[SSSD] [PATCH] Add more info about ticket validation

Ondrej Kos okos at redhat.com
Tue Oct 9 10:41:43 UTC 2012


On 10/09/2012 12:28 PM, Sumit Bose wrote:
> On Tue, Oct 09, 2012 at 11:38:57AM +0200, Ondrej Kos wrote:
>> https://fedorahosted.org/sssd/ticket/1499
>>
>> Adds log message about not finding appropriate entry in keytab and using
>> the last keytab entry when validation is enabled.
>>
>> Adds more information about validation into manpage.
>>
>> Patch is attached.
>>
>> O.
>> --
>> Ondrej Kos
>> Associate Software Engineer
>> Identity Management
>> Red Hat Czech
>>
>> phone: +420-532-294-558
>> cell:  +420-736-417-909
>> ext:   82-62558
>> loc:   1/5C Brno 1 office
>> irc:   okos @ #brno
>
>> diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
>> index f4fd1cb73941e23d8e39d234bf8fd2ae8ae54554..a67e4215f7e897afb37708695e56459cfa968f25 100644
>> --- a/src/man/sssd-krb5.5.xml
>> +++ b/src/man/sssd-krb5.5.xml
>> @@ -231,7 +231,12 @@
>>                       <term>krb5_validate (boolean)</term>
>>                       <listitem>
>>                           <para>
>> -                            Verify with the help of krb5_keytab that the TGT obtained has not been spoofed.
>> +                            Verify with the help of krb5_keytab that the TGT
>> +                            obtained has not been spoofed. If there's no entry with
>> +                            corresponding realm found in keytab, the last one is used.
>> +                            This can be utilized to achieve validation in enviroments
>> +                            with cross-realm trust by placing appropriate keytab entry
>> +                            as the last one.
>
> For completeness I would add that the first entry with a matching realm
> is taken. This might be important to know because pam_krb5 uses a more
> elaborate scheme. For a future version we might want to add an option to
> switch to the scheme used by pam_krb5.
>
> bye,
> Sumit
I forgot this one. updated.
>
>>                           </para>
>>                           <para>
>>                               Default: false
>> diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
>> index b2d5bdaeb9d4b1ac8de12055a4d6bb5a7f48a7f1..ff6a30147bb9d7edac7bab364d5d9004451f6ffb 100644
>> --- a/src/providers/krb5/krb5_child.c
>> +++ b/src/providers/krb5/krb5_child.c
>> @@ -696,6 +696,7 @@ static krb5_error_code validate_tgt(struct krb5_req *kr)
>>       krb5_keytab_entry entry;
>>       krb5_verify_init_creds_opt opt;
>>       krb5_principal validation_princ = NULL;
>> +    bool entry_found = false;
>>
>>       memset(&keytab, 0, sizeof(keytab));
>>       kerr = krb5_kt_resolve(kr->ctx, kr->keytab, &keytab);
>> @@ -736,10 +737,17 @@ static krb5_error_code validate_tgt(struct krb5_req *kr)
>>           if (krb5_realm_compare(kr->ctx, validation_princ, kr->princ)) {
>>               DEBUG(SSSDBG_TRACE_INTERNAL,
>>                     ("Found keytab entry with the realm of the credential.\n"));
>> +            entry_found = true;
>>               break;
>>           }
>>       }
>>
>> +    if (!entry_found) {
>> +        DEBUG(SSSDBG_TRACE_INTERNAL,
>> +                ("Keytab entry with the realm of the credential not found "
>> +                 "in keytab. Using the last entry.\n"));
>> +    }
>> +
>>       /* Close the keytab here.  Even though we're using cursors, the file
>>        * handle is stored in the krb5_keytab structure, and it gets
>>        * overwritten when the verify_init_creds() call below creates its own
>
> just a nitpick. entry_found is a bit misleading, because we always find
> an entry, at least the last one. e.g. realm_entry_found would be more
> precise.
>
> bye,
> Sumit
not a problem, didn't cross my mind.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>

new patch attached

O.


-- 
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech

phone: +420-532-294-558
cell:  +420-736-417-909
ext:   82-62558
loc:   1/5C Brno 1 office
irc:   okos @ #brno
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-more-info-about-ticket-validation.patch
Type: text/x-patch
Size: 3190 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121009/a62b8356/attachment.bin>


More information about the sssd-devel mailing list