From: Stefan Metzmacher Date: Thu, 22 Jun 2023 07:18:51 +0000 (+0200) Subject: s4:kdc: pass krbtgt skdc_entries to samba_kdc_update_pac() X-Git-Tag: talloc-2.4.1~179 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c69174c07c49589ed52a67781ed8862ffb47fea3;p=thirdparty%2Fsamba.git s4:kdc: pass krbtgt skdc_entries to samba_kdc_update_pac() For now we only pass in the krbtgt that verified the client pac and optionally the krbtgt that verified the device pac. These can be different depending on the domain of the related principals. If we want to apply SID filtering in future we may also need to pass in the krbtgt that verified the delegated_proxy_pac, but that needs more research and if not required for the following changes. Signed-off-by: Stefan Metzmacher Reviewed-by: Joseph Sutton Reviewed-by: Andrew Bartlett --- diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c index 33ece51eab8..691ac105a2c 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -713,12 +713,14 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krbtgt_skdc_entry->kdc_db_ctx->samdb, krbtgt_skdc_entry->kdc_db_ctx->lp_ctx, flags, + krbtgt_skdc_entry, client_skdc_entry, server->princ, server_skdc_entry, delegated_proxy_principal, delegated_proxy_entry, NULL /* delegated_proxy_pac */, + NULL /* device_krbtgt */, NULL /* device */, NULL /* device_pac */, *pac, @@ -832,12 +834,14 @@ krb5_error_code mit_samba_update_pac(struct mit_samba_context *ctx, krbtgt_skdc_entry->kdc_db_ctx->samdb, krbtgt_skdc_entry->kdc_db_ctx->lp_ctx, flags, + krbtgt_skdc_entry, client_skdc_entry, server->princ, server_skdc_entry, NULL /* delegated_proxy_principal */, NULL /* delegated_proxy */, NULL /* delegated_proxy_pac */, + NULL /* device_krbtgt */, NULL /* device */, NULL /* device_pac */, old_pac, diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c index 39c46b5c69b..744ecb332a9 100644 --- a/source4/kdc/pac-glue.c +++ b/source4/kdc/pac-glue.c @@ -2307,6 +2307,8 @@ done: * * @param client The client samba kdc entry. * + * @param client_krbtgt The krbtgt samba kdc entry that verified the client + * * @param server_principal The server principal * * @param server The server samba kdc entry. @@ -2324,6 +2326,8 @@ done: * @param device The computer's samba kdc entry; used for compound * authentication. * + * @param device_krbtgt The krbtgt samba kdc entry that verified the device + * * @param device_pac The PAC from the computer's TGT; used * for compound authentication. * @@ -2339,12 +2343,14 @@ krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx, struct ldb_context *samdb, struct loadparm_context *lp_ctx, uint32_t flags, + const struct samba_kdc_entry *client_krbtgt, struct samba_kdc_entry *client, const krb5_const_principal server_principal, const struct samba_kdc_entry *server, const krb5_const_principal delegated_proxy_principal, struct samba_kdc_entry *delegated_proxy, const krb5_const_pac delegated_proxy_pac, + const struct samba_kdc_entry *device_krbtgt, struct samba_kdc_entry *device, const krb5_const_pac device_pac, const krb5_const_pac old_pac, diff --git a/source4/kdc/pac-glue.h b/source4/kdc/pac-glue.h index d966eb256b2..2bb7bfe0c90 100644 --- a/source4/kdc/pac-glue.h +++ b/source4/kdc/pac-glue.h @@ -135,12 +135,14 @@ krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx, struct ldb_context *samdb, struct loadparm_context *lp_ctx, uint32_t flags, + const struct samba_kdc_entry *client_krbtgt, struct samba_kdc_entry *client, const krb5_const_principal server_principal, const struct samba_kdc_entry *server, const krb5_const_principal delegated_proxy_principal, struct samba_kdc_entry *delegated_proxy, const krb5_const_pac delegated_proxy_pac, + const struct samba_kdc_entry *device_krbtgt, struct samba_kdc_entry *device, const krb5_const_pac device_pac, const krb5_const_pac old_pac, diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c index c359529fab2..43cb0b54f79 100644 --- a/source4/kdc/wdc-samba4.c +++ b/source4/kdc/wdc-samba4.c @@ -428,6 +428,8 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r, talloc_get_type_abort(server->context, struct samba_kdc_entry); const struct samba_kdc_entry *krbtgt_skdc_entry = talloc_get_type_abort(krbtgt->context, struct samba_kdc_entry); + const struct samba_kdc_entry *client_krbtgt_skdc_entry = krbtgt_skdc_entry; + const struct samba_kdc_entry *device_krbtgt_skdc_entry = NULL; TALLOC_CTX *mem_ctx = NULL; krb5_pac new_pac = NULL; struct authn_audit_info *server_audit_info = NULL; @@ -452,8 +454,14 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r, } if (device != NULL) { + const hdb_entry *device_krbtgt = NULL; + device_skdc_entry = talloc_get_type_abort(device->context, struct samba_kdc_entry); + + device_krbtgt = kdc_request_get_explicit_armor_server(r); + device_krbtgt_skdc_entry = talloc_get_type_abort(device_krbtgt->context, + struct samba_kdc_entry); } ret = krb5_pac_init(context, &new_pac); @@ -477,12 +485,14 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r, krbtgt_skdc_entry->kdc_db_ctx->samdb, krbtgt_skdc_entry->kdc_db_ctx->lp_ctx, flags, + client_krbtgt_skdc_entry, client_skdc_entry, server->principal, server_skdc_entry, delegated_proxy_principal, delegated_proxy_skdc_entry, delegated_proxy_pac, + device_krbtgt_skdc_entry, device_skdc_entry, device_pac, *pac,