[19222] in Kerberos_V5_Development
Re: Ticket #8152 gss_acquire_cred_with_password() ignores expired
daemon@ATHENA.MIT.EDU (Benjamin Kaduk)
Sat Jun 20 18:01:23 2015
Date: Sat, 20 Jun 2015 18:01:09 -0400 (EDT)
From: Benjamin Kaduk <kaduk@mit.edu>
To: Sorin Manolache <sorinm@gmail.com>
In-Reply-To: <5585A520.3060707@gmail.com>
Message-ID: <alpine.GSO.1.10.1506201759020.22210@multics.mit.edu>
MIME-Version: 1.0
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Sat, 20 Jun 2015, Sorin Manolache wrote:
> Thank you for the information. However I didn't get how you intend to
> change the behaviour.
>
> The ticket mentions checking with Heimdal. Here's what I could
> understand from the Heimdal code:
>
> It traverses all caches (krb5_cc_cache_match) in order to match the
> principal.
> if found => link the found cache to the cred
> If not found => checks if the principal of the dflt cache matches
> if not => fetch creds from KDC, create a new unique memory cache,
> store the creds there, link the new cache to the gss_cred structure. The
> destroy_cache_on_release flag is set on the gss_cred structure.
> if yes => link the dflt cache to the cred.
>
> So newly fetched creds are not stored in the default cache. They are
> stored in a new memory cache that is destroyed when the gss_cred_id_t is
> released.
>
> Because the newly created cache is destroyed when the gss_cred is
> released, a new invocation of gss_acquire_cred_with_password will fetch
> the credentials again from the KDC.
>
> One would benefit of the cache only if the principal of the default
> cache matches the principal of the gss_acquire_cred_with_password.
>
> Heimdal does not fetch new credentials from the KDC when the cache
> contains expired credentials.
The proposed change will result in gss_acquire_cred_with_password() never
using cached credentials, and always fetching new credentials from the
KDC. The motivation is that the routine can be used to implement
password-checking functionality, and using cached credentials could allow
an incorrect password to be erroneously accepted.
-Ben
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
