s4:kdc: pass krbtgt skdc_entries to samba_kdc_update_pac()

For now we only pass in the krbtgt that verified the client pac
and optionally the krbtgt that verified the device pac.

These can be different depending on the domain of the related
principals.

If we want to apply SID filtering in future we may also need
to pass in the krbtgt that verified the delegated_proxy_pac,
but that needs more research and if not required for the
following changes.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 33ece51eab8335cc940d1a0fa0fa3d0238087502..691ac105a2c85fbc55681b17de6e1f1a147e7cee 100644 (file)
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -713,12 +713,14 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
                                    krbtgt_skdc_entry->kdc_db_ctx->samdb,
                                    krbtgt_skdc_entry->kdc_db_ctx->lp_ctx,
                                    flags,
+                                   krbtgt_skdc_entry,
                                    client_skdc_entry,
                                    server->princ,
                                    server_skdc_entry,
                                    delegated_proxy_principal,
                                    delegated_proxy_entry,
                                    NULL /* delegated_proxy_pac */,
+                                   NULL /* device_krbtgt */,
                                    NULL /* device */,
                                    NULL /* device_pac */,
                                    *pac,
@@ -832,12 +834,14 @@ krb5_error_code mit_samba_update_pac(struct mit_samba_context *ctx,
                                    krbtgt_skdc_entry->kdc_db_ctx->samdb,
                                    krbtgt_skdc_entry->kdc_db_ctx->lp_ctx,
                                    flags,
+                                   krbtgt_skdc_entry,
                                    client_skdc_entry,
                                    server->princ,
                                    server_skdc_entry,
                                    NULL /* delegated_proxy_principal */,
                                    NULL /* delegated_proxy */,
                                    NULL /* delegated_proxy_pac */,
+                                   NULL /* device_krbtgt */,
                                    NULL /* device */,
                                    NULL /* device_pac */,
                                    old_pac,

diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index 39c46b5c69b16f19a18c0d2bd97aa5ce06c036c4..744ecb332a9753f8e48a863f4d6c7727d913a940 100644 (file)
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -2307,6 +2307,8 @@ done:
  *
  * @param client    The client samba kdc entry.
  *
+ * @param client_krbtgt     The krbtgt samba kdc entry that verified the client
+ *
  * @param server_principal  The server principal
  *
  * @param server    The server samba kdc entry.
@@ -2324,6 +2326,8 @@ done:
  * @param device    The computer's samba kdc entry; used for compound
  *                  authentication.
  *
+ * @param device_krbtgt     The krbtgt samba kdc entry that verified the device
+ *
  * @param device_pac        The PAC from the computer's TGT; used
  *                          for compound authentication.
  *
@@ -2339,12 +2343,14 @@ krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx,
                                     struct ldb_context *samdb,
                                     struct loadparm_context *lp_ctx,
                                     uint32_t flags,
+                                    const struct samba_kdc_entry *client_krbtgt,
                                     struct samba_kdc_entry *client,
                                     const krb5_const_principal server_principal,
                                     const struct samba_kdc_entry *server,
                                     const krb5_const_principal delegated_proxy_principal,
                                     struct samba_kdc_entry *delegated_proxy,
                                     const krb5_const_pac delegated_proxy_pac,
+                                    const struct samba_kdc_entry *device_krbtgt,
                                     struct samba_kdc_entry *device,
                                     const krb5_const_pac device_pac,
                                     const krb5_const_pac old_pac,

diff --git a/source4/kdc/pac-glue.h b/source4/kdc/pac-glue.h
index d966eb256b21d60b74002f0a55ff84d5ad8dccef..2bb7bfe0c90fd348d55d831c3363d2271856c79d 100644 (file)
--- a/source4/kdc/pac-glue.h
+++ b/source4/kdc/pac-glue.h
@@ -135,12 +135,14 @@ krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx,
                                     struct ldb_context *samdb,
                                     struct loadparm_context *lp_ctx,
                                     uint32_t flags,
+                                    const struct samba_kdc_entry *client_krbtgt,
                                     struct samba_kdc_entry *client,
                                     const krb5_const_principal server_principal,
                                     const struct samba_kdc_entry *server,
                                     const krb5_const_principal delegated_proxy_principal,
                                     struct samba_kdc_entry *delegated_proxy,
                                     const krb5_const_pac delegated_proxy_pac,
+                                    const struct samba_kdc_entry *device_krbtgt,
                                     struct samba_kdc_entry *device,
                                     const krb5_const_pac device_pac,
                                     const krb5_const_pac old_pac,

diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c
index c359529fab2c3c7fc19215d30118094991c31caa..43cb0b54f79604d13f30f4534194335b974542cc 100644 (file)
--- a/source4/kdc/wdc-samba4.c
+++ b/source4/kdc/wdc-samba4.c
@@ -428,6 +428,8 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r,
                talloc_get_type_abort(server->context, struct samba_kdc_entry);
        const struct samba_kdc_entry *krbtgt_skdc_entry =
                talloc_get_type_abort(krbtgt->context, struct samba_kdc_entry);
+       const struct samba_kdc_entry *client_krbtgt_skdc_entry = krbtgt_skdc_entry;
+       const struct samba_kdc_entry *device_krbtgt_skdc_entry = NULL;
        TALLOC_CTX *mem_ctx = NULL;
        krb5_pac new_pac = NULL;
        struct authn_audit_info *server_audit_info = NULL;
@@ -452,8 +454,14 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r,
        }
 
        if (device != NULL) {
+               const hdb_entry *device_krbtgt = NULL;
+
                device_skdc_entry = talloc_get_type_abort(device->context,
                                                          struct samba_kdc_entry);
+
+               device_krbtgt = kdc_request_get_explicit_armor_server(r);
+               device_krbtgt_skdc_entry = talloc_get_type_abort(device_krbtgt->context,
+                                                                struct samba_kdc_entry);
        }
 
        ret = krb5_pac_init(context, &new_pac);
@@ -477,12 +485,14 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r,
                                   krbtgt_skdc_entry->kdc_db_ctx->samdb,
                                   krbtgt_skdc_entry->kdc_db_ctx->lp_ctx,
                                   flags,
+                                  client_krbtgt_skdc_entry,
                                   client_skdc_entry,
                                   server->principal,
                                   server_skdc_entry,
                                   delegated_proxy_principal,
                                   delegated_proxy_skdc_entry,
                                   delegated_proxy_pac,
+                                  device_krbtgt_skdc_entry,
                                   device_skdc_entry,
                                   device_pac,
                                   *pac,