Re: [modauthkerb] How to use a received forwardable ticket

[Russ A. <rr...@st...>]

Andy Cobaugh <pha...@gm...> writes:

> Not quite. mod_auth_kerb, at least the last time I checked (5.4), wasn't
> calling gss_krb5_ccache_name(). If your application (most of php's
> GSS-enabled functions like the imap and ldap functions I know do) uses
> gss_acquire_cred() to create the GSSAPI credential, then it never
> actually looks at KRB5CCNAME.

Kerberos GSSAPI libraries (at least both MIT and Heimdal, and I'm fairly
sure Solaris as well) use KRB5CCNAME to find credentials.
gss_krb5_ccache_name() overrides the environment variable and is useful in
cases where you can't easily pass environment variables, but if it's not
used, the environment variable is used by default.

I'm very curious to hear more about the circumstances that seemed to
indicate this isn't true.

-- 
Russ Allbery (rr...@st...)             <http://www.eyrie.org/~eagle/>