|
 |
5af5b2 |
commit 0406cd81ef9d18cd505fffabba3ac78901dc797d
|
|
|
5af5b2 |
Author: Greg Hudson <ghudson@mit.edu>
|
|
|
5af5b2 |
Date: Wed Sep 25 10:40:23 2013 -0400
|
|
|
5af5b2 |
|
|
|
5af5b2 |
Support authoritative KDB check_transited methods
|
|
|
5af5b2 |
|
|
|
5af5b2 |
In kdc_check_transited_list, consult the KDB module first. If it
|
|
|
5af5b2 |
succeeds, treat this as authoritative and do not use the core
|
|
|
5af5b2 |
transited mechanisms. Modules can return KRB5_PLUGIN_NO_HANDLE to
|
|
|
5af5b2 |
fall back to core mechanisms.
|
|
|
5af5b2 |
|
|
|
5af5b2 |
ticket: 7709
|
|
|
5af5b2 |
|
|
|
5af5b2 |
diff --git a/src/include/kdb.h b/src/include/kdb.h
|
|
|
5af5b2 |
index bc01976..69817bc 100644
|
|
|
5af5b2 |
--- a/src/include/kdb.h
|
|
|
5af5b2 |
+++ b/src/include/kdb.h
|
|
|
5af5b2 |
@@ -1261,8 +1261,9 @@ typedef struct _kdb_vftabl {
|
|
|
5af5b2 |
|
|
|
5af5b2 |
/*
|
|
|
5af5b2 |
* Optional: Perform a policy check on a cross-realm ticket's transited
|
|
|
5af5b2 |
- * field and return an error (other than KRB5_PLUGIN_OP_NOTSUPP) if the
|
|
|
5af5b2 |
- * check fails.
|
|
|
5af5b2 |
+ * field. Return 0 if the check authoritatively succeeds,
|
|
|
5af5b2 |
+ * KRB5_PLUGIN_NO_HANDLE to use the core transited-checking mechanisms, or
|
|
|
5af5b2 |
+ * another error (other than KRB5_PLUGIN_OP_NOTSUPP) if the check fails.
|
|
|
5af5b2 |
*/
|
|
|
5af5b2 |
krb5_error_code (*check_transited_realms)(krb5_context kcontext,
|
|
|
5af5b2 |
const krb5_data *tr_contents,
|
|
|
5af5b2 |
diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
|
|
|
5af5b2 |
index bc638c1..5409078 100644
|
|
|
5af5b2 |
--- a/src/kdc/kdc_util.c
|
|
|
5af5b2 |
+++ b/src/kdc/kdc_util.c
|
|
|
5af5b2 |
@@ -1573,16 +1573,14 @@ kdc_check_transited_list(kdc_realm_t *kdc_active_realm,
|
|
|
5af5b2 |
{
|
|
|
5af5b2 |
krb5_error_code code;
|
|
|
5af5b2 |
|
|
|
5af5b2 |
- /* Check using krb5.conf */
|
|
|
5af5b2 |
- code = krb5_check_transited_list(kdc_context, trans, realm1, realm2);
|
|
|
5af5b2 |
- if (code)
|
|
|
5af5b2 |
+ /* Check against the KDB module. Treat this answer as authoritative if the
|
|
|
5af5b2 |
+ * method is supported and doesn't explicitly pass control. */
|
|
|
5af5b2 |
+ code = krb5_db_check_transited_realms(kdc_context, trans, realm1, realm2);
|
|
|
5af5b2 |
+ if (code != KRB5_PLUGIN_OP_NOTSUPP && code != KRB5_PLUGIN_NO_HANDLE)
|
|
|
5af5b2 |
return code;
|
|
|
5af5b2 |
|
|
|
5af5b2 |
- /* Check against the KDB module. */
|
|
|
5af5b2 |
- code = krb5_db_check_transited_realms(kdc_context, trans, realm1, realm2);
|
|
|
5af5b2 |
- if (code == KRB5_PLUGIN_OP_NOTSUPP)
|
|
|
5af5b2 |
- code = 0;
|
|
|
5af5b2 |
- return code;
|
|
|
5af5b2 |
+ /* Check using krb5.conf [capaths] or hierarchical relationships. */
|
|
|
5af5b2 |
+ return krb5_check_transited_list(kdc_context, trans, realm1, realm2);
|
|
|
5af5b2 |
}
|
|
|
5af5b2 |
|
|
|
5af5b2 |
krb5_error_code
|