[modauthkerb] Negotiate on Windows with cross-realm trust ADand MIT Kereros.

[Achim Grolms]

On Thursday 26 July 2007 21:54, Douglas E. Engert wrote:
> Achim Grolms wrote:
> > On Thursday 26 July 2007 20:40, Henry B. Hotz wrote:
> >>> If I understand RFC2744 correct GSS_C_DELEG_FLAG
> >>> would not be set in that case?
> >>>
> >>> Achim
> >>
> >> Agreed.  That flag shouldn't be set AFAIK, though the value isn't
> >> valid until negotiation is complete.
> >
> > That means before trying to store delegated credentials
> > and before checking GSS_C_DELEG_FLAG
> > mod_auth_kerb needs to check if gss_accept_sec_context ()
> > returns   major_status = GSS_S_COMPLETE

>From my point of view this means that mod_auth_kerb
needs a change in code.
I needs to be of that style:

the major_status of 
gss_accept_sec_context()

needs to be checked before checking GSS_C_DELEG_FLAG.

This can be done this way:

if ( major_status_accept = GSS_S_COMPLETE ) {
    if (conf->krb_save_credentials) {
        if (delegated_cred != GSS_C_NO_CREDENTIAL) {
             .
             .
             .
        }
     }
}


major_status_accept is the major_status returned by
accept_sec_token

Mikkel, can you give this a try?
Achim