kdc: use ticket client name when signing PAC

The principal in the PAC_LOGON_NAME buffer is expected to match the client name
in the ticket. Previously we were setting this to the canonical client name,
which would have broken PAC validation if the client did not request name
canonicalization

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

[jsutton@samba.org Backported from Heimdal commit
 3b0856cab2b25624deb1f6e0e67637ba96a647ac
 - Renamed variable to avoid shadowing existing variable
]

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 75d1a7cd14b134506061ed64ddb9b99856231d2c)

diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c
index d1fd201113b403cfd36848141599384489fabe7e..6dc945b134a22cff540ef918b211368b4434ba61 100644 (file)
--- a/source4/heimdal/kdc/kerberos5.c
+++ b/source4/heimdal/kdc/kerberos5.c
@@ -1716,6 +1716,7 @@ _kdc_as_rep(krb5_context context,
        krb5_pac p = NULL;
        krb5_data data;
        uint16_t rodc_id;
+       krb5_principal client_pac;
 
        ret = _kdc_pac_generate(context, client, pk_reply_key, &p);
        if (ret) {
@@ -1726,12 +1727,21 @@ _kdc_as_rep(krb5_context context,
        if (p != NULL) {
            rodc_id = server->entry.kvno >> 16;
 
+           /* libkrb5 expects ticket and PAC client names to match */
+           ret = _krb5_principalname2krb5_principal(context, &client_pac,
+                                                    et.cname, et.crealm);
+           if (ret) {
+              krb5_pac_free(context, p);
+              goto out;
+           }
+
            ret = _krb5_pac_sign(context, p, et.authtime,
-                                client->entry.principal,
+                                client_pac,
                                 &skey->key, /* Server key */
                                 &skey->key, /* FIXME: should be krbtgt key */
                                 rodc_id,
                                 &data);
+           krb5_free_principal(context, client_pac);
            krb5_pac_free(context, p);
            if (ret) {
                kdc_log(context, config, 0, "PAC signing failed for -- %s",