[17123] in Kerberos-V5-bugs
[krbdev.mit.edu #9225] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Aug 17 17:02:04 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-922641-1787000517-384.9225-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9225":;
Date: Mon, 17 Aug 2026 17:01:57 -0400
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Aug 17 17:01:57 2026: Request 9225 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9225 >
Relax gss_init_sec_context() proxy self check
If the krb5 gss_init_sec_context() detects a proxy ccache, we check in
get_credentials() whether the requested server principal matches the
cache's impersonator principal. For a host-based server name, this
match will fail if krb5_sname_to_principal() yielded an empty realm,
as it does in most configurations.
As host-based principals generally only exist in one realm for a given
FQDN, we can ignore the realm for this comparison when the server name
is host-based.
[ghudson@mit.edu: rewrote comment and commit message; adjusted code to
use krb5_principal_compare_flags()]
https://github.com/krb5/krb5/commit/473b51b640bef2e97c490d6f2985658befa89c16
Author: Alexander Bokovoy <abokovoy@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 473b51b640bef2e97c490d6f2985658befa89c16
Branch: master
src/lib/gssapi/krb5/init_sec_context.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
