On 05.06.2009 19:29, Russ Allbery wrote: > Nikolay Shopik<[email protected]> writes: >> On 05.06.2009 18:36, Russ Allbery wrote: >>> Nikolay Shopik<[email protected]> writes: > >>>> Only thing I found is pam_krb5 which have existing_ticket >>>> option. (tells pam_krb5.so to accept the presence of pre-existing >>>> Kerberos credentials provided by the calling application in the >>>> default credential cache as sufficient to authenticate the user, and >>>> to skip any account management checks). While this available only in >>>> Red Hat from what I see but not in Debian/Ubuntu. > >>> I could add it easily enough. I just never understood the use case. >>> Could you explain more about how you end up in this situation? Where >>> is the ticket coming from that's being used for authentication? > >> Option "existing_ticket" not available on Debian libpam-krb5 >> package. I'm sorry which situation exactly? > > Why would you ever want that option? What's the point of it?
No point for me now. I was searching for way to use cached tickets. >> Well ticket is coming from KDC when it was available and can be used >> until it expired, from my understanding. > > Sure, but how come you're running through a PAM stack that cares about > your existing ticket when you still have a ticket available? There's > probably some obvious case where this happens; I just don't know what it > is. pam_ccreds is do thingy for me, cache KDC credentials so user can logon into machine even when KDC not available. ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
