|
 |
afd354 |
From 684821fc68fd27ddcc5f809a37819edd35365a9d Mon Sep 17 00:00:00 2001
|
|
|
afd354 |
From: Isaac Boukris <iboukris@gmail.com>
|
|
|
afd354 |
Date: Sat, 1 Feb 2020 16:13:30 +0100
|
|
|
afd354 |
Subject: [PATCH] Put KDB authdata first
|
|
|
afd354 |
|
|
|
afd354 |
Windows services, as well as some versions of Samba, may refuse
|
|
|
afd354 |
tickets if the PAC is not in the first AD-IF-RELEVANT container. In
|
|
|
afd354 |
fetch_kdb_authdata(), change the merge order so that authdata from the
|
|
|
afd354 |
KDB module appears first.
|
|
|
afd354 |
|
|
|
afd354 |
[ghudson@mit.edu: added comment and clarified commit message]
|
|
|
afd354 |
|
|
|
afd354 |
ticket: 8872 (new)
|
|
|
afd354 |
tags: pullup
|
|
|
afd354 |
target_version: 1.18
|
|
|
afd354 |
target_version: 1.17-next
|
|
|
afd354 |
|
|
|
afd354 |
(cherry picked from commit 331fa4bdd34263ea20667a0f51338cb84357fdaa)
|
|
|
afd354 |
(cherry picked from commit 1678270de3fda699114122447b1f06b08fb4e53e)
|
|
|
afd354 |
---
|
|
|
afd354 |
src/kdc/kdc_authdata.c | 9 ++++++---
|
|
|
afd354 |
1 file changed, 6 insertions(+), 3 deletions(-)
|
|
|
afd354 |
|
|
|
afd354 |
diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c
|
|
|
afd354 |
index 1b067cb0b..616c3eadc 100644
|
|
|
afd354 |
--- a/src/kdc/kdc_authdata.c
|
|
|
afd354 |
+++ b/src/kdc/kdc_authdata.c
|
|
|
afd354 |
@@ -383,11 +383,14 @@ fetch_kdb_authdata(krb5_context context, unsigned int flags,
|
|
|
afd354 |
if (ret)
|
|
|
afd354 |
return (ret == KRB5_PLUGIN_OP_NOTSUPP) ? 0 : ret;
|
|
|
afd354 |
|
|
|
afd354 |
- /* Add the KDB authdata to the ticket, without copying or filtering. */
|
|
|
afd354 |
- ret = merge_authdata(context, db_authdata,
|
|
|
afd354 |
- &enc_tkt_reply->authorization_data, FALSE, FALSE);
|
|
|
afd354 |
+ /* Put the KDB authdata first in the ticket. A successful merge places the
|
|
|
afd354 |
+ * combined list in db_authdata and releases the old ticket authdata. */
|
|
|
afd354 |
+ ret = merge_authdata(context, enc_tkt_reply->authorization_data,
|
|
|
afd354 |
+ &db_authdata, FALSE, FALSE);
|
|
|
afd354 |
if (ret)
|
|
|
afd354 |
krb5_free_authdata(context, db_authdata);
|
|
|
afd354 |
+ else
|
|
|
afd354 |
+ enc_tkt_reply->authorization_data = db_authdata;
|
|
|
afd354 |
return ret;
|
|
|
afd354 |
}
|
|
|
afd354 |
|