Don't create hostbased principals in new KDBs

Unix-like platforms do not provide a simple method to find the
fully-qualified local hostname as the machine is expected to appear to
other hosts.  Canonicalizing the gethostname() result with
getaddrinfo() usually works, but potentially uses DNS.  Now that
dns_canonicalize_hostname=true is no longer the default, KDB creation
would generally create the wrong host-based principals.

kadmin/hostname is unnecessary because the client software can also
use kadmin/admin, and kiprop/hostname is one of several principals
that must be created for incremental propagation.

ticket: 8935 (new)

1 files changed, 1 insertions, 34 deletions

diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
index c21d199..ae1afd4 100644
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
@@ -307,29 +307,6 @@ create_fixed_special(krb5_context context, struct realm_info *rinfo,
 
 }
 
-/* Create a special principal using one specified component and the
- * canonicalized local hostname. */
-static krb5_error_code
-create_hostbased_special(krb5_context context, struct realm_info *rinfo,
-                         krb5_keyblock *mkey, const char *comp1)
-{
-    krb5_error_code ret;
-    krb5_principal princ = NULL;
-
-    ret = krb5_sname_to_principal(context, NULL, comp1, KRB5_NT_SRV_HST,
-                                  &princ);
-    if (ret)
-        goto cleanup;
-    ret = krb5_set_principal_realm(context, princ, global_params.realm);
-    if (ret)
-        goto cleanup;
-    ret = kdb_ldap_create_principal(context, princ, TGT_KEY, rinfo, mkey);
-
-cleanup:
-    krb5_free_principal(context, princ);
-    return ret;
-}
-
 /* Create all special principals for the realm. */
 static krb5_error_code
 create_special_princs(krb5_context context, krb5_principal master_princ,
@@ -360,22 +337,12 @@ create_special_princs(krb5_context context, krb5_principal master_princ,
     if (ret)
         return ret;
 
-    /* Create kadmin/admin and kadmin/<hostname>. */
+    /* Create kadmin/admin. */
     rblock.max_life = ADMIN_LIFETIME;
     rblock.flags = KRB5_KDB_DISALLOW_TGT_BASED;
     ret = create_fixed_special(context, &rblock, mkey, "kadmin", "admin");
     if (ret)
         return ret;
-    ret = create_hostbased_special(context, &rblock, mkey, "kadmin");
-    if (ret)
-        return ret;
-
-    /* Create kiprop/<hostname>. */
-    rblock.max_life = global_params.max_life;
-    rblock.flags = 0;
-    ret = create_hostbased_special(context, &rblock, mkey, "kiprop");
-    if (ret)
-        return ret;
 
     /* Create kadmin/changepw. */
     rblock.max_life = CHANGEPW_LIFETIME;