| commit | ae4d222f586b7e93800b902b6823ab3a3978ff54 | |
| author | Stefan Metzmacher <metze@samba.org> | |
| Wed, 20 May 2015 13:40:58 +0000 (20 13:40 +0000) | ||
| committer | Andrew Bartlett <abartlet@samba.org> | |
| Fri, 31 Jul 2015 05:30:23 +0000 (31 17:30 +1200) | ||
| tree | 39447bcfa4a86c0d1c3ad318f8c7dc5f465f85c5 | treesnapshot (tar.gz zip) |
| parent | 20da6cad02d5b57ce081b8bf28c41cedb70c00bb | commitdiff |
lib/krb5: verify_logonname() to handle multi component principal
FreeIPA can generate tickets with a client principal of
'host/hostname.example.com'.
verify_logonname() should just verify the principal name
in the PAC_LOGON_NAME is the same as the principal of
the client principal (without realm) of the ticket.
Samba commit b7cc8c1187ff967e44587cd0d09185330378f366
break this. We try to compare ['host']['hostname.example.com']
with ['host/hostname.example.com]' (as we interpret it as enterprise principal)
this fail if we don't compare them as strings.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11142
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
FreeIPA can generate tickets with a client principal of
'host/hostname.example.com'.
verify_logonname() should just verify the principal name
in the PAC_LOGON_NAME is the same as the principal of
the client principal (without realm) of the ticket.
Samba commit b7cc8c1187ff967e44587cd0d09185330378f366
break this. We try to compare ['host']['hostname.example.com']
with ['host/hostname.example.com]' (as we interpret it as enterprise principal)
this fail if we don't compare them as strings.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11142
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
| lib/krb5/pac.c | diffblobblamehistory |