svn rev #22708: trunk/src/plugins/kdb/ldap/libkdb_ldap/

[ghudson@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=22708
Commit By: ghudson
Log Message:
ticket: 6556
subject: Supply LDAP service principal aliases to non-referrals clients
target_version: 1.7
tags: pullup

In the LDAP back end, return aliases when the CLIENT_REFERRALS_ONLY
flag isn't set (abusing that flag to recognize a client name lookup).
Based on a patch from Luke Howard.



Changed Files:
U   trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
Modified: trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
===================================================================
--- trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	2009-09-02 20:21:36 UTC (rev 22707)
+++ trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	2009-09-03 17:39:50 UTC (rev 22708)
@@ -69,6 +69,30 @@
     return 0;
 }
 
+/* Return true if it's okay to return aliases according to flags. */
+static krb5_boolean
+aliases_ok(unsigned int flags)
+{
+    /*
+     * The current DAL does not have a flag to indicate whether
+     * aliases are okay.  For service name lookups (AS or TGT path),
+     * we can always return aliases.  For client name lookups, we can
+     * only return aliases if the client passed the canonicalize flag.
+     * We abuse the CLIENT_REFERRALS_ONLY flag to detect client name
+     * lookups.
+     *
+     * This method has the side effect of permitting aliases for
+     * lookups by administrative interfaces (e.g. kadmin).  Since we
+     * don't have explicit admin support for aliases yet, this is
+     * okay.
+     */
+    if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY))
+	return TRUE;
+    if (flags & KRB5_KDB_FLAG_CANONICALIZE)
+	return TRUE;
+    return FALSE;
+}
+
 /*
  * look up a principal in the directory.
  */
@@ -160,7 +184,7 @@
 	    if ((values=ldap_get_values(ld, ent, "krbcanonicalname")) != NULL) {
 		if (values[0] && strcmp(values[0], user) != 0) {
 		    /* We matched an alias, not the canonical name. */
-		    if (flags & KRB5_KDB_FLAG_CANONICALIZE) {
+		    if (aliases_ok(flags)) {
 			st = krb5_ldap_parse_principal_name(values[0], &cname);
 			if (st != 0)
 			    goto cleanup;