Ticket History #5697: make ccache handle referrals better

In bug reports such as

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=436512

and ticket #5663 it appears that the referrals support causes some
problems in the following cases:

1. pre-existing cred having explicit service realm can't be found in
ccache when looking up a principal name with empty realm from
sname_to_princ

2. pre-existing cred having empty realm or different service realm
from actual encoded ticket can't be found in ccache when looking up
a principal name with the "correct" realm

Both of these can cause excess network traffic as the client attempts
to get another copy of ticket which it already has.

For (1), cause krb5_cc_retrieve_cred to search using the client
principal's realm as the service princpal's realm if a search with an
empty service realm fails.

For (2), cause krb5_cc_store_cred to compare the service principal
(perhaps only the realm) in the cred against the principal in the
actual ticket. If they differ, store using both principal names.

These should be implemented independently of the back ends, i.e. the
krb5_cc_* interfaces will no longer be simple wrappers around a call
through a function pointer. The above solutions will also help in
cases where a ccache is shared between multiple implementations.

From: tlyu@MIT.EDU
Subject: svn rev #19898: trunk/ src/lib/krb5/ccache/
To: cvs-krb5@mit.edu
Date: Wed, 29 Aug 2007 18:59:53 -0400 (EDT)
Reply-To: krbdev@MIT.EDU

Commit By: tlyu
Log Message:
ticket: 5697
tags: pullup

Make ccache handle referrals better by storing both server principal
names if they differ between the creds structure and the encoded
ticket and by looking up the server principal using the client's realm
if not found and server's realm was initially the referral (empty)
realm.



Changed Files:
_U trunk/
U trunk/src/lib/krb5/ccache/ccfns.c

This patch seems to cause the t_cc test to fail.

Tom Yu via RT wrote:

Note that kx509 stores X.509 certificates in the cache using krb5_cc and
there is at least one site that is using the ccache to store SSH
private keys.

I don't think that failure to parse a ticket should result in the ticket
not being stored in the ccache under the requested name.

Bail out if encoded "ticket" doesn't decode correctly. This allows
t_cc test case to pass and allows non-tickets to be stored (for now).

Commit By: tlyu



Revision: 19910
Changed Files:
_U trunk/
U trunk/src/lib/krb5/ccache/ccfns.c