MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: binary From: ghudson@mit.edu X-Mailer: MIME-tools 5.507 (Entity 5.507) Subject: git commit X-RT-Interface: API X-RT-Original-Encoding: ascii RT-Message-ID: Content-Length: 1306 Allow deletion of require_auth with LDAP KDB In update_ldap_mod_auth_ind(), if there is no string attribute value for require_auth, check for krbPrincipalAuthInd attributes that might need to be removed. (This will only work if the entry is loaded and then modified, but that is the normal case for an existing entry.) Move the update_ldap_mod_auth_ind() call inside the tl-data conditional (which should perhaps be a check for KADM5_TL_DATA in the mask instead). A modification which did not intend to update tl-data should not remove the krbPrincipalAuthInd attributes. Change get_int_from_tl_data() to to zero its output so that it can't leave a garbage value behind if it returns 0 (as it does if no KDB_TL_USER_INFO tl-data is present). Based on a patch by Glenn Machin. (cherry picked from commit 6d9da7bb216f96cbdd731aa894714bd84213a9d0) https://github.com/krb5/krb5/commit/0badbf05a8cc7981980b20f2d3aa05989232f0b0 Author: Greg Hudson Commit: 0badbf05a8cc7981980b20f2d3aa05989232f0b0 Branch: krb5-1.18 src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c | 2 + src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 31 +++++++++++++------- src/tests/t_kdb.py | 26 ++++++++++++++++- 3 files changed, 47 insertions(+), 12 deletions(-)