| commit | b7fe0fb85a780fed3c54ed2539fc974db1884dc2 | |
| author | Isaac Boukris <iboukris@gmail.com> | |
| Mon, 12 Nov 2018 18:08:06 +0000 (12 20:08 +0200) | ||
| committer | Jeffrey Altman <jaltman@auristor.com> | |
| Sun, 19 May 2019 02:33:48 +0000 (18 22:33 -0400) | ||
| tree | 42b333921fa61a62f564a543467e25dfebc73a07 | treesnapshot (tar.gz zip) |
| parent | 014e318d6bdefd8ecfcb99ca9928921f6a49d721 | commitdiff |
kdc: allow checksum of PA-FOR-USER to be HMAC_MD5
even if tgt used an enctype with a different checksum.
Per [MS-SFU] 2.2.1 PA-FOR-USER the checksum is always
HMAC_MD5, and that's what Windows and MIT clients send.
In heimdal both the client and kdc use instead the
checksum of the tgt, and therefore work with each other
but windows and MIT clients fail against heimdal KDC.
Both Windows and MIT KDC would allow any keyed checksum
to be used so Heimdal client work fine against it.
Change Heimdal KDC to allow HMAC_MD5 even for non RC4
based tgt in order to support per-spec clients.
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
even if tgt used an enctype with a different checksum.
Per [MS-SFU] 2.2.1 PA-FOR-USER the checksum is always
HMAC_MD5, and that's what Windows and MIT clients send.
In heimdal both the client and kdc use instead the
checksum of the tgt, and therefore work with each other
but windows and MIT clients fail against heimdal KDC.
Both Windows and MIT KDC would allow any keyed checksum
to be used so Heimdal client work fine against it.
Change Heimdal KDC to allow HMAC_MD5 even for non RC4
based tgt in order to support per-spec clients.
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
| kdc/krb5tgs.c | diffblobblamehistory | |
| lib/krb5/libkrb5-exports.def.in | diffblobblamehistory | |
| lib/krb5/version-script.map | diffblobblamehistory | |
| tests/kdc/check-kdc.in | diffblobblamehistory |