oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

(init): Don't disable forwardable for kadmin/changepw.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@15064 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2005-05-03 11:11:54 +00:00
parent 22c95cf623
commit fec66b3327
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
kadmin/init.c
View File

@@ -175,11 +175,16 @@ init(struct init_options *opt, int argc, char **argv)
/* Create `kadmin/changepw' */
krb5_make_principal(context, &princ, realm,
"kadmin", "changepw", NULL);
/*
* The Windows XP (at least) password changing protocol
* request the `kadmin/changepw' ticket with `renewable_ok,
* renewable, forwardable' and so fails if we disallow
* forwardable here.
*/
create_random_entry(princ, 5*60, 5*60,
KRB5_KDB_DISALLOW_TGT_BASED|
KRB5_KDB_PWCHANGE_SERVICE|
KRB5_KDB_DISALLOW_POSTDATED|
KRB5_KDB_DISALLOW_FORWARDABLE|
KRB5_KDB_DISALLOW_RENEWABLE|
KRB5_KDB_DISALLOW_PROXIABLE|
KRB5_KDB_REQUIRES_PRE_AUTH);