gssproxy

#172 Allow to establish context to self for impersonators
Merged by simo. Opened by simo.
simo/gssproxy target_check  into  master

Download 172.patch

Impersonators may need to establish context to themselves, usually to allow gssapi to get access to the ticket and export named attributes on the "client" name.
Given it is harmless to allow connections to self always allow it in the impersonator credential case.

Please don't push this yet, I figured out a simpler/better method to deal with this problem

rebased

Ok, I changed this PR to not require the admin to set krb5_principal to allow self, as that is error prone and did not account for keytabs with multiple keys. It also had side effects people may not ant to deal with again in case of keytabs with multiple keys.
Instead check who actually is the impersonator in the ticket and allow context establishment to that specific target whatever name it is.

It's not in 1.15. Please test a version that has it, and remove the reference here to 1.15. (At some point in the future after we check the version of krb5 in autotools, we can talk about removing the fallback entirely.)

The contents of this if block are candidates for being their own function.

I rebased to a version that should address all your comments.
I also tested with a krb5 version that implements the new call to test impersonator and it also works as expected.

2 new commits added

  • Allow connection to self when impersonator set
  • Change impersonator check code

Pushed to master as eada55e831d12b42d3be3a555ff4e133bed7f594

Pull-Request has been closed by rharwood

Commit 7299db1f fixes this pull-request

Pull-Request has been merged by simo@redhat.com

Commit eada55e8 fixes this pull-request

Pull-Request has been merged by simo@redhat.com

Commit 35307313 fixes this pull-request

Pull-Request has been merged by simo@redhat.com

Commit 73b50c0b fixes this pull-request

Pull-Request has been merged by simo@redhat.com
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.