krb5/krb5 — pull request #194 by kaduk (2014-08-22 22:15:41+00:00)
Title: Improve behavior on windows when UAC is enabled

When User Account Control is enabled, certain operations on the MSLSA cache fail, resulting in essentially total operations failure with the current codebase. Many of the calls to the LSA are documented as requiring SeTcbPrivilege (though I believe not all of the calls documented as such actually require it), and may begin to fail under these conditions. We can clean up the LSA code to avoid using such calls in many places, as there are alternatives available which are not documented as requiring additional privilege. Prior to making those changes, perform some general tidying of cc_mslsa.c by removing dead code and compat code for ancient versions of windows.

Also contained in this patch series is a regression fix in libgssapi, which failed to scan the selected ccache for credentials when leashdll was used to select a ccache.

We must set the KRB5_TC_NOTICKET flag in scan_ccache() as well, in order to detect the presence of a TGT, when UAC is enabled.