From 6c6fc7db61d83e01a4913d22dfb178af43d30d8b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 29 May 2022 18:33:58 +0300 Subject: [PATCH] ipa-kdb: avoid additional checks for a well-known anonymous principal For a well-known anonymous principal an Anonymous PKINIT method is used which ignores the password set in the principal entry. For these principals any defined user auth type is irrelevant, their use is defined in RFC 6112. This gets confusing when a default user auth type requires a particular authentication method. When AS request for Anonymous PKINIT is used, a TGT would contain no authentication indicator. It means we cannot apply any specific indicator policy and must skip the checks. Fixes: https://pagure.io/freeipa/issue/9165 Signed-off-by: Alexander Bokovoy Reviewed-By: Florence Blanc-Renaud --- daemons/ipa-kdb/ipa_kdb_kdcpolicy.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c index fa0c5cd37..f2804c9b2 100644 --- a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c +++ b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c @@ -89,8 +89,9 @@ ipa_kdcpolicy_check_as(krb5_context context, krb5_kdcpolicy_moddata moddata, ua = ied->user_auth; - /* If no mechanisms are set, allow every auth method */ - if (ua == IPADB_USER_AUTH_NONE) { + /* If no mechanisms are set, or it is anonymous PKINIT, allow every auth method */ + if ((ua == IPADB_USER_AUTH_NONE) || + (request->kdc_options & KDC_OPT_REQUEST_ANONYMOUS)) { jitter(ONE_DAY_SECONDS, lifetime_out); kerr = 0; goto done;