diff options
| author | Greg Hudson <ghudson@mit.edu> | 2013-07-19 10:08:08 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2013-07-19 10:08:08 -0400 |
| commit | 9a735044d70304f22a013a81ab5c2901a64d3719 (patch) | |
| tree | 47bc12ba6f796c2970abbc2867b281cbccad0943 | |
| parent | 4fb415e9357b6fb9593dc9b52aa93ffe85524806 (diff) | |
| download | krb5-9a735044d70304f22a013a81ab5c2901a64d3719.tar.gz krb5-9a735044d70304f22a013a81ab5c2901a64d3719.tar.xz krb5-9a735044d70304f22a013a81ab5c2901a64d3719.zip | |
Allow self-service for kadmin purgekeys RPC
Make the purgekeys RPC allow self-service, like the chpass and chrand
RPCs.
ticket: 7681 (new)
| -rw-r--r-- | src/kadmin/server/server_stubs.c | 7 | ||||
| -rw-r--r-- | src/tests/t_kadmin_acl.py | 3 |
2 files changed, 7 insertions, 3 deletions
diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c index 0de627f47..eb50c2f7b 100644 --- a/src/kadmin/server/server_stubs.c +++ b/src/kadmin/server/server_stubs.c @@ -1579,9 +1579,10 @@ purgekeys_2_svc(purgekeys_arg *arg, struct svc_req *rqstp) goto exit_func; } - if (CHANGEPW_SERVICE(rqstp) - || !kadm5int_acl_check(handle->context, rqst2name(rqstp), ACL_MODIFY, - arg->princ, NULL)) { + if (!cmp_gss_krb5_name(handle, rqst2name(rqstp), arg->princ) && + (CHANGEPW_SERVICE(rqstp) + || !kadm5int_acl_check(handle->context, rqst2name(rqstp), ACL_MODIFY, + arg->princ, NULL))) { ret.code = KADM5_AUTH_MODIFY; log_unauth(funcname, prime_arg, &client_name, &service_name, rqstp); } else { diff --git a/src/tests/t_kadmin_acl.py b/src/tests/t_kadmin_acl.py index 1d7b1d098..32e57b896 100644 --- a/src/tests/t_kadmin_acl.py +++ b/src/tests/t_kadmin_acl.py @@ -260,6 +260,9 @@ if 'Operation requires ``modify\'\' privilege' not in out: out = kadmin_as(some_modify, 'purgekeys unselected') if 'Operation requires ``modify\'\' privilege' not in out: fail('purgekeys failure (target)') +out = kadmin_as(none, 'purgekeys none') +if 'Old keys for principal "none@KRBTEST.COM" purged' not in out: + fail('purgekeys success (self exemption)') delprinc('selected') delprinc('unselected') |