Julien Rische bf76899127 ipa-kdb: enforce PAC presence on TGT for TGS-REQ ...

MS-KILE's PA-PAC-REQUEST sequence allows the Kerberos client to request
a TGT without a PAC. At the moment, there is no way to configure the MIT
KDC to reject such request.

This commit enforces the presence of the PAC when processing TGTs
provided by TGS-REQ. It ensures the server principal of the TGT is the
same as the one in PAC_CLIENT_INFO (i.e. enforces client principal
canonicalization) with integrity check.

Only one exception is applied: this check is skipped for local TGTs on
domain where the MS-PAC generator is not initialized (i.e. domains where
SID generation was not executed yet).

Signed-off-by: Julien Rische <jrische@redhat.com>

2025-09-30 10:22:47 +02:00

..

dnssec

ipa-dnskeysyncd: use systemd-tmpfiles to handle tokens

2025-05-06 13:48:35 +02:00

ipa-kdb

ipa-kdb: enforce PAC presence on TGT for TGS-REQ

2025-09-30 10:22:47 +02:00

ipa-otpd

Fix some issues identified by a static analyzer

2025-05-27 10:24:09 +02:00

ipa-sam

ipasam: remove definitions which included from ndr_drsblobs.h

2025-09-19 13:45:16 +02:00

ipa-slapi-plugins

ipa-sidgen: fix memory leak in ipa_sidgen_add_post_op

2025-04-08 09:42:45 +02:00

ipa-version.h.in

Build: move version handling from Makefile to configure

2016-11-09 13:08:32 +01:00

Makefile.am

build: Unify compiler warning flags used

2021-01-15 14:11:56 +01:00