IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-10-25 14:40:16 -05:00
Code Issues Packages Projects Releases Wiki Activity

ipa-kdb: do not remove keys for hardened auth-enabled users

Browse Source 
Since 5d51ae5, principal keys were dropped in case user auth indicator
was not including password. Thereafter, the key removal behavior was
removed by 15ff9c8 in the context of the kdcpolicy plugin introduction.
Support for hardened pre-auth methods (FAST and SPAKE) was added in
d057040, and the removal of principal keys was restored afterwards by
f0d12b7, but not taking the new hardened auth indicator into account.

Fixes: https://pagure.io/freeipa/issue/9065
Related to: https://pagure.io/freeipa/issue/8001

Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
This commit is contained in:
Julien Rische authored and Florence Blanc-Renaud committed 2022-02-02 15:42:45 +01:00
1 parent f3636c6afa
commit 35e94bee0e
1 file changed
+12 -11
Download Patch File Download Diff File Expand all files Collapse all files
daemons/ipa-kdb/ipa_kdb_principals.c
+12 -11
View File
@@ -788,17 +788,18 @@ static krb5_error_code ipadb_parse_ldap_entry(krb5_context kcontext,
&res_key_data, &result, &mkvno);
switch (ret) {
case 0:
/* Only set a principal's key if password auth can be used. Otherwise
* the KDC would add pre-authentication methods to the NEEDED_PREAUTH
* reply for AS-REQs which indicate the password authentication is
* available. This might confuse applications like e.g. SSSD which try
* to determine suitable authentication methods and corresponding
* prompts with the help of MIT Kerberos' responder interface which
* acts on the returned pre-authentication methods. A typical example
* is enforced OTP authentication where of course keys are available
* for the first factor but password authentication should not be
* advertised by the KDC. */
if (!(ua & IPADB_USER_AUTH_PASSWORD) && (ua != IPADB_USER_AUTH_NONE)) {
/* Only set a principal's key if password or hardened auth can be used.
* Otherwise the KDC would add pre-authentication methods to the
* NEEDED_PREAUTH reply for AS-REQs which indicate the password
* authentication is available. This might confuse applications like
* e.g. SSSD which try to determine suitable authentication methods and
* corresponding prompts with the help of MIT Kerberos' responder
* interface which acts on the returned pre-authentication methods. A
* typical example is enforced OTP authentication where of course keys
* are available for the first factor but password authentication
* should not be advertised by the KDC. */
if (!(ua & (IPADB_USER_AUTH_PASSWORD | IPADB_USER_AUTH_HARDENED)) &&
(ua != IPADB_USER_AUTH_NONE)) {
/* This is the same behavior as ENOENT below. */
ipa_krb5_free_key_data(res_key_data, result);
break;