Skip Menu |
 

History Show all quoted text — Show full headers
# Wed Dec 23 16:10:30 2009 hartmans (Sam Hartman) - Ticket created
From: hartmans@mit.edu
Subject: SVN Commit
Download (untitled) / with headers
text/plain 506B
Pkinit's verification of the KDC SAN requires that the certificate
have a SAN for the server principal. That's not correct according to
RFC 4556. The KDC should have a SAN for the TGS principal; that's
independent of whether the TGS principal is actually the server.

Fix to build the TGS principal explicitly.

https://github.com/krb5/krb5/commit/e95ea8f8428041134a835890033d1eef8dca2a06
Commit By: hartmans
Revision: 23504
Changed Files:
U branches/anonymous/src/plugins/preauth/pkinit/pkinit_clnt.c
# Wed Dec 23 16:10:31 2009 hartmans (Sam Hartman) - Requestor hartmans (Sam Hartman) added
# Wed Dec 23 16:10:31 2009 hartmans (Sam Hartman) - Status changed from 'new' to 'review'
# Mon Jan 04 23:38:56 2010 tlyu (Taylor Yu) - Version_Fixed 1.8 added
# Tue Jan 05 17:00:01 2010 tlyu (Taylor Yu) - Subject changed from '[no subject]' to 'PKINIT client should validate SAN for TGS, not service principal'
# Sun Sep 24 20:39:55 2017 ghudson@mit.edu (Greg Hudson) - Status changed from 'review' to 'resolved'