Skip Menu |
 

From: ghudson@mit.edu
Subject: git commit

Change KDC constrained-delegation precedence order

MS-SFU errata from 2019/12/09 indicates that legacy constrained
delegation should be prefered over resource-based constrained
delegation, which results slight diferences.

Also clarify that in the get_authdata_info KDB method, the PAC must be
verified and checked for user sensitivity for S4U2Proxy. Document
that the client name should only be provided in the cross-realm
S4U2Proxy case.

[ghudson@mit.edu: clarified comments and commit message]

https://github.com/krb5/krb5/commit/cf6b710518bd6da8c491ee4020a9ad8ded321d66
Author: Isaac Boukris <iboukris@gmail.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: cf6b710518bd6da8c491ee4020a9ad8ded321d66
Branch: master
src/include/kdb.h | 9 ++-
src/kdc/kdc_util.c | 167 ++++++++++++++++++++------------------------
src/tests/gssapi/t_s4u.py | 32 ++++++---
src/tests/t_audit.py | 2 +-
4 files changed, 107 insertions(+), 103 deletions(-)
Subject: git commit
From: ghudson@mit.edu

Change KDC constrained-delegation precedence order

MS-SFU errata from 2019/12/09 indicates that legacy constrained
delegation should be prefered over resource-based constrained
delegation, which results slight diferences.

Also clarify that in the get_authdata_info KDB method, the PAC must be
verified and checked for user sensitivity for S4U2Proxy. Document
that the client name should only be provided in the cross-realm
S4U2Proxy case.

[ghudson@mit.edu: clarified comments and commit message]

(cherry picked from commit cf6b710518bd6da8c491ee4020a9ad8ded321d66)

https://github.com/krb5/krb5/commit/c61905eb0c589b3046b81b61d635eb08c8667302
Author: Isaac Boukris <iboukris@gmail.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: c61905eb0c589b3046b81b61d635eb08c8667302
Branch: krb5-1.18
src/include/kdb.h | 9 ++-
src/kdc/kdc_util.c | 167 ++++++++++++++++++++------------------------
src/tests/gssapi/t_s4u.py | 32 ++++++---
src/tests/t_audit.py | 2 +-
4 files changed, 107 insertions(+), 103 deletions(-)