summaryrefslogtreecommitdiffstats
path: root/src/providers/krb5
diff options
context:
space:
mode:
authorStef Walter <stefw@gnome.org>2012-04-10 22:20:53 +0200
committerStephen Gallagher <sgallagh@redhat.com>2012-05-07 10:00:16 -0400
commit4c157ecedd52602f75574605ef48d0c48e9bfbe8 (patch)
tree3341f73dcb37129cc97cb57b55e47e077709dc08 /src/providers/krb5
parent5b1a798a2a792c74e5f11f744f4f5b663c8b93c3 (diff)
downloadsssd-4c157ecedd52602f75574605ef48d0c48e9bfbe8.tar.gz
sssd-4c157ecedd52602f75574605ef48d0c48e9bfbe8.tar.xz
sssd-4c157ecedd52602f75574605ef48d0c48e9bfbe8.zip
Limit krb5_get_init_creds_keytab() to etypes in keytab
* Load the enctypes for the keys in the keytab and pass them to krb5_get_init_creds_keytab(). * This fixes the problem where the server offers a enctype that krb5 supports, but we don't have a key for in the keytab. https://bugzilla.redhat.com/show_bug.cgi?id=811375
Diffstat (limited to 'src/providers/krb5')
-rw-r--r--src/providers/krb5/krb5_child.c21
1 files changed, 21 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index cf232b690..d2b976e2b 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -612,6 +612,14 @@ static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx,
krb5_error_code kerr = 0;
krb5_creds creds;
krb5_get_init_creds_opt options;
+ krb5_enctype *etype_list;
+ krb5_error_code krberr;
+ TALLOC_CTX *tmp_ctx;
+ int n_etype_list;
+
+ tmp_ctx = talloc_new(NULL);
+ if (tmp_ctx == NULL)
+ return ENOMEM;
memset(&creds, 0, sizeof(creds));
memset(&options, 0, sizeof(options));
@@ -621,6 +629,18 @@ static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx,
krb5_get_init_creds_opt_set_proxiable(&options, 0);
krb5_set_canonicalize(&options);
+ krberr = sss_krb5_read_etypes_for_keytab(tmp_ctx, ctx, keytab, princ,
+ &etype_list, &n_etype_list);
+ if (krberr) {
+ DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to load etypes from keytab: %s\n",
+ sss_krb5_get_error_message(ctx, krberr)));
+ } else if (n_etype_list > 0) {
+ krb5_get_init_creds_opt_set_etype_list(&options, etype_list,
+ n_etype_list);
+ DEBUG(SSSDBG_FUNC_DATA, ("Loaded %d enctypes from keytab\n",
+ n_etype_list));
+ }
+
kerr = krb5_get_init_creds_keytab(ctx, &creds, princ, keytab, 0, NULL,
&options);
if (kerr != 0) {
@@ -638,6 +658,7 @@ static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx,
done:
krb5_free_cred_contents(ctx, &creds);
+ talloc_free(tmp_ctx);
return kerr;