diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2012-08-30 07:49:21 +1000 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2012-08-30 01:26:12 +0200 |
| commit | 5131359edae7a5c7092c0d41bb225941596ddcac (patch) | |
| tree | 4812a10c52ccb27db45213743a37bd5e2578f284 /auth | |
| parent | a58bf44c1ec62736fc20e0e7dedb8a1c0306380c (diff) | |
| download | samba-5131359edae7a5c7092c0d41bb225941596ddcac.tar.gz samba-5131359edae7a5c7092c0d41bb225941596ddcac.tar.xz samba-5131359edae7a5c7092c0d41bb225941596ddcac.zip | |
auth/credentials: Support match-by-key in cli_credentials_get_server_gss_creds()
This allows a password alone to be used to accept kerberos tickets.
Of course, we need to have got the salt right, but we do not need also
the correct kvno. This allows gensec_gssapi to accept tickets based on
a secrets.tdb entry.
Andrew Bartlett
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Aug 30 01:26:12 CEST 2012 on sn-devel-104
Diffstat (limited to 'auth')
| -rw-r--r-- | auth/credentials/credentials_krb5.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c index 2a23688ffdb..459e9487f48 100644 --- a/auth/credentials/credentials_krb5.c +++ b/auth/credentials/credentials_krb5.c @@ -717,6 +717,11 @@ _PUBLIC_ int cli_credentials_get_keytab(struct cli_credentials *cred, cred->keytab_obtained = (MAX(cred->principal_obtained, cred->username_obtained)); + /* We make this keytab up based on a password. Therefore + * match-by-key is acceptable, we can't match on the wrong + * principal */ + ktc->password_based = true; + talloc_steal(cred, ktc); cred->keytab = ktc; *_ktc = cred->keytab; @@ -818,12 +823,12 @@ _PUBLIC_ int cli_credentials_get_server_gss_creds(struct cli_credentials *cred, return ENOMEM; } - if (obtained < CRED_SPECIFIED) { - /* This creates a GSSAPI cred_id_t with the principal and keytab set */ + if (ktc->password_based || obtained < CRED_SPECIFIED) { + /* This creates a GSSAPI cred_id_t for match-by-key with only the keytab set */ maj_stat = gss_krb5_import_cred(&min_stat, NULL, NULL, ktc->keytab, &gcc->creds); } else { - /* This creates a GSSAPI cred_id_t with the principal and keytab set */ + /* This creates a GSSAPI cred_id_t with the principal and keytab set, matching by name */ maj_stat = gss_krb5_import_cred(&min_stat, NULL, princ, ktc->keytab, &gcc->creds); } |