updated some comments (fcusack)

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@12009 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index 86978f3602a046c85c5551d455e66363d56c1a78..84fdb5213f9557033af56ff9b7ad51d38fb0baf3 100644 (file)
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -960,6 +960,12 @@ krb5_get_init_creds(context, creds, client, prompter, prompter_data,
     /* XXX if there's padata on output, something is wrong, but it's
        not obviously an error */
 
+    /* XXX For 1.1.1 and prior KDC's, when SAM is used w/ USE_SAD_AS_KEY,
+       the AS_REP comes back encrypted in the user's longterm key
+       instead of in the SAD. If there was a SAM preauth, there
+       will be an as_key here which will be the SAD. If that fails,
+       use the gak_fct to get the password, and try again. */
+      
     /* XXX because etypes are handled poorly (particularly wrt SAM,
        where the etype is fixed by the kdc), we may want to try
        decrypt_as_reply twice.  If there's an as_key available, try

diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c
index 5771170c333b817d89480dc1e4f6de515b60937e..94a22d396c954175e0a8920896772e62ffd2b527 100644 (file)
--- a/src/lib/krb5/krb/preauth2.c
+++ b/src/lib/krb5/krb/preauth2.c
@@ -105,11 +105,6 @@ krb5_error_code pa_enc_timestamp(krb5_context context,
     krb5_enc_data enc_data;
     krb5_pa_data *pa;
    
-    /*
-     * We need to use the password as part or all of the key.
-     * If as_key contains info, it should be the users pass phrase.
-     * If not, get the password before issuing the challenge.
-     */
     if (as_key->length == 0) {
        if (ret = ((*gak_fct)(context, request->client,
                             request->ktype[0], prompter, prompter_data,
@@ -316,7 +311,9 @@ krb5_error_code pa_sam(krb5_context context,
        salt = NULL;
 #endif
            
-       /* XXX the server uses this fixed enctype, so we will, too. */
+       /* XXX As of the passwords-04 draft, no enctype is specified,
+          the server uses ENCTYPE_DES_CBC_MD5. In the future the
+          server should send a PA-SAM-ETYPE-INFO containing the enctype. */
 
        ret = krb5_c_string_to_key(context, ENCTYPE_DES_CBC_MD5,
                                   &response_data, salt, as_key);