From 2c3e42ca5d7bd43864cb105a3adfd286857350f8 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 5 Feb 2020 10:47:13 +0200 Subject: [PATCH] Make sure PAC is added as a first AD record in the ticket FreeIPA 4.8.4 started adding authentication indicators for its users with pre-authentication done using SPAKE, OTP, or FAST-wrapped methods. At the same time, FreeIPA users get PAC added if their configuration contains SID (ipaNTSecurityIdentifier) and POSIX properties at the same time. Current KDC logic adds CAMMAC record before PAC if authentication indicators were returned by any of pre-authentication modules. Windows systems expect that PAC is the first AD record in the ticket and otherwise reject authorization (authentication passes just fine). Fixes: https://pagure.io/freeipa/issue/8185 --- src/kdc/kdc_authdata.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c index 1b067cb0b..85e363d02 100644 --- a/src/kdc/kdc_authdata.c +++ b/src/kdc/kdc_authdata.c @@ -866,6 +866,15 @@ handle_authdata(krb5_context context, unsigned int flags, return ret; } + if (!isflagset(enc_tkt_reply->flags, TKT_FLG_ANONYMOUS)) { + /* Fetch authdata from the KDB if appropriate. */ + ret = fetch_kdb_authdata(context, flags, client, server, header_server, + client_key, server_key, header_key, req, + for_user_princ, enc_tkt_req, enc_tkt_reply); + if (ret) + return ret; + } + /* Add auth indicators if any were given. */ if (auth_indicators != NULL && *auth_indicators != NULL && !isflagset(server->attributes, KRB5_KDB_NO_AUTH_DATA_REQUIRED)) { @@ -876,13 +885,6 @@ handle_authdata(krb5_context context, unsigned int flags, } if (!isflagset(enc_tkt_reply->flags, TKT_FLG_ANONYMOUS)) { - /* Fetch authdata from the KDB if appropriate. */ - ret = fetch_kdb_authdata(context, flags, client, server, header_server, - client_key, server_key, header_key, req, - for_user_princ, enc_tkt_req, enc_tkt_reply); - if (ret) - return ret; - /* Validate and insert AD-SIGNTICKET authdata. This must happen last * since it contains a signature over the other authdata. */ ret = handle_signticket(context, flags, client, server, local_tgt, -- 2.24.1