[krbdev.mit.edu #9225] git commit

[Greg Hudson via RT]

Mon Aug 17 17:01:57 2026: Request 9225 was acted upon.
 Transaction: Ticket created by ghudson at mit.edu
       Queue: krb5
     Subject: git commit
       Owner: ghudson at mit.edu
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9225 >



Relax gss_init_sec_context() proxy self check

If the krb5 gss_init_sec_context() detects a proxy ccache, we check in
get_credentials() whether the requested server principal matches the
cache's impersonator principal.  For a host-based server name, this
match will fail if krb5_sname_to_principal() yielded an empty realm,
as it does in most configurations.

As host-based principals generally only exist in one realm for a given
FQDN, we can ignore the realm for this comparison when the server name
is host-based.

[ghudson at mit.edu: rewrote comment and commit message; adjusted code to
use krb5_principal_compare_flags()]

https://github.com/krb5/krb5/commit/473b51b640bef2e97c490d6f2985658befa89c16
Author: Alexander Bokovoy <abokovoy at redhat.com>
Committer: Greg Hudson <ghudson at mit.edu>
Commit: 473b51b640bef2e97c490d6f2985658befa89c16
Branch: master
 src/lib/gssapi/krb5/init_sec_context.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)