| From: | ghudson@mit.edu |
| Subject: | git commit |
Add KDC support for X.509 S4U2Self requests
Add a KDB function krb5_db_get_s4u_x509_principal() and an associated
method in the DAL, bumping the minor version and cleaning up a
leftover comment in the table from major version 6.
When processing an AS-REQ, look up the client principal by certificate
if the request contains a non-empty PA-S4U-X509-USER value. When
processing an S4U2Self TGS-REQ, allow requests with certificates, and
look up the client principal by certificate if one is presented.
[ghudson@mit.edu: factored out lookup_client() in AS code; rewrote
commit message and some comments; adjusted flow control changes in
kdc_process_s4u_x509_user()]
https://github.com/krb5/krb5/commit/0fbfffbef2c266fedac557e00108b944e31e8d50
Author: Isaac Boukris <iboukris@gmail.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 0fbfffbef2c266fedac557e00108b944e31e8d50
Branch: master
src/include/kdb.h | 31 ++++++++++++++++++++++++++++---
src/kdc/do_as_req.c | 23 +++++++++++++++++++++--
src/kdc/kdc_util.c | 34 +++++++++++++++++++++++++++-------
src/lib/kdb/kdb5.c | 32 ++++++++++++++++++++++++++++++++
src/lib/kdb/libkdb5.exports | 1 +
5 files changed, 109 insertions(+), 12 deletions(-)