]> git.ipfire.org Git - thirdparty/cups.git/commit
Fix HTTP PeerCred authentication for domain users (fixes #1001) 1029/head
authorVladislav Tarakanov <vladislav.tarakanov@bk.ru>
Mon, 12 Aug 2024 22:11:39 +0000 (02:11 +0400)
committerVladislav Tarakanov <vladislav.tarakanov@bk.ru>
Mon, 12 Aug 2024 22:11:39 +0000 (02:11 +0400)
commitcdf1d70536fa68f91df74ee078d13f61e2a343c4
treeccbcb235f27194864da4bb42c79e76a948a5c7a1
parenta991802ae2f97bae82a44633b2f4ba7813e2b9ea
Fix HTTP PeerCred authentication for domain users (fixes #1001)

- Remove domain from user name during local user authentication (e.g., "user@example.com" –> "user"). This practice can be beneficial for maintaining compatibility with older versions of Kerberos. However, enabling this option can have negative consequences. It may result in confusion between domain and local users with identical names, potentially leading to incorrect assignment of user permissions and unintentional permission escalation, thus creating a security risk. Therefore, it is advisable to avoid using this option in most cases.
- Add "StripUserDomain" parameter to cups-files.conf

Co-authored-by: Irgaliev Amin <irgaliev01@mail.ru>
Co-authored-by: Artyom Proskurnyov <temap@mail.ru>
Reviewed-by: Alexander Pevzner <pzz@apevzner.com>
conf/cups-files.conf.in
man/cups-files.conf.5
scheduler/auth.c
scheduler/conf.c
scheduler/conf.h