diff options
| author | Sumit Bose <sbose@redhat.com> | 2013-09-20 12:12:03 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2013-09-23 17:01:55 +0200 |
| commit | 6a9ef2c0105d316a1286c92073511ff95301c39f (patch) | |
| tree | 53d790ae26d1b3059fa1e88ba5eaf33c38d786d7 /src/providers/krb5/krb5_auth.c | |
| parent | 9b4fccf333b29ac61b1e8c6ae993d5cbe31e77c2 (diff) | |
| download | sssd-6a9ef2c0105d316a1286c92073511ff95301c39f.tar.gz sssd-6a9ef2c0105d316a1286c92073511ff95301c39f.tar.xz sssd-6a9ef2c0105d316a1286c92073511ff95301c39f.zip | |
krb5: save canonical upn to sysdb
If the returned TGT contains a different user principal name (upn) than
used in the request, i.e. the upn was canonicalized, we currently save
it to sysdb into the same attribute where the upn coming from an LDAP
server is stored as well. This means the canonical upn might be
overwritten when the user data is re-read from the LDAP server.
To avoid this this patch add a new attribute to sysdb where the
canonical upn is stored and makes sure it is used when available.
Fixes https://fedorahosted.org/sssd/ticket/2060
Diffstat (limited to 'src/providers/krb5/krb5_auth.c')
| -rw-r--r-- | src/providers/krb5/krb5_auth.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index fe3e6aba7..b373cb4c3 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -513,7 +513,7 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx, goto done; } - attrs = talloc_array(state, const char *, 6); + attrs = talloc_array(state, const char *, 7); if (attrs == NULL) { ret = ENOMEM; goto done; @@ -524,7 +524,8 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx, attrs[2] = SYSDB_CCACHE_FILE; attrs[3] = SYSDB_UIDNUM; attrs[4] = SYSDB_GIDNUM; - attrs[5] = NULL; + attrs[5] = SYSDB_CANONICAL_UPN; + attrs[6] = NULL; ret = krb5_setup(state, pd, krb5_ctx, &state->kr); if (ret != EOK) { |