Re: [kitten] Checking the transited list of a kerberos ticket in a transitive cross-realm trust situation...

Stefan Metzmacher <[email protected]> Thu, 24 Aug 2017 15:11:16 +0200

Newsgroups	gmane.comp.encryption.kerberos.heimdal.general,gmane.comp.encryption.kerberos.devel,gmane.ietf.kitten,gmane.network.samba.internals
Message-ID	<[email protected]>

Hi Simo,

>> I guess the proposed credential option is necessary, in that case.
>>
> 
> I think in this case ignoring the flag should probably be conditional
> to whether a PAC is present.

We should enforce a PAC always to be present, as we don't support
trusted domains with LSA_TRUST_TYPE_MIT anyway.

metze

signature.asc (application/pgp-signature, 836 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBAgAGBQJZntB3AAoJEA219WEoab1WeBgQAIO4n8HBpj69AZnYyyUrORDc
d39uVAUjjSsOFxVCSdC1p2U6UH+vHQ3TU5FrNIS4+YsZ4+Q3yW9pUwo7MyxGCtcV
kjGHt7mdjid7q2qQ/5xjc6NSBw0tlpwBC/pYDsOdGbF7cRny5ZePyPGsFHhRpCNt
arVyHLrdab5em8Ni4RDP+Ux7n+SGFr8XLoLD66gL9fTrEj3TimKcC07yf+47jt5u
G2vz+GLVWB04gJJDPneez6CaSMQgp1v/aoz4wO9XklTHS/kqa9CgN/fmEu2CSoor
yJWwYSWxJdw+biFIRtMyxLNSz+AMk5dYqgBeEG6m5JKf3Qy/4yBw7envpP7IaFv4
EM5PMtiGSFEl7QfAipHBmCUKnnQlqIeQtsfWTtMw0eu/QBiW5pm5Qlh6K947pGkn
3CdL+QSWV2rmuG2urgOVVNgQ5RFs67gVRi5rWtYAb2iWmOKsRt8K70pI2xaFCLin
ZqChGQD43Uum+hBekFLIrTa2EGkK7HeyOGwOipyruaPd2QKBkPkr4gmsmho13uP+
wKN0iQMXXj8Y3JrHunKVoBYOUdMtOyn/fRYEmy2YHLNRLl7+nGyOXKEzZKLSvLvp
NH1vVqYGoSxCAW9f++B5fQupA4QeGi6nBvG22cEy0MlsXjEXJbtmIpbKdM9SAyIg
H4E2rLsWyT6drUCEiZF8
=nLfj
-----END PGP SIGNATURE-----