From b33681fc0b8ef7b9fa91c154f7c3117afafa349e Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 17 Sep 2002 12:12:50 +0000 Subject: Add clock skew handling to our kerberos code. This allows us to cope with the DC being out of sync with the local machine. (This used to be commit 0d28d769472ea3b98ae4c8757093dfd4499f6dd1) --- source3/libads/kerberos.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'source3/libads/kerberos.c') diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c index 9a486237c9..a80837cf4d 100644 --- a/source3/libads/kerberos.c +++ b/source3/libads/kerberos.c @@ -50,7 +50,7 @@ kerb_prompter(krb5_context ctx, void *data, simulate a kinit, putting the tgt in the default cache location remus@snapserver.com */ -int kerberos_kinit_password(const char *principal, const char *password) +int kerberos_kinit_password(const char *principal, const char *password, int time_offset) { krb5_context ctx; krb5_error_code code = 0; @@ -60,6 +60,10 @@ int kerberos_kinit_password(const char *principal, const char *password) if ((code = krb5_init_context(&ctx))) return code; + + if (time_offset != 0) { + krb5_set_real_time(ctx, time(NULL) + time_offset, 0); + } if ((code = krb5_cc_default(ctx, &cc))) { krb5_free_context(ctx); @@ -111,7 +115,7 @@ int ads_kinit_password(ADS_STRUCT *ads) int ret; asprintf(&s, "%s@%s", ads->auth.user_name, ads->auth.realm); - ret = kerberos_kinit_password(s, ads->auth.password); + ret = kerberos_kinit_password(s, ads->auth.password, ads->auth.time_offset); if (ret) { DEBUG(0,("kerberos_kinit_password %s failed: %s\n", -- cgit