diff options
| author | Greg Hudson <ghudson@mit.edu> | 2013-08-29 09:07:57 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2013-08-29 09:11:48 -0400 |
| commit | ba31a9317bdef13d73e98afe493695601f91d134 (patch) | |
| tree | 41fbde84e067b6c23c478bb049aa5c3e4e287d4b /src | |
| parent | dec685691b3955b27c56b629da829b9e6cf0d789 (diff) | |
| download | krb5-ba31a9317bdef13d73e98afe493695601f91d134.tar.gz krb5-ba31a9317bdef13d73e98afe493695601f91d134.tar.xz krb5-ba31a9317bdef13d73e98afe493695601f91d134.zip | |
Don't change realm in find_alternate_tgs
If a client makes a TGS request for a cross-realm TGS within a
different realm from the one we normally serve (e.g. the KDC realm is
X, and a client makes a TGS request for the server krbtgt/Y@Z), look
for alternate TGS principals within the requested server realm, not
the realm we normally serve.
This change shouldn't break any working well-formed TGS requests,
because changing the realm would trigger a failure in check_tgs_tgt.
It may fix some corner cases when multiple realms are served out of
the same KDB. But primarily, this change makes referrals and aliases
easier to reason about, by eliminating a case where server->princ has
a different realm from request->server after the call to
search_sprinc().
Diffstat (limited to 'src')
| -rw-r--r-- | src/kdc/do_tgs_req.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 6415e2880..e66badbba 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -1027,7 +1027,7 @@ find_alternate_tgs(kdc_realm_t *kdc_active_realm, krb5_principal princ, while (--pl2 > plist) { tmp = *krb5_princ_realm(kdc_context, *pl2); krb5_princ_set_realm(kdc_context, *pl2, - krb5_princ_realm(kdc_context, tgs_server)); + krb5_princ_realm(kdc_context, princ)); retval = db_get_svc_princ(kdc_context, *pl2, 0, &server, status); krb5_princ_set_realm(kdc_context, *pl2, &tmp); if (retval == KRB5_KDB_NOENTRY) |