[krbdev.mit.edu #7549] KDC name type return issues
Greg Hudson via RT
rt-comment at krbdev.mit.edu
Thu Jan 31 02:24:44 EST 2013
I created issue #7555 to track the specific issue of the is_referral flag
being wrong, so this issue can track the larger problem.
There is an important code change which I missed in my previous analysis.
In 1.11, process_tgs_req unconditionally replaces request->server with
server->princ (the DB entry principal) at lines 222-225. Prior to 1.11,
request->server was only modified if a different server principal was
actually selected by find_alternate_tgs or prep_reprocess_req.
Because of this change, a 1.11 KDC will return a server name type of
KRB_NT_PRINCIPAL for all requests.
More information about the krb5-bugs
mailing list