Delete the krb5 ccname variable from the PAM environment if set.

If winbind sets the KRB5CCNAME variable it should unset it when
the cache gets destroyed.

diff --git a/source/nsswitch/pam_winbind.c b/source/nsswitch/pam_winbind.c
index 95b3d23dd434a9623b38acf63d63977f6ca139ca..15b33e3a2fc8f3789ae065f661c664271d477a6f 100644 (file)
--- a/source/nsswitch/pam_winbind.c
+++ b/source/nsswitch/pam_winbind.c
@@ -2358,6 +2358,13 @@ int pam_sm_close_session(pam_handle_t *pamh, int flags,
        }
 
 out:
+       /*
+        * Delete the krb5 ccname variable from the PAM environment
+        * if it was set by winbind.
+        */
+       if (ctx->ctrl & WINBIND_KRB5_AUTH) {
+               pam_putenv(pamh, "KRB5CCNAME");
+       }
 
        _PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", ctx, retval);