Re: PHP's ldap_sasl_bind tries to authenticate with KRB5CCNAME other than the one provided by mod_auth_kerb

On Thu, May 3, 2007 12:33 am, gil ran wrote: >> I dunno what klist does, nor what any of the KRB stuff is, but if >> you >> want to preserve this KRB thingie from page to page, it looks like >> you >> will need to do more than just run 'klist'... > > I don't want to preserve this KRB thingie from page to page. The > opposite is correct: I don't understand why the old file-name is used > instead of the new one. How could GSSAPI know *which* Apache child's environment to check?... > When using ldap_sasl_bind with the 4th argument set to "GSSAPI" we are > trying to bind to the ldap server using sasl and GSSAPI. The GSSAPI > ignores any provided username/password (authcid, for those of you who > are familiar with sasl). Instead, it uses the information kept in the > "credential cache" file. This is the file Apache (mod_auth_kerb) > creates. This is the file-name provided by it in > $_SERVER['KRB5CCNAME']. If you aren't passing it from Apache to GSSAPI, then it's going to snag whichever env happens to have been set last or... There's a differnt ENV floating around for each Apache child, I think, so how is GSSAPI supposed to know which one to snag? -- Some people have a "gift" link here. Know what I want? I want you to buy a CD from some indie artist. http://cdbaby.com/browse/from/lynch Yeah, I get a buck. So?