diff options
| author | Greg Hudson <ghudson@mit.edu> | 2013-05-20 11:03:04 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2013-05-21 11:03:13 -0400 |
| commit | 57acee11b5c6682a7f4f036e35d8b2fc9292875e (patch) | |
| tree | 6f198386b2591b8d8495f6c8260b4f905360ddfb /src/include/CredentialsCache.h | |
| parent | e818d27a372d021bc6025e7bce867ed06a8fc1ad (diff) | |
| download | krb5-57acee11b5c6682a7f4f036e35d8b2fc9292875e.tar.gz krb5-57acee11b5c6682a7f4f036e35d8b2fc9292875e.tar.xz krb5-57acee11b5c6682a7f4f036e35d8b2fc9292875e.zip | |
Fix transited handling for GSSAPI acceptors
The Acceptor Names project (#6855) extended krb5_rd_req so that it can
accept a "matching principal" in the server parameter. If the
matching principal has an empty realm, rd_req_decoded_opt attempted to
do transited checking with an empty server realm.
To fix this, always reset server to req->ticket->server for future
processing steps if we decrypt the ticket using a keytab.
decrypt_ticket replaces req->ticket->server with the principal name
from the keytab entry, so we know this name is correct.
Based on a bug report and patch from nalin@redhat.com.
ticket: 7639
target_version: 1.11.3
tags: pullup
Diffstat (limited to 'src/include/CredentialsCache.h')
0 files changed, 0 insertions, 0 deletions