Windows Integrated Login Fixes for KFW 3.1

Windows Integrated Login Fixes for KFW 3.1

    KFW integrated login was failing when the user is
    not a power user or administrator.  This was occurring
    because the temporary file ccache was being created in
    a directory the user could not read.  While fixing this
    it was noticed that the ACLs on the ccache were too broad.
    Instead of applying a fix to the FILE: krb5_ccache
    implementation it was decided that simply applying a new
    set of ACLs (SYSTEM and "user" with no inheritance) to
    the file immediately after the krb5_cc_initialize() call
    would close the broadest security issues.

    The file is initially created in the SYSTEM %TEMP% directory
    with "SYSTEM" ACL only.  Then it is moved to the user's %TEMP%
    directory with "SYSTEM" and "user" ACLs.  Finally, after
    copying the credentials to the API: ccache, the file is deleted.

ticket: new
tags: pullup
component: windows

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@18379 dc483132-0cff-0310-8789-dd5450dbe970