diff options
| author | Alexander Bokovoy <abokovoy@redhat.com> | 2013-09-28 21:49:57 +0200 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2013-10-04 10:25:31 +0200 |
| commit | 749111e6c2dfbb288c864a6cd2f5ac228f30bec1 (patch) | |
| tree | c791878bec8766d2e259cafff70591b893d56f1b /daemons/ipa-kdb/ipa_kdb.h | |
| parent | 0ab40cdf6b354e8b760f604f2f94cf3c2292217e (diff) | |
| download | freeipa-749111e6c2dfbb288c864a6cd2f5ac228f30bec1.tar.gz freeipa-749111e6c2dfbb288c864a6cd2f5ac228f30bec1.tar.xz freeipa-749111e6c2dfbb288c864a6cd2f5ac228f30bec1.zip | |
KDC: implement transition check for trusted domains
When client principal requests for a ticket for a server principal
and we have to perform transition, check that all three belong to either
our domain or the domains we trust through forest trusts.
In case all three realms (client, transition, and server) match
trusted domains and our domain, issue permission to transition from client
realm to server realm.
Part of https://fedorahosted.org/freeipa/ticket/3909
Diffstat (limited to 'daemons/ipa-kdb/ipa_kdb.h')
| -rw-r--r-- | daemons/ipa-kdb/ipa_kdb.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/daemons/ipa-kdb/ipa_kdb.h b/daemons/ipa-kdb/ipa_kdb.h index f4d35554c..1c2aefc4a 100644 --- a/daemons/ipa-kdb/ipa_kdb.h +++ b/daemons/ipa-kdb/ipa_kdb.h @@ -253,7 +253,10 @@ krb5_error_code ipadb_sign_authdata(krb5_context context, krb5_error_code ipadb_reinit_mspac(struct ipadb_context *ipactx, bool force_reinit); void ipadb_mspac_struct_free(struct ipadb_mspac **mspac); - +krb5_error_code ipadb_check_transited_realms(krb5_context kcontext, + const krb5_data *tr_contents, + const krb5_data *client_realm, + const krb5_data *server_realm); /* DELEGATION CHECKS */ krb5_error_code ipadb_check_allowed_to_delegate(krb5_context kcontext, |