S4U2Self with multiple realms

--000000000000c5ab020570ec95ac
Content-Type: text/plain; charset="UTF-8"

Hello,

A couple of month back we discussed on samba mailing-list an issue in
heimdal with S4U2Self when the user is not in the same domain as the
impersonating service.

The problem is that we cannot just start by sending S4U2Self request
to local KDC in the service realm and hope to be referred. Instead we
first need to obtain a TGT to TGS in that user's realm. Only then we
can send S4U2Self request to a KDC in the user's realm and follow back
referrals to our own realm.
See MS-SFU sections [3.1.5.1.1.1] and [4.2] for details, as well as
MIT implementation where it works ok.

I would like to propose the attached patch which I have tested against
windows lab env, both direct forest trust and transitive forest trust
with two child domains thru parent (passes make-check).
Example test: kgetcred --debug --out-cache=out
[email protected] -H
HTTP/[email protected]

A couple of follow-ups items I am thinking on:
- Try to see if it can be tested by heimdal.

- Do we need to fix get_cred_kdc_capath() too or just fail it early
(we currently issue a failed sfu request before falling back to
referrals).

- When the impersonated user is given as UPN (enterprise?) then
according to MS-SFU [3.1.5.1.1.1] the first step is to locate user's
realm (since the same UPN suffix can be used in different realms).
This is done by sending AS request to the local KDC of the service
with the UPN follow referrals till we get pre-auth required. This is
implemented in MIT in s4u_identify_user() and I'm considering porting
it.

- The fix currently only works when the service name is given as SPN,
that is a shared global namespace and can be referred by KDC in other
realms. The way MIT work around this, is by converting the user
principal to enterprise name (user@domain) which is a global namespace
as well (convert_to_enterprise()). I wonder if it is worth porting
since the caller could determine the situation and convert by himself.


Thank you,
Isaac B.

--000000000000c5ab020570ec95ac
Content-Type: text/plain; charset="US-ASCII"; 
	name="0001-S4U2Self-fix-impersonate-with-multiple-realms-using-.patch.txt"
Content-Disposition: attachment; 
	filename="0001-S4U2Self-fix-impersonate-with-multiple-realms-using-.patch.txt"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_jjkssxj70

RnJvbSA2MTUyOWU5MjI2ZmYzZTlkODE0NzExMTQ4NGRjZmU1MmRmNTIwYzlmIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBJc2FhYyBCb3VrcmlzIDxpYm91a3Jpc0BnbWFpbC5jb20+CkRh
dGU6IFNhdCwgMTQgSnVsIDIwMTggMDI6NDc6MzYgKzAzMDAKU3ViamVjdDogW1BBVENIXSBTNFUy
U2VsZjogZml4IGltcGVyc29uYXRlIHdpdGggbXVsdGlwbGUgcmVhbG1zIHVzaW5nCiByZWZlcnJh
bHMKCldoZW4gaW1wZXJzb25hdGluZyBhIHVzZXIgZnJvbSBhbm90aGVyIHJlYWxtLCB3ZSBmaXJz
dCBuZWVkCnRvIG9idGFpbiBhIFRHVCB0byBUR1MgaW4gdGhhdCB1c2VyJ3MgcmVhbG0uCk9ubHkg
dGhlbiB3ZSBjYW4gYXNrIGZvciBhIHRpY2tldCBmb3Igc2VsZiBhbmQgZm9sbG93IGJhY2sKcmVm
ZXJyYWxzIHRvIG91ciBvd24gcmVhbG0uCgpTZWUgTVMtU0ZVIHNlY3Rpb25zIDMuMS41LjEuMS4x
IGFuZCA0LjIKClNpZ25lZC1vZmYtYnk6IElzYWFjIEJvdWtyaXMgPGlib3VrcmlzQGdtYWlsLmNv
bT4KLS0tCiBsaWIva3JiNS9nZXRfY3JlZC5jIHwgMzYgKysrKysrKysrKysrKysrKysrKysrKysr
KysrKysrKysrKystCiAxIGZpbGUgY2hhbmdlZCwgMzUgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlv
bigtKQoKZGlmZiAtLWdpdCBhL2xpYi9rcmI1L2dldF9jcmVkLmMgYi9saWIva3JiNS9nZXRfY3Jl
ZC5jCmluZGV4IDQ1ZGE4YTM3NC4uNzQ4YTQyNDlhIDEwMDY0NAotLS0gYS9saWIva3JiNS9nZXRf
Y3JlZC5jCisrKyBiL2xpYi9rcmI1L2dldF9jcmVkLmMKQEAgLTk5MCw3ICs5OTAsNDEgQEAgZ2V0
X2NyZWRfa2RjX3JlZmVycmFsKGtyYjVfY29udGV4dCBjb250ZXh0LAogICAgIGlmIChzdGFydF9y
ZWFsbSA9PSBOVUxMKQogICAgICAgICByZXR1cm4ga3JiNV9lbm9tZW0oY29udGV4dCk7CiAKLSAg
ICAvKiBmaW5kIHRndCBmb3IgdGhlIGNsaWVudHMgYmFzZSByZWFsbSAqLworICAgIC8qCisgICAg
ICogZmluZCB0Z3QgZm9yIHRoZSBjbGllbnRzIGJhc2UgcmVhbG0sIGlmIHdlIGFyZSBpbXBlcnNv
bmF0aW5nIGEgdXNlcgorICAgICAqIGZyb20gYW5vdGhlciByZWFsbSwgdGhlbiB3ZSBhY3R1YWxs
eSBuZWVkIGEgcmVmZXJyYWwgdGd0IHRvIHRoYXQgcmVhbG0uCisgICAgICovCisgICAgaWYgKGlt
cGVyc29uYXRlX3ByaW5jaXBhbCAhPSBOVUxMICYmCisgICAgICAgICFrcmI1X3JlYWxtX2NvbXBh
cmUoY29udGV4dCwgaW1wZXJzb25hdGVfcHJpbmNpcGFsLCBpbl9jcmVkcy0+Y2xpZW50KSkKKyAg
ICB7CisgICAgICAgIGtyYjVfY3JlZHMgKmltcGVyc29uYXRlX3RndDsKKyAgICAgICAgcmVmZXJy
YWwgPSAqaW5fY3JlZHM7CisKKyAgICAgICAgcmV0ID0ga3JiNV9tYWtlX3ByaW5jaXBhbChjb250
ZXh0LCAmcmVmZXJyYWwuc2VydmVyLAorICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IHN0YXJ0X3JlYWxtLCBLUkI1X1RHU19OQU1FLAorICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGltcGVyc29uYXRlX3ByaW5jaXBhbC0+cmVhbG0sIE5VTEwpOworICAgICAgICBmcmVl
KHN0YXJ0X3JlYWxtKTsKKyAgICAgICAgaWYgKHJldCkgeworICAgICAgICAgICAgcmV0dXJuIHJl
dDsKKyAgICAgICAgfQorCisgICAgICAgIHJldCA9IGdldF9jcmVkX2tkY19yZWZlcnJhbChjb250
ZXh0LCBmbGFncywgY2NhY2hlLCAmcmVmZXJyYWwsCisgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgTlVMTCwgTlVMTCwgJmltcGVyc29uYXRlX3RndCk7CisgICAgICAgIGty
YjVfZnJlZV9wcmluY2lwYWwoY29udGV4dCwgcmVmZXJyYWwuc2VydmVyKTsKKyAgICAgICAgaWYg
KHJldCkgeworICAgICAgICAgICAgcmV0dXJuIHJldDsKKyAgICAgICAgfQorCisgICAgICAgIHRn
dCA9ICppbXBlcnNvbmF0ZV90Z3Q7CisgICAgICAgIGZyZWUoaW1wZXJzb25hdGVfdGd0KTsKKwor
ICAgICAgICBzdGFydF9yZWFsbSA9IHN0cmR1cChpbXBlcnNvbmF0ZV9wcmluY2lwYWwtPnJlYWxt
KTsKKyAgICAgICAgaWYgKHN0YXJ0X3JlYWxtID09IE5VTEwpIHsKKyAgICAgICAgICAgIGtyYjVf
ZnJlZV9jcmVkX2NvbnRlbnRzKGNvbnRleHQsICZ0Z3QpOworICAgICAgICAgICAgcmV0dXJuIGty
YjVfZW5vbWVtKGNvbnRleHQpOworCX0KKyAgICB9CisgICAgZWxzZQogICAgIHsKIAlrcmI1X3By
aW5jaXBhbCB0Z3RuYW1lOwogCi0tIAoyLjE0LjMKCg==
--000000000000c5ab020570ec95ac--