third_party/heimdal kdc: introduce HDB_F_USER2USER_PRINCIPAL (import lorikeet-heimdal...
commit94fa28979065556a8c0fa71095d87a15c9c6488c
authorStefan Metzmacher <metze@samba.org>
Sun, 15 Oct 2023 23:33:15 +0000 (16 12:33 +1300)
committerJule Anger <janger@samba.org>
Tue, 7 Nov 2023 12:49:11 +0000 (7 12:49 +0000)
tree808e2f570bfce7cb2ded240cf84f32aacb22c602
parent166035b7c557b0d3ef61eaaa85a24bc0b805d8c3
third_party/heimdal kdc: introduce HDB_F_USER2USER_PRINCIPAL (import lorikeet-heimdal-202310152331 (commit a571340c9e1b75d4f5d96f08fcf9fd660d3ba3d4))

This allows HDB backends to do special handling for
User2User TGS-REQs. The main reason is to let
the HDB_F_GET_SERVER lookup to succeed even for
non-computer accounts. In Samba these are typically
not returned in HDB_F_GET_SERVER in order to avoid
generating tickets with the user password.

But for User2User the account password is not used,
so it is safe to return the server entry.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15492

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org Adapted to be an import from lorikeet-heimdal as requested]

(cherry picked from commit cbb8145d0c58b34b76a579afd81f0e19ec7106b6)
third_party/heimdal/kdc/krb5tgs.c
third_party/heimdal/lib/hdb/hdb.h