From 437fbad4bfb7176d304eed7cdc4b877afa6d9a7d Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Thu, 3 Sep 2015 12:38:44 -0400 Subject: [PATCH] Fix KDC client referrals Although our built-in KDB modules do not support client referrals for AS requests, the KDC is supposed to return one if a third-party module returns a DB entry containing a principal in a foreign realm. Unfortunately, this code has never worked; in prepare_error_as(), we erroneously compare the protocol code errcode against the com_err code KRB5KDC_ERR_WRONG_REALM; as a result, we never supply the canonical client principal. Fix this by comparing errcode against the protocol code KDC_ERR_WRONG_REALM instead. Discovered by Alexander Bokovoy and Simo Sorce. (cherry picked from commit 4e036ef4127a9b09d1a567472da1df24c55cdb89) ticket: 8312 (new) version_fixed: 1.12.5 status: resolved --- src/kdc/do_as_req.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index 95c3e23620..fa54c5daae 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -805,7 +805,7 @@ prepare_error_as (struct kdc_request_state *rstate, krb5_kdc_req *request, return retval; errpkt.error = error; errpkt.server = request->server; - errpkt.client = (error == KRB5KDC_ERR_WRONG_REALM) ? canon_client : + errpkt.client = (error == KDC_ERR_WRONG_REALM) ? canon_client : request->client; errpkt.text = string2data((char *)status); -- 2.47.2