diff options
author | Isaac Boukris <iboukris@gmail.com> | 2020-01-15 11:14:00 +0100 |
---|---|---|
committer | Greg Hudson <ghudson@mit.edu> | 2020-01-22 13:00:19 -0500 |
commit | 94f7c9705879500b1dc8dda8592490efce05688f (patch) | |
tree | f111a795cf36fb937fe32a161d9654d5a95206db /src/include | |
parent | 96e5d384acf174e6079b0aeeec14bd8100d24840 (diff) | |
download | krb5-94f7c9705879500b1dc8dda8592490efce05688f.zip krb5-94f7c9705879500b1dc8dda8592490efce05688f.tar.gz krb5-94f7c9705879500b1dc8dda8592490efce05688f.tar.bz2 |
Allow cross-realm RBCD with PAC and other authdata
For cross-realm S4U2Proxy requests, require a PAC to be present to
bypass signedpath verification, but do not require it to be the only
authdata element. For within-realm requests, add and verify
signedpath authdata regardless of the presence of a PAC.
Simplify the test KDB authdata module and the existing RBCD tests as
we no longer need a way to suppress the test module's KDB authdata.
[ghudson@mit.edu: rewrote commit message; reordered a condition for
efficiency]
ticket: 8868 (new)
tags: pullup
target_version: 1.18
Diffstat (limited to 'src/include')
-rw-r--r-- | src/include/kdb.h | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/include/kdb.h b/src/include/kdb.h index 7f1362d..2a85eed 100644 --- a/src/include/kdb.h +++ b/src/include/kdb.h @@ -1493,9 +1493,9 @@ typedef struct _kdb_vftabl { * such as a Windows PAC, based on the request client lookup flags. Return * 0 if all checks have passed. Optionally return a representation of the * authdata in *ad_info_out, to be consumed by allowed_to_delegate_from and - * sign_authdata. If client_out is not NULL, set *client_out to the client - * name in the PAC; this indicates the requested client principal for a - * cross-realm S4U2Proxy request. + * sign_authdata. If client_out is not NULL and the PAC has been verified, + * set *client_out to the client name in the PAC; this indicates the + * requested client principal for a cross-realm S4U2Proxy request. * * This method is called for TGS requests on the authorization data from * the header ticket. For S4U2Proxy requests it is also called on the |