[7976] in Kerberos
Re: kpasswd problem
daemon@ATHENA.MIT.EDU (Ken Hornstein)
Mon Sep 16 12:29:08 1996
To: vonb@charlie.cns.iit.edu (Robert Von Borstel)
Cc: kerberos@MIT.EDU
In-Reply-To: Your message of "13 Sep 1996 16:11:54 CDT."
<51cimq$snd@charlie.cns.iit.edu>
Date: Mon, 16 Sep 1996 12:06:19 -0400
From: Ken Hornstein <kenh@cmf.nrl.navy.mil>
>The problem definitely seems to be with the afs subkey. When I delete
>'des:afs3' from the supported_enctypes in the kdc.conf file, kpasswd
>works fine.
There is a nasty problem in src/lib/kdb/kdb_cpw.c. Around line 400 you'll
see:
case KRB5_KDB_SALTTYPE_AFS3: {
krb5_data * saltdata;
if (retval = krb5_copy_data(context, krb5_princ_realm(context,
db_entry->princ), &saltdata))
return(retval);
key_salt.data = *saltdata;
/* key_salt.data.length = -1; *//*length actually used below...*/
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This is the problem. Setting the length to -1 is how the string2key function
knows to use the AFS string-to-key function. What should happen is the length
should be set to -1, string_to_key should be called, and the length should then
be set back to the correct value.
I don't have time to generate a patch this second, but it should be easy enough
to fix. However, I would say that as a workaround, you don't need des:afs3
type keys unless you plan on migrating your database to an AFS KA database.
--Ken
