SPLIT require explicit ccache

diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index fbf4cb483e0e9d3ce87d33de7bda77b184c04d60..5a5e86d74a30e4db63f6dc137f61062bc6791ece 100644 (file)
--- a/lib/krb5_wrap/krb5_samba.c
+++ b/lib/krb5_wrap/krb5_samba.c
@@ -3985,6 +3985,14 @@ int ads_krb5_cli_get_ticket(TALLOC_CTX *mem_ctx,
                ENCTYPE_NULL};
        bool ok;
 
+       if (ccname == NULL) {
+               DBG_ERR("No explicit ccache given for service [%s], "
+                       "impersonating [%s]\n",
+                       principal, impersonate_princ_s);
+               retval = EINVAL;
+               goto failed;
+       }
+
        DBG_DEBUG("Getting ticket for service [%s] using creds from [%s] "
                  "and impersonating [%s]\n",
                  principal, ccname, impersonate_princ_s);
@@ -4000,9 +4008,7 @@ int ads_krb5_cli_get_ticket(TALLOC_CTX *mem_ctx,
                krb5_set_real_time(context, time(NULL) + time_offset, 0);
        }
 
-       retval = krb5_cc_resolve(context,
-                                ccname ? ccname : krb5_cc_default_name(context),
-                                &ccdef);
+       retval = krb5_cc_resolve(context, ccname, &ccdef);
        if (retval != 0) {
                DBG_WARNING("krb5_cc_default failed (%s)\n",
                            error_message(retval));

diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c
index 951267c558575389e200d5b763f69ef85de0958c..6f68c3a9ff9934d7c04c3d92d877e344b5357094 100644 (file)
--- a/source3/libads/kerberos.c
+++ b/source3/libads/kerberos.c
@@ -131,6 +131,14 @@ int kerberos_kinit_password_ext(const char *given_principal,
 
        ZERO_STRUCT(my_creds);
 
+       if (cache_name == NULL) {
+               DBG_DEBUG("Missing ccache for [%s] and config [%s]\n",
+                         given_principal,
+                         getenv("KRB5_CONFIG"));
+               TALLOC_FREE(frame);
+               return EINVAL;
+       }
+
        code = smb_krb5_init_context_common(&ctx);
        if (code != 0) {
                DBG_ERR("kerberos init context failed (%s)\n",
@@ -145,10 +153,10 @@ int kerberos_kinit_password_ext(const char *given_principal,
 
        DBG_DEBUG("as %s using [%s] as ccache and config [%s]\n",
                  given_principal,
-                 cache_name ? cache_name: krb5_cc_default_name(ctx),
+                 cache_name,
                  getenv("KRB5_CONFIG"));
 
-       if ((code = krb5_cc_resolve(ctx, cache_name ? cache_name : krb5_cc_default_name(ctx), &cc))) {
+       if ((code = krb5_cc_resolve(ctx, cache_name, &cc))) {
                goto out;
        }
 

diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
index 75c9671fd00e5cb7268fadaa01a697652b9a4387..a8ee9e6ec4427bb0ffb75a5eb53a9c5fc62920bb 100644 (file)
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -288,7 +288,8 @@ static NTSTATUS gse_init_client(struct gensec_security *gensec_security,
        }
 
        if (ccache_name == NULL) {
-               ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
+               DBG_WARNING("No explicit ccache_name given\n");
+               return NT_STATUS_INTERNAL_ERROR;
        }
 
        k5ret = krb5_cc_resolve(gse_ctx->k5ctx,