|
 |
a53771 |
From 4c2f596da5ddb8a1687a4f9c969d5a8dcd2cbcc7 Mon Sep 17 00:00:00 2001
|
|
|
a53771 |
From: Robbie Harwood <rharwood@redhat.com>
|
|
|
a53771 |
Date: Thu, 3 Jun 2021 16:03:07 -0400
|
|
|
a53771 |
Subject: [PATCH] Allow kinit with keytab to defer canonicalization
|
|
|
a53771 |
|
|
|
a53771 |
[ghudson@mit.edu: added tests]
|
|
|
a53771 |
|
|
|
a53771 |
ticket: 9012 (new)
|
|
|
a53771 |
(cherry picked from commit 5e6a6efc5df689d9fb8730d0227167ffbb6ece0e)
|
|
|
a53771 |
(cherry picked from commit 090c7319652466339e3e6482bdd1b5a294638dff)
|
|
|
a53771 |
---
|
|
|
a53771 |
src/clients/kinit/kinit.c | 11 -----------
|
|
|
a53771 |
src/tests/t_keytab.py | 13 +++++++++++++
|
|
|
a53771 |
2 files changed, 13 insertions(+), 11 deletions(-)
|
|
|
a53771 |
|
|
|
a53771 |
diff --git a/src/clients/kinit/kinit.c b/src/clients/kinit/kinit.c
|
|
|
a53771 |
index d1f5d74c3..5a6d7237c 100644
|
|
|
a53771 |
--- a/src/clients/kinit/kinit.c
|
|
|
a53771 |
+++ b/src/clients/kinit/kinit.c
|
|
|
a53771 |
@@ -510,17 +510,6 @@ k5_begin(struct k_opts *opts, struct k5_data *k5)
|
|
|
a53771 |
_("when creating default server principal name"));
|
|
|
a53771 |
goto cleanup;
|
|
|
a53771 |
}
|
|
|
a53771 |
- if (k5->me->realm.data[0] == 0) {
|
|
|
a53771 |
- ret = krb5_unparse_name(k5->ctx, k5->me, &k5->name);
|
|
|
a53771 |
- if (ret == 0) {
|
|
|
a53771 |
- com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN,
|
|
|
a53771 |
- _("(principal %s)"), k5->name);
|
|
|
a53771 |
- } else {
|
|
|
a53771 |
- com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN,
|
|
|
a53771 |
- _("for local services"));
|
|
|
a53771 |
- }
|
|
|
a53771 |
- goto cleanup;
|
|
|
a53771 |
- }
|
|
|
a53771 |
} else if (k5->out_cc != NULL) {
|
|
|
a53771 |
/* If the output ccache is initialized, use its principal. */
|
|
|
a53771 |
if (krb5_cc_get_principal(k5->ctx, k5->out_cc, &princ) == 0)
|
|
|
a53771 |
diff --git a/src/tests/t_keytab.py b/src/tests/t_keytab.py
|
|
|
a53771 |
index 850375c92..a9adebb26 100755
|
|
|
a53771 |
--- a/src/tests/t_keytab.py
|
|
|
a53771 |
+++ b/src/tests/t_keytab.py
|
|
|
a53771 |
@@ -41,6 +41,19 @@ realm.kinit(realm.user_princ, flags=['-i'],
|
|
|
a53771 |
expected_msg='keytab specified, forcing -k')
|
|
|
a53771 |
realm.klist(realm.user_princ)
|
|
|
a53771 |
|
|
|
a53771 |
+# Test default principal for -k. This operation requires
|
|
|
a53771 |
+# canonicalization against the keytab in krb5_get_init_creds_keytab()
|
|
|
a53771 |
+# as the krb5_sname_to_principal() result won't have a realm. Try
|
|
|
a53771 |
+# with and without without fallback processing since the code paths
|
|
|
a53771 |
+# are different.
|
|
|
a53771 |
+mark('default principal for -k')
|
|
|
a53771 |
+realm.run([kinit, '-k'])
|
|
|
a53771 |
+realm.klist(realm.host_princ)
|
|
|
a53771 |
+no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}}
|
|
|
a53771 |
+no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf)
|
|
|
a53771 |
+realm.run([kinit, '-k'], env=no_canon)
|
|
|
a53771 |
+realm.klist(realm.host_princ)
|
|
|
a53771 |
+
|
|
|
a53771 |
# Test extracting keys with multiple key versions present.
|
|
|
a53771 |
mark('multi-kvno extract')
|
|
|
a53771 |
os.remove(realm.keytab)
|