#1906 Investigate the check for principal equality in krb5_auth.c
Closed: Invalid None Opened 10 years ago by jhrozek.

The Kerberos authentication code checks if the principal the krb5_child returns is the same as the authentication code would expect, typically in the form of user@REALM. However, this may break in cases enterprise principals are used. The current code works around the check by only enabling it when the enterprise principals are off, but we should investigate a better way.


Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.10 beta
rhbz: => 0

Fields changed

milestone: SSSD 1.10 beta => SSSD 1.10.0

Fields changed

milestone: SSSD 1.10.0 => SSSD 1.10.1

Moving tickets that didn't make 1.10.1 to the 1.10.2 bucket.

Moving tickets that didn't make 1.10.1 to 1.10.2

milestone: SSSD 1.10.1 => SSSD 1.10.2

The check was amended in several patches including b2d7810 or 42084c0. We are not aware of any other issues related to the check for UPN correctness, so it's OK to close this ticket.

changelog: =>
resolution: => worksforme
status: new => closed

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.10.2

7 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/2948

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.

Metadata