diff options
| author | Sam Hartman <hartmans@mit.edu> | 2006-09-21 01:48:50 +0000 |
|---|---|---|
| committer | Sam Hartman <hartmans@mit.edu> | 2006-09-21 01:48:50 +0000 |
| commit | 25860eac35980ab0d8d786fe1d06ced26a04d2db (patch) | |
| tree | 74e4b87fee38208ea1378bb6868c009964e9cf3f /src/lib/krb5/libkrb5.exports | |
| parent | b2239415f139c8822715180716e41b4f9606232e (diff) | |
| download | krb5-25860eac35980ab0d8d786fe1d06ced26a04d2db.zip krb5-25860eac35980ab0d8d786fe1d06ced26a04d2db.tar.gz krb5-25860eac35980ab0d8d786fe1d06ced26a04d2db.tar.bz2 | |
Set the canonicalize flag in TGS requests and accept cross-realm referral tickets.
We do not yet accept tickets in which the server name changes.
* krb5_sname_to_principal: If there is no domain realm mapping return null realm
*krb5_get_cred_via_tkt: New behavior as described below
1) the referrals case:
- check for TGT for initial realm
- if a remote realm was specified (which must have happened via a
domain_realm mapping), obtain a TGT for it the standard way and
start with that.
- use client realm for server if not specified
- iterate through this loop:
- request ticket with referrals turned on
- if that fails:
- if this was the first request, punt to non-referrals case
- otherwise, retry once without referrals turned on then terminate
either way
- if it works, either use the service ticket or follow the referral path
- if loop count exceeded, hardfail
2) the nonreferrals case
- this is mostly the old walk_realm_tree TGT-finding (which allows
limited shortcut referrals per 4120) followed by a standard tgs-req.
- originally requested principal is used for this, although if we were
handed something without a realm, determine a fallback realm based on
DNS TXT records or a truncation of the domain name.
ticket: 2652
Owner: amb
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@18598 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/lib/krb5/libkrb5.exports')
| -rw-r--r-- | src/lib/krb5/libkrb5.exports | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports index 94e94e4..952ab2f 100644 --- a/src/lib/krb5/libkrb5.exports +++ b/src/lib/krb5/libkrb5.exports @@ -458,6 +458,7 @@ krb5_init_keyblock krb5_init_secure_context krb5_internalize_opaque krb5_is_permitted_enctype +krb5_is_referral_realm krb5_is_thread_safe krb5_kdc_rep_decrypt_proc krb5_kt_add_entry |