]> git.ipfire.org Git - thirdparty/krb5.git/commitdiff
Set lockdown attribute when creating LDAP KDB
authorGreg Hudson <ghudson@mit.edu>
Mon, 10 Aug 2020 16:44:21 +0000 (12:44 -0400)
committerGreg Hudson <ghudson@mit.edu>
Tue, 3 Nov 2020 16:55:39 +0000 (11:55 -0500)
In kdb5_ldap_util, set lockdown_keys on the special principals when
creating an LDAP KDB, as we do in kdb5_util when creating a regular
KDB.

(cherry picked from commit 6cdf7d82e74f21fb8a37efe6b1bba45744f891ba)

ticket: 8936
version_fixed: 1.18.3

src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c

index c21d19981999af745063b0a5801ede8013875f55..94d58ed1e2ae661e06893e025c483c4c2d97c83d 100644 (file)
@@ -1337,7 +1337,7 @@ kdb_ldap_create_principal(krb5_context context, krb5_principal princ,
                                                      now, &db_create_princ)))
         goto cleanup;
 
-    entry.attributes = pblock->flags;
+    entry.attributes = pblock->flags | KRB5_KDB_LOCKDOWN_KEYS;
     entry.max_life = pblock->max_life;
     entry.max_renewable_life = pblock->max_rlife;
     entry.expiration = pblock->expiration;