diff options
| author | Sumit Bose <sbose@redhat.com> | 2010-11-18 12:48:05 +0100 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2010-12-07 17:09:19 -0500 |
| commit | 5843ad321944a028f6dee7e1fd4f9381c4953d07 (patch) | |
| tree | fe7087c3ebb948e0269ef613a1cea06111c2cfc3 /src/providers/krb5/krb5_auth.c | |
| parent | 263c8d47ca21d3bacd77266613fcc7baab988465 (diff) | |
| download | sssd-5843ad321944a028f6dee7e1fd4f9381c4953d07.tar.gz sssd-5843ad321944a028f6dee7e1fd4f9381c4953d07.tar.xz sssd-5843ad321944a028f6dee7e1fd4f9381c4953d07.zip | |
Add support for FAST in krb5 provider
Diffstat (limited to 'src/providers/krb5/krb5_auth.c')
| -rw-r--r-- | src/providers/krb5/krb5_auth.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index 515c181bc..e6b680eaf 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -646,14 +646,16 @@ static void krb5_find_ccache_step(struct tevent_req *req) } /* We need to keep the root privileges to read the keytab file if - * validation is enabled, otherwise we can drop them and run krb5_child - * with user privileges. + * validation or FAST is enabled, otherwise we can drop them and run + * krb5_child with user privileges. * If we are offline we want to create an empty ccache file. In this * case we can drop the privileges, too. */ - if (!dp_opt_get_bool(kr->krb5_ctx->opts, KRB5_VALIDATE) || kr->is_offline) { - kr->run_as_user = true; - } else { + if ((dp_opt_get_bool(kr->krb5_ctx->opts, KRB5_VALIDATE) || + kr->krb5_ctx->use_fast) && + !kr->is_offline) { kr->run_as_user = false; + } else { + kr->run_as_user = true; } subreq = handle_child_send(state, state->ev, kr); |