summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2012-01-11 18:19:14 +1100
committerAndrew Bartlett <abartlet@samba.org>2012-01-12 18:02:54 +1100
commitd087e715fc803eae735636b4ebbb4c0f131f9bb4 (patch)
treeeee9b2d009e11fc2882defcf5a2d139bd26ead7c
parentb69c40ffce7d1ab8828ec6a1df1d46f7e8c51278 (diff)
downloadsamba-d087e715fc803eae735636b4ebbb4c0f131f9bb4.tar.gz
samba-d087e715fc803eae735636b4ebbb4c0f131f9bb4.tar.bz2
samba-d087e715fc803eae735636b4ebbb4c0f131f9bb4.zip
heimdal: remove checking of KDC PAC signature, delegate to wdc plugin
The checking of the KDC signature is more complex than it looks, it may be of a different enc type to that which the ticket is encrypted with, and may even be prefixed with the RODC number. This is better handled in the plugin which can easily look up the DB for the correct key to verify this with, and can also quickly determine if this is an interdomain trust, which we cannot verify the PAC for. Andrew Bartlett
-rw-r--r--source4/heimdal/kdc/krb5tgs.c14
1 files changed, 2 insertions, 12 deletions
diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c
index 96ee9ccc30..45681775f8 100644
--- a/source4/heimdal/kdc/krb5tgs.c
+++ b/source4/heimdal/kdc/krb5tgs.c
@@ -284,7 +284,6 @@ check_PAC(krb5_context context,
hdb_entry_ex *server,
hdb_entry_ex *krbtgt,
const EncryptionKey *server_check_key,
- const EncryptionKey *krbtgt_check_key,
const EncryptionKey *server_sign_key,
const EncryptionKey *krbtgt_sign_key,
EncTicketPart *tkt,
@@ -330,7 +329,7 @@ check_PAC(krb5_context context,
ret = krb5_pac_verify(context, pac, tkt->authtime,
client_principal,
- server_check_key, krbtgt_check_key);
+ server_check_key, NULL);
if (ret) {
krb5_pac_free(context, pac);
return ret;
@@ -1525,7 +1524,6 @@ tgs_build_reply(krb5_context context,
Key *tkey_check;
Key *tkey_sign;
- Key *tkey_krbtgt_check = NULL;
int flags = HDB_F_FOR_TGS_REQ;
memset(&sessionkey, 0, sizeof(sessionkey));
@@ -1799,13 +1797,6 @@ server_lookup:
goto out;
}
- /* Check if we would know the krbtgt key for the PAC. We would
- * only know this if the krbtgt principal was the same (ie, in our
- * realm, regardless of KVNO) */
- if (krb5_principal_compare(context, krbtgt_out->entry.principal, krbtgt->entry.principal)) {
- tkey_krbtgt_check = tkey_check;
- }
-
ret = _kdc_db_fetch(context, config, cp, HDB_F_GET_CLIENT | flags,
NULL, &clientdb, &client);
if(ret == HDB_ERR_NOT_FOUND_HERE) {
@@ -1839,7 +1830,6 @@ server_lookup:
ret = check_PAC(context, config, cp, NULL,
client, server, krbtgt,
&tkey_check->key,
- tkey_krbtgt_check ? &tkey_krbtgt_check->key : NULL,
ekey, &tkey_sign->key,
tgt, &rspac, &signedpath);
if (ret) {
@@ -2109,7 +2099,7 @@ server_lookup:
*/
ret = check_PAC(context, config, tp, dp,
client, server, krbtgt,
- &clientkey->key, &tkey_check->key,
+ &clientkey->key,
ekey, &tkey_sign->key,
&adtkt, &rspac, &ad_signedpath);
if (ret) {