diff options
| author | Stef Walter <stefw@gnome.org> | 2012-04-10 22:20:53 +0200 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2012-05-07 10:00:16 -0400 |
| commit | 4c157ecedd52602f75574605ef48d0c48e9bfbe8 (patch) | |
| tree | 3341f73dcb37129cc97cb57b55e47e077709dc08 /src/providers | |
| parent | 5b1a798a2a792c74e5f11f744f4f5b663c8b93c3 (diff) | |
| download | sssd-4c157ecedd52602f75574605ef48d0c48e9bfbe8.tar.gz sssd-4c157ecedd52602f75574605ef48d0c48e9bfbe8.tar.xz sssd-4c157ecedd52602f75574605ef48d0c48e9bfbe8.zip | |
Limit krb5_get_init_creds_keytab() to etypes in keytab
* Load the enctypes for the keys in the keytab and pass
them to krb5_get_init_creds_keytab().
* This fixes the problem where the server offers a enctype
that krb5 supports, but we don't have a key for in the keytab.
https://bugzilla.redhat.com/show_bug.cgi?id=811375
Diffstat (limited to 'src/providers')
| -rw-r--r-- | src/providers/krb5/krb5_child.c | 21 | ||||
| -rw-r--r-- | src/providers/ldap/ldap_child.c | 15 |
2 files changed, 36 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index cf232b690..d2b976e2b 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -612,6 +612,14 @@ static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx, krb5_error_code kerr = 0; krb5_creds creds; krb5_get_init_creds_opt options; + krb5_enctype *etype_list; + krb5_error_code krberr; + TALLOC_CTX *tmp_ctx; + int n_etype_list; + + tmp_ctx = talloc_new(NULL); + if (tmp_ctx == NULL) + return ENOMEM; memset(&creds, 0, sizeof(creds)); memset(&options, 0, sizeof(options)); @@ -621,6 +629,18 @@ static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx, krb5_get_init_creds_opt_set_proxiable(&options, 0); krb5_set_canonicalize(&options); + krberr = sss_krb5_read_etypes_for_keytab(tmp_ctx, ctx, keytab, princ, + &etype_list, &n_etype_list); + if (krberr) { + DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to load etypes from keytab: %s\n", + sss_krb5_get_error_message(ctx, krberr))); + } else if (n_etype_list > 0) { + krb5_get_init_creds_opt_set_etype_list(&options, etype_list, + n_etype_list); + DEBUG(SSSDBG_FUNC_DATA, ("Loaded %d enctypes from keytab\n", + n_etype_list)); + } + kerr = krb5_get_init_creds_keytab(ctx, &creds, princ, keytab, 0, NULL, &options); if (kerr != 0) { @@ -638,6 +658,7 @@ static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx, done: krb5_free_cred_contents(ctx, &creds); + talloc_free(tmp_ctx); return kerr; diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c index e6bf4c3a7..023979044 100644 --- a/src/providers/ldap/ldap_child.c +++ b/src/providers/ldap/ldap_child.c @@ -155,6 +155,8 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx, krb5_get_init_creds_opt options; krb5_error_code krberr; krb5_timestamp kdc_time_offset; + krb5_enctype *etype_list; + int n_etype_list; int canonicalize = 0; int kdc_time_offset_usec; int ret; @@ -270,6 +272,19 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx, } sss_krb5_get_init_creds_opt_set_canonicalize(&options, canonicalize); + krberr = sss_krb5_read_etypes_for_keytab(memctx, context, keytab, kprinc, + &etype_list, &n_etype_list); + if (krberr) { + DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to load etypes from keytab: %s\n", + sss_krb5_get_error_message(context, + krberr))); + } else if (n_etype_list > 0) { + krb5_get_init_creds_opt_set_etype_list(&options, etype_list, + n_etype_list); + DEBUG(SSSDBG_FUNC_DATA, ("Loaded %d enctypes from keytab for %s\n", + n_etype_list, full_princ)); + } + krberr = krb5_get_init_creds_keytab(context, &my_creds, kprinc, keytab, 0, NULL, &options); |