"Markus Moeller" <[EMAIL PROTECTED]> writes:
> find attached a patch which allows to compile pam-krb5 against IBM's NAS
> libraries (which are based on MIT 1.4.x) . Unfortunatly IBM doesn't seem to
> export the profile calls, so I included them into options.c. I didn't
> update configure.in yet. I only changed in configure the KRB5EXTRA statement
> - KRB5EXTRA="-lk5crypto -lcom_err"
> + KRB5EXTRA="-lk5profile -lksvc"
Is there some specific function I should look for in ksvc to see whether
or not I need that library? (What function wasn't found without it?)
> diff -w -B -r -u -N pam-krb5-3.9/api-auth.c pam-krb5-3.9-aix/api-auth.c
> --- pam-krb5-3.9/api-auth.c 2007-12-25 14:37:27.000000000 +0000
> +++ pam-krb5-3.9-aix/api-auth.c 2007-12-05 15:41:50.000000000 +0000
> @@ -27,6 +27,9 @@
> # include <pam/pam_modules.h>
> #endif
> #include <stdio.h>
> +#ifdef _AIX
> +extern int snprintf(char *__restrict__, size_t, const char *__restrict__,
> ...);
> +#endif
Why was this needed? Do I maybe need to add the Autoconf logic to define
_ALL_SOURCE instead so that I can get the native AIX prototype? I was
hoping AIX wouldn't need that by now.
> --- pam-krb5-3.9/options.c 2007-11-13 00:20:39.000000000 +0000
> +++ pam-krb5-3.9-aix/options.c 2007-12-13 13:34:05.000000000 +0000
[...]
> +void KRB5_CALLCONV
> +krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *opt)
> +{
> + opt->flags = 0;
> +}
AIX provides the functions for verifying initial creds and the struct, but
doesn't provide the initialization function?
> + if (realmstr) {
> + names[2] = realmstr;
> + names[3] = option;
> + names[4] = 0;
> + retval = profile_get_values(profile, names, &nameval);
> + if (retval == 0 && nameval && nameval[0]) {
> + *ret_value = strdup(nameval[0]);
> + goto goodbye;
> + }
> + }
Hm, the functions like profile_get_values are internal Kerberos library
functions. They're exported on AIX? I'm leery of calling them directly,
since they're supposed to be internal and could therefore disappear again.
Thank you very much for the patch and the detective work. It sounds like
that implementation of Kerberos is substantially different than MIT's. I
wonder why it varies so heavily.
--
Russ Allbery ([EMAIL PROTECTED]) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
