Delete the krb5 ccname variable from the PAM environment if set.

If winbind sets the KRB5CCNAME variable it should unset it when
the cache gets destroyed.

diff --git a/source3/nsswitch/pam_winbind.c b/source3/nsswitch/pam_winbind.c
index 4cfd9001d6e17e2d2769fbf98b75776823220feb..2967770d8d0493d72b523302049af7195799fb34 100644 (file)
--- a/source3/nsswitch/pam_winbind.c
+++ b/source3/nsswitch/pam_winbind.c
@@ -2740,6 +2740,14 @@ out:
                     user, "wbcLogoffUser");
        }
 
+       /*
+        * Delete the krb5 ccname variable from the PAM environment
+        * if it was set by winbind.
+        */
+       if (ctx->ctrl & WINBIND_KRB5_AUTH) {
+               pam_putenv(pamh, "KRB5CCNAME");
+       }
+
        _PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", ctx, retval);
 
        TALLOC_FREE(ctx);