IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

kdb: PAC generator: do not fail if canonical principal is missing

Browse Source 
krbCanonicalName is mandatory for services but IPA services created
before commit e6ff83e (FreeIPA 4.4.0, ~2016) had no normalization done
to set krbCanonicalName; services created after that version were
upgraded to do have krbCanonicalName.

Accept krbPrincipalName alone since they have no alias either */

Fixes: https://pagure.io/freeipa/issue/9465

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
This commit is contained in:
Alexander Bokovoy 2024-01-26 20:53:39 +02:00 committed by Florence Blanc-Renaud
parent 89d945fe6f
commit ed977a6e82
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
daemons/ipa-kdb/ipa_kdb_mspac.c
View File

@ -496,8 +496,16 @@ static krb5_error_code ipadb_fill_info3(struct ipadb_context *ipactx,
ret = ipadb_ldap_attr_to_str(ipactx->lcontext, lentry,
"krbCanonicalName", &strres);
if (ret) {
/* krbCanonicalName is mandatory for services */
return ret;
/* krbCanonicalName is mandatory for services but IPA services
* created before commit e6ff83e (FreeIPA 4.4.0, ~2016) had no
* normalization to set krbCanonicalName; services created after
* that version were upgraded to do have krbCanonicalName.
*
* Accept krbPrincipalName alone since they have no alias either */
ret = ipadb_ldap_attr_to_str(ipactx->lcontext, lentry,
"krbPrincipalName", &strres);
if (ret)
return ret;
}
ret = krb5_parse_name(ipactx->kcontext, strres, &princ);