Skip Menu |
 

From: Arlene Berry <aberry@likewise.com>
To: "krb5-bugs@mit.edu" <krb5-bugs@mit.edu>
Subject: spnego_gss_acquire_cred_impersonate_name incorrect usage of impersonator_cred_handle
Date: Thu, 11 Aug 2011 00:23:34 +0000
Download (untitled) / with headers
text/plain 1.4KiB
In src/lib/gssapi/spnego/spnego_mech.c for spnego_gss_acquire_cred it has:

OM_uint32
spnego_gss_acquire_cred_impersonate_name(OM_uint32 *minor_status,
const gss_cred_id_t impersonator_cred_handle,
const gss_name_t desired_name,
OM_uint32 time_req,
gss_OID_set desired_mechs,
gss_cred_usage_t cred_usage,
gss_cred_id_t *output_cred_handle,
gss_OID_set *actual_mechs,
OM_uint32 *time_rec)

...

if (desired_mechs == GSS_C_NO_OID_SET) {
status = gss_inquire_cred(minor_status,
impersonator_cred_handle,
NULL, NULL,
NULL, &amechs);
desired_mechs = amechs;
}

imp_spcred = (spnego_gss_cred_id_t)impersonator_cred_handle;

impersonator_cred_handle is a mechanism cred, i.e. an spnego_cred_id_t, not a gss_cred_id_t, and you cannot call gss_inquire_cred on it. The assignment to imp_spcred needs to be moved up and gss_inquire_cred needs to be called on imp_spcred->mcred in the same manner as the subsequent gss_acquire_cred_impersonate_name.
From: ghudson@mit.edu
Subject: SVN Commit

Fix call to gss_inquire_cred from spnego_gss_acquire_cred_impersonate_name.

If desired_mechs is NULL (this should never happen when invoked from
the MIT mechglue), we call gss_inquire_cred to get a list of mechs.
This call needs to pass a union cred handle, not the SPNEGO handle we
got as input. Reported by aberry@likewise.com.

https://github.com/krb5/krb5/commit/12a2d660e9d106fb5c7d11bb61b3f956d00f9d17
Commit By: ghudson
Revision: 25098
Changed Files:
U trunk/src/lib/gssapi/spnego/spnego_mech.c