Nicolas Williams bba573f286 krb5: Fix dst TGT deleg w/o dns_lookup_realm ...

Setting `dns_lookup_realm = false` in `[libdefaults]` and setting name
canon rules that force the empty realm causes destination-TGT delegation
to break because the client doesn't know the service's realm.

Because MIT and Heimdal check that the (unauthenticated plaintext)
sname/realm of the Ticket in the KDC reply matches the sname/srealm in
the enc-part of the KDC reply, we know we can trust the realm of the
ticket found in the ccache.  So use that.

2021-12-06 17:39:22 -06:00

49 KiB

Raw Blame History

View Raw