[31785] in Kerberos
Re: Kerberos tickets, SSH public key auth, AFS tokens
daemon@ATHENA.MIT.EDU (Russ Allbery)
Wed Dec 16 22:34:44 2009
From: Russ Allbery <rra@stanford.edu>
To: Jeff Blaine <jblaine@stage-infinity.com>
In-Reply-To: <4B29A5C3.4060908@stage-infinity.com> (Jeff Blaine's message of
"Wed, 16 Dec 2009 22:30:11 -0500")
Date: Wed, 16 Dec 2009 19:34:02 -0800
Message-ID: <87my1ixoid.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Jeff Blaine <jblaine@stage-infinity.com> writes:
> On 12/16/2009 10:24 PM, Russ Allbery wrote:
>> Oh, right, I remember this problem now. This is why Douglas has
>> another PAM module that does nothing except set KRB5CCNAME in the
>> environment for use on Solaris. Solaris uses the default UID-based
>> ticket cache and hence doesn't set KRB5CCNAME in the environment.
>> Try adding always_aklog to the pam_afs_session configuration.
> Bingo. That worked.
That should do it. The only drawback will be that it will run aklog even
if people don't forward credentials, but that's just a minor waste of
effort and shouldn't cause any problems.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
