Revert commit 4c157ecedd52602f75574605ef48d0c48e9bfbe8

 * This broke corner cases when used with
      default_tkt_types = des-cbc-crc
   and DES enabled on an AD domain.
 * This is fixed in kerberos instead, in a more correct way
   and in a way which we cannot replicate.

2 files changed, 0 insertions, 36 deletions

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 091538fb..86050d16 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -803,14 +803,6 @@ static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx,
     krb5_error_code kerr = 0;
     krb5_creds creds;
     krb5_get_init_creds_opt options;
-    krb5_enctype *etype_list;
-    krb5_error_code krberr;
-    TALLOC_CTX *tmp_ctx;
-    int n_etype_list;
-
-    tmp_ctx = talloc_new(NULL);
-    if (tmp_ctx == NULL)
-        return ENOMEM;
 
     memset(&creds, 0, sizeof(creds));
     memset(&options, 0, sizeof(options));
@@ -820,18 +812,6 @@ static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx,
     krb5_get_init_creds_opt_set_proxiable(&options, 0);
     krb5_set_canonicalize(&options);
 
-    krberr = sss_krb5_read_etypes_for_keytab(tmp_ctx, ctx, keytab, princ,
-                                             &etype_list, &n_etype_list);
-    if (krberr) {
-        DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to load etypes from keytab: %s\n",
-                                     sss_krb5_get_error_message(ctx, krberr)));
-    } else if (n_etype_list > 0) {
-        krb5_get_init_creds_opt_set_etype_list(&options, etype_list,
-                                               n_etype_list);
-        DEBUG(SSSDBG_FUNC_DATA, ("Loaded %d enctypes from keytab\n",
-                                 n_etype_list));
-    }
-
     kerr = krb5_get_init_creds_keytab(ctx, &creds, princ, keytab, 0, NULL,
                                       &options);
     if (kerr != 0) {
@@ -849,7 +829,6 @@ static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx,
 
 done:
     krb5_free_cred_contents(ctx, &creds);
-    talloc_free(tmp_ctx);
 
     return kerr;
 
diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c
index 4e339017..143f2e2e 100644
--- a/src/providers/ldap/ldap_child.c
+++ b/src/providers/ldap/ldap_child.c
@@ -161,8 +161,6 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
     krb5_get_init_creds_opt options;
     krb5_error_code krberr;
     krb5_timestamp kdc_time_offset;
-    krb5_enctype *etype_list;
-    int n_etype_list;
     int canonicalize = 0;
     int kdc_time_offset_usec;
     int ret;
@@ -284,19 +282,6 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
     }
     sss_krb5_get_init_creds_opt_set_canonicalize(&options, canonicalize);
 
-    krberr = sss_krb5_read_etypes_for_keytab(memctx, context, keytab, kprinc,
-                                             &etype_list, &n_etype_list);
-    if (krberr) {
-        DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to load etypes from keytab: %s\n",
-                                     sss_krb5_get_error_message(context,
-                                                                krberr)));
-    } else if (n_etype_list > 0) {
-        krb5_get_init_creds_opt_set_etype_list(&options, etype_list,
-                                               n_etype_list);
-        DEBUG(SSSDBG_FUNC_DATA, ("Loaded %d enctypes from keytab for %s\n",
-                                 n_etype_list, full_princ));
-    }
-
     krberr = krb5_get_init_creds_keytab(context, &my_creds, kprinc,
                                         keytab, 0, NULL, &options);