[29058] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.13]: Fix KDC client referrals
daemon@ATHENA.MIT.EDU (Tom Yu)
Wed Sep 16 17:29:38 2015
Date: Wed, 16 Sep 2015 17:27:31 -0400
From: Tom Yu <tlyu@mit.edu>
Message-Id: <201509162127.t8GLRVJT029453@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/0ab7ca1d886be6223b59dc7948f7500f8872f3da
commit 0ab7ca1d886be6223b59dc7948f7500f8872f3da
Author: Greg Hudson <ghudson@mit.edu>
Date: Thu Sep 3 12:38:44 2015 -0400
Fix KDC client referrals
Although our built-in KDB modules do not support client referrals for
AS requests, the KDC is supposed to return one if a third-party module
returns a DB entry containing a principal in a foreign realm.
Unfortunately, this code has never worked; in prepare_error_as(), we
erroneously compare the protocol code errcode against the com_err code
KRB5KDC_ERR_WRONG_REALM; as a result, we never supply the canonical
client principal. Fix this by comparing errcode against the protocol
code KDC_ERR_WRONG_REALM instead.
Discovered by Alexander Bokovoy and Simo Sorce.
(cherry picked from commit 4e036ef4127a9b09d1a567472da1df24c55cdb89)
ticket: 8241
version_fixed: 1.13.3
status: resolved
src/kdc/do_as_req.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index a1db924..2db0d2e 100644
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -795,7 +795,7 @@ prepare_error_as (struct kdc_request_state *rstate, krb5_kdc_req *request,
return retval;
errpkt.error = error;
errpkt.server = request->server;
- errpkt.client = (error == KRB5KDC_ERR_WRONG_REALM) ? canon_client :
+ errpkt.client = (error == KDC_ERR_WRONG_REALM) ? canon_client :
request->client;
errpkt.text = string2data((char *)status);
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5