Skip Menu |
 

History Show all quoted text — Show full headers
# Tue Sep 01 21:30:13 2009 Luke Howard <lhoward@MIT.EDU> - Ticket created
From: Luke Howard <lhoward@MIT.EDU>
To: krb5-bugs@MIT.EDU
Subject: k5_pac_validate_client()
Date: Wed, 2 Sep 2009 00:45:34 +0200
Download (untitled) / with headers
text/plain 673B
Download (untitled) / with headers
text/html 2.9KiB
Show quoted text
Bug in 1.7 in k5_pac_validate_client(), in 1.7. It would be nice to fix this for 1.7.1.

The issue is that PACs from principals in different realms to the service fail to validate.

The fix to pac.c is to ignore the realm component (because the principal name in the PAC is unqualified):

    if (pac_authtime != authtime ||
        !krb5_principal_compare_flags(context,
                                      pac_principal,
                                      principal,
                                      KRB5_PRINCIPAL_COMPARE_IGNORE_REALM))
        ret = KRB5KRB_AP_WRONG_PRINC;

-- Luke

# Wed Mar 14 11:03:19 2018 ghudson@mit.edu (Greg Hudson) - Status changed from 'new' to 'resolved'
# Wed Mar 14 11:03:19 2018 ghudson@mit.edu (Greg Hudson) - Ticket 6555 RefersTo ticket 6572.
# Wed Mar 14 11:03:19 2018 ghudson@mit.edu (Greg Hudson) - Comments added
Download (untitled) / with headers
text/plain 57B
The suggested change was made on the side in ticket 6572.
# Sat Oct 27 11:42:55 2018 ghudson@mit.edu (Greg Hudson) - Tags nochange added