Re: [Dovecot] GSSAPI cross-realm fixed

2009-07-07 Thread Bryan Jacobs
On Tue, 07 Jul 2009 20:27:57 -0400 Timo Sirainen wrote: > On Tue, 2009-03-03 at 13:56 -0500, Bryan Jacobs wrote: > > Attached is a patch which in my environment (Linux/Heimdal 1.2.1) > > fixes cross-realm GSSAPI authentication. > > > > Changes it makes: > > 1. When using krb5_kuserok, do not ca

Re: [Dovecot] GSSAPI cross-realm fixed

2009-07-07 Thread Timo Sirainen
On Tue, 2009-03-03 at 13:56 -0500, Bryan Jacobs wrote: > Attached is a patch which in my environment (Linux/Heimdal 1.2.1) fixes > cross-realm GSSAPI authentication. > > Changes it makes: > 1. When using krb5_kuserok, do not call gss_compare_name to check that > authn_name and authz_name are the

Re: [Dovecot] GSSAPI cross-realm fixed

2009-03-13 Thread Timo Sirainen
On Tue, 2009-03-03 at 13:56 -0500, Bryan Jacobs wrote: > Changes it makes: > 1. When using krb5_kuserok, do not call gss_compare_name to check that > authn_name and authz_name are the same. Instead, make TWO calls to > krb5_kuserok, one for each ID. If both IDs are acceptable, allow the > login

[Dovecot] GSSAPI cross-realm fixed

2009-03-03 Thread Bryan Jacobs
Attached is a patch which in my environment (Linux/Heimdal 1.2.1) fixes cross-realm GSSAPI authentication. Changes it makes: 1. When using krb5_kuserok, do not call gss_compare_name to check that authn_name and authz_name are the same. Instead, make TWO calls to krb5_kuserok, one for each ID. I