|
 |
ecf709 |
From 04a1802749b6ebf72730357b06bf8cabe09ebb01 Mon Sep 17 00:00:00 2001
|
|
|
ecf709 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
ecf709 |
Date: Wed, 24 May 2017 16:10:26 +0200
|
|
|
ecf709 |
Subject: [PATCH 139/141] krb5: accept changed principal if
|
|
|
ecf709 |
krb5_canonicalize=True
|
|
|
ecf709 |
|
|
|
ecf709 |
Currently SSSD accepts significant changes in the principal only if
|
|
|
ecf709 |
krb5_use_enterprise_principal=True. But canonicalization can lead to
|
|
|
ecf709 |
similar changes so they should be accepted in this case as well.
|
|
|
ecf709 |
|
|
|
ecf709 |
Resolves:
|
|
|
ecf709 |
https://pagure.io/SSSD/sssd/issue/3408
|
|
|
ecf709 |
|
|
|
ecf709 |
Reviewed-by: Robbie Harwood <rharwood@redhat.com>
|
|
|
ecf709 |
(cherry picked from commit ca95807a9060e454ee68f6f30558d6f7ee968c39)
|
|
|
ecf709 |
---
|
|
|
ecf709 |
src/providers/krb5/krb5_auth.c | 3 +++
|
|
|
ecf709 |
1 file changed, 3 insertions(+)
|
|
|
ecf709 |
|
|
|
ecf709 |
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
|
|
|
ecf709 |
index 894bd41bde031ac33187bfa3b14202e9429a9198..03ea9d88cac67919d4b9ba3a1cf2efa208662195 100644
|
|
|
ecf709 |
--- a/src/providers/krb5/krb5_auth.c
|
|
|
ecf709 |
+++ b/src/providers/krb5/krb5_auth.c
|
|
|
ecf709 |
@@ -829,6 +829,7 @@ static void krb5_auth_done(struct tevent_req *subreq)
|
|
|
ecf709 |
char *renew_interval_str;
|
|
|
ecf709 |
time_t renew_interval_time = 0;
|
|
|
ecf709 |
bool use_enterprise_principal;
|
|
|
ecf709 |
+ bool canonicalize;
|
|
|
ecf709 |
|
|
|
ecf709 |
ret = handle_child_recv(subreq, pd, &buf, &len;;
|
|
|
ecf709 |
talloc_zfree(subreq);
|
|
|
ecf709 |
@@ -908,6 +909,7 @@ static void krb5_auth_done(struct tevent_req *subreq)
|
|
|
ecf709 |
|
|
|
ecf709 |
use_enterprise_principal = dp_opt_get_bool(kr->krb5_ctx->opts,
|
|
|
ecf709 |
KRB5_USE_ENTERPRISE_PRINCIPAL);
|
|
|
ecf709 |
+ canonicalize = dp_opt_get_bool(kr->krb5_ctx->opts, KRB5_CANONICALIZE);
|
|
|
ecf709 |
|
|
|
ecf709 |
/* Check if the cases of our upn are correct and update it if needed.
|
|
|
ecf709 |
* Fail if the upn differs by more than just the case for non-enterprise
|
|
|
ecf709 |
@@ -915,6 +917,7 @@ static void krb5_auth_done(struct tevent_req *subreq)
|
|
|
ecf709 |
if (res->correct_upn != NULL &&
|
|
|
ecf709 |
strcmp(kr->upn, res->correct_upn) != 0) {
|
|
|
ecf709 |
if (strcasecmp(kr->upn, res->correct_upn) == 0 ||
|
|
|
ecf709 |
+ canonicalize == true ||
|
|
|
ecf709 |
use_enterprise_principal == true) {
|
|
|
ecf709 |
talloc_free(kr->upn);
|
|
|
ecf709 |
kr->upn = talloc_strdup(kr, res->correct_upn);
|
|
|
ecf709 |
--
|
|
|
ecf709 |
2.9.4
|
|
|
ecf709 |
|