[15897] in Kerberos-V5-bugs
[krbdev.mit.edu #8649] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Wed Mar 14 11:59:23 2018
Mail-followup-to: rt@krbdev.mit.edu
mail-copies-to: never
From: "Greg Hudson via RT" <rt-comment@KRBDEV-PROD-APP-1.mit.edu>
In-Reply-To: <rt-8649@krbdev.mit.edu>
Message-ID: <rt-8649-48292.14.1453947693324@krbdev.mit.edu>
To: "'AdminCc of krbdev.mit.edu Ticket #8649'":;
Date: Wed, 14 Mar 2018 11:59:09 -0400 (EDT)
Reply-To: rt-comment@KRBDEV-PROD-APP-1.mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Allow validation of PACs with enterprise names
In k5_pac_validate_client(), if we are verifying against an enterprise
principal, parse the PAC_CLIENT_INFO field as an enterprise principal.
This scenario may arise in the response to an S4U2Self request for an
enterprise principal, as the KDC does not appear to canonicalize the
client principal requested in PA-FOR-USER.
[ghudson@mit.edu: rewrote commit message; adjusted style]
https://github.com/krb5/krb5/commit/f876aab80a69f9b934cd7f4e2339e3815aa8c4bf
Author: Isaac Boukris <iboukris@gmail.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: f876aab80a69f9b934cd7f4e2339e3815aa8c4bf
Branch: master
src/lib/krb5/krb/pac.c | 9 +++++++--
1 files changed, 7 insertions(+), 2 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
