From: Greg Hudson Date: Thu, 6 Sep 2018 17:20:56 +0000 (-0400) Subject: Clarify documentation on pkinit_identities X-Git-Tag: krb5-1.17-beta1~39 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F841%2Fhead;p=thirdparty%2Fkrb5.git Clarify documentation on pkinit_identities The documentation for pkinit_identities implies that we try harder to use each value before ignoring the rest, when in fact we only go as far as the first successful parse. Soften the language and describe the most likely use case for multiple values under the current semantics. ticket: 8733 tags: pullup target_version: 1.16-next --- diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst index 68c69df04a..42c117a34b 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst @@ -1134,11 +1134,11 @@ PKINIT krb5.conf options **pkinit_identities** Specifies the location(s) to be used to find the user's X.509 - identity information. This option may be specified multiple - times. Each value is attempted in order until identity - information is found and authentication is attempted. Note that - these values are not used if the user specifies - **X509_user_identity** on the command line. + identity information. If this option is specified multiple times, + the first valid value is used; this can be used to specify an + environment variable (with **ENV:**\ *envvar*) followed by a + default value. Note that these values are not used if the user + specifies **X509_user_identity** on the command line. **pkinit_kdc_hostname** The presense of this option indicates that the client is willing