diff options
| author | Greg Hudson <ghudson@mit.edu> | 2011-02-07 18:40:00 +0000 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2011-02-07 18:40:00 +0000 |
| commit | 66587fcd6380eac2c53674df4f64a827d337aee5 (patch) | |
| tree | e3e98004479a87b3f1e1171056464f3a6be65d95 /src/include | |
| parent | 1b46b254240d95534b7a3ee1f45ac85f6c38db1b (diff) | |
| download | krb5-66587fcd6380eac2c53674df4f64a827d337aee5.tar.gz krb5-66587fcd6380eac2c53674df4f64a827d337aee5.tar.xz krb5-66587fcd6380eac2c53674df4f64a827d337aee5.zip | |
Improve acceptor name flexibility
Be more flexible about the principal names we will accept for a given
GSS acceptor name. Also add support for a new libdefaults profile
variable ignore_acceptor_hostname, which causes the hostnames of
host-based service principals to be ignored when passed by server
applications as acceptor names.
Note that we still always invoke krb5_sname_to_principal() when
importing a gss-krb5 mechanism name, even though we won't always use
the result. This is an unfortunate waste of getaddrinfo/getnameinfo
queries in some situations, but the code surgery necessary to defer
it appears too risky at this time.
The project proposal for this change is at:
http://k5wiki.kerberos.org/wiki/Projects/Acceptor_Names
ticket: 6855
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24616 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/include')
| -rw-r--r-- | src/include/k5-int.h | 2 | ||||
| -rw-r--r-- | src/include/krb5/krb5.hin | 16 |
2 files changed, 18 insertions, 0 deletions
diff --git a/src/include/k5-int.h b/src/include/k5-int.h index d188f8e9d..92ff1f043 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -217,6 +217,7 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses" #define KRB5_CONF_FORWARDABLE "forwardable" #define KRB5_CONF_HOST_BASED_SERVICES "host_based_services" +#define KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME "ignore_acceptor_hostname" #define KRB5_CONF_IPROP_ENABLE "iprop_enable" #define KRB5_CONF_IPROP_MASTER_ULOGSIZE "iprop_master_ulogsize" #define KRB5_CONF_IPROP_PORT "iprop_port" @@ -1600,6 +1601,7 @@ struct _krb5_context { struct _kdb_log_context *kdblog_context; krb5_boolean allow_weak_crypto; + krb5_boolean ignore_acceptor_hostname; krb5_trace_callback trace_callback; void *trace_callback_data; diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin index adf670082..14c4a9e41 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -4284,6 +4284,22 @@ krb5_error_code KRB5_CALLCONV krb5_sname_to_principal(krb5_context context, const char *hostname, const char *sname, krb5_int32 type, krb5_principal *ret_princ); +/** Return true if @a princ matches @a matching, false otherwise. + * + * A matching principal is a host-based principal with an empty realm and/or + * second data component (hostname). Profile configuration may cause the + * hostname to be ignored even if it is present. A principal matches a + * matching principal if the principal has the same non-empty (and non-ignored) + * components of the matching principal. + * + * If @a matching is NULL, return true. If @a matching is not a matching + * principal, return the value of krb5_principal_compare(context, matching, + * princ). + */ +krb5_boolean KRB5_CALLCONV +krb5_sname_match(krb5_context context, krb5_const_principal matching, + krb5_const_principal princ); + /** * @brief Change the password for an existing Kerberos account. * |