Allow passing Kerberos credentials when becoming.

[profile.git] / opt / bin / become

diff --git a/opt/bin/become b/opt/bin/become
index f7f037e..9be0b9b 100755 (executable)
--- a/opt/bin/become
+++ b/opt/bin/become
@@ -1,8 +1,17 @@
 #!/bin/bash
 
+kerberos=0
+while getopts ":k" opt; do
+  case $opt in
+    k) kerberos=1
+  esac
+done
+shift $((OPTIND-1))
+
 user="$1"; shift
 if [ -z "$user" ]; then
-  echo >&2 "Usage: become <user>"
+  echo >&2 "Usage: become [-k] <user>"
+  echo >&2 "Options: -k   Delegate Kerberos credentials even if target user is not root."
   exit 1
 fi
 
@@ -22,7 +31,19 @@ if [ -n "$file" ]; then
 
   echo >&3 "cd"
   echo >&3 "PROFILE_HOME='$HOME'"
-  [ -n "$PRINCIPAL" ] && echo >&3 "PRINCIPAL='$PRINCIPAL'"
+  if [ -n "$PRINCIPAL" ]; then
+    echo >&3 "PRINCIPAL='$PRINCIPAL'"
+    if [ $kerberos = 1 ]; then
+      ccname=$(klist 2>/dev/null | sed -n 's/^Ticket cache: FILE://p')
+      if [ -f "$ccname" ]; then
+        openssl=$(find_working openssl)
+        if [ -n "$openssl" ]; then
+          echo >&3 "KRB5OPENSSL='$openssl'"
+          echo >&3 "KRB5BASE64='$($openssl enc -a -in $ccname)'"
+        fi
+      fi
+    fi
+  fi
   if [ -n "$DISPLAY" -a -n "$COOKIE" ]; then
     echo >&3 "xauth add $COOKIE"
   else