IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

kdb: Use krb5_pac_full_sign_compat() when available

Browse Source 
In November 2022, Microsoft introduced a new PAC signature type called
"extended KDC signature" (or "full PAC checksum"). This new PAC
signature will be required by default by Active Directory in July 2023
for S4U requests, and opt-out will no longer be possible after October
2023.

Support for this new signature type was added to MIT krb5, but it relies
on the new KDB API introduced in krb5 1.20. For older MIT krb5 versions,
the code generating extended KDC signatures cannot be backported as it
is without backporting the full new KDB API code too. This would have
too much impact to be done.

As a consequence, krb5 packages for Fedora 37, CentOS 8 Stream, and RHEL
8 will include a downstream-only update adding the
krb5_pac_full_sign_compat() function, which can be used in combination
with the prior to 1.20 KDB API to generate PAC extended KDC signatures.

Fixes: https://pagure.io/freeipa/issue/9373
Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Julien Rische
2023-03-24 18:32:37 +01:00
committed by Florence Blanc-Renaud
parent da65cc35bd
commit 9cd5f49c74
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
daemons/ipa-kdb/ipa_kdb_mspac_v6.c
View File

@@ -176,11 +176,21 @@ static krb5_error_code ipadb_sign_pac(krb5_context context,
/* only pass with_realm TRUE when it is cross-realm ticket and S4U2Self
* was requested */
#ifdef HAVE_KRB5_PAC_FULL_SIGN_COMPAT
kerr = krb5_pac_full_sign_compat(
context, pac, authtime, client_princ, server->princ, server_key,
right_krbtgt_signing_key,
(is_issuing_referral && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION)),
pac_data
);
#else
/* Use standard function, PAC extended KDC signature not supported */
kerr = krb5_pac_sign_ext(context, pac, authtime, client_princ, server_key,
right_krbtgt_signing_key,
(is_issuing_referral &&
(flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION)),
pac_data);
#endif
done:
free(princ);

9
server.m4
View File

@@ -90,6 +90,15 @@ AC_CHECK_MEMBER([kdb_vftabl.issue_pac],
[have_kdb_issue_pac=yes],
[have_kdb_issue_pac=no], [#include <kdb.h>])
dnl ---------------------------------------------------------------------------
dnl - Check for KRB5 krb5_kdc_sign_ticket function
dnl ---------------------------------------------------------------------------
AC_CHECK_LIB(krb5, krb5_pac_full_sign_compat,
[AC_DEFINE([HAVE_KRB5_PAC_FULL_SIGN_COMPAT], [1],
[krb5_pac_full_sign_compat() is available.])],
[AC_MSG_NOTICE([krb5_pac_full_sign_compat() is not available])])
dnl ---------------------------------------------------------------------------
dnl - Check for UUID library
dnl ---------------------------------------------------------------------------