Don't rely on default realm in S4U2Self client

When converting server principal to enterprise name (to be possibly
used for cross-realm), ignore the realm when reparsing, to avoid a
spurious error if a default realm isn't configured.

[ghudson@mit.edu: added rewritten test case; edited commit message]

(cherry picked from commit 13967567ca65a306c2d5fcb4a4aff71fb422cd80)

ticket: 8741
version_fixed: 1.15.4

diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c
index ed05b6790e68e0d636a3d89d7c181317c08cb89e..91c02aa34d5e704b1f0ece1c91d5308902d6e39e 100644 (file)
--- a/src/lib/krb5/krb/s4u_creds.c
+++ b/src/lib/krb5/krb/s4u_creds.c
@@ -452,7 +452,9 @@ convert_to_enterprise(krb5_context context, krb5_principal princ,
     code = krb5_unparse_name(context, princ, &str);
     if (code != 0)
         return code;
-    code = krb5_parse_name_flags(context, str, KRB5_PRINCIPAL_PARSE_ENTERPRISE,
+    code = krb5_parse_name_flags(context, str,
+                                 KRB5_PRINCIPAL_PARSE_ENTERPRISE |
+                                 KRB5_PRINCIPAL_PARSE_IGNORE_REALM,
                                  eprinc_out);
     krb5_free_unparsed_name(context, str);
     return code;

diff --git a/src/tests/gssapi/t_s4u.py b/src/tests/gssapi/t_s4u.py
index 7366e3915ee353ec14ec40a30d3966175824f5c1..07e6d5adde4f3fbee8a068fbb89ec58e2606b35b 100755 (executable)
--- a/src/tests/gssapi/t_s4u.py
+++ b/src/tests/gssapi/t_s4u.py
@@ -146,9 +146,13 @@ realm.stop()
 
 # Exercise cross-realm S4U2Self.  The query in the foreign realm will
 # fail, but we can check that the right server principal was used.
+# Include a regression test for #8741 by unsetting the default realm.
 r1, r2 = cross_realms(2, create_user=False)
 r1.run([kinit, '-k', r1.host_princ])
-out = r1.run(['./t_s4u', 'p:' + r2.host_princ], expected_code=1)
+remove_default = {'libdefaults': {'default_realm': None}}
+no_default = r1.special_env('no_default', False, krb5_conf=remove_default)
+out = r1.run(['./t_s4u', 'p:' + r2.host_princ], expected_code=1,
+             env=no_default)
 if 'Server not found in Kerberos database' not in out:
     fail('cross-realm s4u2self (t_s4u output)')
 r1.stop()