updated patch from Matthieu Hautreux for cascading credentials

[gssapi-openssh.git] / openssh / gss-serv.c

diff --git a/openssh/gss-serv.c b/openssh/gss-serv.c
index e1b2b433150f1476909c56221ac04c681dd7afa7..7cbf8e2f89b82b7ad18fcbb88a5c1621e9934a68 100644 (file)
--- a/openssh/gss-serv.c
+++ b/openssh/gss-serv.c
@@ -530,11 +530,12 @@ static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg,
 void
 ssh_gssapi_rekey_creds() {
        int ok;
-       int ret;
 #ifdef USE_PAM
+       int ret;
        pam_handle_t *pamh = NULL;
        struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL};
        char *envstr;
+       char **p;char **pw;
 #endif
 
        if (gssapi_client.store.filename == NULL && 
@@ -564,6 +565,18 @@ ssh_gssapi_rekey_creds() {
        if (ret)
                return;
 
+       /* Put ssh pam stack env variables in this new pam stack env 
+        * Using pam-pkinit, KRB5CCNAME is set during do_pam_session
+        * this addition enables pam-pkinit to access KRB5CCNAME if used 
+        * in sshd-rekey stack too
+        */
+       pw = p = fetch_pam_environment();
+       while ( *pw != NULL ) {
+               pam_putenv(pamh,*pw);
+               pw++;
+       }
+       free_pam_environment(p);
+
        xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar, 
            gssapi_client.store.envval);