50 lines
1.9 KiB
Diff
50 lines
1.9 KiB
Diff
|
From f7b6d43533d1d9ec3960e3d7f375995896768aef Mon Sep 17 00:00:00 2001
|
||
|
|
From: Greg Hudson <ghudson@mit.edu>
|
||
|
|
Date: Wed, 6 May 2020 16:03:13 -0400
|
||
|
|
Subject: [PATCH] Omit KDC indicator check for S4U2Self requests
|
||
|
|
|
||
|
|
As there was no initial ticket exchange from the client for an
|
||
|
|
S4U2Self request, the auth indicator check is inapplicable (and would
|
||
|
|
always fail if any auth indicators are required).
|
||
|
|
|
||
|
|
ticket: 8902 (new)
|
||
|
|
(cherry picked from commit 183631fbf72351c2d5fc7d60b2d9fc4d09fe7465)
|
||
|
|
(cherry picked from commit 442f1fa5b2e4034954a51048414cc0863b914379)
|
||
|
|
---
|
||
|
|
src/kdc/do_tgs_req.c | 14 +++++++-------
|
||
|
|
1 file changed, 7 insertions(+), 7 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
|
||
|
|
index 241f34e2a..463a9c0dd 100644
|
||
|
|
--- a/src/kdc/do_tgs_req.c
|
||
|
|
+++ b/src/kdc/do_tgs_req.c
|
||
|
|
@@ -392,8 +392,8 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
|
||
|
|
}
|
||
|
|
authtime = subject_tkt->times.authtime;
|
||
|
|
|
||
|
|
- /* Extract auth indicators from the subject ticket, except for S4U2Self
|
||
|
|
- * requests (where the client didn't authenticate). */
|
||
|
|
+ /* Extract and check auth indicators from the subject ticket, except for
|
||
|
|
+ * S4U2Self requests (where the client didn't authenticate). */
|
||
|
|
if (s4u_x509_user == NULL) {
|
||
|
|
errcode = get_auth_indicators(kdc_context, subject_tkt, local_tgt,
|
||
|
|
&local_tgt_key, &auth_indicators);
|
||
|
|
@@ -401,12 +401,12 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
|
||
|
|
status = "GET_AUTH_INDICATORS";
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
- }
|
||
|
|
|
||
|
|
- errcode = check_indicators(kdc_context, server, auth_indicators);
|
||
|
|
- if (errcode) {
|
||
|
|
- status = "HIGHER_AUTHENTICATION_REQUIRED";
|
||
|
|
- goto cleanup;
|
||
|
|
+ errcode = check_indicators(kdc_context, server, auth_indicators);
|
||
|
|
+ if (errcode) {
|
||
|
|
+ status = "HIGHER_AUTHENTICATION_REQUIRED";
|
||
|
|
+ goto cleanup;
|
||
|
|
+ }
|
||
|
|
}
|
||
|
|
|
||
|
|
if (is_referral)
|