Put kdc last in tests/Makefile.am. There's two tests in tests/kdc
that have been failing for a long time, and that causes the
remaining tests to not be run. By putting kdc last those tests do
run.
The previous fix was incomplete. But it also finally uncovered an
old check-des problem that I'd had once and which may have gotten
papered over by changing the default of one of the *strongest* KDC
parameters. The old problem is that we were passing the wrong
enctype to _kdc_encode_reply(): we were passing the session key
enctype where the ticket enc-part key's enctype was expected.
The whole enctype being passed in is superfluous anyways. Let's
clean that up next.
When I added support for configuring how the KDC selects session,
reply, and ticket enc-part keys I accidentally had the KDC use the
session key selection algorithm for selecting the ticket enc-part
key. This becomes a problem when using a Heimdal KDC with an MIT
KDB as the HDB backend and when the krbtgt keys are not in
strongest-to-weakest order, in which case forwardable tickets minted
by the Heimdal KDC will not be accepted by MIT KDCs with the same
KDB.
Application developers have a tendency to use krb5_get_error_message()
as a drop in replacement for error_message() and under various
circumstances they pass in a NULL context. This method works fine
for MIT's implementation which ignores the context but in Heimdal
passing in a NULL context would dump core.
This patch set modifies krb5_get_error_message() in order to
permit the passing of a NULL context. First, if the context
is NULL, an attempt will be made to allocate one locally for
the purpose of evaluating the error code. Second, if a local
context cannot be allocated, fall back on calling error_message().
If error_message() fails to return a string, then generate an
"unknown error" response.
Only if all of the above fails is NULL returned.
Change-Id: If4baf7d6c428cf0baf11c044b8dfd5c2b3cdf7e4
