Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.427 (Entity 5.427) From: tlyu@mit.edu Subject: git commit RT-Send-CC: X-RT-Original-Encoding: iso-8859-1 Content-Length: 1315 Default to LSA when TGT in LSA is inaccessible When UAC is enabled and a domain user with Administrator privileges logs in, the TGT is inaccessible. Access to the TGT in a UAC-restricted session may allow a non-elevated user to bypass the UAC. In a UAC-restricted session, ms2mit copies the current tickets from the LSA ccache to the API ccache except the TGT, effectively preventing a user session from getting additional service tickets while appearing, for some purposes, to have a usable ccache. Another bug is that ms2mit always copies from the LSA ccache to the default ccache, even if the default ccache is itself the LSA ccache. New behavior: * If the TGT is accessible in the LSA ccache, copy the LSA ccache to the API ccache. * Set the registry key for the default ccname to "API:" if the copy occurred, or to "MSLSA:" if it didn't occur. [tlyu@mit.edu: edit commit message] (cherry picked from commit 33b862799efa65b16e2acd1510c84d9f1ded2cbb) https://github.com/krb5/krb5/commit/d61414189b4c157b19e3e7e7b9039a6ced88fbd8 Author: Sarah Day Committer: Tom Yu Commit: d61414189b4c157b19e3e7e7b9039a6ced88fbd8 Branch: krb5-1.13 src/windows/ms2mit/ms2mit.c | 99 ++++++++++++++++++++++++++++++++++--------- 1 files changed, 79 insertions(+), 20 deletions(-)