[krbdev.mit.edu #8479] git commit
"Greg Hudson via RT" <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <[email protected]> |
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8479 > Add RBCD client support When making S4U2Proxy requests, include a PA-PAC-OPTIONS pa-data element advertising resource-based constrained delegation support. If the KDC returns a referral TGT for the initial request and advertises RBCD support, chase referrals to the target realm with both a regular and proxy TGT, and make an S4U2Proxy request to the target realm with the proxy TGT as evidence ticket. Because cross-realm S4U2Proxy requests must use referrals, an explicit foreign realm in the server name cannot be honored. In the GSSAPI krb5 mech, if a host-based server name is used, omit the realm (if one was obtained from [domain_realm] or similar) when calling krb5_get_credentials() for constrained delegation. [[email protected]: rewrote commit message; made style changes] https://github.com/krb5/krb5/commit/c426ef2ca2ba45dbf96f5380cf7d153ec0679424 Author: Isaac Boukris <[email protected]> Committer: Greg Hudson <[email protected]> Commit: c426ef2ca2ba45dbf96f5380cf7d153ec0679424 Branch: master src/include/k5-int.h | 13 ++ src/include/krb5/krb5.hin | 1 + src/lib/gssapi/krb5/init_sec_context.c | 9 +- src/lib/krb5/asn.1/asn1_k_encode.c | 22 +++ src/lib/krb5/krb/gc_via_tkt.c | 9 +- src/lib/krb5/krb/s4u_creds.c | 306 ++++++++++++++++++++++++++++++-- src/lib/krb5/libkrb5.exports | 2 + 7 files changed, 345 insertions(+), 17 deletions(-)