s4:heimdal Allow KRB5_NT_ENTERPRISE names in all DB lookups

[metze/samba/wip.git] / source4 / heimdal / kdc / misc.c

diff --git a/source4/heimdal/kdc/misc.c b/source4/heimdal/kdc/misc.c
index 0c64dd568eb9ffa69fcb94678f277ea89a1cba54..247cb575de0eed7acfa16aa1e25d7ba7abadbcd3 100644 (file)
--- a/source4/heimdal/kdc/misc.c
+++ b/source4/heimdal/kdc/misc.c
@@ -1,34 +1,34 @@
 /*
- * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden). 
- * All rights reserved. 
+ * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
  *
- * Redistribution and use in source and binary forms, with or without 
- * modification, are permitted provided that the following conditions 
- * are met: 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
  *
- * 1. Redistributions of source code must retain the above copyright 
- *    notice, this list of conditions and the following disclaimer. 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
  *
- * 2. Redistributions in binary form must reproduce the above copyright 
- *    notice, this list of conditions and the following disclaimer in the 
- *    documentation and/or other materials provided with the distribution. 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * 3. Neither the name of the Institute nor the names of its contributors 
- *    may be used to endorse or promote products derived from this software 
- *    without specific prior written permission. 
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
- * SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
 #include "kdc_locl.h"
@@ -56,17 +56,39 @@ _kdc_db_fetch(krb5_context context,
     }
 
     for(i = 0; i < config->num_db; i++) {
+       krb5_principal enterprise_principal = NULL;
+       if (!(config->db[i]->hdb_capability_flags & HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL) 
+           && principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
+           if (principal->name.name_string.len != 1) {
+               ret = KRB5_PARSE_MALFORMED;
+               krb5_set_error_message(context, ret,
+                                      "malformed request: "
+                                      "enterprise name with %d name components",
+                                      principal->name.name_string.len);
+               return ret;
+           }
+           ret = krb5_parse_name(context, principal->name.name_string.val[0],
+                                 &enterprise_principal);
+           if (ret)
+               return ret;
+
+           principal = enterprise_principal;
+       }
+
        ret = config->db[i]->hdb_open(context, config->db[i], O_RDONLY, 0);
        if (ret) {
-           kdc_log(context, config, 0, "Failed to open database: %s", 
+           kdc_log(context, config, 0, "Failed to open database: %s",
                    krb5_get_err_text(context, ret));
            continue;
        }
-       ret = config->db[i]->hdb_fetch(context, 
+
+       ret = config->db[i]->hdb_fetch(context,
                                       config->db[i],
                                       principal,
                                       flags | HDB_F_DECRYPT,
                                       ent);
+       krb5_free_principal(context, enterprise_principal);
+
        config->db[i]->hdb_close(context, config->db[i]);
        if(ret == 0) {
            if (db)
@@ -116,7 +138,7 @@ _kdc_get_preferred_key(krb5_context context,
        }
     }
 
-    krb5_set_error_message(context, EINVAL, 
+    krb5_set_error_message(context, EINVAL,
                           "No valid kerberos key found for %s", name);
     return EINVAL;
 }