[krbdev.mit.edu #8156] Create anonymous memory ccache in gss_acquire_cred_from

Simo Sorce via RT rt-comment at krbdev.mit.edu
Thu Mar 19 09:51:20 EDT 2015


When we implemented gss_acquire_cred_from() we did not set the rules of
where to store acquired credentials if no ccache item is provided by the
caller.
Because of the way the code is structured this resulted in the
credentials being stored into the default user ccache.
This is undesirable as a failure to set an explicit ccache in the
configuration apssed to the functrion risks overriding the credentials
being used by the user of the program.
If no 'ccache' element is passed in the function an anoymous MEMORY
credentil should be generated instead.
gss_store_cred_into() can then be used should the program decide to
store such credentials in some permanent credential cache.

These emails to kitten gives some background on why this is important:
http://www.ietf.org/mail-archive/web/kitten/current/msg05439.html
http://www.ietf.org/mail-archive/web/kitten/current/msg05440.html


More information about the krb5-bugs mailing list