Limit krb5_get_init_creds_keytab() to etypes in keytab

 * Load the enctypes for the keys in the keytab and pass
   them to krb5_get_init_creds_keytab().
 * This fixes the problem where the server offers a enctype
   that krb5 supports, but we don't have a key for in the keytab.

https://bugzilla.redhat.com/show_bug.cgi?id=811375

1 files changed, 15 insertions, 0 deletions

diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c
index e66406c0e..0679dbfdf 100644
--- a/src/providers/ldap/ldap_child.c
+++ b/src/providers/ldap/ldap_child.c
@@ -155,6 +155,8 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
     krb5_get_init_creds_opt options;
     krb5_error_code krberr;
     krb5_timestamp kdc_time_offset;
+    krb5_enctype *etype_list;
+    int n_etype_list;
     int canonicalize = 0;
     int kdc_time_offset_usec;
     int ret;
@@ -270,6 +272,19 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
     }
     sss_krb5_get_init_creds_opt_set_canonicalize(&options, canonicalize);
 
+    krberr = sss_krb5_read_etypes_for_keytab(memctx, context, keytab, kprinc,
+                                             &etype_list, &n_etype_list);
+    if (krberr) {
+        DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to load etypes from keytab: %s\n",
+                                     sss_krb5_get_error_message(context,
+                                                                krberr)));
+    } else if (n_etype_list > 0) {
+        krb5_get_init_creds_opt_set_etype_list(&options, etype_list,
+                                               n_etype_list);
+        DEBUG(SSSDBG_FUNC_DATA, ("Loaded %d enctypes from keytab for %s\n",
+                                 n_etype_list, full_princ));
+    }
+
     krberr = krb5_get_init_creds_keytab(context, &my_creds, kprinc,
                                         keytab, 0, NULL, &options);