From c97b01af62fa73b31a5b0c86c21c3347cdd0874d Mon Sep 17 00:00:00 2001
From: Darren Tucker <dtucker@zip.com.au>
Date: Wed, 16 Feb 2005 16:47:37 +1100
Subject: [PATCH]  - (dtucker) [session.c] Bug #918: store credentials from
 gssapi-with-mic    authentication early enough to be available to PAM session
 modules when    privsep=yes.  Patch from deengert at anl.gov, ok'ed in
 principle by Sam    Hartman and similar to Debian's ssh-krb5 package.

---
 ChangeLog |  6 +++++-
 session.c | 22 ++++++++++++++--------
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index bbead8299..9d132f981 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,10 @@
  - (dtucker) [configure.ac] Bug #893: check for libresolv early on Reliant
    Unix; prevents problems relating to the location of -lresolv in the
    link order.
+ - (dtucker) [session.c] Bug #918: store credentials from gssapi-with-mic
+   authentication early enough to be available to PAM session modules when
+   privsep=yes.  Patch from deengert at anl.gov, ok'ed in principle by Sam
+   Hartman and similar to Debian's ssh-krb5 package.
 
 20050215
  - (dtucker) [config.sh.in] Collect oslevel -r too.
@@ -2142,4 +2146,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.3657 2005/02/16 05:19:17 dtucker Exp $
+$Id: ChangeLog,v 1.3658 2005/02/16 05:47:37 dtucker Exp $
diff --git a/session.c b/session.c
index 1896e141f..df7552334 100644
--- a/session.c
+++ b/session.c
@@ -677,14 +677,6 @@ do_exec(Session *s, const char *command)
 	}
 #endif
 
-#ifdef GSSAPI
-	if (options.gss_authentication) {
-		temporarily_use_uid(s->pw);
-		ssh_gssapi_storecreds();
-		restore_uid();
-	}
-#endif
-
 	if (s->ttyfd != -1)
 		do_exec_pty(s, command);
 	else
@@ -1279,6 +1271,13 @@ do_setusercontext(struct passwd *pw)
 # ifdef __bsdi__
 		setpgid(0, 0);
 # endif
+#ifdef GSSAPI
+		if (options.gss_authentication) {
+			temporarily_use_uid(pw);
+			ssh_gssapi_storecreds();
+			restore_uid();
+		}
+#endif
 # ifdef USE_PAM
 		if (options.use_pam) {
 			do_pam_session();
@@ -1309,6 +1308,13 @@ do_setusercontext(struct passwd *pw)
 			exit(1);
 		}
 		endgrent();
+#ifdef GSSAPI
+		if (options.gss_authentication) {
+			temporarily_use_uid(pw);
+			ssh_gssapi_storecreds();
+			restore_uid();
+		}
+#endif
 # ifdef USE_PAM
 		/*
 		 * PAM credentials may take the form of supplementary groups.