Return-Path: X-Original-To: rt@krbdev.mit.edu Received: from smtp4.stanford.edu (smtp4.Stanford.EDU [171.67.219.84]) by krbdev.mit.edu (Postfix) with ESMTP id D7A04CC004 for ; Tue, 13 Jan 2009 20:46:54 +0000 (UTC) Received: from smtp4.stanford.edu (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 0EE4F486416 for ; Tue, 13 Jan 2009 12:46:54 -0800 (PST) Received: from windlord.stanford.edu (windlord.Stanford.EDU [171.67.225.134]) by smtp4.stanford.edu (Postfix) with ESMTP id E540348641A for ; Tue, 13 Jan 2009 12:46:53 -0800 (PST) Received: by windlord.stanford.edu (Postfix, from userid 1000) id B2C4DE792E; Tue, 13 Jan 2009 12:46:53 -0800 (PST) To: rt@krbdev.mit.edu Subject: Re: [krbdev.mit.edu #6337] kadmin should force non-forwardable tickets In-Reply-To: (Russ Allbery's message of "Tue\, 13 Jan 2009 20\:38\:00 +0000 \(UTC\)") User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.2 (gnu/linux) References: From: Russ Allbery Organization: The Eyrie Date: Tue, 13 Jan 2009 12:46:53 -0800 Message-ID: <8763kj6iiq.fsf@windlord.stanford.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii RT-Send-Cc: X-RT-Original-Encoding: us-ascii Content-Length: 1336 "Russ Allbery via RT" writes: > In kadm5_gic_iter() when authenticating with a password, the client > library sets up krb5_get_init_creds_opt structure but doesn't set any > parameters in it. Since the acquired credentials are going into a > memory cache specific to that client invocation, forwardable tickets are > pointless. I think the kadmin client library should therefore force the > forwardable option (and probably the proxiable option and renewable > time) to false. Here's a patch. Let me know if this looks good and I'll check it in. Index: client_init.c =================================================================== --- src/lib/kadm5/clnt/client_init.c (revision 21740) +++ src/lib/kadm5/clnt/client_init.c (working copy) @@ -541,8 +541,12 @@ goto error; } - if (init_type != INIT_CREDS) + /* Credentials for kadmin don't need to be forwardable or proxiable. */ + if (init_type != INIT_CREDS) { krb5_get_init_creds_opt_init(&opt); + krb5_get_init_creds_opt_set_forwardable(&opt, 0); + krb5_get_init_creds_opt_set_proxiable(&opt, 0); + } if (init_type == INIT_PASS) { code = krb5_get_init_creds_password(ctx, &outcreds, client, pass, -- Russ Allbery (rra@stanford.edu)