|
 |
2fc102 |
From 62b3828dae4445e30d948cf858e0ecbe120eaf36 Mon Sep 17 00:00:00 2001
|
|
|
2fc102 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
2fc102 |
Date: Fri, 21 Mar 2014 16:16:23 +0100
|
|
|
2fc102 |
Subject: [PATCH 117/117] krb5-child: add revert_changepw_options()
|
|
|
2fc102 |
|
|
|
2fc102 |
After changing the Kerberos password krb5-child will try to get a fresh
|
|
|
2fc102 |
TGT with the new password. This patch tries to make sure the right gic
|
|
|
2fc102 |
options are used.
|
|
|
2fc102 |
|
|
|
2fc102 |
Resolves: https://fedorahosted.org/sssd/ticket/2289
|
|
|
2fc102 |
|
|
|
2fc102 |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
2fc102 |
---
|
|
|
2fc102 |
src/providers/krb5/krb5_child.c | 22 ++++++++++++++++++++++
|
|
|
2fc102 |
1 file changed, 22 insertions(+)
|
|
|
2fc102 |
|
|
|
2fc102 |
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
|
|
|
2fc102 |
index 674dad7387c6874209ee5e491cefc18eba4a6da5..97c5a590ad78080613325b5a397ac965905932fd 100644
|
|
|
2fc102 |
--- a/src/providers/krb5/krb5_child.c
|
|
|
2fc102 |
+++ b/src/providers/krb5/krb5_child.c
|
|
|
2fc102 |
@@ -140,6 +140,24 @@ static void set_changepw_options(krb5_context ctx,
|
|
|
2fc102 |
krb5_get_init_creds_opt_set_tkt_life(options, 5*60);
|
|
|
2fc102 |
}
|
|
|
2fc102 |
|
|
|
2fc102 |
+static void revert_changepw_options(krb5_get_init_creds_opt *options)
|
|
|
2fc102 |
+{
|
|
|
2fc102 |
+ krb5_error_code kerr;
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ set_canonicalize_option(options);
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ /* Currently we do not set forwardable and proxiable explicitly, the flags
|
|
|
2fc102 |
+ * must be removed so that libkrb5 can take the defaults from krb5.conf */
|
|
|
2fc102 |
+ options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_FORWARDABLE);
|
|
|
2fc102 |
+ options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_PROXIABLE);
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ kerr = set_lifetime_options(options);
|
|
|
2fc102 |
+ if (kerr != 0) {
|
|
|
2fc102 |
+ DEBUG(SSSDBG_OP_FAILURE, ("set_lifetime_options failed.\n"));
|
|
|
2fc102 |
+ }
|
|
|
2fc102 |
+}
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+
|
|
|
2fc102 |
static errno_t sss_send_pac(krb5_authdata **pac_authdata)
|
|
|
2fc102 |
{
|
|
|
2fc102 |
struct sss_cli_req_data sss_data;
|
|
|
2fc102 |
@@ -1187,6 +1205,10 @@ static errno_t changepw_child(struct krb5_req *kr, bool prelim)
|
|
|
2fc102 |
|
|
|
2fc102 |
krb5_free_cred_contents(kr->ctx, kr->creds);
|
|
|
2fc102 |
|
|
|
2fc102 |
+ /* We changed some of the gic options for the password change, now we have
|
|
|
2fc102 |
+ * to change them back to get a fresh TGT. */
|
|
|
2fc102 |
+ revert_changepw_options(kr->options);
|
|
|
2fc102 |
+
|
|
|
2fc102 |
kerr = get_and_save_tgt(kr, newpassword);
|
|
|
2fc102 |
|
|
|
2fc102 |
sss_authtok_set_empty(kr->pd->newauthtok);
|
|
|
2fc102 |
--
|
|
|
2fc102 |
1.8.5.3
|
|
|
2fc102 |
|