From ba31a9317bdef13d73e98afe493695601f91d134 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Thu, 29 Aug 2013 09:07:57 -0400 Subject: Don't change realm in find_alternate_tgs If a client makes a TGS request for a cross-realm TGS within a different realm from the one we normally serve (e.g. the KDC realm is X, and a client makes a TGS request for the server krbtgt/Y@Z), look for alternate TGS principals within the requested server realm, not the realm we normally serve. This change shouldn't break any working well-formed TGS requests, because changing the realm would trigger a failure in check_tgs_tgt. It may fix some corner cases when multiple realms are served out of the same KDB. But primarily, this change makes referrals and aliases easier to reason about, by eliminating a case where server->princ has a different realm from request->server after the call to search_sprinc(). --- src/kdc/do_tgs_req.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 6415e2880..e66badbba 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -1027,7 +1027,7 @@ find_alternate_tgs(kdc_realm_t *kdc_active_realm, krb5_principal princ, while (--pl2 > plist) { tmp = *krb5_princ_realm(kdc_context, *pl2); krb5_princ_set_realm(kdc_context, *pl2, - krb5_princ_realm(kdc_context, tgs_server)); + krb5_princ_realm(kdc_context, princ)); retval = db_get_svc_princ(kdc_context, *pl2, 0, &server, status); krb5_princ_set_realm(kdc_context, *pl2, &tmp); if (retval == KRB5_KDB_NOENTRY) -- cgit