diff options
| author | Russ Allbery <rra@stanford.edu> | 2009-01-14 00:29:04 +0000 |
|---|---|---|
| committer | Russ Allbery <rra@stanford.edu> | 2009-01-14 00:29:04 +0000 |
| commit | 033fd8fb426adcf264a867fc0001c0ee6735a079 (patch) | |
| tree | a00c6dfeb14ccdab80651b146f02395bd0f08c02 /src/lib/kadm5/clnt/client_init.c | |
| parent | 919383c2c3c95973c3579e6730cdc5c077132c3d (diff) | |
| download | krb5-033fd8fb426adcf264a867fc0001c0ee6735a079.zip krb5-033fd8fb426adcf264a867fc0001c0ee6735a079.tar.gz krb5-033fd8fb426adcf264a867fc0001c0ee6735a079.tar.bz2 | |
Force tickets acquired by the kadm5 client library via password
authentication to be non-forwardable and non-proxiable, overridding
any [libdefaults] configuration. This may be necessary at sites that
set forwardable to true by default in their krb5.conf files but
disable forwardable tickets for privileged principals. Since the
ticket cache acquired by the kadm5 client library is used only for
kadmin operations, where forwardable is not useful or necessary, there
is no reason to ever attempt to obtain forwardable or proxiable tickets
here.
Ticket: 6337
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21744 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/lib/kadm5/clnt/client_init.c')
| -rw-r--r-- | src/lib/kadm5/clnt/client_init.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c index d5fe5b0..82bec3c 100644 --- a/src/lib/kadm5/clnt/client_init.c +++ b/src/lib/kadm5/clnt/client_init.c @@ -541,8 +541,12 @@ kadm5_gic_iter(kadm5_server_handle_t handle, goto error; } - if (init_type != INIT_CREDS) + /* Credentials for kadmin don't need to be forwardable or proxiable. */ + if (init_type != INIT_CREDS) { krb5_get_init_creds_opt_init(&opt); + krb5_get_init_creds_opt_set_forwardable(&opt, 0); + krb5_get_init_creds_opt_set_proxiable(&opt, 0); + } if (init_type == INIT_PASS) { code = krb5_get_init_creds_password(ctx, &outcreds, client, pass, |