[33466] in Kerberos
Re: Help: Can OpenSSH get OpenAFS token after the client login?
daemon@ATHENA.MIT.EDU (Simon Wilkinson)
Sat Jun 11 13:57:22 2011
In-Reply-To: <it08ql$jq1$1@dough.gmane.org>
Mime-Version: 1.0 (iPhone Mail 8G4)
Message-Id: <88CD4D22-B4FB-4260-B9CD-2A2155AA5117@sxw.org.uk>
From: Simon Wilkinson <simon@sxw.org.uk>
Date: Sat, 11 Jun 2011 18:56:56 +0100
To: Markus Moeller <huaraz@moeller.plus.com>
Cc: "openafs-info@openafs.org" <openafs-info@openafs.org>,
"kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 11 Jun 2011, at 18:22, "Markus Moeller" <huaraz@moeller.plus.com> wrote:
> If I remember right when GSSAPIauthentication is used and the client has a
> valid Kerberos ticket pam won't be called on the server, so the pam module
> won't help in that case.
No, the PAM stack is invoked whatever mechanism has been used to authenticated the user. Russ's pam_afs_session works perfectly to add AFS tokens for users authenticated with Kerberos tickets.
S.
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
