diff options
| author | Isaac Boukris <iboukris@gmail.com> | 2018-09-15 10:28:48 +0300 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2018-10-29 20:52:35 -0400 |
| commit | 505622085c5487bfbae0ca3dde47af9add9781bb (patch) | |
| tree | 3e40b07663a27b74583713927bb3e63812ba2799 | |
| parent | 697458053ed317364ee507c9497e148e9d1aa7ab (diff) | |
| download | krb5-505622085c5487bfbae0ca3dde47af9add9781bb.zip krb5-505622085c5487bfbae0ca3dde47af9add9781bb.tar.gz krb5-505622085c5487bfbae0ca3dde47af9add9781bb.tar.bz2 | |
Don't rely on default realm in S4U2Self client
When converting server principal to enterprise name (to be possibly
used for cross-realm), ignore the realm when reparsing, to avoid a
spurious error if a default realm isn't configured.
[ghudson@mit.edu: added rewritten test case; edited commit message]
(cherry picked from commit 13967567ca65a306c2d5fcb4a4aff71fb422cd80)
ticket: 8741
version_fixed: 1.15.4
| -rw-r--r-- | src/lib/krb5/krb/s4u_creds.c | 4 | ||||
| -rwxr-xr-x | src/tests/gssapi/t_s4u.py | 6 |
2 files changed, 8 insertions, 2 deletions
diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c index ed05b67..91c02aa 100644 --- a/src/lib/krb5/krb/s4u_creds.c +++ b/src/lib/krb5/krb/s4u_creds.c @@ -452,7 +452,9 @@ convert_to_enterprise(krb5_context context, krb5_principal princ, code = krb5_unparse_name(context, princ, &str); if (code != 0) return code; - code = krb5_parse_name_flags(context, str, KRB5_PRINCIPAL_PARSE_ENTERPRISE, + code = krb5_parse_name_flags(context, str, + KRB5_PRINCIPAL_PARSE_ENTERPRISE | + KRB5_PRINCIPAL_PARSE_IGNORE_REALM, eprinc_out); krb5_free_unparsed_name(context, str); return code; diff --git a/src/tests/gssapi/t_s4u.py b/src/tests/gssapi/t_s4u.py index 7366e39..07e6d5a 100755 --- a/src/tests/gssapi/t_s4u.py +++ b/src/tests/gssapi/t_s4u.py @@ -146,9 +146,13 @@ realm.stop() # Exercise cross-realm S4U2Self. The query in the foreign realm will # fail, but we can check that the right server principal was used. +# Include a regression test for #8741 by unsetting the default realm. r1, r2 = cross_realms(2, create_user=False) r1.run([kinit, '-k', r1.host_princ]) -out = r1.run(['./t_s4u', 'p:' + r2.host_princ], expected_code=1) +remove_default = {'libdefaults': {'default_realm': None}} +no_default = r1.special_env('no_default', False, krb5_conf=remove_default) +out = r1.run(['./t_s4u', 'p:' + r2.host_princ], expected_code=1, + env=no_default) if 'Server not found in Kerberos database' not in out: fail('cross-realm s4u2self (t_s4u output)') r1.stop() |