From 3be1203987de8cf1ae6f30b6e3a6904e3d46990e Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 29 Dec 2016 14:42:49 +0100 Subject: [PATCH] krb5_wrap: let smb_krb5_kinit_s4u2_ccache() work if store_creds.client and server have different realms As the principal in the resulting ccache may not match the realm of the target principal, we need to store the credentials twice. The caller uses the ccache principal's realm to construct the search key for the target principal. If we get administrator@SAMBADOMAIN via the NTLMSSP authentication and want to do s4u2selfproxy, we'll get ticket for client realm: SAMBADOMAIN client name: administrator server realm: SAMBA.EXAMPLE.COM server name: cifs/localdc This is stored in credential cache, but the caller will use cifs/localdc@SAMBADOMAIN as target_principal name when it tries to use the cache. So also store the ticket as: client realm: SAMBADOMAIN client name: administrator server realm: SAMBADOMAIN server name: cifs/localdc Note that it can always happen that the target is not in the clients realm, so we always deal with changing realm names, so this is not a s4u2self/proxy specific thing. Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider --- lib/krb5_wrap/krb5_samba.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c index f8f3b16e63d..bb0b5dfa620 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c @@ -1942,6 +1942,7 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, krb5_principal target_princ; krb5_ccache tmp_cc; const char *self_realm; + const char *client_realm = NULL; krb5_principal blacklist_principal = NULL; krb5_principal whitelist_principal = NULL; @@ -2273,6 +2274,29 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return code; } + client_realm = krb5_principal_get_realm(ctx, store_creds.client); + if (client_realm != NULL) { + /* + * Because the CANON flag doesn't have any impact + * on the impersonate_principal => store_creds.client + * realm mapping. We need to store the credentials twice, + * once with the returned realm and once with the + * realm of impersonate_principal. + */ + code = krb5_principal_set_realm(ctx, store_creds.server, + client_realm); + if (code != 0) { + krb5_free_cred_contents(ctx, &store_creds); + return code; + } + + code = krb5_cc_store_cred(ctx, store_cc, &store_creds); + if (code != 0) { + krb5_free_cred_contents(ctx, &store_creds); + return code; + } + } + if (expire_time) { *expire_time = (time_t) store_creds.times.endtime; } -- 2.34.1