diff options
| author | Greg Hudson <ghudson@mit.edu> | 2021-06-07 15:00:41 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2021-06-08 22:45:42 -0400 |
| commit | dcb79089276624d7ddf44e08d35bd6d7d7e557d2 (patch) | |
| tree | e7ee8089a1b957053fca417969d8655fa0d58437 | |
| parent | 5e6a6efc5df689d9fb8730d0227167ffbb6ece0e (diff) | |
| download | krb5-dcb79089276624d7ddf44e08d35bd6d7d7e557d2.zip krb5-dcb79089276624d7ddf44e08d35bd6d7d7e557d2.tar.gz krb5-dcb79089276624d7ddf44e08d35bd6d7d7e557d2.tar.bz2 | |
Fix kadmin -k with fallback or referral realm
kadmin -k produces a client principal name with
krb5_sname_to_principal(), but it gets converted to a string and back
due to the signature of kadm5_init_with_skey(), which loses track of
the name type, so no canonicalization is performed.
In libkadm5clnt initialization, recognize the important subset of this
case--an empty realm indicates either fallback processing or the
referral realm--and restore the host-based name type so that the
client principal can be canonicalized against the keytab.
ticket: 9013 (new)
| -rw-r--r-- | src/lib/kadm5/clnt/client_init.c | 7 | ||||
| -rw-r--r-- | src/tests/t_kadmin.py | 12 |
2 files changed, 19 insertions, 0 deletions
diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c index aa1223b..0aaca70 100644 --- a/src/lib/kadm5/clnt/client_init.c +++ b/src/lib/kadm5/clnt/client_init.c @@ -221,9 +221,16 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, return KADM5_MISSING_KRB5_CONF_PARAMS; } + /* + * Parse the client name. If it has an empty realm, it is almost certainly + * a host-based principal using DNS fallback processing or the referral + * realm, so give it the appropriate name type for canonicalization. + */ code = krb5_parse_name(handle->context, client_name, &client); if (code) goto error; + if (init_type == INIT_SKEY && client->realm.length == 0) + client->type = KRB5_NT_SRV_HST; /* * Get credentials. Also does some fallbacks in case kadmin/fqdn diff --git a/src/tests/t_kadmin.py b/src/tests/t_kadmin.py index fe6a3cc..98453d9 100644 --- a/src/tests/t_kadmin.py +++ b/src/tests/t_kadmin.py @@ -51,4 +51,16 @@ for i in range(200): realm.run_kadmin(['addprinc', '-randkey', 'foo%d' % i]) realm.run_kadmin(['listprincs'], expected_msg='foo199') +# Test kadmin -k with the default principal, with and without +# fallback. This operation requires canonicalization against the +# keytab in krb5_get_init_creds_keytab() as the +# krb5_sname_to_principal() result won't have a realm. Try with and +# without without fallback processing since the code paths are +# different. +mark('kadmin -k') +realm.run([kadmin, '-k', 'getprinc', realm.host_princ]) +no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}} +no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf) +realm.run([kadmin, '-k', 'getprinc', realm.host_princ], env=no_canon) + success('kadmin and kpasswd tests') |