search for: krb5_verify_us

...f sshd uses only the first default realm for kerberos password authentication. However gssapi access works with multiple default realms, at least for HEIMDAL. It should be fine if sshd uses all default realms or all realms defined in /etc/krb5.conf. For HEIMDAL I replaced the line "problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user, ccache, password, 1, NULL);" by a line "problem = krb5_verify_user_lrealm(authctxt->krb5_ctx, authctxt->krb5_user, ccache, password, 1, NULL);" in the file auth-krb5.c and the Kerberos password authentication takes into accoun...

...); if (problem) goto out; - problem = krb5_cc_initialize(authctxt->krb5_ctx, - authctxt->krb5_fwd_ccache, authctxt->krb5_user); + problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache, + authctxt->krb5_user); if (problem) goto out; restore_uid(); + problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user, - authctxt->krb5_fwd_ccache, password, 1, NULL); + ccache, password, 1, NULL); + temporarily_use_uid(authctxt->pw); if (problem) goto out; + problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, + &auth...