Fix S4U client authdata handling

Only send client authdata in the initial request, and note
request authdata in out_creds.

ticket: 8866 (new)
tags: pullup
target_version: 1.18

diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c
index 8202fe9d3b723cbc9b8d330d6b341e59049561d2..504eb557f3fc7a41d4b12d9538519ca608e32db8 100644 (file)
--- a/src/lib/krb5/krb/s4u_creds.c
+++ b/src/lib/krb5/krb/s4u_creds.c
@@ -582,6 +582,10 @@ krb5_get_self_cred_from_kdc(krb5_context context,
         if (code != 0)
             goto cleanup;
 
+        /* The authdata in this referral TGT will be copied into the final
+         * credentials, so we don't need to request it again. */
+        s4u_creds.authdata = NULL;
+
         /* Only include a cert in the initial request to the client realm. */
         s4u_user.user_id.subject_cert = empty_data();
 
@@ -708,6 +712,12 @@ krb5_get_credentials_for_user(krb5_context context, krb5_flags options,
         code = 0;
     }
 
+    /* Note the authdata we asked for in the output creds. */
+    code = krb5_copy_authdata(context, in_creds->authdata,
+                              &(*out_creds)->authdata);
+    if (code)
+        goto cleanup;
+
     if ((options & KRB5_GC_NO_STORE) == 0) {
         code = krb5_cc_store_cred(context, ccache, *out_creds);
         if (code != 0)
@@ -1042,6 +1052,10 @@ k5_get_proxy_cred_from_kdc(krb5_context context, krb5_flags options,
             goto cleanup;
         }
 
+        /* The authdata in this referral TGT will be copied into the final
+         * credentials, so we don't need to request it again. */
+        mcreds.authdata = NULL;
+
         /*
          * Make sure the KDC supports S4U and resource-based constrained
          * delegation; otherwise we might have gotten a regular TGT referral
@@ -1112,6 +1126,11 @@ k5_get_proxy_cred_from_kdc(krb5_context context, krb5_flags options,
             goto cleanup;
     }
 
+    /* Note the authdata we asked for in the output creds. */
+    code = krb5_copy_authdata(context, in_creds->authdata, &tkt->authdata);
+    if (code)
+        goto cleanup;
+
     if (!(options & KRB5_GC_NO_STORE))
         (void)krb5_cc_store_cred(context, ccache, tkt);