|
 |
9991ea |
From 817e83837d249a63395d90ac47dc975a23f00c6c Mon Sep 17 00:00:00 2001
|
|
|
9991ea |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
9991ea |
Date: Tue, 25 Feb 2014 20:53:49 +0200
|
|
|
9991ea |
Subject: [PATCH 50/51] ipa-kdb: make sure we don't produce MS-PAC in case of
|
|
|
9991ea |
authdata flag cleared by admin
|
|
|
9991ea |
MIME-Version: 1.0
|
|
|
9991ea |
Content-Type: text/plain; charset=UTF-8
|
|
|
9991ea |
Content-Transfer-Encoding: 8bit
|
|
|
9991ea |
|
|
|
9991ea |
When admin clears authdata flag for the service principal, KDC will pass
|
|
|
9991ea |
NULL client pointer (service proxy) to the DAL driver.
|
|
|
9991ea |
|
|
|
9991ea |
Make sure we bail out correctly.
|
|
|
9991ea |
|
|
|
9991ea |
Reviewed-By: Tomáš Babej <tbabej@redhat.com>
|
|
|
9991ea |
Reviewed-By: Simo Sorce <ssorce@redhat.com>
|
|
|
9991ea |
---
|
|
|
9991ea |
daemons/ipa-kdb/ipa_kdb_mspac.c | 8 ++++++++
|
|
|
9991ea |
1 file changed, 8 insertions(+)
|
|
|
9991ea |
|
|
|
9991ea |
diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c
|
|
|
9991ea |
index 2a0480fff029d29fb56286d85108936f6c579901..9137cd5ad1e6166fd5d6e765fab2c8178ca0587c 100644
|
|
|
9991ea |
--- a/daemons/ipa-kdb/ipa_kdb_mspac.c
|
|
|
9991ea |
+++ b/daemons/ipa-kdb/ipa_kdb_mspac.c
|
|
|
9991ea |
@@ -1985,6 +1985,14 @@ krb5_error_code ipadb_sign_authdata(krb5_context context,
|
|
|
9991ea |
int result;
|
|
|
9991ea |
krb5_db_entry *client_entry = NULL;
|
|
|
9991ea |
|
|
|
9991ea |
+
|
|
|
9991ea |
+ /* When client is NULL, authdata flag on the service principal was cleared
|
|
|
9991ea |
+ * by an admin. We don't generate MS-PAC in this case */
|
|
|
9991ea |
+ if (client == NULL) {
|
|
|
9991ea |
+ *signed_auth_data = NULL;
|
|
|
9991ea |
+ return 0;
|
|
|
9991ea |
+ }
|
|
|
9991ea |
+
|
|
|
9991ea |
/* When using s4u2proxy client_princ actually refers to the proxied user
|
|
|
9991ea |
* while client->princ to the proxy service asking for the TGS on behalf
|
|
|
9991ea |
* of the proxied user. So always use client_princ in preference */
|
|
|
9991ea |
--
|
|
|
9991ea |
1.8.5.3
|
|
|
9991ea |
|