svn rev #24178: trunk/src/ include/ kdc/ lib/kadm5/srv/ plugins/kdb/ldap/libkdb_ldap/

ghudson@MIT.EDU ghudson at MIT.EDU
Thu Jul 8 19:34:35 EDT 2010


http://src.mit.edu/fisheye/changelog/krb5/?cs=24178
Commit By: ghudson
Log Message:
ticket: 6749
status: open

Create a KRB5_KDB_FLAG_ALIAS_OK to control whether plugin modules
should return in-realm aliases.  Set it where appropriate, and use it
in the LDAP module instead of intuiting the result based on other
flags.



Changed Files:
U   trunk/src/include/kdb.h
U   trunk/src/kdc/do_as_req.c
U   trunk/src/kdc/do_tgs_req.c
U   trunk/src/lib/kadm5/srv/server_kdb.c
U   trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
Modified: trunk/src/include/kdb.h
===================================================================
--- trunk/src/include/kdb.h	2010-07-08 13:40:11 UTC (rev 24177)
+++ trunk/src/include/kdb.h	2010-07-08 23:34:35 UTC (rev 24178)
@@ -130,6 +130,8 @@
 #define KRB5_KDB_FLAG_USER_TO_USER              0x00000800
 /* Cross-realm */
 #define KRB5_KDB_FLAG_CROSS_REALM               0x00001000
+/* Allow in-realm aliases */
+#define KRB5_KDB_FLAG_ALIAS_OK                  0x00002000
 
 #define KRB5_KDB_FLAGS_S4U                      ( KRB5_KDB_FLAG_PROTOCOL_TRANSITION | \
                                                   KRB5_KDB_FLAG_CONSTRAINED_DELEGATION )
@@ -913,19 +915,17 @@
      * db_get_principal):
      *
      * KRB5_KDB_FLAG_CANONICALIZE: Set by the KDC when looking up entries for
-     *     an AS or TGS request with canonicalization requested.  Affects
-     *     whether the module should return out-of-realm referrals and aliases
-     *     (see below).
+     *     an AS or TGS request with canonicalization requested.  Determines
+     *     whether the module should return out-of-realm referrals.
      *
-     * KRB5_KDB_INCLUDE_PAC: Set by the KDC during an AS request when the
+     * KRB5_KDB_FLAG_INCLUDE_PAC: Set by the KDC during an AS request when the
      *     client requested PAC information during padata, and during most TGS
      *     requests.  Indicates that the module should include PAC information
      *     when generating authorization data.
      *
      * KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY: Set by the KDC when looking up the
      *     client entry in an AS request.  Affects how the module should return
-     *     out-of-realm referrals and whether the module should return in-realm
-     *     aliases (see below).
+     *     out-of-realm referrals.
      *
      * KRB5_KDB_FLAG_MAP_PRINCIPALS: Set by the KDC when looking up the client
      *     entry during TGS requests, except for S4U TGS requests and requests
@@ -946,11 +946,15 @@
      *     during a TGS request, if the client principal is not part of the
      *     realm being served.
      *
-     * A module can return in-realm aliases if KRB5_KDB_FLAG_CANONICALIZE is
-     * set, or if KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY is not set (because
-     * aliases are always okay for TGS requests).  To return an in-realm alias,
-     * fill in a different value for entries->princ than the one requested.
+     * KRB5_KDB_FLAG_ALIAS_OK: Set by the KDC for server principal lookups and
+     *     for AS request client principal lookups with canonicalization
+     *     requested; also set by the admin interface.  Determines whether the
+     *     module should return in-realm aliases.
      *
+     * A module can return in-realm aliases if KRB5_KDB_FLAG_ALIAS_OK is set.
+     * To return an in-realm alias, fill in a different value for
+     * entries->princ than the one requested.
+     *
      * A module can return out-of-realm referrals if KRB5_KDB_FLAG_CANONICALIZE
      * is set.  For AS request clients (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY is
      * also set), the module should do so by simply filling in an out-of-realm

Modified: trunk/src/kdc/do_as_req.c
===================================================================
--- trunk/src/kdc/do_as_req.c	2010-07-08 13:40:11 UTC (rev 24177)
+++ trunk/src/kdc/do_as_req.c	2010-07-08 23:34:35 UTC (rev 24178)
@@ -195,6 +195,7 @@
         krb5_princ_type(kdc_context,
                         request->client) == KRB5_NT_ENTERPRISE_PRINCIPAL) {
         setflag(c_flags, KRB5_KDB_FLAG_CANONICALIZE);
+        setflag(c_flags, KRB5_KDB_FLAG_ALIAS_OK);
     }
     if (include_pac_p(kdc_context, request)) {
         setflag(c_flags, KRB5_KDB_FLAG_INCLUDE_PAC);
@@ -237,6 +238,7 @@
 #endif
 
     s_flags = 0;
+    setflag(s_flags, KRB5_KDB_FLAG_ALIAS_OK);
     if (isflagset(request->kdc_options, KDC_OPT_CANONICALIZE)) {
         setflag(s_flags, KRB5_KDB_FLAG_CANONICALIZE);
     }

Modified: trunk/src/kdc/do_tgs_req.c
===================================================================
--- trunk/src/kdc/do_tgs_req.c	2010-07-08 13:40:11 UTC (rev 24177)
+++ trunk/src/kdc/do_tgs_req.c	2010-07-08 23:34:35 UTC (rev 24178)
@@ -205,6 +205,7 @@
     /* XXX make sure server here has the proper realm...taken from AP_REQ
        header? */
 
+    setflag(s_flags, KRB5_KDB_FLAG_ALIAS_OK);
     if (isflagset(request->kdc_options, KDC_OPT_CANONICALIZE)) {
         setflag(c_flags, KRB5_KDB_FLAG_CANONICALIZE);
         setflag(s_flags, KRB5_KDB_FLAG_CANONICALIZE);

Modified: trunk/src/lib/kadm5/srv/server_kdb.c
===================================================================
--- trunk/src/lib/kadm5/srv/server_kdb.c	2010-07-08 13:40:11 UTC (rev 24177)
+++ trunk/src/lib/kadm5/srv/server_kdb.c	2010-07-08 23:34:35 UTC (rev 24178)
@@ -242,7 +242,8 @@
 
     *kdb_ptr = NULL;
 
-    ret = krb5_db_get_principal(handle->context, principal, 0, &kdb);
+    ret = krb5_db_get_principal(handle->context, principal,
+                                KRB5_KDB_FLAG_ALIAS_OK, &kdb);
     if (ret == KRB5_KDB_NOENTRY)
         return(KADM5_UNK_PRINC);
     if (ret)

Modified: trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
===================================================================
--- trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	2010-07-08 13:40:11 UTC (rev 24177)
+++ trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	2010-07-08 23:34:35 UTC (rev 24178)
@@ -70,30 +70,6 @@
     return 0;
 }
 
-/* Return true if it's okay to return aliases according to flags. */
-static krb5_boolean
-aliases_ok(unsigned int flags)
-{
-    /*
-     * The current DAL does not have a flag to indicate whether
-     * aliases are okay.  For service name lookups (AS or TGT path),
-     * we can always return aliases.  For client name lookups, we can
-     * only return aliases if the client passed the canonicalize flag.
-     * We abuse the CLIENT_REFERRALS_ONLY flag to detect client name
-     * lookups.
-     *
-     * This method has the side effect of permitting aliases for
-     * lookups by administrative interfaces (e.g. kadmin).  Since we
-     * don't have explicit admin support for aliases yet, this is
-     * okay.
-     */
-    if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY))
-        return TRUE;
-    if (flags & KRB5_KDB_FLAG_CANONICALIZE)
-        return TRUE;
-    return FALSE;
-}
-
 /*
  * look up a principal in the directory.
  */
@@ -178,7 +154,7 @@
             if ((values=ldap_get_values(ld, ent, "krbcanonicalname")) != NULL) {
                 if (values[0] && strcmp(values[0], user) != 0) {
                     /* We matched an alias, not the canonical name. */
-                    if (aliases_ok(flags)) {
+                    if (flags & KRB5_KDB_FLAG_ALIAS_OK) {
                         st = krb5_ldap_parse_principal_name(values[0], &cname);
                         if (st != 0)
                             goto cleanup;




More information about the cvs-krb5 mailing list