[SSSD] [PATCH] krb5-child: add revert_changepw_options()

Sumit Bose sbose at redhat.com
Fri Mar 21 13:22:47 UTC 2014


Hi,

a recent patch unified the usage of the krb5_get_init_creds_opt options
to make sure the same set of FAST related options are uses for
authentication and password changes. Before changing the password some
options were set to special values but were not reverted before
requesting a new TGT with the new password. As a result the new TGT will
have some unexpected options set or the request might even fail.

This patch set resets the password change related option to their
original values before requesting the new TGT.

The first two patches are just refactorings which are required to keep
the third patch simple.

bye,
Sumit
-------------- next part --------------
From 72234e507d581424249bae166eedf1e334eb2e53 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 20 Mar 2014 18:39:48 +0100
Subject: [PATCH 1/3] krb5_child: remove unused option lifetime_str from
 k5c_setup_fast()

---
 src/providers/krb5/krb5_child.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 1bff0e9..b10ec88 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -1678,7 +1678,7 @@ static errno_t k5c_recv_data(struct krb5_req *kr, int fd, uint32_t *offline)
     return ret;
 }
 
-static int k5c_setup_fast(struct krb5_req *kr, char *lifetime_str, bool demand)
+static int k5c_setup_fast(struct krb5_req *kr, bool demand)
 {
     krb5_principal fast_princ_struct;
     krb5_data *realm_data;
@@ -1687,9 +1687,6 @@ static int k5c_setup_fast(struct krb5_req *kr, char *lifetime_str, bool demand)
     krb5_error_code kerr;
     char *tmp_str;
 
-    DEBUG(SSSDBG_CONF_SETTINGS, "%s is set to [%s]\n",
-                                 SSSD_KRB5_LIFETIME, lifetime_str);
-
     tmp_str = getenv(SSSD_KRB5_FAST_PRINCIPAL);
     if (tmp_str) {
         DEBUG(SSSDBG_CONF_SETTINGS, "%s is set to [%s]\n",
@@ -1885,9 +1882,9 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
         if (use_fast_str == NULL || strcasecmp(use_fast_str, "never") == 0) {
             DEBUG(SSSDBG_CONF_SETTINGS, "Not using FAST.\n");
         } else if (strcasecmp(use_fast_str, "try") == 0) {
-            kerr = k5c_setup_fast(kr, lifetime_str, false);
+            kerr = k5c_setup_fast(kr, false);
         } else if (strcasecmp(use_fast_str, "demand") == 0) {
-            kerr = k5c_setup_fast(kr, lifetime_str, true);
+            kerr = k5c_setup_fast(kr, true);
         } else {
             DEBUG(SSSDBG_CRIT_FAILURE,
                   "Unsupported value [%s] for krb5_use_fast.\n",
-- 
1.8.3.1

-------------- next part --------------
From 37b58b2c59b52f56a62895646c67e9ab550c8c1b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 21 Mar 2014 11:00:25 +0100
Subject: [PATCH 2/3] krb5-child: extract lifetime settings into
 set_lifetime_options()

---
 src/providers/krb5/krb5_child.c | 85 ++++++++++++++++++++++++-----------------
 1 file changed, 49 insertions(+), 36 deletions(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index b10ec88..ebfc4e1 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -65,6 +65,51 @@ struct krb5_req {
 static krb5_context krb5_error_ctx;
 #define KRB5_CHILD_DEBUG(level, error) KRB5_DEBUG(level, krb5_error_ctx, error)
 
+static krb5_error_code set_lifetime_options(krb5_get_init_creds_opt *options)
+{
+    char *lifetime_str;
+    krb5_error_code kerr;
+    krb5_deltat lifetime;
+
+    lifetime_str = getenv(SSSD_KRB5_RENEWABLE_LIFETIME);
+    if (lifetime_str == NULL) {
+        DEBUG(SSSDBG_CONF_SETTINGS, "Cannot read [%s] from environment.\n",
+              SSSD_KRB5_RENEWABLE_LIFETIME);
+    } else {
+        kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
+        if (kerr != 0) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "krb5_string_to_deltat failed for [%s].\n",
+                      lifetime_str);
+            KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
+            return kerr;
+        }
+        DEBUG(SSSDBG_CONF_SETTINGS, "%s is set to [%s]\n",
+              SSSD_KRB5_RENEWABLE_LIFETIME, lifetime_str);
+        krb5_get_init_creds_opt_set_renew_life(options, lifetime);
+    }
+
+    lifetime_str = getenv(SSSD_KRB5_LIFETIME);
+    if (lifetime_str == NULL) {
+        DEBUG(SSSDBG_CONF_SETTINGS, "Cannot read [%s] from environment.\n",
+              SSSD_KRB5_LIFETIME);
+    } else {
+        kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
+        if (kerr != 0) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "krb5_string_to_deltat failed for [%s].\n",
+                      lifetime_str);
+            KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
+            return kerr;
+        }
+        DEBUG(SSSDBG_CONF_SETTINGS,
+              "%s is set to [%s]\n", SSSD_KRB5_LIFETIME, lifetime_str);
+        krb5_get_init_creds_opt_set_tkt_life(options, lifetime);
+    }
+
+    return 0;
+}
+
 static void set_changepw_options(krb5_context ctx,
                                  krb5_get_init_creds_opt *options)
 {
@@ -1758,9 +1803,7 @@ static int k5c_setup_fast(struct krb5_req *kr, bool demand)
 static int k5c_setup(struct krb5_req *kr, uint32_t offline)
 {
     krb5_error_code kerr;
-    char *lifetime_str;
     char *use_fast_str;
-    krb5_deltat lifetime;
     int parse_flags;
 
     kr->realm = getenv(SSSD_KRB5_REALM);
@@ -1839,40 +1882,10 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
     krb5_get_init_creds_opt_set_change_password_prompt(kr->options, 0);
 #endif
 
-    lifetime_str = getenv(SSSD_KRB5_RENEWABLE_LIFETIME);
-    if (lifetime_str == NULL) {
-        DEBUG(SSSDBG_CONF_SETTINGS, "Cannot read [%s] from environment.\n",
-              SSSD_KRB5_RENEWABLE_LIFETIME);
-    } else {
-        kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
-        if (kerr != 0) {
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "krb5_string_to_deltat failed for [%s].\n",
-                      lifetime_str);
-            KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
-            return kerr;
-        }
-        DEBUG(SSSDBG_CONF_SETTINGS, "%s is set to [%s]\n",
-              SSSD_KRB5_RENEWABLE_LIFETIME, lifetime_str);
-        krb5_get_init_creds_opt_set_renew_life(kr->options, lifetime);
-    }
-
-    lifetime_str = getenv(SSSD_KRB5_LIFETIME);
-    if (lifetime_str == NULL) {
-        DEBUG(SSSDBG_CONF_SETTINGS, "Cannot read [%s] from environment.\n",
-              SSSD_KRB5_LIFETIME);
-    } else {
-        kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
-        if (kerr != 0) {
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "krb5_string_to_deltat failed for [%s].\n",
-                      lifetime_str);
-            KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
-            return kerr;
-        }
-        DEBUG(SSSDBG_CONF_SETTINGS,
-              "%s is set to [%s]\n", SSSD_KRB5_LIFETIME, lifetime_str);
-        krb5_get_init_creds_opt_set_tkt_life(kr->options, lifetime);
+    kerr = set_lifetime_options(kr->options);
+    if (kerr != 0) {
+        DEBUG(SSSDBG_OP_FAILURE, "set_lifetime_options failed.\n");
+        return kerr;
     }
 
     if (!offline) {
-- 
1.8.3.1

-------------- next part --------------
From 51e644335cafd44827156a2728d652aa04d6b44f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 21 Mar 2014 11:01:09 +0100
Subject: [PATCH 3/3] krb5-child: add revert_changepw_options()

After changing the Kerberos password krb5-child will try to get a fresh
TGT with the new password. This patch tires to make sure the right gic
options are used.

Resolves: https://fedorahosted.org/sssd/ticket/2289
---
 src/providers/krb5/krb5_child.c | 50 +++++++++++++++++++++++++++++------------
 1 file changed, 36 insertions(+), 14 deletions(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index ebfc4e1..e8f8126 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -110,6 +110,20 @@ static krb5_error_code set_lifetime_options(krb5_get_init_creds_opt *options)
     return 0;
 }
 
+static void krb5_set_canonicalize(krb5_get_init_creds_opt *opts)
+{
+    int canonicalize = 0;
+    char *tmp_str;
+
+    tmp_str = getenv(SSSD_KRB5_CANONICALIZE);
+    if (tmp_str != NULL && strcasecmp(tmp_str, "true") == 0) {
+        canonicalize = 1;
+    }
+    DEBUG(SSSDBG_CONF_SETTINGS, "%s is set to [%s]\n",
+          SSSD_KRB5_CANONICALIZE, tmp_str ? tmp_str : "not set");
+    sss_krb5_get_init_creds_opt_set_canonicalize(opts, canonicalize);
+}
+
 static void set_changepw_options(krb5_context ctx,
                                  krb5_get_init_creds_opt *options)
 {
@@ -120,6 +134,24 @@ static void set_changepw_options(krb5_context ctx,
     krb5_get_init_creds_opt_set_tkt_life(options, 5*60);
 }
 
+static void revert_changepw_options(krb5_get_init_creds_opt *options)
+{
+    krb5_error_code kerr;
+
+    krb5_set_canonicalize(options);
+
+    /* Currently we do not set forwardable and proxiable explicitly, the flags
+     * must be removed so that libkrb5 can take the defaults from krb5.conf */
+    options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_FORWARDABLE);
+    options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_PROXIABLE);
+
+    kerr = set_lifetime_options(options);
+    if (kerr != 0) {
+        DEBUG(SSSDBG_OP_FAILURE, "set_lifetime_options failed.\n");
+    }
+}
+
+
 static errno_t sss_send_pac(krb5_authdata **pac_authdata)
 {
     struct sss_cli_req_data sss_data;
@@ -870,20 +902,6 @@ done:
 
 }
 
-static void krb5_set_canonicalize(krb5_get_init_creds_opt *opts)
-{
-    int canonicalize = 0;
-    char *tmp_str;
-
-    tmp_str = getenv(SSSD_KRB5_CANONICALIZE);
-    if (tmp_str != NULL && strcasecmp(tmp_str, "true") == 0) {
-        canonicalize = 1;
-    }
-    DEBUG(SSSDBG_CONF_SETTINGS, "%s is set to [%s]\n",
-          SSSD_KRB5_CANONICALIZE, tmp_str ? tmp_str : "not set");
-    sss_krb5_get_init_creds_opt_set_canonicalize(opts, canonicalize);
-}
-
 static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx,
                                                     krb5_principal princ,
                                                     krb5_keytab keytab,
@@ -1190,6 +1208,10 @@ static errno_t changepw_child(struct krb5_req *kr, bool prelim)
 
     krb5_free_cred_contents(kr->ctx, kr->creds);
 
+    /* We changed some of the gic options for the password change, now we have
+     * to change them back to get a fresh TGT. */
+    revert_changepw_options(kr->options);
+
     kerr = get_and_save_tgt(kr, newpassword);
 
     sss_authtok_set_empty(kr->pd->newauthtok);
-- 
1.8.3.1

-------------- next part --------------
From 962d946a346b7fda5e19b924fc63c1a6753261c9 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 20 Mar 2014 18:39:48 +0100
Subject: [PATCH 1/3] krb5_child: remove unused option lifetime_str from
 k5c_setup_fast()

---
 src/providers/krb5/krb5_child.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index b268c86..6c38ec6 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -1667,7 +1667,7 @@ static errno_t k5c_recv_data(struct krb5_req *kr, int fd, uint32_t *offline)
     return ret;
 }
 
-static int k5c_setup_fast(struct krb5_req *kr, char *lifetime_str, bool demand)
+static int k5c_setup_fast(struct krb5_req *kr, bool demand)
 {
     krb5_principal fast_princ_struct;
     krb5_data *realm_data;
@@ -1676,9 +1676,6 @@ static int k5c_setup_fast(struct krb5_req *kr, char *lifetime_str, bool demand)
     krb5_error_code kerr;
     char *tmp_str;
 
-    DEBUG(SSSDBG_CONF_SETTINGS, ("%s is set to [%s]\n",
-                                 SSSD_KRB5_LIFETIME, lifetime_str));
-
     tmp_str = getenv(SSSD_KRB5_FAST_PRINCIPAL);
     if (tmp_str) {
         DEBUG(SSSDBG_CONF_SETTINGS, ("%s is set to [%s]\n",
@@ -1870,9 +1867,9 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
         if (use_fast_str == NULL || strcasecmp(use_fast_str, "never") == 0) {
             DEBUG(SSSDBG_CONF_SETTINGS, ("Not using FAST.\n"));
         } else if (strcasecmp(use_fast_str, "try") == 0) {
-            kerr = k5c_setup_fast(kr, lifetime_str, false);
+            kerr = k5c_setup_fast(kr, false);
         } else if (strcasecmp(use_fast_str, "demand") == 0) {
-            kerr = k5c_setup_fast(kr, lifetime_str, true);
+            kerr = k5c_setup_fast(kr, true);
         } else {
             DEBUG(SSSDBG_CRIT_FAILURE,
                   ("Unsupported value [%s] for krb5_use_fast.\n",
-- 
1.8.3.1

-------------- next part --------------
From c1b5ad11bdb2aa6f24f4dbe8fa7c3d1e7241f91b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 21 Mar 2014 12:14:11 +0100
Subject: [PATCH 2/3] krb5-child: extract lifetime settings into
 set_lifetime_options()

---
 src/providers/krb5/krb5_child.c | 83 ++++++++++++++++++++++++-----------------
 1 file changed, 49 insertions(+), 34 deletions(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 6c38ec6..dc9990f 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -65,6 +65,51 @@ struct krb5_req {
 static krb5_context krb5_error_ctx;
 #define KRB5_CHILD_DEBUG(level, error) KRB5_DEBUG(level, krb5_error_ctx, error)
 
+static krb5_error_code set_lifetime_options(krb5_get_init_creds_opt *options)
+{
+    char *lifetime_str;
+    krb5_error_code kerr;
+    krb5_deltat lifetime;
+
+    lifetime_str = getenv(SSSD_KRB5_RENEWABLE_LIFETIME);
+    if (lifetime_str == NULL) {
+        DEBUG(SSSDBG_CONF_SETTINGS, ("Cannot read [%s] from environment.\n",
+              SSSD_KRB5_RENEWABLE_LIFETIME));
+    } else {
+        kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
+        if (kerr != 0) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  ("krb5_string_to_deltat failed for [%s].\n",
+                      lifetime_str));
+            KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
+            return kerr;
+        }
+        DEBUG(SSSDBG_CONF_SETTINGS, ("%s is set to [%s]\n",
+              SSSD_KRB5_RENEWABLE_LIFETIME, lifetime_str));
+        krb5_get_init_creds_opt_set_renew_life(options, lifetime);
+    }
+
+    lifetime_str = getenv(SSSD_KRB5_LIFETIME);
+    if (lifetime_str == NULL) {
+        DEBUG(SSSDBG_CONF_SETTINGS, ("Cannot read [%s] from environment.\n",
+              SSSD_KRB5_LIFETIME));
+    } else {
+        kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
+        if (kerr != 0) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  ("krb5_string_to_deltat failed for [%s].\n",
+                      lifetime_str));
+            KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
+            return kerr;
+        }
+        DEBUG(SSSDBG_CONF_SETTINGS,
+              ("%s is set to [%s]\n", SSSD_KRB5_LIFETIME, lifetime_str));
+        krb5_get_init_creds_opt_set_tkt_life(options, lifetime);
+    }
+
+    return 0;
+}
+
 static void set_changepw_options(krb5_context ctx,
                                  krb5_get_init_creds_opt *options)
 {
@@ -1745,9 +1790,7 @@ static int k5c_setup_fast(struct krb5_req *kr, bool demand)
 static int k5c_setup(struct krb5_req *kr, uint32_t offline)
 {
     krb5_error_code kerr;
-    char *lifetime_str;
     char *use_fast_str;
-    krb5_deltat lifetime;
     int parse_flags;
 
     kr->realm = getenv(SSSD_KRB5_REALM);
@@ -1826,38 +1869,10 @@ static int k5c_setup(struct krb5_req *kr, uint32_t offline)
     krb5_get_init_creds_opt_set_change_password_prompt(kr->options, 0);
 #endif
 
-    lifetime_str = getenv(SSSD_KRB5_RENEWABLE_LIFETIME);
-    if (lifetime_str == NULL) {
-        DEBUG(SSSDBG_CONF_SETTINGS, ("Cannot read [%s] from environment.\n",
-              SSSD_KRB5_RENEWABLE_LIFETIME));
-    } else {
-        kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
-        if (kerr != 0) {
-            DEBUG(1, ("krb5_string_to_deltat failed for [%s].\n",
-                      lifetime_str));
-            KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
-            return kerr;
-        }
-        DEBUG(SSSDBG_CONF_SETTINGS, ("%s is set to [%s]\n",
-              SSSD_KRB5_RENEWABLE_LIFETIME, lifetime_str));
-        krb5_get_init_creds_opt_set_renew_life(kr->options, lifetime);
-    }
-
-    lifetime_str = getenv(SSSD_KRB5_LIFETIME);
-    if (lifetime_str == NULL) {
-        DEBUG(SSSDBG_CONF_SETTINGS, ("Cannot read [%s] from environment.\n",
-              SSSD_KRB5_LIFETIME));
-    } else {
-        kerr = krb5_string_to_deltat(lifetime_str, &lifetime);
-        if (kerr != 0) {
-            DEBUG(1, ("krb5_string_to_deltat failed for [%s].\n",
-                      lifetime_str));
-            KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
-            return kerr;
-        }
-        DEBUG(SSSDBG_CONF_SETTINGS,
-              ("%s is set to [%s]\n", SSSD_KRB5_LIFETIME, lifetime_str));
-        krb5_get_init_creds_opt_set_tkt_life(kr->options, lifetime);
+    kerr = set_lifetime_options(kr->options);
+    if (kerr != 0) {
+        DEBUG(SSSDBG_OP_FAILURE, ("set_lifetime_options failed.\n"));
+        return kerr;
     }
 
     if (!offline) {
-- 
1.8.3.1

-------------- next part --------------
From fc4e89d12c0947f18a26d382436ceb03ec5c353b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 21 Mar 2014 11:01:09 +0100
Subject: [PATCH 3/3] krb5-child: add revert_changepw_options()

After changing the Kerberos password krb5-child will try to get a fresh
TGT with the new password. This patch tires to make sure the right gic
options are used.

Resolves: https://fedorahosted.org/sssd/ticket/2289
---
 src/providers/krb5/krb5_child.c | 50 +++++++++++++++++++++++++++++------------
 1 file changed, 36 insertions(+), 14 deletions(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index dc9990f..2dbb902 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -110,6 +110,20 @@ static krb5_error_code set_lifetime_options(krb5_get_init_creds_opt *options)
     return 0;
 }
 
+static void krb5_set_canonicalize(krb5_get_init_creds_opt *opts)
+{
+    int canonicalize = 0;
+    char *tmp_str;
+
+    tmp_str = getenv(SSSD_KRB5_CANONICALIZE);
+    if (tmp_str != NULL && strcasecmp(tmp_str, "true") == 0) {
+        canonicalize = 1;
+    }
+    DEBUG(SSSDBG_CONF_SETTINGS, ("%s is set to [%s]\n",
+          SSSD_KRB5_CANONICALIZE, tmp_str ? tmp_str : "not set"));
+    sss_krb5_get_init_creds_opt_set_canonicalize(opts, canonicalize);
+}
+
 static void set_changepw_options(krb5_context ctx,
                                  krb5_get_init_creds_opt *options)
 {
@@ -120,6 +134,24 @@ static void set_changepw_options(krb5_context ctx,
     krb5_get_init_creds_opt_set_tkt_life(options, 5*60);
 }
 
+static void revert_changepw_options(krb5_get_init_creds_opt *options)
+{
+    krb5_error_code kerr;
+
+    krb5_set_canonicalize(options);
+
+    /* Currently we do not set forwardable and proxiable explicitly, the flags
+     * must be removed so that libkrb5 can take the defaults from krb5.conf */
+    options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_FORWARDABLE);
+    options->flags &= ~(KRB5_GET_INIT_CREDS_OPT_PROXIABLE);
+
+    kerr = set_lifetime_options(options);
+    if (kerr != 0) {
+        DEBUG(SSSDBG_OP_FAILURE, ("set_lifetime_options failed.\n"));
+    }
+}
+
+
 static errno_t sss_send_pac(krb5_authdata **pac_authdata)
 {
     struct sss_cli_req_data sss_data;
@@ -869,20 +901,6 @@ done:
 
 }
 
-static void krb5_set_canonicalize(krb5_get_init_creds_opt *opts)
-{
-    int canonicalize = 0;
-    char *tmp_str;
-
-    tmp_str = getenv(SSSD_KRB5_CANONICALIZE);
-    if (tmp_str != NULL && strcasecmp(tmp_str, "true") == 0) {
-        canonicalize = 1;
-    }
-    DEBUG(SSSDBG_CONF_SETTINGS, ("%s is set to [%s]\n",
-          SSSD_KRB5_CANONICALIZE, tmp_str ? tmp_str : "not set"));
-    sss_krb5_get_init_creds_opt_set_canonicalize(opts, canonicalize);
-}
-
 static krb5_error_code get_and_save_tgt_with_keytab(krb5_context ctx,
                                                     krb5_principal princ,
                                                     krb5_keytab keytab,
@@ -1181,6 +1199,10 @@ static errno_t changepw_child(struct krb5_req *kr, bool prelim)
 
     krb5_free_cred_contents(kr->ctx, kr->creds);
 
+    /* We changed some of the gic options for the password change, now we have
+     * to change them back to get a fresh TGT. */
+    revert_changepw_options(kr->options);
+
     kerr = get_and_save_tgt(kr, newpassword);
 
     sss_authtok_set_empty(kr->pd->newauthtok);
-- 
1.8.3.1



More information about the sssd-devel mailing list