }
ret = hdb_entry_get_pkinit_acl(&client->entry, &acl);
if (ret == 0) {
/*
* Cheat here and compare the generated name with the string
* and not the reverse.
*/
for (i = 0; i < acl->len; i++) {
if (strcmp(*subject_name, acl->val[0].subject) != 0)
continue;
/* Don't support isser and anchor checking right now */
if (acl->val[0].issuer)
continue;
if (acl->val[0].anchor)
continue;
kdc_log(context, config, 5,
"Found matching PK-INIT database ACL");
return 0;
}
}
for (i = 0; i < principal_mappings.len; i++) { for (i = 0; i < principal_mappings.len; i++) {
krb5_boolean b; krb5_boolean b;
@@ -1234,11 +1257,14 @@ _kdc_pk_check_client(krb5_context context,
continue; continue;
if (strcmp(principal_mappings.val[i].subject, *subject_name) != 0) if (strcmp(principal_mappings.val[i].subject, *subject_name) != 0)
continue; continue;
kdc_log(context, config, 5,
"Found matching PK-INIT FILE ACL");
return 0; return 0;
} }
free(*subject_name);
free(*subject_name);
*subject_name = NULL; *subject_name = NULL;
krb5_set_error_string(context, "PKINIT no matching principals"); krb5_set_error_string(context, "PKINIT no matching principals");
return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH; return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
} }