Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Provide a new internal function called get_switched() to encapsulate the algorithm for selecting a credential cache when the selected ccache type supports switching. There is no change in behavior for UNIX which always calls krb5_cc_new_unique(). However, on Windows alternate behavior is provided when the ccache type is API or MSLSA. For the API ccache the default ccache name is stored in the Windows registry which is shared across all logon sessions belonging to a user. For users that are members of the Administrators group this includes both the UAC restricted and elevated sessions sharing the same desktop. It is very disconcerting when the elevated session obtains credentials for the same client principal as the restricted session and then all apps in the restricted session lose access to their credential cache. For Windows, the API credential caches are named after the principal that is stored within them. It provides for a better end user experience. For the MSLSA ccache tickets belonging to multiple principals are all stored within the MSLSA ccache. As a result, all attempts to switch ccache names default back to the one and only one name. Change-Id: I7865cd044cff01ff38ab107ec0961e42788fa073
- Loading branch information