diff options
| author | Ken Hornstein <kenh@cmf.nrl.navy.mil> | 2021-01-27 21:21:19 -0500 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2021-02-11 12:50:44 -0500 |
| commit | 13ae08e70a05768d4f65978ce1a8d4e16fec0d35 (patch) | |
| tree | 35128e0f2d7f833f69575b8d70f27399581c762e /doc | |
| parent | c374ab40dd059a5938ffc0440d87457ac5da3a46 (diff) | |
| download | krb5-13ae08e70a05768d4f65978ce1a8d4e16fec0d35.zip krb5-13ae08e70a05768d4f65978ce1a8d4e16fec0d35.tar.gz krb5-13ae08e70a05768d4f65978ce1a8d4e16fec0d35.tar.bz2 | |
Load certs when checking pkinit_identities values
Move the crypto_load_certs() probe from pkinit_identity_initialize()
to process_option_identity(). This will attempt to load a certificate
for each pkinit_identities value, and if the certificate load fails to
move to the next line.
For PKCS11, return an error if pkinit_open_session() fails, but do not
fail in pkinit_open_session() just because identity prompts are
deferred.
[ghudson@mit.edu: added test case; moved cert probe to
process_option_identity(); rewrote commit message]
ticket: 8984 (new)
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/admin/conf_files/krb5_conf.rst | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst index 08e0fc8..d5d6e06 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst @@ -1123,10 +1123,9 @@ PKINIT krb5.conf options **pkinit_identities** Specifies the location(s) to be used to find the user's X.509 identity information. If this option is specified multiple times, - the first valid value is used; this can be used to specify an - environment variable (with **ENV:**\ *envvar*) followed by a - default value. Note that these values are not used if the user - specifies **X509_user_identity** on the command line. + each value is attempted in order until certificates are found. + Note that these values are not used if the user specifies + **X509_user_identity** on the command line. **pkinit_kdc_hostname** The presence of this option indicates that the client is willing |