>From a7df5df1d466dcab8c95f5cbd3ed4ba643f7b2cb Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Fri, 19 Jul 2013 08:36:28 +0300 Subject: [PATCH] KRB5: Do not send PAC in server mode The krb5 child contacts the PAC responder for any user except for the IPA native users if the PAC is configured. This works fine for the general case but the ipa_server_mode is a special one. The PAC responder is there, but since in the server mode we should be operating as AD provider default, the PAC shouldn't be analyzed either in this case. --- src/providers/ipa/ipa_init.c | 8 +++++++- src/providers/krb5/krb5_child_handler.c | 16 +++++++++++----- src/providers/krb5/krb5_common.h | 8 +++++++- 3 files changed, 25 insertions(+), 7 deletions(-) diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c index fe13b18722d7a2506ea52850e17a4cf20073bc56..407ab166918c5ff5599382c8281502380aa179fe 100644 --- a/src/providers/ipa/ipa_init.c +++ b/src/providers/ipa/ipa_init.c @@ -300,7 +300,13 @@ int sssm_ipa_auth_init(struct be_ctx *bectx, goto done; } krb5_auth_ctx->service = ipa_options->service->krb5_service; - krb5_auth_ctx->is_ipa = true; + + if (dp_opt_get_bool(id_ctx->ipa_options->basic, + IPA_SERVER_MODE) == true) { + krb5_auth_ctx->config_type = K5C_IPA_SERVER; + } else { + krb5_auth_ctx->config_type = K5C_IPA_CLIENT; + } ipa_options->auth_ctx->krb5_auth_ctx = krb5_auth_ctx; ret = ipa_get_auth_options(ipa_options, bectx->cdb, bectx->conf_path, diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c index 044c27195a08b423cab2459915bf3488ba6ca885..8117d1e5db01cfe0684ee4d7f3e4acf8ff1e4768 100644 --- a/src/providers/krb5/krb5_child_handler.c +++ b/src/providers/krb5/krb5_child_handler.c @@ -142,11 +142,17 @@ static errno_t create_send_buffer(struct krb5child_req *kr, validate = dp_opt_get_bool(kr->krb5_ctx->opts, KRB5_VALIDATE) ? 1 : 0; - /* Always send PAC except for local IPA users */ - if (kr->krb5_ctx->is_ipa) { - send_pac = kr->upn_from_different_realm ? 1 : 0; - } else { - send_pac = 1; + /* Always send PAC except for local IPA users and IPA server mode */ + switch (kr->krb5_ctx->config_type) { + case K5C_IPA_CLIENT: + send_pac = kr->upn_from_different_realm ? 1 : 0; + break; + case K5C_IPA_SERVER: + send_pac = 0; + break; + default: + send_pac = 1; + break; } if (kr->pd->cmd == SSS_CMD_RENEW) { diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h index 27089ab969c9695d0d92c10a540387376e305467..e56bd496e04a7a5c8776a34648aabe0f2d73a3b9 100644 --- a/src/providers/krb5/krb5_common.h +++ b/src/providers/krb5/krb5_common.h @@ -91,6 +91,12 @@ struct deferred_auth_ctx; struct renew_tgt_ctx; struct sss_krb5_cc_be; +enum krb5_config_type { + K5C_GENERIC, + K5C_IPA_CLIENT, + K5C_IPA_SERVER +}; + struct krb5_ctx { /* opts taken from kinit */ /* in seconds */ @@ -130,7 +136,7 @@ struct krb5_ctx { hash_table_t *wait_queue_hash; - bool is_ipa; + enum krb5_config_type config_type; }; struct remove_info_files_ctx { -- 1.8.3.1