From 7351471575460f5aa0b487ee9c3108fa1a117e8f Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 9 Jul 2012 11:01:25 +0200 Subject: [PATCH] Use UPN from Kerberos ticket Instead of guessing the user principal name (UPN) in the PAC responder the client principal from the Kerberos ticket containing PAC is taken and send to the PAC responder together with the PAC. The sending code had to be move in the Kerberos plugin because the client principal is not available to the import method which was currently used. Fixes https://fedorahosted.org/sssd/ticket/1634 --- Makefile.am | 27 ++++++++++- src/providers/krb5/krb5_child.c | 32 ++++-------- src/responder/pac/pacsrv.h | 4 ++ src/responder/pac/pacsrv_cmd.c | 48 ++++++++++++++++-- src/responder/pac/pacsrv_utils.c | 80 +++++++++++++++++++++++------- src/sss_client/common_pac.c | 57 ++++++++++++++++++++++ src/sss_client/sss_cli.h | 4 +- src/sss_client/sssd_pac.c | 65 +++++++++++++++++++------ src/tests/cmocka/test_pac_responder.c | 86 +++++++++++++++++++++++++++++++++ src/util/sss_krb5.c | 9 +++- src/util/sss_krb5.h | 3 +- 11 files changed, 351 insertions(+), 64 deletions(-) create mode 100644 src/sss_client/common_pac.c create mode 100644 src/tests/cmocka/test_pac_responder.c diff --git a/Makefile.am b/Makefile.am index 39e6e07..3a6dc29 100644 --- a/Makefile.am +++ b/Makefile.am @@ -147,6 +147,10 @@ endif if HAVE_CMOCKA non_interactive_cmocka_based_tests = \ nss-srv-tests + +if BUILD_PAC_RESPONDER + non_interactive_cmocka_based_tests += cmocka_pac_responder-tests +endif endif check_PROGRAMS = \ @@ -1213,6 +1217,25 @@ nss_srv_tests_LDFLAGS = \ nss_srv_tests_LDADD = \ $(CMOCKA_LIBS) \ libsss_util.la + +cmocka_pac_responder_tests_SOURCES = \ + src/tests/cmocka/test_pac_responder.c \ + src/responder/pac/pacsrv_utils.c \ + src/sss_client/common_pac.c +cmocka_pac_responder_tests_CFLAGS = \ + $(AM_CFLAGS) \ + $(NDR_KRB5PAC_CFLAGS) +cmocka_pac_responder_tests_LDFLAGS = \ + -Wl,-wrap,sss_pac_make_request +cmocka_pac_responder_tests_LDADD = \ + $(TALLOC_LIBS) \ + $(NDR_KRB5PAC_LIBS) \ + $(SSSD_LIBS) \ + -lm \ + libsss_idmap.la \ + libsss_debug.la \ + libsss_util.la \ + $(CMOCKA_LIBS) endif noinst_PROGRAMS = pam_test_client @@ -1554,7 +1577,8 @@ krb5_child_SOURCES = \ src/util/authtok.c \ src/util/util.c \ src/util/signal.c \ - src/sss_client/common.c + src/sss_client/common.c \ + src/sss_client/common_pac.c krb5_child_CFLAGS = \ $(AM_CFLAGS) \ $(POPT_CFLAGS) \ @@ -1628,6 +1652,7 @@ endif sssd_pac_plugin_la_SOURCES = \ src/sss_client/sssd_pac.c \ src/sss_client/common.c \ + src/sss_client/common_pac.c \ src/sss_client/sss_cli.h \ src/sss_client/krb5_authdata_int.h sssd_pac_plugin_la_CFLAGS = \ diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index 6568533..424a899 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -87,26 +87,6 @@ static krb5_error_code get_changepw_options(krb5_context ctx, return 0; } -static errno_t sss_send_pac(krb5_authdata **pac_authdata) -{ - struct sss_cli_req_data sss_data; - int ret; - int errnop; - - sss_data.len = pac_authdata[0]->length; - sss_data.data = pac_authdata[0]->contents; - - ret = sss_pac_make_request(SSS_PAC_ADD_PAC_USER, &sss_data, - NULL, NULL, &errnop); - if (ret != NSS_STATUS_SUCCESS || errnop != 0) { - DEBUG(SSSDBG_OP_FAILURE, ("sss_pac_make_request failed [%d][%d].\n", - ret, errnop)); - return EIO; - } - - return EOK; -} - static void sss_krb5_expire_callback_func(krb5_context context, void *data, krb5_timestamp password_expiration, krb5_timestamp account_expiration, @@ -893,6 +873,7 @@ static krb5_error_code validate_tgt(struct krb5_req *kr) bool realm_entry_found = false; krb5_ccache validation_ccache = NULL; krb5_authdata **pac_authdata = NULL; + char *upn_from_ticket = NULL; memset(&keytab, 0, sizeof(keytab)); kerr = krb5_kt_resolve(kr->ctx, kr->keytab, &keytab); @@ -990,7 +971,8 @@ static krb5_error_code validate_tgt(struct krb5_req *kr) * do not belong to our realm. Failures are not critical. */ if (kr->upn_from_different_realm) { kerr = sss_extract_pac(kr->ctx, validation_ccache, validation_princ, - kr->creds->client, keytab, &pac_authdata); + kr->creds->client, keytab, &pac_authdata, + &upn_from_ticket); if (kerr != 0) { DEBUG(SSSDBG_OP_FAILURE, ("sss_extract_and_send_pac failed, group " \ "membership for user with principal [%s] " \ @@ -999,7 +981,9 @@ static krb5_error_code validate_tgt(struct krb5_req *kr) goto done; } - kerr = sss_send_pac(pac_authdata); + kerr = sss_pac_send_v2(pac_authdata[0]->contents, + pac_authdata[0]->length, + upn_from_ticket); krb5_free_authdata(kr->ctx, pac_authdata); if (kerr != 0) { DEBUG(SSSDBG_OP_FAILURE, ("sss_send_pac failed, group " \ @@ -1010,6 +994,10 @@ static krb5_error_code validate_tgt(struct krb5_req *kr) } done: + if (upn_from_ticket != NULL) { + krb5_free_unparsed_name(kr->ctx, upn_from_ticket); + } + if (validation_ccache != NULL) { krb5_cc_destroy(kr->ctx, validation_ccache); } diff --git a/src/responder/pac/pacsrv.h b/src/responder/pac/pacsrv.h index 64154da..ac6fbae 100644 --- a/src/responder/pac/pacsrv.h +++ b/src/responder/pac/pacsrv.h @@ -113,6 +113,7 @@ errno_t get_pwd_from_pac(TALLOC_CTX *mem_ctx, struct pac_ctx *pac_ctx, struct sss_domain_info *dom, struct PAC_LOGON_INFO *logon_info, + const char *upn_from_ticket, struct passwd **_pwd, struct sysdb_attrs **_attrs); @@ -130,4 +131,7 @@ struct sss_domain_info *find_domain_by_id(struct sss_domain_info *domains, const char *id_str); bool new_and_cached_user_differs(struct passwd *pwd, struct ldb_message *msg); + +errno_t pac_get_v2_data(uint8_t *body, size_t blen, char **upn, + uint8_t **pac_blob, size_t *pac_blob_len); #endif /* __PACSRV_H__ */ diff --git a/src/responder/pac/pacsrv_cmd.c b/src/responder/pac/pacsrv_cmd.c index a8b272e..82793cf 100644 --- a/src/responder/pac/pacsrv_cmd.c +++ b/src/responder/pac/pacsrv_cmd.c @@ -55,6 +55,7 @@ struct pac_req_ctx { const char *user_name; char *fq_name; struct sss_domain_info *dom; + char *upn; struct PAC_LOGON_INFO *logon_info; struct dom_sid2 *domain_sid; @@ -88,16 +89,46 @@ static errno_t pac_store_membership(struct pac_req_ctx *pr_ctx, struct tevent_req *pac_save_memberships_send(struct pac_req_ctx *pr_ctx); static void pac_save_memberships_done(struct tevent_req *req); - -static errno_t pac_add_pac_user(struct cli_ctx *cctx) +static errno_t pac_get_data_from_input(struct cli_ctx *cctx, char **upn, + uint8_t **pac_blob, + size_t *pac_blob_len) { int ret; uint8_t *body; size_t blen; + + sss_packet_get_body(cctx->creq->in, &body, &blen); + + switch(cctx->cli_protocol_version->version) { + case 1: + *pac_blob = body; + *pac_blob_len = blen; + *upn = NULL; + ret = EOK; + break; + case 2: + ret = pac_get_v2_data(body, blen, upn, pac_blob, pac_blob_len); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("pac_get_v2_data failed.\n")); + } + break; + default: + DEBUG(SSSDBG_OP_FAILURE, ("Illegal protocol version [%d].\n", + cctx->cli_protocol_version->version)); + ret = EINVAL; + } + + return ret; +} + +static errno_t pac_add_pac_user(struct cli_ctx *cctx) +{ + int ret; + uint8_t *pac_blob; + size_t pac_blob_len; struct pac_req_ctx *pr_ctx; struct tevent_req *req; - sss_packet_get_body(cctx->creq->in, &body, &blen); pr_ctx = talloc_zero(cctx, struct pac_req_ctx); if (pr_ctx == NULL) { @@ -113,7 +144,13 @@ static errno_t pac_add_pac_user(struct cli_ctx *cctx) return EINVAL; } - ret = get_data_from_pac(pr_ctx, body, blen, + ret = pac_get_data_from_input(cctx, &pr_ctx->upn, &pac_blob, &pac_blob_len); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("pac_get_data_from_input failed.\n")); + goto done; + } + + ret = get_data_from_pac(pr_ctx, pac_blob, pac_blob_len, &pr_ctx->logon_info); if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, ("get_data_from_pac failed.\n")); @@ -378,7 +415,7 @@ static errno_t save_pac_user(struct pac_req_ctx *pr_ctx) } ret = get_pwd_from_pac(tmp_ctx, pr_ctx->pac_ctx, pr_ctx->dom, - pr_ctx->logon_info, &pwd, &user_attrs); + pr_ctx->logon_info, pr_ctx->upn, &pwd, &user_attrs); if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, ("get_pwd_from_pac failed.\n")); goto done; @@ -769,6 +806,7 @@ struct cli_protocol_version *register_cli_protocol_version(void) { static struct cli_protocol_version pac_cli_protocol_version[] = { {1, "2011-04-12", "initial version"}, + {2, "2013-03-14", "zero-terminated UPN followed by PAC blob"}, {0, NULL, NULL} }; diff --git a/src/responder/pac/pacsrv_utils.c b/src/responder/pac/pacsrv_utils.c index 824daa6..3daf1e4 100644 --- a/src/responder/pac/pacsrv_utils.c +++ b/src/responder/pac/pacsrv_utils.c @@ -725,6 +725,7 @@ errno_t get_pwd_from_pac(TALLOC_CTX *mem_ctx, struct pac_ctx *pac_ctx, struct sss_domain_info *dom, struct PAC_LOGON_INFO *logon_info, + const char *upn_from_ticket, struct passwd **_pwd, struct sysdb_attrs **_attrs) { @@ -812,26 +813,34 @@ errno_t get_pwd_from_pac(TALLOC_CTX *mem_ctx, goto done; } - uc_realm = get_uppercase_realm(mem_ctx, dom->name); - if (uc_realm == NULL) { - DEBUG(SSSDBG_OP_FAILURE, ("get_uppercase_realm failed.\n")); - ret = ENOMEM; - goto done; - } + if (upn_from_ticket != NULL) { + ret = sysdb_attrs_add_string(attrs, SYSDB_UPN, upn_from_ticket); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n")); + goto done; + } + } else { + uc_realm = get_uppercase_realm(mem_ctx, dom->name); + if (uc_realm == NULL) { + DEBUG(SSSDBG_OP_FAILURE, ("get_uppercase_realm failed.\n")); + ret = ENOMEM; + goto done; + } - upn = talloc_asprintf(mem_ctx, "%s@%s", lname, uc_realm); - talloc_free(uc_realm); - if (upn == NULL) { - DEBUG(SSSDBG_OP_FAILURE, ("talloc_asprintf failed.\n")); - ret = ENOMEM; - goto done; - } + upn = talloc_asprintf(mem_ctx, "%s@%s", lname, uc_realm); + talloc_free(uc_realm); + if (upn == NULL) { + DEBUG(SSSDBG_OP_FAILURE, ("talloc_asprintf failed.\n")); + ret = ENOMEM; + goto done; + } - ret = sysdb_attrs_add_string(attrs, SYSDB_UPN, upn); - talloc_free(upn); - if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n")); - goto done; + ret = sysdb_attrs_add_string(attrs, SYSDB_UPN, upn); + talloc_free(upn); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n")); + goto done; + } } ret = sysdb_attrs_add_string(attrs, SYSDB_NAME_ALIAS, pwd->pw_name); @@ -1091,3 +1100,38 @@ bool new_and_cached_user_differs(struct passwd *pwd, struct ldb_message *msg) return false; } + +errno_t pac_get_v2_data(uint8_t *body, size_t blen, char **upn, + uint8_t **pac_blob, size_t *pac_blob_len) +{ + uint8_t *pac_start; + + if (body == NULL || upn == NULL || pac_blob == NULL || + pac_blob_len == NULL) + { + return EINVAL; + } + + pac_start = memchr(body, '\0', blen); + if (pac_start == NULL) { + DEBUG(SSSDBG_OP_FAILURE, ("Received buffer does not contain a " \ + "0-terminated UPN.\n")); + return EINVAL; + } + pac_start++; + + if ((pac_start - body) >= blen) { + DEBUG(SSSDBG_OP_FAILURE, ("Received buffer does not contain a PAC.\n")); + return EINVAL; + } + + *upn = (char *) body; + *pac_blob = pac_start; + *pac_blob_len = blen - (pac_start - body); + + DEBUG(SSSDBG_TRACE_INTERNAL, ("Received uon [%s] and a PAC of size [%u].\n", + *upn, *pac_blob_len)); + + return EOK; +} + diff --git a/src/sss_client/common_pac.c b/src/sss_client/common_pac.c new file mode 100644 index 0000000..6ab0a12 --- /dev/null +++ b/src/sss_client/common_pac.c @@ -0,0 +1,57 @@ +/* + Authors: + Sumit Bose + + Copyright (C) 2013 Red Hat + + Common utilities to send data to the PAC responder + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include +#include + +#include "sss_cli.h" + +int sss_pac_send_v2(uint8_t *pac_blob, size_t pac_len, const char *upn) +{ + struct sss_cli_req_data sss_data; + int ret; + int errnop; + uint8_t *buf; + size_t upn_len; + + if (pac_blob == NULL || upn == NULL) { + return EINVAL; + } + + upn_len = strlen(upn) + 1; + + sss_data.len = upn_len + pac_len; + buf = malloc(sss_data.len); + memcpy(buf, upn, upn_len); + memcpy(buf + upn_len, pac_blob, pac_len); + sss_data.data = buf; + + ret = sss_pac_make_request(SSS_PAC_ADD_PAC_USER, &sss_data, + NULL, NULL, &errnop); + free(buf); + if (ret != NSS_STATUS_SUCCESS || errnop != 0) { + return EIO; + } + + return EOK; +} + diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h index b0d7b82..eae5d3c 100644 --- a/src/sss_client/sss_cli.h +++ b/src/sss_client/sss_cli.h @@ -47,7 +47,7 @@ typedef int errno_t; #define SSS_SUDO_PROTOCOL_VERSION 1 #define SSS_AUTOFS_PROTOCOL_VERSION 1 #define SSS_SSH_PROTOCOL_VERSION 0 -#define SSS_PAC_PROTOCOL_VERSION 1 +#define SSS_PAC_PROTOCOL_VERSION 2 #ifdef LOGIN_NAME_MAX #define SSS_NAME_MAX LOGIN_NAME_MAX @@ -491,6 +491,8 @@ int sss_pac_make_request(enum sss_cli_command cmd, uint8_t **repbuf, size_t *replen, int *errnop); +int sss_pac_send_v2(uint8_t *pac_blob, size_t pac_len, const char *upn); + int sss_sudo_make_request(enum sss_cli_command cmd, struct sss_cli_req_data *rd, uint8_t **repbuf, size_t *replen, diff --git a/src/sss_client/sssd_pac.c b/src/sss_client/sssd_pac.c index 0cce43d..afe5f95 100644 --- a/src/sss_client/sssd_pac.c +++ b/src/sss_client/sssd_pac.c @@ -2,7 +2,7 @@ Authors: Sumit Bose - Copyright (C) 2011 Red Hat + Copyright (C) 2011, 2012, 2013 Red Hat This program is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by @@ -45,7 +45,7 @@ sssdpac_flags(krb5_context kcontext, krb5_authdatatype ad_type, krb5_flags *flags) { - *flags = AD_USAGE_KDC_ISSUED | AD_INFORMATIONAL | AD_USAGE_TGS_REQ; + *flags = AD_USAGE_KDC_ISSUED | AD_USAGE_TGS_REQ; } static void @@ -81,9 +81,6 @@ sssdpac_import_authdata(krb5_context kcontext, krb5_boolean kdc_issued, krb5_const_principal kdc_issuer) { - struct sss_cli_req_data sss_data; - int ret; - int errnop; char *data = NULL; struct sssd_context *sssdctx = (struct sssd_context *)request_context; @@ -91,15 +88,6 @@ sssdpac_import_authdata(krb5_context kcontext, return EINVAL; } - sss_data.len = authdata[0]->length; - sss_data.data = authdata[0]->contents; - - ret = sss_pac_make_request(SSS_PAC_ADD_PAC_USER, &sss_data, - NULL, NULL, &errnop); - if (ret != 0) { - /* Ignore the error */ - } - if (authdata[0]->length > 0) { data = malloc(sizeof(char) * authdata[0]->length); if (data == NULL) { @@ -134,6 +122,53 @@ sssdpac_request_fini(krb5_context kcontext, } } +static krb5_error_code sssdpac_verify(krb5_context kcontext, + krb5_authdata_context context, + void *plugin_context, + void *request_context, + const krb5_auth_context *auth_context, + const krb5_keyblock *key, + const krb5_ap_req *req) +{ + krb5_error_code kerr; + int ret; + krb5_pac pac; + struct sssd_context *sssdctx = (struct sssd_context *)request_context; + char *upn = NULL; + + if (sssdctx == NULL || sssdctx->data.data == NULL) { + return EINVAL; + } + + kerr = krb5_pac_parse(kcontext, sssdctx->data.data, + sssdctx->data.length, &pac); + if (kerr != 0) { + return EINVAL; + } + + kerr = krb5_pac_verify(kcontext, pac, + req->ticket->enc_part2->times.authtime, + req->ticket->enc_part2->client, key, NULL); + if (kerr != 0) { + return EINVAL; + } + + + kerr = krb5_unparse_name(kcontext, req->ticket->enc_part2->client, &upn); + if (kerr != 0) { + return EINVAL; + } + + ret = sss_pac_send_v2((uint8_t *) sssdctx->data.data, sssdctx->data.length, + upn); + krb5_free_unparsed_name(kcontext, upn); + if (ret != 0) { + /* Ignore the error */ + } + + return 0; +} + static krb5_error_code sssdpac_size(krb5_context kcontext, krb5_authdata_context context, @@ -272,7 +307,7 @@ krb5plugin_authdata_client_ftable_v0 authdata_client_0 = { sssdpac_import_authdata, NULL, NULL, - NULL, + sssdpac_verify, sssdpac_size, sssdpac_externalize, sssdpac_internalize, diff --git a/src/tests/cmocka/test_pac_responder.c b/src/tests/cmocka/test_pac_responder.c new file mode 100644 index 0000000..8aa245b --- /dev/null +++ b/src/tests/cmocka/test_pac_responder.c @@ -0,0 +1,86 @@ +/* + Authors: + Sumit Bose + + Copyright (C) 2013 Red Hat + + Tests for the PAC responder + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "tests/cmocka/common_mock.h" + +#include "sss_client/sss_cli.h" +#include "responder/pac/pacsrv.h" + +uint8_t test_pac_blob[] = {0x01, 0x02, 0x00, 0x03, 0x04, 0x00, 0x05}; +size_t test_pac_blob_len = sizeof(test_pac_blob); +const char *test_upn = "user@REALM.NAME"; +uint8_t test_data[] = {'u', 's', 'e', 'r', '@', 'R', 'E', 'A', 'L', 'M', '.', + 'N', 'A', 'M', 'E', 0x00, 0x01, 0x02, 0x00, 0x03, 0x04, + 0x00, 0x05}; +const size_t test_data_len = sizeof(test_data); + + +int __wrap_sss_pac_make_request(enum sss_cli_command cmd, + struct sss_cli_req_data *rd, + uint8_t **repbuf, size_t *replen, + int *errnop) +{ + check_expected(cmd); + check_expected(rd->len); + check_expected(rd->data); + + *errnop = 0; + return NSS_STATUS_SUCCESS; +} + +void test_sss_pac_send_v2(void **state) +{ + int ret; + + expect_value(__wrap_sss_pac_make_request, cmd, SSS_PAC_ADD_PAC_USER); + expect_value(__wrap_sss_pac_make_request, rd->len, test_data_len); + expect_memory(__wrap_sss_pac_make_request, rd->data, test_data, + test_data_len); + ret = sss_pac_send_v2(test_pac_blob, test_pac_blob_len, test_upn); + assert_int_equal(ret, EOK); +} + +void test_pac_get_v2_data(void **state) +{ + int ret; + char *upn; + uint8_t *pac_blob; + size_t pac_blob_len; + + ret = pac_get_v2_data(test_data, test_data_len, &upn, + &pac_blob, &pac_blob_len); + assert_int_equal(ret, EOK); + assert_string_equal(upn, test_upn); + assert_int_equal(pac_blob_len, test_pac_blob_len); + assert_memory_equal(pac_blob, test_pac_blob, test_pac_blob_len); + +} + +int main(int argc, const char *argv[]) +{ + const UnitTest tests[] = { + unit_test(test_sss_pac_send_v2), + unit_test(test_pac_get_v2_data), + }; + + return run_tests(tests); +} diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c index ab0344c..789b37d 100644 --- a/src/util/sss_krb5.c +++ b/src/util/sss_krb5.c @@ -1052,7 +1052,8 @@ krb5_error_code sss_extract_pac(krb5_context ctx, krb5_principal server_principal, krb5_principal client_principal, krb5_keytab keytab, - krb5_authdata ***_pac_authdata) + krb5_authdata ***_pac_authdata, + char **upn_from_ticket) { #ifdef HAVE_PAC_RESPONDER krb5_error_code kerr; @@ -1130,6 +1131,12 @@ krb5_error_code sss_extract_pac(krb5_context ctx, goto done; } + kerr = krb5_unparse_name(ctx, ticket->enc_part2->client, upn_from_ticket); + if (kerr != 0) { + DEBUG(SSSDBG_OP_FAILURE, ("krb5_unparse_name_ext failed.\n")); + goto done; + } + ret = unsetenv("_SSS_LOOPS"); if (ret != EOK) { DEBUG(1, ("Failed to unset _SSS_LOOPS, " diff --git a/src/util/sss_krb5.h b/src/util/sss_krb5.h index deb0cbf..aaba940 100644 --- a/src/util/sss_krb5.h +++ b/src/util/sss_krb5.h @@ -181,5 +181,6 @@ krb5_error_code sss_extract_pac(krb5_context ctx, krb5_principal server_principal, krb5_principal client_principal, krb5_keytab keytab, - krb5_authdata ***_pac_authdata); + krb5_authdata ***_pac_authdata, + char **upn_from_ticket); #endif /* __SSS_KRB5_H__ */ -- 1.7.7.6