diff options
| author | Stef Walter <stefw@gnome.org> | 2012-04-11 12:12:57 +0200 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2012-05-04 15:47:04 -0400 |
| commit | 4d1a261202d828efc84e3a84d16c30548f29f76d (patch) | |
| tree | 1f5fd8c9522842979eed34efecfd7636c79a9e67 /src/providers/ldap/ldap_child.c | |
| parent | 077ec9ac6dfef339c16ecc9c2f60cd77e62c9272 (diff) | |
| download | sssd-4d1a261202d828efc84e3a84d16c30548f29f76d.tar.gz sssd-4d1a261202d828efc84e3a84d16c30548f29f76d.tar.xz sssd-4d1a261202d828efc84e3a84d16c30548f29f76d.zip | |
If canon'ing principals, write ccache with updated default principal
* When calling krb5_get_init_creds_keytab() with
krb5_get_init_creds_opt_set_canonicalize() the credential
principal can get updated.
* Create the cache file with the correct default credential.
* LDAP GSSAPI SASL would fail due to the mismatched credentials
before this patch.
https://bugzilla.redhat.com/show_bug.cgi?id=811518
Diffstat (limited to 'src/providers/ldap/ldap_child.c')
| -rw-r--r-- | src/providers/ldap/ldap_child.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c index 5356f8834..e6bf4c3a7 100644 --- a/src/providers/ldap/ldap_child.c +++ b/src/providers/ldap/ldap_child.c @@ -285,7 +285,8 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx, goto done; } - krberr = krb5_cc_initialize(context, ccache, kprinc); + /* Use updated principal if changed due to canonicalization. */ + krberr = krb5_cc_initialize(context, ccache, my_creds.client); if (krberr) { DEBUG(2, ("Failed to init ccache: %s\n", sss_krb5_get_error_message(context, krberr))); |