From 749111e6c2dfbb288c864a6cd2f5ac228f30bec1 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sat, 28 Sep 2013 21:49:57 +0200 Subject: KDC: implement transition check for trusted domains When client principal requests for a ticket for a server principal and we have to perform transition, check that all three belong to either our domain or the domains we trust through forest trusts. In case all three realms (client, transition, and server) match trusted domains and our domain, issue permission to transition from client realm to server realm. Part of https://fedorahosted.org/freeipa/ticket/3909 --- daemons/ipa-kdb/ipa_kdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'daemons/ipa-kdb/ipa_kdb.c') diff --git a/daemons/ipa-kdb/ipa_kdb.c b/daemons/ipa-kdb/ipa_kdb.c index 5e4d0474c..c807bbcfa 100644 --- a/daemons/ipa-kdb/ipa_kdb.c +++ b/daemons/ipa-kdb/ipa_kdb.c @@ -602,7 +602,7 @@ kdb_vftabl kdb_function_table = { NULL, /* decrypt_key_data */ NULL, /* encrypt_key_data */ ipadb_sign_authdata, /* sign_authdata */ - NULL, /* check_transited_realms */ + ipadb_check_transited_realms, /* check_transited_realms */ ipadb_check_policy_as, /* check_policy_as */ NULL, /* check_policy_tgs */ ipadb_audit_as_req, /* audit_as_req */ -- cgit