[SSSD] [PATCH] Only check UPN if enterprise principals are not used

Jakub Hrozek jhrozek at redhat.com
Fri May 3 17:56:48 UTC 2013


Currently when enterprise principals are enabled in the AD provider, we
check if the UPN is the same as we'd expect. But when enterprise
principals are enabled (which is by default in AD provider), then the
principal krb5_child returns is different from what SSSD expects.

Sumit, you wrote the enterprise principal support, do you know if there
is a better way than disabling the check altogether? Can we expect the
principal in the form krb5_child sends it? This is how the principal
looked on my setup for user "testlogin:

$ klist 
Ticket cache: DIR::/run/user/947005183/krb5cc/tktDSjgIe
Default principal: testlogin\@SSSD-AD.TEST at SSSD-AD.TEST

Valid starting     Expires            Service principal
05/03/13 17:52:32  05/04/13 03:52:32  krbtgt/SSSD-AD.TEST at SSSD-AD.TEST
    renew until 05/10/13 17:52:32
-------------- next part --------------
>From d8ecff3478a1e09c9d6f13df363dd7fcd1c80705 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 3 May 2013 19:30:51 +0200
Subject: [PATCH] Only check UPN if enterprise principals are not used

If enterprise principals are enabled (which is the default in the AD
provider), then the returned UPN might be slightly different from
the one SSSD constructs before attempting the login. This patch makes
SSSD only check if the principal is the same when the enterprise
principals are disabled.
---
 src/providers/krb5/krb5_auth.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index 5baea0bc84bb6991d32300210d4bb4db3bcee5d0..6d7494c37d9921f80d2684d95627de96b900fb88 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -840,6 +840,7 @@ static void krb5_auth_done(struct tevent_req *subreq)
     krb5_deltat renew_interval_delta;
     char *renew_interval_str;
     time_t renew_interval_time = 0;
+    bool use_enterprise_principal;
 
     ret = handle_child_recv(subreq, pd, &buf, &len);
     talloc_zfree(subreq);
@@ -908,9 +909,13 @@ static void krb5_auth_done(struct tevent_req *subreq)
         }
     }
 
+    use_enterprise_principal = dp_opt_get_bool(kr->krb5_ctx->opts,
+                                               KRB5_USE_ENTERPRISE_PRINCIPAL);
+
     /* Check if the cases of our upn are correct and update it if needed.
      * Fail if the upn differs by more than just the case. */
     if (res->correct_upn != NULL &&
+        use_enterprise_principal == false &&
         strcmp(kr->upn, res->correct_upn) != 0) {
         if (strcasecmp(kr->upn, res->correct_upn) == 0) {
             talloc_free(kr->upn);
-- 
1.8.2.1



More information about the sssd-devel mailing list