diff options
author | Sumit Bose <sbose@redhat.com> | 2012-12-17 22:14:55 +0100 |
---|---|---|
committer | Jakub Hrozek <jhrozek@redhat.com> | 2012-12-18 19:03:57 +0100 |
commit | cbc15482c7c6e5b0782cf05507b86576360e5e37 (patch) | |
tree | a7dbf25909d0ece9ead3e4fd3c7d165e25bd0f94 | |
parent | 163d02193d4ce9f0075ef87a6ce209ee41554272 (diff) | |
download | sssd-cbc15482c7c6e5b0782cf05507b86576360e5e37.tar.gz sssd-cbc15482c7c6e5b0782cf05507b86576360e5e37.tar.xz sssd-cbc15482c7c6e5b0782cf05507b86576360e5e37.zip |
select_principal_from_keytab() do wildcard lookups after specific ones
Currently the wildcard lookup '*$' is done before the one for
host/our.hostname@REALM. This means we would ignore a more specific
match in favour of an unspecific match with a principal which is only
used in a AD environment.
I think this is wrong an wildcards should only be used is all specific
lookups fail.
-rw-r--r-- | src/util/sss_krb5.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c index 0eb032a76..1b8dc79b2 100644 --- a/src/util/sss_krb5.c +++ b/src/util/sss_krb5.c @@ -51,15 +51,15 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx, * Priority of lookup: * - our.hostname@REALM or host/our.hostname@REALM depending on the input * - our.hostname$@REALM (AD domain) - * - foobar$@REALM (AD domain) * - host/our.hostname@REALM + * - foobar$@REALM (AD domain) * - host/foobar@REALM * - host/foo@BAR * - pick the first principal in the keytab */ - const char *primary_patterns[] = {"%s", "%s$", "*$", "host/%s", "host/*", + const char *primary_patterns[] = {"%s", "%s$", "host/%s", "*$", "host/*", "host/*", NULL}; - const char *realm_patterns[] = {"%s", "%s", "%s", "%s", "%s", + const char *realm_patterns[] = {"%s", "%s", "%s", "%s", "%s", NULL, NULL}; DEBUG(5, ("trying to select the most appropriate principal from keytab\n")); |