From d76f11a8bd685517b0e5a3be4684bec41af9e822 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Tue, 16 Nov 2010 14:16:31 +1100 Subject: s4-kdc Fix the realm handling again, this time pay attention to the flags The KDC sets different flags for the AS-REQ (this is client-depenent) and the TGS-REQ to determine if the realm should be forced to the canonical value. If we do this always, or do this never, we get into trouble, so it's much better to honour the flags we are given. Andrew Bartlett --- source4/kdc/db-glue.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) (limited to 'source4/kdc') diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c index 28837f6df0..b062282c28 100644 --- a/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c @@ -1113,7 +1113,6 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context, * krbtgt */ int lret; - char *realm_fixed; if (krbtgt_number == kdc_db_ctx->my_krbtgt_number) { lret = dsdb_search_one(kdc_db_ctx->samdb, mem_ctx, @@ -1147,31 +1146,32 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context, return HDB_ERR_NOENTRY; } - realm_fixed = strupper_talloc(mem_ctx, lpcfg_realm(lp_ctx)); - if (!realm_fixed) { - ret = ENOMEM; - krb5_set_error_message(context, ret, "strupper_talloc: out of memory"); - return ret; - } - - ret = krb5_copy_principal(context, principal, &alloc_principal); - if (ret) { - return ret; - } + if (flags & HDB_F_CANON) { + ret = krb5_copy_principal(context, principal, &alloc_principal); + if (ret) { + return ret; + } - free(alloc_principal->name.name_string.val[1]); - alloc_principal->name.name_string.val[1] = strdup(realm_fixed); - talloc_free(realm_fixed); - if (!alloc_principal->name.name_string.val[1]) { - ret = ENOMEM; - krb5_set_error_message(context, ret, "samba_kdc_fetch: strdup() failed!"); - return ret; + /* When requested to do so, ensure that the + * both realm values in the principal are set + * to the upper case, canonical realm */ + free(alloc_principal->name.name_string.val[1]); + alloc_principal->name.name_string.val[1] = strdup(lpcfg_realm(lp_ctx)); + if (!alloc_principal->name.name_string.val[1]) { + ret = ENOMEM; + krb5_set_error_message(context, ret, "samba_kdc_fetch: strdup() failed!"); + return ret; + } + principal = alloc_principal; } - principal = alloc_principal; ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx, principal, SAMBA_KDC_ENT_TYPE_KRBTGT, flags, realm_dn, msg, entry_ex); + if (flags & HDB_F_CANON) { + /* This is again copied in the message2entry call */ + krb5_free_principal(context, alloc_principal); + } if (ret != 0) { krb5_warnx(context, "samba_kdc_fetch: self krbtgt message2entry failed"); } -- cgit