From 669f3d71161741c676ddd6a08bd08d4a4ccd495b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Fri, 26 Nov 2021 17:40:54 +0200 Subject: [PATCH] ipa-kdb: issue PAC_REQUESTER_SID only for TGTs MS-KILE 3.3.5.6.4.8 in revision after Windows Server November 2021 security fixes added the following requirement: - PAC_REQUESTER_SID is only added in TGT case (including referrals and tickets to RODCs) Fixes: https://pagure.io/freeipa/issue/9031 Signed-off-by: Alexander Bokovoy Reviewed-By: Rob Crittenden --- daemons/ipa-kdb/ipa_kdb_mspac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c index 6f7d1ac15daf17dfca36ebd3265c866725d24717..538cfbba958068bd2ee0aaae7a2743ae82237898 100644 --- a/daemons/ipa-kdb/ipa_kdb_mspac.c +++ b/daemons/ipa-kdb/ipa_kdb_mspac.c @@ -1148,7 +1148,8 @@ static krb5_error_code ipadb_get_pac(krb5_context kcontext, #endif #ifdef HAVE_PAC_REQUESTER_SID - { + /* MS-KILE 3.3.5.6.4.8: add PAC_REQUESTER_SID only in TGT case */ + if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0) { union PAC_INFO pac_requester_sid; /* == Package PAC_REQUESTER_SID == */ memset(&pac_requester_sid, 0, sizeof(pac_requester_sid)); -- 2.31.1