diff options
author | Sumit Bose <sbose@redhat.com> | 2013-06-24 20:59:53 +0200 |
---|---|---|
committer | Jakub Hrozek <jhrozek@redhat.com> | 2013-06-25 14:34:39 +0200 |
commit | fa4a9c4afcc0c62a693034e21f33356e64735687 (patch) | |
tree | 5f396acead970d06e8ebdd9da7d3397238736072 /src/providers/krb5/krb5_auth.h | |
parent | 48a53690ae35ef7e5690eb216c8e33140070f984 (diff) | |
download | sssd-fa4a9c4afcc0c62a693034e21f33356e64735687.tar.gz sssd-fa4a9c4afcc0c62a693034e21f33356e64735687.tar.xz sssd-fa4a9c4afcc0c62a693034e21f33356e64735687.zip |
krb5: do not send pac for IPA users from the local domain
So far we didn't send the PAC of IPA users to the PAC responder during
password authentication because group memberships for IPA users can be
retrieved efficiently with LDAP calls. Recently patches added PAC
support for the AD provider as well and removed the restriction for the
IPA users. This patch restores the original behaviour by introducing a
new flag in struct krb5_ctx which is only set for the IPA provider.
Additionally a different flag is renamed to make it's purpose more
clear.
Fixes https://fedorahosted.org/sssd/ticket/1995
Diffstat (limited to 'src/providers/krb5/krb5_auth.h')
-rw-r--r-- | src/providers/krb5/krb5_auth.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_auth.h b/src/providers/krb5/krb5_auth.h index cf290ca05..d31925dae 100644 --- a/src/providers/krb5/krb5_auth.h +++ b/src/providers/krb5/krb5_auth.h @@ -55,6 +55,7 @@ struct krb5child_req { bool valid_tgt; bool run_as_user; bool upn_from_different_realm; + bool send_pac; }; errno_t krb5_setup(TALLOC_CTX *mem_ctx, struct pam_data *pd, |