When returning constrained delegation creds, don't require they

be explicitly passed to gss_acquire_cred_impersonate_cred();
they can now be passed directly to gss_init_sec_context().

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u@22565 dc483132-0cff-0310-8789-dd5450dbe970

4 files changed, 17 insertions, 28 deletions

diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
index 9ae0b0b..d61fc4c 100644
--- a/src/lib/gssapi/krb5/accept_sec_context.c
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
@@ -115,8 +115,9 @@
 #ifndef LEAN_CLIENT
 
 static krb5_error_code
-create_constrained_deleg_creds(context, ticket, out_cred)
+create_constrained_deleg_creds(context, verifier_cred, ticket, out_cred)
     krb5_context context;
+    krb5_gss_cred_id_t verifier_cred;
     krb5_ticket *ticket;
     krb5_gss_cred_id_t *out_cred;
 {
@@ -144,19 +145,12 @@ create_constrained_deleg_creds(context, ticket, out_cred)
 
     krb_creds.ticket = *data;
 
-    retval = krb5_cc_new_unique(context, "MEMORY", NULL, &ccache);
+    retval = kg_duplicate_ccache(context, verifier_cred, &ccache);
     if (retval) {
         krb5_free_data(context, data);
         return retval;
     }
 
-    retval = krb5_cc_initialize(context, ccache, ticket->enc_part2->client);
-    if (retval) {
-        krb5_cc_destroy(context, ccache);
-        krb5_free_data(context, data);
-        return retval;
-    }
-
     retval = krb5_cc_store_cred(context, ccache, &krb_creds);
     if (retval) {
         krb5_cc_destroy(context, ccache);
@@ -193,6 +187,7 @@ create_constrained_deleg_creds(context, ticket, out_cred)
     /* cred->princ already set */
     cred->prerfc_mech = 1; /* this cred will work with all three mechs */
     cred->rfc_mech = 1;
+    cred->proxy_cred = 1;
     cred->keytab = NULL; /* no keytab associated with this... */
     cred->tgt_expire = krb_creds.times.endtime; /* store the end time */
     cred->ccache = ccache; /* the ccache containing the credential */
@@ -960,7 +955,7 @@ kg_accept_krb5(minor_status, context_handle,
          * containing the service ticket to ourselves, which can be
          * used for S4U2Proxy.
          */
-        code = create_constrained_deleg_creds(context, ticket, &deleg_cred);
+        code = create_constrained_deleg_creds(context, cred, ticket, &deleg_cred);
         if (code) {
             major_status = GSS_S_FAILURE;
             goto fail;
diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h
index 3aef499..767bfbe 100644
--- a/src/lib/gssapi/krb5/gssapiP_krb5.h
+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h
@@ -836,6 +836,12 @@ OM_uint32 gss_krb5int_unseal_token_v3(krb5_context *contextptr,
 
 int gss_krb5int_rotate_left (void *ptr, size_t bufsiz, size_t rc);
 
+/* s4u_gss_glue.c */
+krb5_error_code
+kg_duplicate_ccache(krb5_context context,
+                    krb5_gss_cred_id_t impersonator_cred,
+                    krb5_ccache *out_ccache);
+
 /*
  * These take unglued krb5-mech-specific contexts.
  */
diff --git a/src/lib/gssapi/krb5/s4u_gss_glue.c b/src/lib/gssapi/krb5/s4u_gss_glue.c
index ea7e0c9..f426d9d 100644
--- a/src/lib/gssapi/krb5/s4u_gss_glue.c
+++ b/src/lib/gssapi/krb5/s4u_gss_glue.c
@@ -332,7 +332,7 @@ kg_get_evidence_ticket(krb5_context context,
                                  KRB5_TC_MATCH_TIMES, &mcreds, ncreds);
 }
 
-static krb5_error_code
+krb5_error_code
 kg_duplicate_ccache(krb5_context context,
                     krb5_gss_cred_id_t impersonator_cred,
                     krb5_ccache *out_ccache)
diff --git a/src/tests/gssapi/t_s4u.c b/src/tests/gssapi/t_s4u.c
index 5c8f66d..eabde22 100644
--- a/src/tests/gssapi/t_s4u.c
+++ b/src/tests/gssapi/t_s4u.c
@@ -199,7 +199,6 @@ constrainedDelegate(OM_uint32 *minor,
                     gss_cred_id_t verifier_cred_handle)
 {
     OM_uint32 major, tmp;
-    gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
     gss_ctx_id_t initiator_context = GSS_C_NO_CONTEXT;
     gss_name_t cred_name = GSS_C_NO_NAME;
     OM_uint32 time_rec, lifetime;
@@ -209,20 +208,6 @@ constrainedDelegate(OM_uint32 *minor,
     printf("Constrained delegation tests follow\n");
     printf("-----------------------------------\n\n");
 
-    major = gss_acquire_cred_impersonate_cred(minor,
-                                              verifier_cred_handle,
-                                              delegated_cred_handle,
-                                              GSS_C_INDEFINITE,
-                                              desired_mechs,
-                                              GSS_C_INITIATE,
-                                              &cred,
-                                              NULL,
-                                              &time_rec);
-    if (GSS_ERROR(major)) {
-        displayStatus("gss_acquire_cred_impersonate_cred", major, minor);
-        return major;
-    }
-
     if (gss_inquire_cred(minor, verifier_cred_handle, &cred_name,
                          &lifetime, &usage, NULL) == GSS_S_COMPLETE) {
         displayCanonName(minor, cred_name, "Proxy name");
@@ -238,10 +223,14 @@ constrainedDelegate(OM_uint32 *minor,
     printf("\n");
 
     major = gss_init_sec_context(minor,
-                                 cred,
+                                 delegated_cred_handle,
                                  &initiator_context,
                                  target,
+#if 0
                                  (gss_OID)&spnego_mech,
+#else
+                                 (gss_OID)gss_mech_krb5,
+#endif
                                  GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG,
                                  GSS_C_INDEFINITE,
                                  GSS_C_NO_CHANNEL_BINDINGS,
@@ -255,7 +244,6 @@ constrainedDelegate(OM_uint32 *minor,
 
     (void) gss_release_buffer(&tmp, &token);
     (void) gss_delete_sec_context(&tmp, &initiator_context, NULL);
-    (void) gss_release_cred(&tmp, &cred);
 
     return major;
 }