Re: Nuances of MIT Kerberos prompting
Russ Allbery <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.general |
|---|---|
| Organization | The Eyrie |
| Message-ID | <[email protected]> |
Greg Hudson <[email protected]> writes: > Yes. For this prompter call, name is NULL, banner is the formatted > expiration warning, and num_prompts is 0. Thanks! > Ah, two responder calls, not two prompter calls. I was looking at the > wrong code paths. Oh, sorry, poor bug report on my part. > Now that I look a the PKINIT responder logic, I agree that there is a > bug. In the second call to k5_preauth(), we are processing the KDC > PKINIT padata supplied alongside the issued ticket, in order to > authenticate the KDC response and set the correct reply key. PKINIT > does not need access to client certificates at this stage, but > pkinit_client_prep_questions() re-asks questions for its recorded > identities without checking the padata type or any other state that > would indicate where it is in the process. I will file a ticket. Thanks! > (The real reason kinit isn't affected is that it doesn't use a responder > callback.) Yes, that makes perfect sense in retrospect. I should have started with gdb before speculating. -- Russ Allbery ([email protected]) <https://www.eyrie.org/~eagle/> ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos