3 * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
4 * (Royal Institute of Technology, Stockholm, Sweden).
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the Institute nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 #include "krb5_locl.h"
37 static krb5_error_code
38 decrypt_tkt_enc_part (krb5_context context
,
40 EncryptedData
*enc_part
,
41 EncTicketPart
*decr_part
)
48 ret
= krb5_crypto_init(context
, key
, 0, &crypto
);
51 ret
= krb5_decrypt_EncryptedData (context
,
56 krb5_crypto_destroy(context
, crypto
);
60 ret
= decode_EncTicketPart(plain
.data
, plain
.length
, decr_part
, &len
);
62 krb5_set_error_message(context
, ret
,
63 N_("Failed to decode encrypted "
65 krb5_data_free (&plain
);
69 static krb5_error_code
70 decrypt_authenticator (krb5_context context
,
72 EncryptedData
*enc_part
,
73 Authenticator
*authenticator
,
81 ret
= krb5_crypto_init(context
, key
, 0, &crypto
);
84 ret
= krb5_decrypt_EncryptedData (context
,
86 usage
/* KRB5_KU_AP_REQ_AUTH */,
89 /* for backwards compatibility, also try the old usage */
90 if (ret
&& usage
== KRB5_KU_TGS_REQ_AUTH
)
91 ret
= krb5_decrypt_EncryptedData (context
,
96 krb5_crypto_destroy(context
, crypto
);
100 ret
= decode_Authenticator(plain
.data
, plain
.length
,
101 authenticator
, &len
);
102 krb5_data_free (&plain
);
106 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
107 krb5_decode_ap_req(krb5_context context
,
108 const krb5_data
*inbuf
,
113 ret
= decode_AP_REQ(inbuf
->data
, inbuf
->length
, ap_req
, &len
);
116 if (ap_req
->pvno
!= 5){
118 krb5_clear_error_message (context
);
119 return KRB5KRB_AP_ERR_BADVERSION
;
121 if (ap_req
->msg_type
!= krb_ap_req
){
123 krb5_clear_error_message (context
);
124 return KRB5KRB_AP_ERR_MSG_TYPE
;
126 if (ap_req
->ticket
.tkt_vno
!= 5){
128 krb5_clear_error_message (context
);
129 return KRB5KRB_AP_ERR_BADVERSION
;
134 static krb5_error_code
135 check_transited(krb5_context context
, Ticket
*ticket
, EncTicketPart
*enc
)
138 unsigned int num_realms
, n
;
142 * Windows 2000 and 2003 uses this inside their TGT so it's normaly
143 * not seen by others, however, samba4 joined with a Windows AD as
144 * a Domain Controller gets exposed to this.
146 if(enc
->transited
.tr_type
== 0 && enc
->transited
.contents
.length
== 0)
149 if(enc
->transited
.tr_type
!= DOMAIN_X500_COMPRESS
)
150 return KRB5KDC_ERR_TRTYPE_NOSUPP
;
152 if(enc
->transited
.contents
.length
== 0)
155 ret
= krb5_domain_x500_decode(context
, enc
->transited
.contents
,
156 &realms
, &num_realms
,
161 ret
= krb5_check_transited(context
, enc
->crealm
,
163 realms
, num_realms
, NULL
);
164 for (n
= 0; n
< num_realms
; n
++)
170 static krb5_error_code
171 find_etypelist(krb5_context context
,
172 krb5_auth_context auth_context
,
178 ret
= _krb5_get_ad(context
, auth_context
->authenticator
->authorization_data
, NULL
, KRB5_AUTHDATA_GSS_API_ETYPE_NEGOTIATION
, &data
);
182 ret
= decode_EtypeList(data
.data
, data
.length
, etypes
, NULL
);
183 krb5_data_free(&data
);
185 krb5_clear_error_message(context
);
190 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
191 krb5_decrypt_ticket(krb5_context context
,
199 ret
= decrypt_tkt_enc_part (context
, key
, &ticket
->enc_part
, &t
);
205 time_t start
= t
.authtime
;
207 krb5_timeofday (context
, &now
);
209 start
= *t
.starttime
;
210 if(start
- now
> context
->max_skew
212 && !(flags
& KRB5_VERIFY_AP_REQ_IGNORE_INVALID
))) {
213 free_EncTicketPart(&t
);
214 krb5_clear_error_message (context
);
215 return KRB5KRB_AP_ERR_TKT_NYV
;
217 if(now
- t
.endtime
> context
->max_skew
) {
218 free_EncTicketPart(&t
);
219 krb5_clear_error_message (context
);
220 return KRB5KRB_AP_ERR_TKT_EXPIRED
;
223 if(!t
.flags
.transited_policy_checked
) {
224 ret
= check_transited(context
, ticket
, &t
);
226 free_EncTicketPart(&t
);
235 free_EncTicketPart(&t
);
239 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
240 krb5_verify_authenticator_checksum(krb5_context context
,
241 krb5_auth_context ac
,
246 krb5_keyblock
*key
= NULL
;
247 krb5_authenticator authenticator
;
250 ret
= krb5_auth_con_getauthenticator(context
, ac
, &authenticator
);
253 if (authenticator
->cksum
== NULL
) {
257 ret
= krb5_auth_con_getkey(context
, ac
, &key
);
260 ret
= krb5_crypto_init(context
, key
, 0, &crypto
);
263 ret
= krb5_verify_checksum(context
, crypto
,
264 KRB5_KU_AP_REQ_AUTH_CKSUM
,
265 data
, len
, authenticator
->cksum
);
266 krb5_crypto_destroy(context
, crypto
);
268 krb5_free_authenticator(context
, &authenticator
);
269 krb5_free_keyblock(context
, key
);
274 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
275 krb5_verify_ap_req(krb5_context context
,
276 krb5_auth_context
*auth_context
,
278 krb5_const_principal server
,
279 krb5_keyblock
*keyblock
,
281 krb5_flags
*ap_req_options
,
282 krb5_ticket
**ticket
)
284 return krb5_verify_ap_req2 (context
,
292 KRB5_KU_AP_REQ_AUTH
);
295 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
296 krb5_verify_ap_req2(krb5_context context
,
297 krb5_auth_context
*auth_context
,
299 krb5_const_principal server
,
300 krb5_keyblock
*keyblock
,
302 krb5_flags
*ap_req_options
,
303 krb5_ticket
**ticket
,
304 krb5_key_usage usage
)
307 krb5_auth_context ac
;
311 memset(&etypes
, 0, sizeof(etypes
));
316 if (auth_context
&& *auth_context
) {
319 ret
= krb5_auth_con_init (context
, &ac
);
324 t
= calloc(1, sizeof(*t
));
326 ret
= krb5_enomem(context
);
330 if (ap_req
->ap_options
.use_session_key
&& ac
->keyblock
){
331 ret
= krb5_decrypt_ticket(context
, &ap_req
->ticket
,
335 krb5_free_keyblock(context
, ac
->keyblock
);
338 ret
= krb5_decrypt_ticket(context
, &ap_req
->ticket
,
346 ret
= _krb5_principalname2krb5_principal(context
,
348 ap_req
->ticket
.sname
,
349 ap_req
->ticket
.realm
);
351 ret
= _krb5_principalname2krb5_principal(context
,
357 ret
= decrypt_authenticator (context
,
359 &ap_req
->authenticator
,
366 krb5_principal p1
, p2
;
369 _krb5_principalname2krb5_principal(context
,
371 ac
->authenticator
->cname
,
372 ac
->authenticator
->crealm
);
373 _krb5_principalname2krb5_principal(context
,
377 res
= krb5_principal_compare (context
, p1
, p2
);
378 krb5_free_principal (context
, p1
);
379 krb5_free_principal (context
, p2
);
381 ret
= KRB5KRB_AP_ERR_BADMATCH
;
382 krb5_clear_error_message (context
);
387 /* check addresses */
390 && ac
->remote_address
391 && !krb5_address_search (context
,
394 ret
= KRB5KRB_AP_ERR_BADADDR
;
395 krb5_clear_error_message (context
);
399 /* check timestamp in authenticator */
403 krb5_timeofday (context
, &now
);
405 if (labs(ac
->authenticator
->ctime
- now
) > context
->max_skew
) {
406 ret
= KRB5KRB_AP_ERR_SKEW
;
407 krb5_clear_error_message (context
);
412 if (ac
->authenticator
->seq_number
)
413 krb5_auth_con_setremoteseqnumber(context
, ac
,
414 *ac
->authenticator
->seq_number
);
416 /* XXX - Xor sequence numbers */
418 if (ac
->authenticator
->subkey
) {
419 ret
= krb5_auth_con_setremotesubkey(context
, ac
,
420 ac
->authenticator
->subkey
);
425 ret
= find_etypelist(context
, ac
, &etypes
);
429 ac
->keytype
= ETYPE_NULL
;
434 for (i
= 0; i
< etypes
.len
; i
++) {
435 if (krb5_enctype_valid(context
, etypes
.val
[i
]) == 0) {
436 ac
->keytype
= etypes
.val
[i
];
443 ret
= krb5_copy_keyblock(context
, &t
->ticket
.key
, &ac
->keyblock
);
446 if (ap_req_options
) {
448 if (ac
->keytype
!= (krb5_enctype
)ETYPE_NULL
)
449 *ap_req_options
|= AP_OPTS_USE_SUBKEY
;
450 if (ap_req
->ap_options
.use_session_key
)
451 *ap_req_options
|= AP_OPTS_USE_SESSION_KEY
;
452 if (ap_req
->ap_options
.mutual_required
)
453 *ap_req_options
|= AP_OPTS_MUTUAL_REQUIRED
;
459 krb5_free_ticket (context
, t
);
461 if (*auth_context
== NULL
)
464 krb5_auth_con_free (context
, ac
);
465 free_EtypeList(&etypes
);
468 free_EtypeList(&etypes
);
470 krb5_free_ticket (context
, t
);
471 if (auth_context
== NULL
|| *auth_context
== NULL
)
472 krb5_auth_con_free (context
, ac
);
480 struct krb5_rd_req_in_ctx_data
{
482 krb5_keyblock
*keyblock
;
483 krb5_boolean check_pac
;
486 struct krb5_rd_req_out_ctx_data
{
487 krb5_keyblock
*keyblock
;
488 krb5_flags ap_req_options
;
490 krb5_principal server
;
494 * Allocate a krb5_rd_req_in_ctx as an input parameter to
495 * krb5_rd_req_ctx(). The caller should free the context with
496 * krb5_rd_req_in_ctx_free() when done with the context.
498 * @param context Keberos 5 context.
499 * @param ctx in ctx to krb5_rd_req_ctx().
501 * @return Kerberos 5 error code, see krb5_get_error_message().
506 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
507 krb5_rd_req_in_ctx_alloc(krb5_context context
, krb5_rd_req_in_ctx
*ctx
)
509 *ctx
= calloc(1, sizeof(**ctx
));
511 return krb5_enomem(context
);
512 (*ctx
)->check_pac
= (context
->flags
& KRB5_CTX_F_CHECK_PAC
) ? 1 : 0;
517 * Set the keytab that krb5_rd_req_ctx() will use.
519 * @param context Keberos 5 context.
520 * @param in in ctx to krb5_rd_req_ctx().
521 * @param keytab keytab that krb5_rd_req_ctx() will use, only copy the
522 * pointer, so the caller must free they keytab after
523 * krb5_rd_req_in_ctx_free() is called.
525 * @return Kerberos 5 error code, see krb5_get_error_message().
530 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
531 krb5_rd_req_in_set_keytab(krb5_context context
,
532 krb5_rd_req_in_ctx in
,
540 * Set if krb5_rq_red() is going to check the Windows PAC or not
542 * @param context Keberos 5 context.
543 * @param in krb5_rd_req_in_ctx to check the option on.
544 * @param flag flag to select if to check the pac (TRUE) or not (FALSE).
546 * @return Kerberos 5 error code, see krb5_get_error_message().
551 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
552 krb5_rd_req_in_set_pac_check(krb5_context context
,
553 krb5_rd_req_in_ctx in
,
556 in
->check_pac
= flag
;
561 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
562 krb5_rd_req_in_set_keyblock(krb5_context context
,
563 krb5_rd_req_in_ctx in
,
564 krb5_keyblock
*keyblock
)
566 in
->keyblock
= keyblock
; /* XXX should make copy */
570 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
571 krb5_rd_req_out_get_ap_req_options(krb5_context context
,
572 krb5_rd_req_out_ctx out
,
573 krb5_flags
*ap_req_options
)
575 *ap_req_options
= out
->ap_req_options
;
579 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
580 krb5_rd_req_out_get_ticket(krb5_context context
,
581 krb5_rd_req_out_ctx out
,
582 krb5_ticket
**ticket
)
584 return krb5_copy_ticket(context
, out
->ticket
, ticket
);
587 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
588 krb5_rd_req_out_get_keyblock(krb5_context context
,
589 krb5_rd_req_out_ctx out
,
590 krb5_keyblock
**keyblock
)
592 return krb5_copy_keyblock(context
, out
->keyblock
, keyblock
);
596 * Get the principal that was used in the request from the
597 * client. Might not match whats in the ticket if krb5_rd_req_ctx()
598 * searched in the keytab for a matching key.
600 * @param context a Kerberos 5 context.
601 * @param out a krb5_rd_req_out_ctx from krb5_rd_req_ctx().
602 * @param principal return principal, free with krb5_free_principal().
607 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
608 krb5_rd_req_out_get_server(krb5_context context
,
609 krb5_rd_req_out_ctx out
,
610 krb5_principal
*principal
)
612 return krb5_copy_principal(context
, out
->server
, principal
);
615 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
616 krb5_rd_req_in_ctx_free(krb5_context context
, krb5_rd_req_in_ctx ctx
)
622 * Free the krb5_rd_req_out_ctx.
624 * @param context Keberos 5 context.
625 * @param ctx krb5_rd_req_out_ctx context to free.
630 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
631 krb5_rd_req_out_ctx_free(krb5_context context
, krb5_rd_req_out_ctx ctx
)
634 krb5_free_ticket(context
, ctx
->ticket
);
636 krb5_free_keyblock(context
, ctx
->keyblock
);
638 krb5_free_principal(context
, ctx
->server
);
643 * Process an AP_REQ message.
645 * @param context Kerberos 5 context.
646 * @param auth_context authentication context of the peer.
647 * @param inbuf the AP_REQ message, obtained for example with krb5_read_message().
648 * @param server server principal.
649 * @param keytab server keytab.
650 * @param ap_req_options set to the AP_REQ options. See the AP_OPTS_* defines.
651 * @param ticket on success, set to the authenticated client credentials.
652 * Must be deallocated with krb5_free_ticket(). If not
653 * interested, pass a NULL value.
655 * @return 0 to indicate success. Otherwise a Kerberos error code is
656 * returned, see krb5_get_error_message().
658 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
659 krb5_rd_req(krb5_context context
,
660 krb5_auth_context
*auth_context
,
661 const krb5_data
*inbuf
,
662 krb5_const_principal server
,
664 krb5_flags
*ap_req_options
,
665 krb5_ticket
**ticket
)
668 krb5_rd_req_in_ctx in
;
669 krb5_rd_req_out_ctx out
;
671 ret
= krb5_rd_req_in_ctx_alloc(context
, &in
);
675 ret
= krb5_rd_req_in_set_keytab(context
, in
, keytab
);
677 krb5_rd_req_in_ctx_free(context
, in
);
681 ret
= krb5_rd_req_ctx(context
, auth_context
, inbuf
, server
, in
, &out
);
682 krb5_rd_req_in_ctx_free(context
, in
);
687 *ap_req_options
= out
->ap_req_options
;
689 ret
= krb5_copy_ticket(context
, out
->ticket
, ticket
);
695 krb5_rd_req_out_ctx_free(context
, out
);
703 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
704 krb5_rd_req_with_keyblock(krb5_context context
,
705 krb5_auth_context
*auth_context
,
706 const krb5_data
*inbuf
,
707 krb5_const_principal server
,
708 krb5_keyblock
*keyblock
,
709 krb5_flags
*ap_req_options
,
710 krb5_ticket
**ticket
)
713 krb5_rd_req_in_ctx in
;
714 krb5_rd_req_out_ctx out
;
716 ret
= krb5_rd_req_in_ctx_alloc(context
, &in
);
720 ret
= krb5_rd_req_in_set_keyblock(context
, in
, keyblock
);
722 krb5_rd_req_in_ctx_free(context
, in
);
726 ret
= krb5_rd_req_ctx(context
, auth_context
, inbuf
, server
, in
, &out
);
727 krb5_rd_req_in_ctx_free(context
, in
);
732 *ap_req_options
= out
->ap_req_options
;
734 ret
= krb5_copy_ticket(context
, out
->ticket
, ticket
);
740 krb5_rd_req_out_ctx_free(context
, out
);
748 static krb5_error_code
749 get_key_from_keytab(krb5_context context
,
751 krb5_const_principal server
,
753 krb5_keyblock
**out_key
)
755 krb5_keytab_entry entry
;
758 krb5_keytab real_keytab
;
761 krb5_kt_default(context
, &real_keytab
);
763 real_keytab
= keytab
;
765 if (ap_req
->ticket
.enc_part
.kvno
)
766 kvno
= *ap_req
->ticket
.enc_part
.kvno
;
770 ret
= krb5_kt_get_entry (context
,
774 ap_req
->ticket
.enc_part
.etype
,
778 ret
= krb5_copy_keyblock(context
, &entry
.keyblock
, out_key
);
779 krb5_kt_free_entry (context
, &entry
);
782 krb5_kt_close(context
, real_keytab
);
788 * The core server function that verify application authentication
789 * requests from clients.
791 * @param context Keberos 5 context.
792 * @param auth_context the authentication context, can be NULL, then
793 * default values for the authentication context will used.
794 * @param inbuf the (AP-REQ) authentication buffer
796 * @param server the server to authenticate to. If NULL the function
797 * will try to find any available credential in the keytab
798 * that will verify the reply. The function will prefer the
799 * server specified in the AP-REQ, but if
800 * there is no mach, it will try all keytab entries for a
801 * match. This has serious performance issues for large keytabs.
803 * @param inctx control the behavior of the function, if NULL, the
804 * default behavior is used.
805 * @param outctx the return outctx, free with krb5_rd_req_out_ctx_free().
806 * @return Kerberos 5 error code, see krb5_get_error_message().
811 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
812 krb5_rd_req_ctx(krb5_context context
,
813 krb5_auth_context
*auth_context
,
814 const krb5_data
*inbuf
,
815 krb5_const_principal server
,
816 krb5_rd_req_in_ctx inctx
,
817 krb5_rd_req_out_ctx
*outctx
)
821 krb5_rd_req_out_ctx o
= NULL
;
822 krb5_keytab id
= NULL
, keytab
= NULL
;
823 krb5_principal service
= NULL
;
827 o
= calloc(1, sizeof(*o
));
829 return krb5_enomem(context
);
831 if (*auth_context
== NULL
) {
832 ret
= krb5_auth_con_init(context
, auth_context
);
837 ret
= krb5_decode_ap_req(context
, inbuf
, &ap_req
);
841 /* Save the principal that was in the request */
842 ret
= _krb5_principalname2krb5_principal(context
,
845 ap_req
.ticket
.realm
);
849 if (ap_req
.ap_options
.use_session_key
&&
850 (*auth_context
)->keyblock
== NULL
) {
851 ret
= KRB5KRB_AP_ERR_NOKEY
;
852 krb5_set_error_message(context
, ret
,
853 N_("krb5_rd_req: user to user auth "
854 "without session key given", ""));
858 if (inctx
&& inctx
->keytab
)
861 if((*auth_context
)->keyblock
){
862 ret
= krb5_copy_keyblock(context
,
863 (*auth_context
)->keyblock
,
867 } else if(inctx
&& inctx
->keyblock
){
868 ret
= krb5_copy_keyblock(context
,
876 krb5_kt_default(context
, &keytab
);
882 if (server
== NULL
) {
883 ret
= _krb5_principalname2krb5_principal(context
,
886 ap_req
.ticket
.realm
);
892 ret
= get_key_from_keytab(context
,
898 /* If caller specified a server, fail. */
899 if (service
== NULL
&& (context
->flags
& KRB5_CTX_F_RD_REQ_IGNORE
) == 0)
901 /* Otherwise, fall back to iterating over the keytab. This
902 * have serious performace issues for larger keytab.
910 * We got an exact keymatch, use that.
913 ret
= krb5_verify_ap_req2(context
,
921 KRB5_KU_AP_REQ_AUTH
);
928 * Interate over keytab to find a key that can decrypt the request.
931 krb5_keytab_entry entry
;
932 krb5_kt_cursor cursor
;
933 int done
= 0, kvno
= 0;
935 memset(&cursor
, 0, sizeof(cursor
));
937 if (ap_req
.ticket
.enc_part
.kvno
)
938 kvno
= *ap_req
.ticket
.enc_part
.kvno
;
940 ret
= krb5_kt_start_seq_get(context
, id
, &cursor
);
948 ret
= krb5_kt_next_entry(context
, id
, &entry
, &cursor
);
950 _krb5_kt_principal_not_found(context
, ret
, id
, o
->server
,
951 ap_req
.ticket
.enc_part
.etype
,
956 if (entry
.keyblock
.keytype
!= ap_req
.ticket
.enc_part
.etype
) {
957 krb5_kt_free_entry (context
, &entry
);
961 ret
= krb5_verify_ap_req2(context
,
969 KRB5_KU_AP_REQ_AUTH
);
971 krb5_kt_free_entry (context
, &entry
);
976 * Found a match, save the keyblock for PAC processing,
977 * and update the service principal in the ticket to match
978 * whatever is in the keytab.
981 ret
= krb5_copy_keyblock(context
,
985 krb5_kt_free_entry (context
, &entry
);
989 ret
= krb5_copy_principal(context
, entry
.principal
, &p
);
991 krb5_kt_free_entry (context
, &entry
);
994 krb5_free_principal(context
, o
->ticket
->server
);
995 o
->ticket
->server
= p
;
997 krb5_kt_free_entry (context
, &entry
);
1001 krb5_kt_end_seq_get (context
, id
, &cursor
);
1006 /* If there is a PAC, verify its server signature */
1007 if (inctx
== NULL
|| inctx
->check_pac
) {
1011 ret
= krb5_ticket_get_authorization_data_type(context
,
1013 KRB5_AUTHDATA_WIN2K_PAC
,
1016 ret
= krb5_pac_parse(context
, data
.data
, data
.length
, &pac
);
1017 krb5_data_free(&data
);
1021 ret
= krb5_pac_verify(context
,
1023 o
->ticket
->ticket
.authtime
,
1027 krb5_pac_free(context
, pac
);
1035 if (ret
|| outctx
== NULL
) {
1036 krb5_rd_req_out_ctx_free(context
, o
);
1040 free_AP_REQ(&ap_req
);
1043 krb5_free_principal(context
, service
);
1046 krb5_kt_close(context
, keytab
);