auth/credentials: Support match-by-key in cli_credentials_get_server_gss_creds()

[samba.git] / auth / credentials / credentials_krb5.c

diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index 684f2440fd72d619cbbeaf5915f678441df2787c..459e9487f4822cf8f37d52ab98e7a6d4acbf23e8 100644 (file)
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -533,6 +533,7 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
                return ret;
        }
 
+#ifdef SAMBA4_USES_HEIMDAL /* MIT lacks krb5_get_default_in_tkt_etypes */
        /*
         * transfer the enctypes from the smb_krb5_context to the gssapi layer
         *
@@ -567,6 +568,8 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
                        return ret;
                }
        }
+#endif
+#ifdef SAMBA4_USES_HEIMDAL /* MIT lacks GSS_KRB5_CRED_NO_CI_FLAGS_X */
 
        /* don't force GSS_C_CONF_FLAG and GSS_C_INTEG_FLAG */
        maj_stat = gss_set_cred_option(&min_stat, &gcc->creds,
@@ -582,7 +585,7 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
                (*error_string) = talloc_asprintf(cred, "gss_set_cred_option failed: %s", error_message(ret));
                return ret;
        }
-
+#endif
        cred->client_gss_creds_obtained = cred->ccache_obtained;
        talloc_set_destructor(gcc, free_gssapi_creds);
        cred->client_gss_creds = gcc;
@@ -714,6 +717,11 @@ _PUBLIC_ int cli_credentials_get_keytab(struct cli_credentials *cred,
        cred->keytab_obtained = (MAX(cred->principal_obtained, 
                                     cred->username_obtained));
 
+       /* We make this keytab up based on a password.  Therefore
+        * match-by-key is acceptable, we can't match on the wrong
+        * principal */
+       ktc->password_based = true;
+
        talloc_steal(cred, ktc);
        cred->keytab = ktc;
        *_ktc = cred->keytab;
@@ -815,12 +823,12 @@ _PUBLIC_ int cli_credentials_get_server_gss_creds(struct cli_credentials *cred,
                return ENOMEM;
        }
 
-       if (obtained < CRED_SPECIFIED) {
-               /* This creates a GSSAPI cred_id_t with the principal and keytab set */
+       if (ktc->password_based || obtained < CRED_SPECIFIED) {
+               /* This creates a GSSAPI cred_id_t for match-by-key with only the keytab set */
                maj_stat = gss_krb5_import_cred(&min_stat, NULL, NULL, ktc->keytab,
                                                &gcc->creds);
        } else {
-               /* This creates a GSSAPI cred_id_t with the principal and keytab set */
+               /* This creates a GSSAPI cred_id_t with the principal and keytab set, matching by name */
                maj_stat = gss_krb5_import_cred(&min_stat, NULL, princ, ktc->keytab,
                                                &gcc->creds);
        }