From ede01c14e58a98af728152635e5d75be0deb389d Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 25 Feb 2014 17:50:55 +0200 Subject: [PATCH 49/51] ipa-kdb: in case of delegation use original client's database entry, not the proxy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://fedorahosted.org/freeipa/ticket/4195 Reviewed-By: Tomáš Babej Reviewed-By: Simo Sorce --- daemons/ipa-kdb/ipa_kdb_mspac.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c index ff67391538234e2272ea1ec886ec96fa88ea579b..2a0480fff029d29fb56286d85108936f6c579901 100644 --- a/daemons/ipa-kdb/ipa_kdb_mspac.c +++ b/daemons/ipa-kdb/ipa_kdb_mspac.c @@ -1983,12 +1983,14 @@ krb5_error_code ipadb_sign_authdata(krb5_context context, bool with_pac; bool with_pad; int result; + krb5_db_entry *client_entry = NULL; /* When using s4u2proxy client_princ actually refers to the proxied user * while client->princ to the proxy service asking for the TGS on behalf * of the proxied user. So always use client_princ in preference */ if (client_princ != NULL) { ks_client_princ = client_princ; + kerr = ipadb_get_principal(context, client_princ, flags, &client_entry); } else { ks_client_princ = client->princ; } @@ -2025,7 +2027,7 @@ krb5_error_code ipadb_sign_authdata(krb5_context context, } } - kerr = ipadb_get_pac(context, client, &pac); + kerr = ipadb_get_pac(context, client_entry ? client_entry : client, &pac); if (kerr != 0 && kerr != ENOENT) { goto done; } @@ -2041,7 +2043,7 @@ krb5_error_code ipadb_sign_authdata(krb5_context context, /* check or generate pac data */ if ((pac_auth_data == NULL) || (pac_auth_data[0] == NULL)) { if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { - kerr = ipadb_get_pac(context, client, &pac); + kerr = ipadb_get_pac(context, client_entry ? client_entry : client, &pac); if (kerr != 0 && kerr != ENOENT) { goto done; } @@ -2094,6 +2096,9 @@ krb5_error_code ipadb_sign_authdata(krb5_context context, kerr = 0; done: + if (client_entry != NULL) { + ipadb_free_principal(context, client_entry); + } krb5_pac_free(context, pac); return kerr; } -- 1.8.5.3