XD2, Kerberos, PAM, & Xscreensaver

SuSE 9 XD2

I have PAM configured for Kerberos authentication for a user.  I'm using 
pam_krb5afs rather than pam_unix2 which YAST attempts to use when you 
configure Kerberos through it.

In my /etc/pam.d/login file I have:

auth sufficient pam_unix2.so nullok
auth required pam_krb5afs.so krb4_convert minimum_uid=500 tokens
auth required pam_securetty.so
auth required pam_nologin.so
auth required pam_env.so
auth required pam_mail.so
account required pam_unix2.so
password required pam_pwcheck.so nullok
password required pam_unix2.so nullok use_first_pass use_authtok
session required pam_unix2.so none
session required pam_limits.so
session optional pam_krb5afs.so

This works well.  When I login, I get kerberos tickets stored in a cache 
file that is session specific (i think, krb5cc_uid_uniquenumber) and afs 
tokens, and the KRB5CCNAME env variable is updated to point to the cache 
file.

In my /etc/pam.d/xscreensaver file I have:

auth sufficient pam_unix2.so nullok
auth required pam_krb5afs.so krb4_convert minimum_uid=500 tokens

This works part of the way.  When I lock the console using Xscreensaver, 
it uses kerberos to authenticate me to unlock the machine.  But it 
creates a new ticket cache file, doesn't get rid of the old one(s), and 
doesn't update the KRB5CCNAME env variable.

Any idea what I might need to do to correct this?  The man files aren't 
any help at this level.  Does Xscreensaver do any session management, 
meaning that I would need the session piece in my 
/etc/pam.d/xscreensaver file?

Luke
_______________________________________________
Users maillist  -  [email protected]
http://lists.ximian.com/mailman/listinfo/users