[sssd PR#958][opened] ldap_child: do not try PKINIT

[sumit-bose]

   URL: https://github.com/SSSD/sssd/pull/958
Author: sumit-bose
 Title: #958: ldap_child: do not try PKINIT
Action: opened

PR body:
"""
if the PKINIT plugin is installed and pkinit_identities is set in
/etc/krb5.conf libkrb5 will try to do PKINIT although ldap_child only
wants to authenticate with a keytab. As a result ldap_child might try to
access a Smartcard which is either not allowed at all or might cause
unexpected delays.

To avoid this the current patch sets pkinit_identities for LDAP child
explicitly to make the PKINIT plugin fail because if installed libkrb5
will always use it.

It turned out the setting pre-authentication options requires some
internal flags to be set and krb5_get_init_creds_opt_alloc() must be
used to initialize the options struct.

Related to https://pagure.io/SSSD/sssd/issue/4126
"""

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/958/head:pr958
git checkout pr958