diff options
| author | Joseph Sutton <josephsutton@catalyst.net.nz> | 2023-10-05 16:07:55 +1300 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2023-10-12 23:13:32 +0000 |
| commit | 6228267cba64121d14747700b785cc4aa041b810 (patch) | |
| tree | 733ff1ac0eb102334548749a01ab1e6481307280 /source4 | |
| parent | 1e3c347985033fbb73f32097440427bb352baeea (diff) | |
| download | samba-6228267cba64121d14747700b785cc4aa041b810.tar.gz samba-6228267cba64121d14747700b785cc4aa041b810.tar.bz2 samba-6228267cba64121d14747700b785cc4aa041b810.zip | |
s4:kdc: Create the Requester SID blob only if we actually need it
View with ‘git show -b’.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/kdc/pac-glue.c | 32 |
1 files changed, 17 insertions, 15 deletions
diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c index d41ec9cd9eb..2e2f91ff9b5 100644 --- a/source4/kdc/pac-glue.c +++ b/source4/kdc/pac-glue.c @@ -2719,14 +2719,16 @@ krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx, goto done; } - nt_status = samba_kdc_get_requester_sid_blob(tmp_ctx, - user_info_dc_shallow_copy, - &requester_sid_blob); - if (!NT_STATUS_IS_OK(nt_status)) { - DBG_ERR("samba_kdc_get_requester_sid_blob failed: %s\n", - nt_errstr(nt_status)); - code = KRB5KDC_ERR_TGT_REVOKED; - goto done; + if (is_tgs) { + nt_status = samba_kdc_get_requester_sid_blob(tmp_ctx, + user_info_dc_shallow_copy, + &requester_sid_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_ERR("samba_kdc_get_requester_sid_blob failed: %s\n", + nt_errstr(nt_status)); + code = KRB5KDC_ERR_TGT_REVOKED; + goto done; + } } /* Don't trust RODC-issued claims. Regenerate them. */ @@ -2824,13 +2826,13 @@ krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx, if (!is_tgs) { pac_blobs_remove_blob(pac_blobs, PAC_TYPE_REQUESTER_SID); - } else { - code = pac_blobs_add_blob(pac_blobs, - PAC_TYPE_REQUESTER_SID, - requester_sid_blob); - if (code != 0) { - goto done; - } + } + + code = pac_blobs_add_blob(pac_blobs, + PAC_TYPE_REQUESTER_SID, + requester_sid_blob); + if (code != 0) { + goto done; } /* |