diff options
| author | Sumit Bose <sbose@redhat.com> | 2012-10-18 16:14:40 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2012-11-05 00:14:05 +0100 |
| commit | c0680269167475aa9172b20d13ec3ace721a37ff (patch) | |
| tree | ee3034c1e7a3479e59963c0fc5c5b4bccf00eda0 /src/providers/krb5/krb5_auth.c | |
| parent | 74254ab3c4d6b9ca63488245bc88db7cf7689084 (diff) | |
| download | sssd-c0680269167475aa9172b20d13ec3ace721a37ff.tar.gz sssd-c0680269167475aa9172b20d13ec3ace721a37ff.tar.xz sssd-c0680269167475aa9172b20d13ec3ace721a37ff.zip | |
krb5_auth: check if principal belongs to a different realm
Add a flag if the principal used for authentication does not belong
to our realm. This can be used to act differently for users from other
realms.
Diffstat (limited to 'src/providers/krb5/krb5_auth.c')
| -rw-r--r-- | src/providers/krb5/krb5_auth.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index c98535b1d..72f0711eb 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -427,6 +427,13 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx, DEBUG(1, ("krb5_get_simple_upn failed.\n")); goto done; } + } else { + ret = compare_principal_realm(kr->upn, realm, + &kr->upn_from_different_realm); + if (ret != 0) { + DEBUG(SSSDBG_OP_FAILURE, ("compare_principal_realm failed.\n")); + goto done; + } } kr->homedir = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_HOMEDIR, |