diff options
| author | Jeffrey Altman <jaltman@secure-endpoints.com> | 2004-02-27 05:24:39 +0000 |
|---|---|---|
| committer | Jeffrey Altman <jaltman@secure-endpoints.com> | 2004-02-27 05:24:39 +0000 |
| commit | 9cd5e4909839ba4871484372e8f89cba95c14a45 (patch) | |
| tree | 511a311a5bc81336bca168b6826eb59080d9435d /src/lib/krb5/krb/ChangeLog | |
| parent | a5e807d666326c64985dfa1dd58d7a37c907846c (diff) | |
| download | krb5-9cd5e4909839ba4871484372e8f89cba95c14a45.zip krb5-9cd5e4909839ba4871484372e8f89cba95c14a45.tar.gz krb5-9cd5e4909839ba4871484372e8f89cba95c14a45.tar.bz2 | |
As discussed on the krbdev mailing list, krb5_get_init_creds_password()
suffered from a behavior in which it would unintentionally query a master
KDC twice if in fact the KDC queried when krb5int_sendto() was called
with use_master = 0 was in fact the master. This resulted in more than
an additional protocol operation. There were two negative side effects.
First, in the case of an incorrect password there would be two counts
against the max retry attempts. Second, in the case of hardware pre-auth
and an expired password, the user would be asked to enter their expired
password twice before being told it was expired.
This has been fixed by changing the use_master parameter into an in/out
parameter and modifying krb5int_sendto() to indicate which KDC it received
the response from. This allows the use_master parameter to be set to
indicate whether or not the response came from a master KDC regardless
of whether a master KDC was requested.
ticket: new
target_version: next
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@16137 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/lib/krb5/krb/ChangeLog')
| -rw-r--r-- | src/lib/krb5/krb/ChangeLog | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog index 0abd32f..acef6b9 100644 --- a/src/lib/krb5/krb/ChangeLog +++ b/src/lib/krb5/krb/ChangeLog @@ -1,3 +1,13 @@ +2004-02-26 Jeffrey Altman <jaltman@mit.edu> + + * get_in_tkt.c, gic_keytab.c, gic_pwd.c, send_tgs.c: + Implement changes to support the use of + krb5_get_init_creds_password's use_master as an in/out + parameter. This allows us to prevent a duplicate request + being sent to the KDC in the situation that the password + used is incorrect. This behavior results a negative user + experience and had to be corrected. + 2004-02-13 Ken Raeburn <raeburn@mit.edu> * sendauth.c: Don't specify defaults for |