URL:
https://github.com/SSSD/sssd/pull/876
Author: jhrozek
Title: #876: KCM: Fill in pre-created ccache instead of creating a new one in
kcm_initialize
Action: opened
PR body:
"""
This is a continuation of
https://pagure.io/SSSD/sssd/issue/3873
Some programs like openssh use the following sequence of calls:
cc = krb5_cc_new_unique
krb5_cc_switch(cc)
krb5_cc_initialize(cc, principal)
Since switch changes the default ccache, we create a 'dummy' ccache with
krb5_cc_switch() and then the initialize call just fills in the details.
The 'fills in the details' part was not properly implemented with the previous
patchset, the previous patchset worked only for password-based authentication
where nothing is cached initially. For delegation, we watch to make sure
that the credentials that are being delegated are filled in to the new ccache
and the new ccache is used as the default.
What initialize did previously was that if there was a default ccache already
(in this case the dummy one created with krb5_cc_switch()), it would treat
it as obsolete, create a new one and switch to it. Then the client (openssh) would
store the credential in a ccache that wouldn't be the default anymore, leaving
the default ccache empty. Afterwards, klist or similar would see that the default
ccache is empty and just pick the first non-empty one as a fallback, which would
often be one of the previous expired ones.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/876/head:pr876
git checkout pr876