3 * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
4 * (Royal Institute of Technology, Stockholm, Sweden).
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the Institute nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 #include "krb5_locl.h"
37 static krb5_error_code
38 decrypt_tkt_enc_part (krb5_context context
,
40 EncryptedData
*enc_part
,
41 EncTicketPart
*decr_part
)
48 ret
= krb5_crypto_init(context
, key
, 0, &crypto
);
51 ret
= krb5_decrypt_EncryptedData (context
,
56 krb5_crypto_destroy(context
, crypto
);
60 ret
= decode_EncTicketPart(plain
.data
, plain
.length
, decr_part
, &len
);
62 krb5_set_error_message(context
, ret
,
63 N_("Failed to decode encrypted "
65 krb5_data_free (&plain
);
69 static krb5_error_code
70 decrypt_authenticator (krb5_context context
,
72 EncryptedData
*enc_part
,
73 Authenticator
*authenticator
,
81 ret
= krb5_crypto_init(context
, key
, 0, &crypto
);
84 ret
= krb5_decrypt_EncryptedData (context
,
86 usage
/* KRB5_KU_AP_REQ_AUTH */,
89 /* for backwards compatibility, also try the old usage */
90 if (ret
&& usage
== KRB5_KU_TGS_REQ_AUTH
)
91 ret
= krb5_decrypt_EncryptedData (context
,
96 krb5_crypto_destroy(context
, crypto
);
100 ret
= decode_Authenticator(plain
.data
, plain
.length
,
101 authenticator
, &len
);
102 krb5_data_free (&plain
);
106 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
107 krb5_decode_ap_req(krb5_context context
,
108 const krb5_data
*inbuf
,
113 ret
= decode_AP_REQ(inbuf
->data
, inbuf
->length
, ap_req
, &len
);
116 if (ap_req
->pvno
!= 5){
118 krb5_clear_error_message (context
);
119 return KRB5KRB_AP_ERR_BADVERSION
;
121 if (ap_req
->msg_type
!= krb_ap_req
){
123 krb5_clear_error_message (context
);
124 return KRB5KRB_AP_ERR_MSG_TYPE
;
126 if (ap_req
->ticket
.tkt_vno
!= 5){
128 krb5_clear_error_message (context
);
129 return KRB5KRB_AP_ERR_BADVERSION
;
134 static krb5_error_code
135 check_transited(krb5_context context
, Ticket
*ticket
, EncTicketPart
*enc
)
138 unsigned int num_realms
;
142 * Windows 2000 and 2003 uses this inside their TGT so it's normaly
143 * not seen by others, however, samba4 joined with a Windows AD as
144 * a Domain Controller gets exposed to this.
146 if(enc
->transited
.tr_type
== 0 && enc
->transited
.contents
.length
== 0)
149 if(enc
->transited
.tr_type
!= DOMAIN_X500_COMPRESS
)
150 return KRB5KDC_ERR_TRTYPE_NOSUPP
;
152 if(enc
->transited
.contents
.length
== 0)
155 ret
= krb5_domain_x500_decode(context
, enc
->transited
.contents
,
156 &realms
, &num_realms
,
161 ret
= krb5_check_transited(context
, enc
->crealm
,
163 realms
, num_realms
, NULL
);
168 static krb5_error_code
169 find_etypelist(krb5_context context
,
170 krb5_auth_context auth_context
,
175 krb5_authdata adIfRelevant
;
178 adIfRelevant
.len
= 0;
183 ad
= auth_context
->authenticator
->authorization_data
;
187 for (i
= 0; i
< ad
->len
; i
++) {
188 if (ad
->val
[i
].ad_type
== KRB5_AUTHDATA_IF_RELEVANT
) {
189 ret
= decode_AD_IF_RELEVANT(ad
->val
[i
].ad_data
.data
,
190 ad
->val
[i
].ad_data
.length
,
196 if (adIfRelevant
.len
== 1 &&
197 adIfRelevant
.val
[0].ad_type
==
198 KRB5_AUTHDATA_GSS_API_ETYPE_NEGOTIATION
) {
201 free_AD_IF_RELEVANT(&adIfRelevant
);
202 adIfRelevant
.len
= 0;
206 if (adIfRelevant
.len
== 0)
209 ret
= decode_EtypeList(adIfRelevant
.val
[0].ad_data
.data
,
210 adIfRelevant
.val
[0].ad_data
.length
,
214 krb5_clear_error_message(context
);
216 free_AD_IF_RELEVANT(&adIfRelevant
);
221 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
222 krb5_decrypt_ticket(krb5_context context
,
230 ret
= decrypt_tkt_enc_part (context
, key
, &ticket
->enc_part
, &t
);
236 time_t start
= t
.authtime
;
238 krb5_timeofday (context
, &now
);
240 start
= *t
.starttime
;
241 if(start
- now
> context
->max_skew
243 && !(flags
& KRB5_VERIFY_AP_REQ_IGNORE_INVALID
))) {
244 free_EncTicketPart(&t
);
245 krb5_clear_error_message (context
);
246 return KRB5KRB_AP_ERR_TKT_NYV
;
248 if(now
- t
.endtime
> context
->max_skew
) {
249 free_EncTicketPart(&t
);
250 krb5_clear_error_message (context
);
251 return KRB5KRB_AP_ERR_TKT_EXPIRED
;
254 if(!t
.flags
.transited_policy_checked
) {
255 ret
= check_transited(context
, ticket
, &t
);
257 free_EncTicketPart(&t
);
266 free_EncTicketPart(&t
);
270 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
271 krb5_verify_authenticator_checksum(krb5_context context
,
272 krb5_auth_context ac
,
278 krb5_authenticator authenticator
;
281 ret
= krb5_auth_con_getauthenticator (context
,
286 if(authenticator
->cksum
== NULL
) {
287 krb5_free_authenticator(context
, &authenticator
);
290 ret
= krb5_auth_con_getkey(context
, ac
, &key
);
292 krb5_free_authenticator(context
, &authenticator
);
295 ret
= krb5_crypto_init(context
, key
, 0, &crypto
);
298 ret
= krb5_verify_checksum (context
,
300 KRB5_KU_AP_REQ_AUTH_CKSUM
,
303 authenticator
->cksum
);
304 krb5_crypto_destroy(context
, crypto
);
306 krb5_free_authenticator(context
, &authenticator
);
307 krb5_free_keyblock(context
, key
);
312 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
313 krb5_verify_ap_req(krb5_context context
,
314 krb5_auth_context
*auth_context
,
316 krb5_const_principal server
,
317 krb5_keyblock
*keyblock
,
319 krb5_flags
*ap_req_options
,
320 krb5_ticket
**ticket
)
322 return krb5_verify_ap_req2 (context
,
330 KRB5_KU_AP_REQ_AUTH
);
333 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
334 krb5_verify_ap_req2(krb5_context context
,
335 krb5_auth_context
*auth_context
,
337 krb5_const_principal server
,
338 krb5_keyblock
*keyblock
,
340 krb5_flags
*ap_req_options
,
341 krb5_ticket
**ticket
,
342 krb5_key_usage usage
)
345 krb5_auth_context ac
;
352 if (auth_context
&& *auth_context
) {
355 ret
= krb5_auth_con_init (context
, &ac
);
360 t
= calloc(1, sizeof(*t
));
363 krb5_clear_error_message (context
);
367 if (ap_req
->ap_options
.use_session_key
&& ac
->keyblock
){
368 ret
= krb5_decrypt_ticket(context
, &ap_req
->ticket
,
372 krb5_free_keyblock(context
, ac
->keyblock
);
375 ret
= krb5_decrypt_ticket(context
, &ap_req
->ticket
,
383 ret
= _krb5_principalname2krb5_principal(context
,
385 ap_req
->ticket
.sname
,
386 ap_req
->ticket
.realm
);
388 ret
= _krb5_principalname2krb5_principal(context
,
394 ret
= decrypt_authenticator (context
,
396 &ap_req
->authenticator
,
403 krb5_principal p1
, p2
;
406 _krb5_principalname2krb5_principal(context
,
408 ac
->authenticator
->cname
,
409 ac
->authenticator
->crealm
);
410 _krb5_principalname2krb5_principal(context
,
414 res
= krb5_principal_compare (context
, p1
, p2
);
415 krb5_free_principal (context
, p1
);
416 krb5_free_principal (context
, p2
);
418 ret
= KRB5KRB_AP_ERR_BADMATCH
;
419 krb5_clear_error_message (context
);
424 /* check addresses */
427 && ac
->remote_address
428 && !krb5_address_search (context
,
431 ret
= KRB5KRB_AP_ERR_BADADDR
;
432 krb5_clear_error_message (context
);
436 /* check timestamp in authenticator */
440 krb5_timeofday (context
, &now
);
442 if (abs(ac
->authenticator
->ctime
- now
) > context
->max_skew
) {
443 ret
= KRB5KRB_AP_ERR_SKEW
;
444 krb5_clear_error_message (context
);
449 if (ac
->authenticator
->seq_number
)
450 krb5_auth_con_setremoteseqnumber(context
, ac
,
451 *ac
->authenticator
->seq_number
);
453 /* XXX - Xor sequence numbers */
455 if (ac
->authenticator
->subkey
) {
456 ret
= krb5_auth_con_setremotesubkey(context
, ac
,
457 ac
->authenticator
->subkey
);
462 ret
= find_etypelist(context
, ac
, &etypes
);
466 ac
->keytype
= ETYPE_NULL
;
471 for (i
= 0; i
< etypes
.len
; i
++) {
472 if (krb5_enctype_valid(context
, etypes
.val
[i
]) == 0) {
473 ac
->keytype
= etypes
.val
[i
];
480 ret
= krb5_copy_keyblock(context
, &t
->ticket
.key
, &ac
->keyblock
);
483 if (ap_req_options
) {
485 if (ac
->keytype
!= ETYPE_NULL
)
486 *ap_req_options
|= AP_OPTS_USE_SUBKEY
;
487 if (ap_req
->ap_options
.use_session_key
)
488 *ap_req_options
|= AP_OPTS_USE_SESSION_KEY
;
489 if (ap_req
->ap_options
.mutual_required
)
490 *ap_req_options
|= AP_OPTS_MUTUAL_REQUIRED
;
496 krb5_free_ticket (context
, t
);
498 if (*auth_context
== NULL
)
501 krb5_auth_con_free (context
, ac
);
502 free_EtypeList(&etypes
);
506 krb5_free_ticket (context
, t
);
507 if (auth_context
== NULL
|| *auth_context
== NULL
)
508 krb5_auth_con_free (context
, ac
);
516 struct krb5_rd_req_in_ctx_data
{
518 krb5_keyblock
*keyblock
;
519 krb5_boolean check_pac
;
522 struct krb5_rd_req_out_ctx_data
{
523 krb5_keyblock
*keyblock
;
524 krb5_flags ap_req_options
;
526 krb5_principal server
;
530 * Allocate a krb5_rd_req_in_ctx as an input parameter to
531 * krb5_rd_req_ctx(). The caller should free the context with
532 * krb5_rd_req_in_ctx_free() when done with the context.
534 * @param context Keberos 5 context.
535 * @param ctx in ctx to krb5_rd_req_ctx().
537 * @return Kerberos 5 error code, see krb5_get_error_message().
542 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
543 krb5_rd_req_in_ctx_alloc(krb5_context context
, krb5_rd_req_in_ctx
*ctx
)
545 *ctx
= calloc(1, sizeof(**ctx
));
547 krb5_set_error_message(context
, ENOMEM
,
548 N_("malloc: out of memory", ""));
551 (*ctx
)->check_pac
= (context
->flags
& KRB5_CTX_F_CHECK_PAC
) ? 1 : 0;
556 * Set the keytab that krb5_rd_req_ctx() will use.
558 * @param context Keberos 5 context.
559 * @param in in ctx to krb5_rd_req_ctx().
560 * @param keytab keytab that krb5_rd_req_ctx() will use, only copy the
561 * pointer, so the caller must free they keytab after
562 * krb5_rd_req_in_ctx_free() is called.
564 * @return Kerberos 5 error code, see krb5_get_error_message().
569 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
570 krb5_rd_req_in_set_keytab(krb5_context context
,
571 krb5_rd_req_in_ctx in
,
579 * Set if krb5_rq_red() is going to check the Windows PAC or not
581 * @param context Keberos 5 context.
582 * @param in krb5_rd_req_in_ctx to check the option on.
583 * @param flag flag to select if to check the pac (TRUE) or not (FALSE).
585 * @return Kerberos 5 error code, see krb5_get_error_message().
590 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
591 krb5_rd_req_in_set_pac_check(krb5_context context
,
592 krb5_rd_req_in_ctx in
,
595 in
->check_pac
= flag
;
600 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
601 krb5_rd_req_in_set_keyblock(krb5_context context
,
602 krb5_rd_req_in_ctx in
,
603 krb5_keyblock
*keyblock
)
605 in
->keyblock
= keyblock
; /* XXX should make copy */
609 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
610 krb5_rd_req_out_get_ap_req_options(krb5_context context
,
611 krb5_rd_req_out_ctx out
,
612 krb5_flags
*ap_req_options
)
614 *ap_req_options
= out
->ap_req_options
;
618 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
619 krb5_rd_req_out_get_ticket(krb5_context context
,
620 krb5_rd_req_out_ctx out
,
621 krb5_ticket
**ticket
)
623 return krb5_copy_ticket(context
, out
->ticket
, ticket
);
626 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
627 krb5_rd_req_out_get_keyblock(krb5_context context
,
628 krb5_rd_req_out_ctx out
,
629 krb5_keyblock
**keyblock
)
631 return krb5_copy_keyblock(context
, out
->keyblock
, keyblock
);
635 * Get the principal that was used in the request from the
636 * client. Might not match whats in the ticket if krb5_rd_req_ctx()
637 * searched in the keytab for a matching key.
639 * @param context a Kerberos 5 context.
640 * @param out a krb5_rd_req_out_ctx from krb5_rd_req_ctx().
641 * @param principal return principal, free with krb5_free_principal().
646 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
647 krb5_rd_req_out_get_server(krb5_context context
,
648 krb5_rd_req_out_ctx out
,
649 krb5_principal
*principal
)
651 return krb5_copy_principal(context
, out
->server
, principal
);
654 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
655 krb5_rd_req_in_ctx_free(krb5_context context
, krb5_rd_req_in_ctx ctx
)
661 * Free the krb5_rd_req_out_ctx.
663 * @param context Keberos 5 context.
664 * @param ctx krb5_rd_req_out_ctx context to free.
669 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
670 krb5_rd_req_out_ctx_free(krb5_context context
, krb5_rd_req_out_ctx ctx
)
673 krb5_free_ticket(context
, ctx
->ticket
);
675 krb5_free_keyblock(context
, ctx
->keyblock
);
677 krb5_free_principal(context
, ctx
->server
);
685 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
686 krb5_rd_req(krb5_context context
,
687 krb5_auth_context
*auth_context
,
688 const krb5_data
*inbuf
,
689 krb5_const_principal server
,
691 krb5_flags
*ap_req_options
,
692 krb5_ticket
**ticket
)
695 krb5_rd_req_in_ctx in
;
696 krb5_rd_req_out_ctx out
;
698 ret
= krb5_rd_req_in_ctx_alloc(context
, &in
);
702 ret
= krb5_rd_req_in_set_keytab(context
, in
, keytab
);
704 krb5_rd_req_in_ctx_free(context
, in
);
708 ret
= krb5_rd_req_ctx(context
, auth_context
, inbuf
, server
, in
, &out
);
709 krb5_rd_req_in_ctx_free(context
, in
);
714 *ap_req_options
= out
->ap_req_options
;
716 ret
= krb5_copy_ticket(context
, out
->ticket
, ticket
);
722 krb5_rd_req_out_ctx_free(context
, out
);
730 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
731 krb5_rd_req_with_keyblock(krb5_context context
,
732 krb5_auth_context
*auth_context
,
733 const krb5_data
*inbuf
,
734 krb5_const_principal server
,
735 krb5_keyblock
*keyblock
,
736 krb5_flags
*ap_req_options
,
737 krb5_ticket
**ticket
)
740 krb5_rd_req_in_ctx in
;
741 krb5_rd_req_out_ctx out
;
743 ret
= krb5_rd_req_in_ctx_alloc(context
, &in
);
747 ret
= krb5_rd_req_in_set_keyblock(context
, in
, keyblock
);
749 krb5_rd_req_in_ctx_free(context
, in
);
753 ret
= krb5_rd_req_ctx(context
, auth_context
, inbuf
, server
, in
, &out
);
754 krb5_rd_req_in_ctx_free(context
, in
);
759 *ap_req_options
= out
->ap_req_options
;
761 ret
= krb5_copy_ticket(context
, out
->ticket
, ticket
);
767 krb5_rd_req_out_ctx_free(context
, out
);
775 static krb5_error_code
776 get_key_from_keytab(krb5_context context
,
778 krb5_const_principal server
,
780 krb5_keyblock
**out_key
)
782 krb5_keytab_entry entry
;
785 krb5_keytab real_keytab
;
788 krb5_kt_default(context
, &real_keytab
);
790 real_keytab
= keytab
;
792 if (ap_req
->ticket
.enc_part
.kvno
)
793 kvno
= *ap_req
->ticket
.enc_part
.kvno
;
797 ret
= krb5_kt_get_entry (context
,
801 ap_req
->ticket
.enc_part
.etype
,
805 ret
= krb5_copy_keyblock(context
, &entry
.keyblock
, out_key
);
806 krb5_kt_free_entry (context
, &entry
);
809 krb5_kt_close(context
, real_keytab
);
815 * The core server function that verify application authentication
816 * requests from clients.
818 * @param context Keberos 5 context.
819 * @param auth_context the authentication context, can be NULL, then
820 * default values for the authentication context will used.
821 * @param inbuf the (AP-REQ) authentication buffer
823 * @param server the server with authenticate as, if NULL the function
824 * will try to find any avaiable credentintial in the keytab
825 * that will verify the reply. The function will prefer the
826 * server the server client specified in the AP-REQ, but if
827 * there is no mach, it will try all keytab entries for a
828 * match. This have serious performance issues for larger keytabs.
830 * @param inctx control the behavior of the function, if NULL, the
831 * default behavior is used.
832 * @param outctx the return outctx, free with krb5_rd_req_out_ctx_free().
833 * @return Kerberos 5 error code, see krb5_get_error_message().
838 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
839 krb5_rd_req_ctx(krb5_context context
,
840 krb5_auth_context
*auth_context
,
841 const krb5_data
*inbuf
,
842 krb5_const_principal server
,
843 krb5_rd_req_in_ctx inctx
,
844 krb5_rd_req_out_ctx
*outctx
)
848 krb5_rd_req_out_ctx o
= NULL
;
849 krb5_keytab id
= NULL
, keytab
= NULL
;
850 krb5_principal service
= NULL
;
854 o
= calloc(1, sizeof(*o
));
856 krb5_set_error_message(context
, ENOMEM
,
857 N_("malloc: out of memory", ""));
861 if (*auth_context
== NULL
) {
862 ret
= krb5_auth_con_init(context
, auth_context
);
867 ret
= krb5_decode_ap_req(context
, inbuf
, &ap_req
);
871 /* Save that principal that was in the request */
872 ret
= _krb5_principalname2krb5_principal(context
,
875 ap_req
.ticket
.realm
);
879 if (ap_req
.ap_options
.use_session_key
&&
880 (*auth_context
)->keyblock
== NULL
) {
881 ret
= KRB5KRB_AP_ERR_NOKEY
;
882 krb5_set_error_message(context
, ret
,
883 N_("krb5_rd_req: user to user auth "
884 "without session key given", ""));
888 if (inctx
&& inctx
->keytab
)
891 if((*auth_context
)->keyblock
){
892 ret
= krb5_copy_keyblock(context
,
893 (*auth_context
)->keyblock
,
897 } else if(inctx
&& inctx
->keyblock
){
898 ret
= krb5_copy_keyblock(context
,
906 krb5_kt_default(context
, &keytab
);
912 if (server
== NULL
) {
913 ret
= _krb5_principalname2krb5_principal(context
,
916 ap_req
.ticket
.realm
);
922 ret
= get_key_from_keytab(context
,
928 /* If caller specified a server, fail. */
931 /* Otherwise, fall back to iterating over the keytab. This
932 * have serious performace issues for larger keytab.
940 * We got an exact keymatch, use that.
943 ret
= krb5_verify_ap_req2(context
,
951 KRB5_KU_AP_REQ_AUTH
);
958 * Interate over keytab to find a key that can decrypt the request.
961 krb5_keytab_entry entry
;
962 krb5_kt_cursor cursor
;
963 int done
= 0, kvno
= 0;
965 memset(&cursor
, 0, sizeof(cursor
));
967 if (ap_req
.ticket
.enc_part
.kvno
)
968 kvno
= *ap_req
.ticket
.enc_part
.kvno
;
970 ret
= krb5_kt_start_seq_get(context
, id
, &cursor
);
978 ret
= krb5_kt_next_entry(context
, id
, &entry
, &cursor
);
980 _krb5_kt_principal_not_found(context
, ret
, id
, o
->server
,
981 ap_req
.ticket
.enc_part
.etype
,
986 if (entry
.keyblock
.keytype
!= ap_req
.ticket
.enc_part
.etype
||
987 (kvno
&& kvno
!= entry
.vno
)) {
988 krb5_kt_free_entry (context
, &entry
);
992 ret
= krb5_verify_ap_req2(context
,
1000 KRB5_KU_AP_REQ_AUTH
);
1002 krb5_kt_free_entry (context
, &entry
);
1007 * Found a match, save the keyblock for PAC processing,
1008 * and update the service principal in the ticket to match
1009 * whatever is in the keytab.
1012 ret
= krb5_copy_keyblock(context
,
1016 krb5_kt_free_entry (context
, &entry
);
1020 ret
= krb5_copy_principal(context
, entry
.principal
, &p
);
1022 krb5_kt_free_entry (context
, &entry
);
1025 krb5_free_principal(context
, o
->ticket
->server
);
1026 o
->ticket
->server
= p
;
1028 krb5_kt_free_entry (context
, &entry
);
1032 krb5_kt_end_seq_get (context
, id
, &cursor
);
1035 /* If there is a PAC, verify its server signature */
1036 if (inctx
== NULL
|| inctx
->check_pac
) {
1040 ret
= krb5_ticket_get_authorization_data_type(context
,
1042 KRB5_AUTHDATA_WIN2K_PAC
,
1045 ret
= krb5_pac_parse(context
, data
.data
, data
.length
, &pac
);
1046 krb5_data_free(&data
);
1050 ret
= krb5_pac_verify(context
,
1052 o
->ticket
->ticket
.authtime
,
1056 krb5_pac_free(context
, pac
);
1064 if (ret
|| outctx
== NULL
) {
1065 krb5_rd_req_out_ctx_free(context
, o
);
1069 free_AP_REQ(&ap_req
);
1072 krb5_free_principal(context
, service
);
1075 krb5_kt_close(context
, keytab
);