Ticket History #5121: keytab code can't match principals with realms not yet determined

The new referral support code puts determination of the realm of a
service on the KDC. On the client side, in krb5_sname_to_principal, if
we don't have explicit data in the config file (or supplied by the
application), we leave the realm as an empty string rather than applying
unreliable heuristics.

However, if the resulting principal name is used to look up an entry in
a keytab, rather than as the server name to pass off to a KDC, it will
not match any of the entries in the file.

Proposed fix: If an empty realm name is given to the keytab-reading
code, the default realm is used instead.

ktfns.c (krb5_kt_get_entry): If the supplied server principal has an empty
realm name, replace it with the default realm, in a private copy.

Commit By: raeburn



Revision: 18975
Changed Files:
U trunk/src/lib/krb5/keytab/ktfns.c

pull up r18974 from trunk

r18974@cathode-dark-space: raeburn | 2006-12-18 20:28:32 -0500
ticket: 5121
status: open

krb5_is_referral_realm now takes a pointer to const krb5_data, since it doesn't
modify it.



Commit By: tlyu



Revision: 18978
Changed Files:
_U branches/krb5-1-6/
U branches/krb5-1-6/src/include/krb5/krb5.hin
U branches/krb5-1-6/src/lib/krb5/krb/princ_comp.c