URL:
https://github.com/SSSD/sssd/pull/616
Title: #616: become_user: add supplementary groups so ad provider can access keytab
asheplyakov commented:
"""
become_user() is also used in krb5_child to switch to the user trying
to log in to create the ccache with the right permissions.
Yep, calling initgroups in this context is indeed inappropriate. What about adding a new
function `become_user_ext`, which adds supplementary groups, and using it where
appropriate, for instance, in
[
server_setup](https://github.com/SSSD/sssd/blob/519354d079731e673244a8e38...
and
[
data_provider_be.c:main](https://github.com/SSSD/sssd/blob/1038473e1c9775...
"""
See the full comment at
https://github.com/SSSD/sssd/pull/616#issuecomment-405041095