|
 |
9991ea |
From 4b7059b4f29832d98b4ff4f266007d007ca07a19 Mon Sep 17 00:00:00 2001
|
|
|
9991ea |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
9991ea |
Date: Fri, 28 Feb 2014 22:03:29 +0200
|
|
|
9991ea |
Subject: [PATCH] fix filtering of subdomain-based trust users
|
|
|
9991ea |
|
|
|
9991ea |
https://fedorahosted.org/freeipa/ticket/4207
|
|
|
9991ea |
---
|
|
|
9991ea |
daemons/ipa-kdb/ipa_kdb_mspac.c | 41 ++++++++++++++++++++++++++++++++---------
|
|
|
9991ea |
1 file changed, 32 insertions(+), 9 deletions(-)
|
|
|
9991ea |
|
|
|
9991ea |
diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c
|
|
|
9991ea |
index 9137cd5ad1e6166fd5d6e765fab2c8178ca0587c..68f27f0e2d9028cdaece80c4bd3440d0438d20db 100644
|
|
|
9991ea |
--- a/daemons/ipa-kdb/ipa_kdb_mspac.c
|
|
|
9991ea |
+++ b/daemons/ipa-kdb/ipa_kdb_mspac.c
|
|
|
9991ea |
@@ -806,6 +806,12 @@ static krb5_error_code ipadb_get_pac(krb5_context kcontext,
|
|
|
9991ea |
krb5_error_code kerr;
|
|
|
9991ea |
enum ndr_err_code ndr_err;
|
|
|
9991ea |
|
|
|
9991ea |
+ /* When no client entry is there, we cannot generate MS-PAC */
|
|
|
9991ea |
+ if (!client) {
|
|
|
9991ea |
+ *pac = NULL;
|
|
|
9991ea |
+ return 0;
|
|
|
9991ea |
+ }
|
|
|
9991ea |
+
|
|
|
9991ea |
ipactx = ipadb_get_context(kcontext);
|
|
|
9991ea |
if (!ipactx) {
|
|
|
9991ea |
return KRB5_KDB_DBNOTINITED;
|
|
|
9991ea |
@@ -1534,6 +1540,12 @@ static krb5_error_code ipadb_add_transited_service(krb5_context context,
|
|
|
9991ea |
uint32_t i;
|
|
|
9991ea |
char *tmpstr;
|
|
|
9991ea |
|
|
|
9991ea |
+ /* When proxy is NULL, authdata flag on the service principal was cleared
|
|
|
9991ea |
+ * by an admin. We don't generate MS-PAC in this case */
|
|
|
9991ea |
+ if (proxy == NULL) {
|
|
|
9991ea |
+ return 0;
|
|
|
9991ea |
+ }
|
|
|
9991ea |
+
|
|
|
9991ea |
tmpctx = talloc_new(NULL);
|
|
|
9991ea |
if (!tmpctx) {
|
|
|
9991ea |
kerr = ENOMEM;
|
|
|
9991ea |
@@ -1731,6 +1743,12 @@ static krb5_error_code ipadb_verify_pac(krb5_context context,
|
|
|
9991ea |
}
|
|
|
9991ea |
|
|
|
9991ea |
if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
|
|
|
9991ea |
+ if (proxy == NULL) {
|
|
|
9991ea |
+ *pac = NULL;
|
|
|
9991ea |
+ kerr = 0;
|
|
|
9991ea |
+ goto done;
|
|
|
9991ea |
+ }
|
|
|
9991ea |
+
|
|
|
9991ea |
kerr = ipadb_add_transited_service(context, proxy, server,
|
|
|
9991ea |
old_pac, new_pac);
|
|
|
9991ea |
if (kerr) {
|
|
|
9991ea |
@@ -1986,20 +2004,27 @@ krb5_error_code ipadb_sign_authdata(krb5_context context,
|
|
|
9991ea |
krb5_db_entry *client_entry = NULL;
|
|
|
9991ea |
|
|
|
9991ea |
|
|
|
9991ea |
- /* When client is NULL, authdata flag on the service principal was cleared
|
|
|
9991ea |
- * by an admin. We don't generate MS-PAC in this case */
|
|
|
9991ea |
- if (client == NULL) {
|
|
|
9991ea |
- *signed_auth_data = NULL;
|
|
|
9991ea |
- return 0;
|
|
|
9991ea |
- }
|
|
|
9991ea |
+ is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
|
|
|
9991ea |
|
|
|
9991ea |
/* When using s4u2proxy client_princ actually refers to the proxied user
|
|
|
9991ea |
* while client->princ to the proxy service asking for the TGS on behalf
|
|
|
9991ea |
* of the proxied user. So always use client_princ in preference */
|
|
|
9991ea |
if (client_princ != NULL) {
|
|
|
9991ea |
ks_client_princ = client_princ;
|
|
|
9991ea |
- kerr = ipadb_get_principal(context, client_princ, flags, &client_entry);
|
|
|
9991ea |
+ if (!is_as_req) {
|
|
|
9991ea |
+ kerr = ipadb_get_principal(context, client_princ, flags, &client_entry);
|
|
|
9991ea |
+ /* If we didn't find client_princ in our database, it might be:
|
|
|
9991ea |
+ * - a principal from another realm, handle it down in ipadb_get/verify_pac()
|
|
|
9991ea |
+ */
|
|
|
9991ea |
+ if (!kerr) {
|
|
|
9991ea |
+ client_entry = NULL;
|
|
|
9991ea |
+ }
|
|
|
9991ea |
+ }
|
|
|
9991ea |
} else {
|
|
|
9991ea |
+ if (client == NULL) {
|
|
|
9991ea |
+ *signed_auth_data = NULL;
|
|
|
9991ea |
+ return 0;
|
|
|
9991ea |
+ }
|
|
|
9991ea |
ks_client_princ = client->princ;
|
|
|
9991ea |
}
|
|
|
9991ea |
|
|
|
9991ea |
@@ -2014,8 +2039,6 @@ krb5_error_code ipadb_sign_authdata(krb5_context context,
|
|
|
9991ea |
"currently not supported.");
|
|
|
9991ea |
}
|
|
|
9991ea |
|
|
|
9991ea |
- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
|
|
|
9991ea |
-
|
|
|
9991ea |
if (is_as_req && with_pac && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) {
|
|
|
9991ea |
/* Be aggressive here: special case for discovering range type
|
|
|
9991ea |
* immediately after establishing the trust by IPA framework */
|
|
|
9991ea |
--
|
|
|
9991ea |
1.8.5.3
|
|
|
9991ea |
|