diff options
| author | Greg Hudson <ghudson@mit.edu> | 2015-09-03 12:38:44 -0400 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2015-12-09 17:27:41 -0500 |
| commit | 437fbad4bfb7176d304eed7cdc4b877afa6d9a7d (patch) | |
| tree | f90c78c23cd4e76fb87bbe6e97db98dcb512f87e | |
| parent | 52d1cadf0cec3882efe46335b3784a20c7d04cc2 (diff) | |
| download | krb5-437fbad4bfb7176d304eed7cdc4b877afa6d9a7d.zip krb5-437fbad4bfb7176d304eed7cdc4b877afa6d9a7d.tar.gz krb5-437fbad4bfb7176d304eed7cdc4b877afa6d9a7d.tar.bz2 | |
Fix KDC client referrals
Although our built-in KDB modules do not support client referrals for
AS requests, the KDC is supposed to return one if a third-party module
returns a DB entry containing a principal in a foreign realm.
Unfortunately, this code has never worked; in prepare_error_as(), we
erroneously compare the protocol code errcode against the com_err code
KRB5KDC_ERR_WRONG_REALM; as a result, we never supply the canonical
client principal. Fix this by comparing errcode against the protocol
code KDC_ERR_WRONG_REALM instead.
Discovered by Alexander Bokovoy and Simo Sorce.
(cherry picked from commit 4e036ef4127a9b09d1a567472da1df24c55cdb89)
ticket: 8312 (new)
version_fixed: 1.12.5
status: resolved
| -rw-r--r-- | src/kdc/do_as_req.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index 95c3e23..fa54c5d 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -805,7 +805,7 @@ prepare_error_as (struct kdc_request_state *rstate, krb5_kdc_req *request, return retval; errpkt.error = error; errpkt.server = request->server; - errpkt.client = (error == KRB5KDC_ERR_WRONG_REALM) ? canon_client : + errpkt.client = (error == KDC_ERR_WRONG_REALM) ? canon_client : request->client; errpkt.text = string2data((char *)status); |