Attachment 149335 Details for Bug 231136 – new option "prefer_2b"

[patch] new option "prefer_2b"

pam_krb5-prefer_2b.patch (text/plain), 2.45 KB, created by Jan Iven on 2007-03-06 14:11:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Iven

Created: 2007-03-06 14:11:55 UTC

Size: 2.45 KB

patch

obsolete

>New private option "prefer_2b":
>
>Even with Kerberos IV-support enabled, still try to use the 2b-style
>service tickets based on KerberosV instead of using the
>KerberosIV-based ones. Saves a few more attempts for nonexisting
>principals on the server.
>
>This is the equivalent of giving "-5" to the afs5log command.
>
>
>--- src/options.c~	2006-10-20 17:25:08.000000000 +0200
>+++ src/options.c	2007-03-02 16:09:23.000000000 +0100
>@@ -445,6 +445,19 @@
> 	}
> 
> 	/* private option */
>+	options->prefer_2b = option_b(pamh, argc, argv,
>+					ctx, options->realm, "prefer_2b");
>+	if (options->prefer_2b == -1) {
>+		options->prefer_2b = 0;
>+	}
>+	if (options->debug && options->prefer_2b == 1) {
>+		debug("flag: prefer_2b");
>+	}
>+	if (options->debug && options->prefer_2b == 0) {
>+		debug("flag: no prefer_2b");
>+	}
>+
>+	/* private option */
> 	options->use_first_pass = 1;
> 	options->use_second_pass = 1;
> 	use_first_pass = option_b(pamh, argc, argv,
>--- src/options.h~	2006-10-20 17:25:08.000000000 +0200
>+++ src/options.h	2007-03-02 16:06:51.000000000 +0100
>@@ -56,6 +56,7 @@
> 	int v4_for_afs;
> 	int v4_use_524;
> 	int v4_use_as_req;
>+	int prefer_2b;
> 	int warn;
> 
> 	krb5_deltat ticket_lifetime;
>--- src/pam_krb5.8.in~	2006-10-20 17:25:08.000000000 +0200
>+++ src/pam_krb5.8.in	2007-03-02 16:06:10.000000000 +0100
>@@ -139,6 +139,11 @@
> have an encrypted connection with its client in order to avoid allowing the
> user's password to be eavesdropped.
> 
>+.IP prefer_2b
>+tells pam_krb5.so to prefer the 2b-style (Kerberos V-based) AFS credentials,
>+instead of using Kerberos IV credentials for AFS. Kerberos IV credentials can
>+still be obtained, but won't be used for the AFS token conversion.
>+
> .IP proxiable
> tells pam_krb5.so that credentials it obtains should be proxiable.  This
> option is deprecated in favor of the \fIproxiable\fR option in the
>--- src/tokens.c~	2006-03-29 23:02:08.000000000 +0200
>+++ src/tokens.c	2007-03-02 16:02:10.000000000 +0100
>@@ -128,8 +128,9 @@
> 
> 	/* If options say we should neither use the 524 service nor contact the
> 	 * KDC to get v4 creds, then we need to try to use 2b-style tokens,
>-	 * because we'll never get v4-formatted credentials for use with AFS. */
>-	use_2b = (!options->v4_use_524) && (!options->v4_use_as_req);
>+	 * because we'll never get v4-formatted credentials for use with AFS.
>+	   But the admin can choose to always use 2b even with v4. */
>+	use_2b = (options->prefer_2b) || (!options->v4_use_524) && (!options->v4_use_as_req);
> #ifndef USE_KRB4
> 	use_2b = 1;
> #endif

Actions: View | Diff

Attachments on bug 231136: 149335