I've written a GSSAPI cross-realm auth patch for people not lucky enough
to have the __gss_userok function, though it should apply pretty cleanly
with that patch in place as well.
The patch is available at:
http://zinux.cynicbytrade.com/svn/servers/dovecot/cross-realm.diff.bz2
It works for me on MIT-kerb, and I tested compilation against heimdal,
but I don't have a cross-realm setup to test functionality under heimdal
(though I also have no reason to think it wouldn't work).
Since neither MIT nor heimdal provide a gss_userok() function, I used
the krb5_userok() function. So if you're using a mechanism other than
krb5 this won't work. But it's the same thing that OpenSSH and the apps
distributed with heimdal do, so it seemed relatively safe.
I also choose to append the krb5_userok() check rather than replace the
gss_compare_name() check -- that way same-realm auth works for non-krb5
mechanisms, and my new code doesn't get called unless the same-realm
check fails. If you don't care about other mechanisms it would be faster
to bypass the gss_compare_name() check entirely.
If this is something you'd like to mainline I'd be happy to standardize
the coding style -- just point me to a style definition document. And if
it doesn't hit the mainline I expect to maintain it for the foreseeable
future, with updates at the same URL.
Zach
