r18826: Allow 'enterprise' principal names to log in.

These principals do not need to be in the same realm as the rest of
the ticket, the full principal name is in the first componet of the
ASN.1.

Samba4's backend will handle getting this to the 'right' place.

Andrew Bartlett
(This used to be commit 90b01b8af21609e2e5c8b6bd8cab8bd393844acf)

1 files changed, 15 insertions, 5 deletions

diff --git a/source4/heimdal/lib/krb5/asn1_glue.c b/source4/heimdal/lib/krb5/asn1_glue.c
index 01b5d3ee44..8f7b886e80 100644
--- a/source4/heimdal/lib/krb5/asn1_glue.c
+++ b/source4/heimdal/lib/krb5/asn1_glue.c
@@ -47,13 +47,23 @@ _krb5_principal2principalname (PrincipalName *p,
 }
 
 krb5_error_code KRB5_LIB_FUNCTION
-_krb5_principalname2krb5_principal (krb5_principal *principal,
+_krb5_principalname2krb5_principal (krb5_context context, 
+				    krb5_principal *principal,
 				    const PrincipalName from,
 				    const Realm realm)
 {
-    krb5_principal p = malloc(sizeof(*p));
-    copy_PrincipalName(&from, &p->name);
-    p->realm = strdup(realm);
-    *principal = p;
+    if (from.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
+	    if (from.name_string.len != 1) {
+		    return KRB5_PARSE_MALFORMED;
+	    }
+	    return krb5_parse_name(context, 
+				   from.name_string.val[0],
+				   principal);
+    } else {
+	    krb5_principal p = malloc(sizeof(*p));
+	    copy_PrincipalName(&from, &p->name);
+	    p->realm = strdup(realm);
+	    *principal = p;
+    }
     return 0;
 }