Author: gd Date: 2006-03-21 11:14:29 +0000 (Tue, 21 Mar 2006) New Revision: 14611
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=14611 Log: Fix init_creds_opts issue jerry discovered when using MIT krb5 1.3: We were using a far too short renewable_time in the request; newer MIT releases take care interally that the renewable time is never shorter then the default ticket lifetime. Guenther Modified: branches/SAMBA_3_0/source/libads/kerberos.c branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c trunk/source/libads/kerberos.c trunk/source/nsswitch/winbindd_ads.c Changeset: Modified: branches/SAMBA_3_0/source/libads/kerberos.c =================================================================== --- branches/SAMBA_3_0/source/libads/kerberos.c 2006-03-21 10:57:02 UTC (rev 14610) +++ branches/SAMBA_3_0/source/libads/kerberos.c 2006-03-21 11:14:29 UTC (rev 14611) @@ -72,9 +72,7 @@ krb5_ccache cc = NULL; krb5_principal me; krb5_creds my_creds; -#if 0 krb5_get_init_creds_opt opt; -#endif initialize_krb5_error_table(); if ((code = krb5_init_context(&ctx))) @@ -97,12 +95,9 @@ return code; } -#if 0 /* This code causes problems with MIT krb5 1.3 when asking for a - TGT for the machine account */ krb5_get_init_creds_opt_init(&opt); krb5_get_init_creds_opt_set_renew_life(&opt, renewable_time); krb5_get_init_creds_opt_set_forwardable(&opt, 1); -#endif if (request_pac) { #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST @@ -110,13 +105,8 @@ #endif } -#if 0 if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password), kerb_prompter, NULL, 0, NULL, &opt))) -#else - if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password), - kerb_prompter, NULL, 0, NULL, NULL))) -#endif { krb5_free_principal(ctx, me); krb5_free_context(ctx); Modified: branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c =================================================================== --- branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c 2006-03-21 10:57:02 UTC (rev 14610) +++ branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c 2006-03-21 11:14:29 UTC (rev 14611) @@ -102,7 +102,7 @@ ads->auth.realm = SMB_STRDUP( lp_realm() ); } - ads->auth.renewable = 1; + ads->auth.renewable = WINBINDD_PAM_AUTH_KRB5_RENEW_TIME; status = ads_connect(ads); if (!ADS_ERR_OK(status) || !ads->config.realm) { Modified: trunk/source/libads/kerberos.c =================================================================== --- trunk/source/libads/kerberos.c 2006-03-21 10:57:02 UTC (rev 14610) +++ trunk/source/libads/kerberos.c 2006-03-21 11:14:29 UTC (rev 14611) @@ -72,9 +72,7 @@ krb5_ccache cc = NULL; krb5_principal me; krb5_creds my_creds; -#if 0 krb5_get_init_creds_opt opt; -#endif initialize_krb5_error_table(); if ((code = krb5_init_context(&ctx))) @@ -97,12 +95,9 @@ return code; } -#if 0 /* This code causes problems with MIT krb5 1.3 when asking for a - TGT for the machine account */ krb5_get_init_creds_opt_init(&opt); krb5_get_init_creds_opt_set_renew_life(&opt, renewable_time); krb5_get_init_creds_opt_set_forwardable(&opt, 1); -#endif if (request_pac) { #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST @@ -110,13 +105,8 @@ #endif } -#if 0 if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password), kerb_prompter, NULL, 0, NULL, &opt))) -#else - if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password), - kerb_prompter, NULL, 0, NULL, NULL))) -#endif { krb5_free_principal(ctx, me); krb5_free_context(ctx); Modified: trunk/source/nsswitch/winbindd_ads.c =================================================================== --- trunk/source/nsswitch/winbindd_ads.c 2006-03-21 10:57:02 UTC (rev 14610) +++ trunk/source/nsswitch/winbindd_ads.c 2006-03-21 11:14:29 UTC (rev 14611) @@ -102,7 +102,7 @@ ads->auth.realm = SMB_STRDUP( lp_realm() ); } - ads->auth.renewable = 1; + ads->auth.renewable = WINBINDD_PAM_AUTH_KRB5_RENEW_TIME; status = ads_connect(ads); if (!ADS_ERR_OK(status) || !ads->config.realm) {
