URL:
https://github.com/SSSD/sssd/pull/5661
Author: sumit-bose
Title: #5661: pam: change default for pam_response_filter
Action: opened
PR body:
"""
So far pam_response_filter didn't had any default. It turned out that it
would be useful to filter the environment variable KRB5CCANME by default
for sudo. The reason is the e.g. in contrast to su the calling user is
authenticated and hence only the Kerberos credentials of the calling user
are available. But this causes a couple of inconsistencies. E.g. depending
on the credential cache type the target user might not have access to the
credential cache and even if the credential cache can be accessed it will
contain credentials which different privileges than the target user. As a
result it seems better to not make KRB5CCANME in the environment of the
target user and let him pick the matching default credential cache.
Resolves:
https://github.com/SSSD/sssd/issues/5660
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/5661/head:pr5661
git checkout pr5661