|
 |
9c4c6b |
From 61f3943f9fc237936ed9fd098edcd8dcc43b8da7 Mon Sep 17 00:00:00 2001
|
|
|
9c4c6b |
From: Greg Hudson <ghudson@mit.edu>
|
|
|
9c4c6b |
Date: Wed, 6 May 2020 16:03:13 -0400
|
|
|
9c4c6b |
Subject: [PATCH] Omit KDC indicator check for S4U2Self requests
|
|
|
9c4c6b |
|
|
|
9c4c6b |
As there was no initial ticket exchange from the client for an
|
|
|
9c4c6b |
S4U2Self request, the auth indicator check is inapplicable (and would
|
|
|
9c4c6b |
always fail if any auth indicators are required).
|
|
|
9c4c6b |
|
|
|
9c4c6b |
ticket: 8902 (new)
|
|
|
9c4c6b |
(cherry picked from commit 183631fbf72351c2d5fc7d60b2d9fc4d09fe7465)
|
|
|
9c4c6b |
(cherry picked from commit 442f1fa5b2e4034954a51048414cc0863b914379)
|
|
|
9c4c6b |
---
|
|
|
9c4c6b |
src/kdc/do_tgs_req.c | 14 +++++++-------
|
|
|
9c4c6b |
1 file changed, 7 insertions(+), 7 deletions(-)
|
|
|
9c4c6b |
|
|
|
9c4c6b |
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
|
|
|
9c4c6b |
index 241f34e2a..463a9c0dd 100644
|
|
|
9c4c6b |
--- a/src/kdc/do_tgs_req.c
|
|
|
9c4c6b |
+++ b/src/kdc/do_tgs_req.c
|
|
|
9c4c6b |
@@ -392,8 +392,8 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
|
|
|
9c4c6b |
}
|
|
|
9c4c6b |
authtime = subject_tkt->times.authtime;
|
|
|
9c4c6b |
|
|
|
9c4c6b |
- /* Extract auth indicators from the subject ticket, except for S4U2Self
|
|
|
9c4c6b |
- * requests (where the client didn't authenticate). */
|
|
|
9c4c6b |
+ /* Extract and check auth indicators from the subject ticket, except for
|
|
|
9c4c6b |
+ * S4U2Self requests (where the client didn't authenticate). */
|
|
|
9c4c6b |
if (s4u_x509_user == NULL) {
|
|
|
9c4c6b |
errcode = get_auth_indicators(kdc_context, subject_tkt, local_tgt,
|
|
|
9c4c6b |
&local_tgt_key, &auth_indicators);
|
|
|
9c4c6b |
@@ -401,12 +401,12 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
|
|
|
9c4c6b |
status = "GET_AUTH_INDICATORS";
|
|
|
9c4c6b |
goto cleanup;
|
|
|
9c4c6b |
}
|
|
|
9c4c6b |
- }
|
|
|
9c4c6b |
|
|
|
9c4c6b |
- errcode = check_indicators(kdc_context, server, auth_indicators);
|
|
|
9c4c6b |
- if (errcode) {
|
|
|
9c4c6b |
- status = "HIGHER_AUTHENTICATION_REQUIRED";
|
|
|
9c4c6b |
- goto cleanup;
|
|
|
9c4c6b |
+ errcode = check_indicators(kdc_context, server, auth_indicators);
|
|
|
9c4c6b |
+ if (errcode) {
|
|
|
9c4c6b |
+ status = "HIGHER_AUTHENTICATION_REQUIRED";
|
|
|
9c4c6b |
+ goto cleanup;
|
|
|
9c4c6b |
+ }
|
|
|
9c4c6b |
}
|
|
|
9c4c6b |
|
|
|
9c4c6b |
if (is_referral)
|