Alexander Bokovoy
0c32ebf858
When PAC check is performed, we might get a signing TGT instead of the client DB entry. This means it is a principal from a trusted domain but we don't know which one exactly because we only have a krbtgt for the forest root. This happens in MIT Kerberos 1.20 or later where KDB's issue_pac() callback never gets the original client principal directly. Look into known child domains as well and make pass the check if both NetBIOS name and SID correspond to one of the trusted domains under this forest root. Move check for the SID before NetBIOS name check because we can use SID of the domain in PAC to find out the right child domain in our trusted domains' topology list. Fixes: https://pagure.io/freeipa/issue/9316 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This is the ipa krb5kdc database backend. As the KDB interfaces heavily with krb5, we inherit its code style as well. However, note the following changes: - no modelines (and different file preamble) - return types don't require their own line - single-statement blocks may optionally be braced - /* and */ do not ever get their own line - C99 for-loops are permitted (and encouraged) - a restricted set of other C99 features are permitted In particular, variable-length arrays, flexible array members, compound literals, universal character names, and //-style comments are not permitted. Use of regular malloc/free is preferred over talloc for new code. By and large, existing code mostly conforms to these requirements. New code must conform to them.