s4-kdc: Add "Fresh Public Key Identity" SID if PKINIT freshness used

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Feb 28 04:45:48 UTC 2024 on atb-devel-224

diff --git a/selftest/knownfail.d/pkinit-freshness b/selftest/knownfail.d/pkinit-freshness
deleted file mode 100644 (file)
index 0df7bc7..0000000
--- a/selftest/knownfail.d/pkinit-freshness
+++ /dev/null
@@ -1,4 +0,0 @@
-^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_freshness\(ad_dc\)
-^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_freshness_current\(ad_dc\)
-^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_freshness_current_dh\(ad_dc\)
-^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_freshness_dh\(ad_dc\)

diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index 12465b7644dd6951ecaef692d10ef98596cde53d..58f089f4562829b05e1c732d32d6aa31fb8ee1ea 100644 (file)
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -824,6 +824,16 @@ NTSTATUS samba_kdc_add_claims_valid(struct auth_user_info_dc *user_info_dc)
                &user_info_dc->num_sids);
 }
 
+NTSTATUS samba_kdc_add_fresh_public_key_identity(struct auth_user_info_dc *user_info_dc)
+{
+       return add_sid_to_array_attrs_unique(
+               user_info_dc,
+               &global_sid_Fresh_Public_Key_Identity,
+               SE_GROUP_DEFAULT_FLAGS,
+               &user_info_dc->sids,
+               &user_info_dc->num_sids);
+}
+
 static NTSTATUS samba_kdc_add_compounded_auth(struct auth_user_info_dc *user_info_dc)
 {
        return add_sid_to_array_attrs_unique(

diff --git a/source4/kdc/pac-glue.h b/source4/kdc/pac-glue.h
index 1b4444a0aeb65594c3533300c642dfa7ad3761c2..aa022f7b00151ef93ccc1d99013f1d7764580edc 100644 (file)
--- a/source4/kdc/pac-glue.h
+++ b/source4/kdc/pac-glue.h
@@ -200,3 +200,4 @@ NTSTATUS samba_kdc_add_asserted_identity(enum samba_asserted_identity ai,
                                         struct auth_user_info_dc *user_info_dc);
 
 NTSTATUS samba_kdc_add_claims_valid(struct auth_user_info_dc *user_info_dc);
+NTSTATUS samba_kdc_add_fresh_public_key_identity(struct auth_user_info_dc *user_info_dc);

diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c
index dc2fffad2e435af7eeef6707e8084d544e95a1fe..d1653a36404c38f4d0b884144aa0341dfc8eec39 100644 (file)
--- a/source4/kdc/wdc-samba4.c
+++ b/source4/kdc/wdc-samba4.c
@@ -165,6 +165,16 @@ static krb5_error_code samba_wdc_get_pac(void *priv,
                return map_errno_from_nt_status(nt_status);
        }
 
+       if (kdc_request_get_pkinit_freshness_used(r)) {
+               nt_status = samba_kdc_add_fresh_public_key_identity(user_info_dc_shallow_copy);
+               if (!NT_STATUS_IS_OK(nt_status)) {
+                       DBG_ERR("Failed to add Fresh Public Key Identity: %s\n",
+                               nt_errstr(nt_status));
+                       talloc_free(mem_ctx);
+                       return map_errno_from_nt_status(nt_status);
+               }
+       }
+
        ret = samba_kdc_get_claims_data_from_db(server_entry->kdc_db_ctx->samdb,
                                                skdc_entry,
                                                &auth_claims.user_claims);