From 80b9ebb1e512c0835ce09118a50d9bcfc22bdadd Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Dec 05 2017 19:58:45 +0000
Subject: Properly initialize ccaches before storing into them


krb5_cc_new_unique() doesn't initialize ccaches, which results in the
krb5 libraries being aware of their presence within the collection but
being unable to manipulate them.

This is transparent to most gssproxy consumers because we just
re-fetch the ccache on error.

Signed-off-by: Robbie Harwood <rharwood@redhat.com>

---

diff --git a/src/mechglue/gpp_creds.c b/src/mechglue/gpp_creds.c
index 1ac9691..e87da82 100644
--- a/src/mechglue/gpp_creds.c
+++ b/src/mechglue/gpp_creds.c
@@ -247,6 +247,13 @@ uint32_t gpp_store_remote_creds(uint32_t *min, bool store_as_default_cred,
 
         ret = krb5_cc_new_unique(ctx, cc_type, NULL, &ccache);
         free(cc_type);
+        if (ret)
+            goto done;
+
+        /* krb5_cc_new_unique() doesn't initialize, and we need to initialize
+         * before storing into the ccache.  Note that this will only clobber
+         * the ccache handle, not the whole collection. */
+        ret = krb5_cc_initialize(ctx, ccache, cred.client);
     }
     if (ret)
         goto done;