Patch to ignore service principals when accepting connexions.

Sam Hartman hartmans at
Wed Aug 25 19:11:50 EDT 2010

>>>>> "Luke" == Luke Howard <lukeh at> writes:

    >> Taking a look at the code, we only seem to use the service name in the
    >> ticket if the keytab operations vector doesn't include sequential gets.
    >> That's only true for the kdb keytab.

    Luke> From rd_req_dec.c:

    Luke> if (server != NULL || keytab->ops->start_seq_get == NULL) {
    Luke> ...

Yes, but a couple of lines down:
    if (server != NULL || keytab->ops->start_seq_get == NULL) {
        retval = krb5_kt_get_entry(context, keytab,
                                   server != NULL ? server : req->ticket->server,
                                   req->ticket->enc_part.enctype, &ktent);

Note that the name from the ticket is only used if server is null.

More information about the krbdev mailing list