make reply session key available to authdata backends, so they can implement AD-KDCIssued

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/authdata@22662 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index a99dc35ba19b7373c74d1642c7fb6299f9802a4a..8b1c47387b2ea4f7d9d45fa51ac55f265f3fdedf 100644 (file)
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -675,6 +675,10 @@ tgt_again:
     else
         enc_tkt_reply.client = header_enc_tkt->client;
 
+    enc_tkt_reply.session = &session_key;
+    enc_tkt_reply.transited.tr_type = KRB5_DOMAIN_X500_COMPRESS;
+    enc_tkt_reply.transited.tr_contents = empty_string; /* equivalent of "" */
+
     errcode = handle_authdata(kdc_context,
                               c_flags,
                               (c_nprincs != 0) ? &client : NULL,
@@ -703,10 +707,6 @@ tgt_again:
         }
     }
 
-    enc_tkt_reply.session = &session_key;
-    enc_tkt_reply.transited.tr_type = KRB5_DOMAIN_X500_COMPRESS;
-    enc_tkt_reply.transited.tr_contents = empty_string; /* equivalent of "" */
-
     /*
      * Only add the realm of the presented tgt to the transited list if 
      * it is different than the local realm (cross-realm) and it is different

diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c
index 43ea0869ac09af3667eba69de7ce0447d48273f1..cc69f5fdbeba1d024a030ad67fcf5c07cf6c73fc 100644 (file)
--- a/src/kdc/kdc_authdata.c
+++ b/src/kdc/kdc_authdata.c
@@ -526,6 +526,7 @@ handle_tgt_authdata (krb5_context context,
                            server_key, /* U2U or server key */
                            enc_tkt_reply->times.authtime,
                            tgs_req ? enc_tkt_request->authorization_data : NULL,
+                           enc_tkt_reply->session,
                            &db_authdata,
                            &ad_entry,
                            &ad_nprincs);

diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
index 88ef110629c0a2a1fa9496ac0e7b6c5e2ea2a64b..8dd4f91dec549c4c989dfbbeebf878c89122dce0 100644 (file)
--- a/src/kdc/kdc_util.c
+++ b/src/kdc/kdc_util.c
@@ -1745,6 +1745,7 @@ sign_db_authdata (krb5_context context,
                  krb5_keyblock *server_key,
                  krb5_timestamp authtime,
                  krb5_authdata **tgs_authdata,
+                 krb5_keyblock *session_key,
                  krb5_authdata ***ret_authdata,
                  krb5_db_entry *ad_entry,
                  int *ad_nprincs)
@@ -1771,6 +1772,7 @@ sign_db_authdata (krb5_context context,
     req.server_key             = server_key;
     req.authtime               = authtime;
     req.auth_data              = tgs_authdata;
+    req.session_key            = session_key;
 
     rep.entry                  = ad_entry;
     rep.nprincs                        = 0;

diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h
index 0604426045e5b5e426b2736b340329692807e84b..e34ca876b44d4eac447afc0f8898dc4134590a46 100644 (file)
--- a/src/kdc/kdc_util.h
+++ b/src/kdc/kdc_util.h
@@ -230,6 +230,7 @@ krb5_error_code sign_db_authdata
                krb5_keyblock *server_key,
                krb5_timestamp authtime,
                krb5_authdata **tgs_authdata,
+               krb5_keyblock *session_key,
                krb5_authdata ***ret_authdata,
                krb5_db_entry *ad_entry,
                int *ad_nprincs);