Ticket History #6337: kadmin should force non-forwardable tickets

# Tue Jan 13 15:38:00 2009 Russ Allbery <devnull@mit.edu> - Ticket created

Subject:

kadmin should force non-forwardable tickets

Download (untitled) / with headers
text/plain 733B

We make forwardable tickets the default in the [libdefaults] section of
our krb5.conf file, but we disable forwardable tickets for privileged
principals (*/root, */admin). Authenticating to kadmin with a password
as a privileged account therefore fails on systems with our default
krb5.conf file.

In kadm5_gic_iter() when authenticating with a password, the client
library sets up krb5_get_init_creds_opt structure but doesn't set any
parameters in it. Since the acquired credentials are going into a
memory cache specific to that client invocation, forwardable tickets are
pointless. I think the kadmin client library should therefore force the
forwardable option (and probably the proxiable option and renewable
time) to false.

# Tue Jan 13 15:46:55 2009 Russ Allbery <rra@stanford.edu> - Correspondence added

To:	rt@krbdev.mit.edu
Subject:	Re: [krbdev.mit.edu #6337] kadmin should force non-forwardable tickets
From:	Russ Allbery <rra@stanford.edu>
Date:	Tue, 13 Jan 2009 12:46:53 -0800
RT-Send-Cc:

Download (untitled) / with headers
text/plain 1.3KiB

"Russ Allbery <rra@stanford.edu> via RT" <rt-comment@krbdev.mit.edu>
writes:

Show quoted text

> In kadm5_gic_iter() when authenticating with a password, the client
> library sets up krb5_get_init_creds_opt structure but doesn't set any
> parameters in it. Since the acquired credentials are going into a
> memory cache specific to that client invocation, forwardable tickets are
> pointless. I think the kadmin client library should therefore force the
> forwardable option (and probably the proxiable option and renewable
> time) to false.

Here's a patch. Let me know if this looks good and I'll check it in.

Index: client_init.c
===================================================================
--- src/lib/kadm5/clnt/client_init.c (revision 21740)
+++ src/lib/kadm5/clnt/client_init.c (working copy)
@@ -541,8 +541,12 @@
goto error;
}

- if (init_type != INIT_CREDS)
+ /* Credentials for kadmin don't need to be forwardable or proxiable. */
+ if (init_type != INIT_CREDS) {
krb5_get_init_creds_opt_init(&opt);
+ krb5_get_init_creds_opt_set_forwardable(&opt, 0);
+ krb5_get_init_creds_opt_set_proxiable(&opt, 0);
+ }

if (init_type == INIT_PASS) {
code = krb5_get_init_creds_password(ctx, &outcreds, client, pass,

--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>

# Tue Jan 13 16:20:47 2009 raeburn (Ken Raeburn) - Correspondence added

From:	Ken Raeburn <raeburn@MIT.EDU>
To:	rt@krbdev.mit.edu
Subject:	Re: [krbdev.mit.edu #6337] kadmin should force non-forwardable tickets
Date:	Tue, 13 Jan 2009 16:20:44 -0500
RT-Send-Cc:

Download (untitled) / with headers
text/plain 33B

The patch looks good to me.

Ken

# Tue Jan 13 19:29:07 2009 Russ Allbery <devnull@mit.edu> - Given to Russ Allbery <devnull@mit.edu>

# Tue Jan 13 19:29:07 2009 Russ Allbery <devnull@mit.edu> - Status changed from 'new' to 'review'

# Tue Jan 13 19:29:07 2009 Russ Allbery <devnull@mit.edu> - Correspondence added

From:	Russ Allbery <rra@stanford.edu>
Subject:	SVN Commit

Download (untitled) / with headers
text/plain 717B

Force tickets acquired by the kadm5 client library via password
authentication to be non-forwardable and non-proxiable, overridding
any [libdefaults] configuration. This may be necessary at sites that
set forwardable to true by default in their krb5.conf files but
disable forwardable tickets for privileged principals. Since the
ticket cache acquired by the kadm5 client library is used only for
kadmin operations, where forwardable is not useful or necessary, there
is no reason to ever attempt to obtain forwardable or proxiable tickets
here.

https://github.com/krb5/krb5/commit/033fd8fb426adcf264a867fc0001c0ee6735a079
Commit By: rra
Revision: 21744
Changed Files:
U trunk/src/lib/kadm5/clnt/client_init.c

# Fri Jan 23 15:49:06 2009 tlyu (Taylor Yu) - Status changed from 'review' to 'resolved'

# Fri Jan 30 23:08:21 2009 tlyu (Taylor Yu) - Version_Fixed 1.7 added

# Mon Aug 04 18:09:29 2014 tlyu (Taylor Yu) - Data error added