Initial revision

[gssapi-openssh.git] / openssh / auth2.c

diff --git a/openssh/auth2.c b/openssh/auth2.c
index eaa377f29af6c7b52ac7f274be1d6c07f8d31c88..7cb74cfa9c5b6747c20b4c9a081dbc80a7dc10d5 100644 (file)
--- a/openssh/auth2.c
+++ b/openssh/auth2.c
@@ -147,7 +147,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
        method = packet_get_string(NULL);
 
 #ifdef GSSAPI
-       if (strcmp(user, "") == 0) {
+       if (user[0] == '\0') {
            debug("received empty username for %s", method);
            if (strcmp(method, "external-keyx") == 0) {
                char *lname = NULL;
@@ -156,7 +156,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                    xfree(user);
                    user = lname;
                    debug("set username to %s from gssapi context", user);
-               } else if (authctxt->valid) {
+               } else {
                    debug("failed to set username from gssapi context");
                }
            }
@@ -164,19 +164,17 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
 #endif
 
        debug("userauth-request for user %s service %s method %s",
-             (user && user[0]) ? user : "<implicit>", service, method);
+             user[0] ? user : "<implicit>", service, method);
        debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
 
        if ((style = strchr(user, ':')) != NULL)
                *style++ = 0;
 
-       ;
        /* If first time or username changed or implicit username,
           setup/reset authentication context. */
        if ((authctxt->attempt++ == 0) ||
            (strcmp(user, authctxt->user) != 0) ||
            (strcmp(user, "") == 0)) {
-               /* setup auth context */
                if (authctxt->user) {
                    xfree(authctxt->user);
                    authctxt->user = NULL;
@@ -189,38 +187,40 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                    xfree(authctxt->style);
                    authctxt->style = NULL;
                }
+               authctxt->valid = 0;
 #ifdef GSSAPI
-               /* We'll verify the username after we set it from the
-                  GSSAPI context. */
+               /* If we're going to set the username based on the
+                  GSSAPI context later, then wait until then to
+                  verify it. Just put in placeholders for now. */
                if ((strcmp(user, "") == 0) &&
                    ((strcmp(method, "gssapi") == 0) ||
-                    (strcmp(method, "external-keyx") == 0))) {
-                   authctxt->pw = NULL;
-                   authctxt->valid = 1;
+                    (strcmp(method, "gssapi-with-mic") == 0))) {
+                       authctxt->pw = fakepw();
+                       authctxt->user = xstrdup(user);
                } else {
 #endif
                authctxt->pw = PRIVSEP(getpwnamallow(user));
+               authctxt->user = xstrdup(user);
                if (authctxt->pw && strcmp(service, "ssh-connection")==0) {
                        authctxt->valid = 1;
                        debug2("input_userauth_request: setting up authctxt for %s", user);
 #ifdef USE_PAM
                        if (options.use_pam)
-                               PRIVSEP(start_pam(authctxt->pw->pw_name));
+                               PRIVSEP(start_pam(authctxt));
 #endif
                } else {
                        logit("input_userauth_request: illegal user %s", user);
                        authctxt->pw = fakepw();
 #ifdef USE_PAM
                        if (options.use_pam)
-                               PRIVSEP(start_pam(user));
+                               PRIVSEP(start_pam(authctxt));
 #endif
                }
 #ifdef GSSAPI
-               }
+               } /* endif for setting username based on GSSAPI context */
 #endif
                setproctitle("%s%s", authctxt->pw ? user : "unknown",
                    use_privsep ? " [net]" : "");
-               authctxt->user = xstrdup(user);
                authctxt->service = xstrdup(service);
                authctxt->style = style ? xstrdup(style) : NULL;
                if (use_privsep && (authctxt->attempt == 1))