[krbdev.mit.edu #7549] KDC name type return issues

Greg Hudson via RT rt-comment at krbdev.mit.edu
Thu Jan 31 02:24:44 EST 2013


I created issue #7555 to track the specific issue of the is_referral flag 
being wrong, so this issue can track the larger problem.

There is an important code change which I missed in my previous analysis.  
In 1.11, process_tgs_req unconditionally replaces request->server with 
server->princ (the DB entry principal) at lines 222-225.  Prior to 1.11, 
request->server was only modified if a different server principal was 
actually selected by find_alternate_tgs or prep_reprocess_req.

Because of this change, a 1.11 KDC will return a server name type of 
KRB_NT_PRINCIPAL for all requests.


More information about the krb5-bugs mailing list