[krbdev.mit.edu #9225] git commit

Mon Aug 17 17:01:57 2026: Request 9225 was acted upon.
 Transaction: Ticket created by [email protected]
       Queue: krb5
     Subject: git commit
       Owner: [email protected]
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9225 >



Relax gss_init_sec_context() proxy self check

If the krb5 gss_init_sec_context() detects a proxy ccache, we check in
get_credentials() whether the requested server principal matches the
cache's impersonator principal.  For a host-based server name, this
match will fail if krb5_sname_to_principal() yielded an empty realm,
as it does in most configurations.

As host-based principals generally only exist in one realm for a given
FQDN, we can ignore the realm for this comparison when the server name
is host-based.

[[email protected]: rewrote comment and commit message; adjusted code to
use krb5_principal_compare_flags()]

https://github.com/krb5/krb5/commit/473b51b640bef2e97c490d6f2985658befa89c16
Author: Alexander Bokovoy <[email protected]>
Committer: Greg Hudson <[email protected]>
Commit: 473b51b640bef2e97c490d6f2985658befa89c16
Branch: master
 src/lib/gssapi/krb5/init_sec_context.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)