diff --git a/contrib/pam-krb5/docs/pam_krb5.pod b/contrib/pam-krb5/docs/pam_krb5.pod
index 024584dfd4cd..f352af71b553 100644
--- a/contrib/pam-krb5/docs/pam_krb5.pod
+++ b/contrib/pam-krb5/docs/pam_krb5.pod
@@ -1,1056 +1,1059 @@
 =for stopwords
 KRB5CCNAME ChallengeResponseAuthentication GSS-API Heimdal KDC PKINIT
 PasswordAuthentication SRV Solaris Sourceforge aname appdefaults auth
 canonicalized ccache krb5.conf forwardable kdestroy keytab libdefaults
 logout pam-krb5 preauth 0.8rc1 screensaver screensavers sshd localname
 krb5.conf. 0.8rc1. Allbery Cusack Salomon FSFAP SPDX-License-Identifier
 responder
 
 =head1 NAME
 
 pam_krb5 - Kerberos PAM module
 
 =head1 SYNOPSIS
 
   auth            sufficient      pam_krb5.so minimum_uid=1000
   session         required        pam_krb5.so minimum_uid=1000
   account         required        pam_krb5.so minimum_uid=1000
   password        sufficient      pam_krb5.so minimum_uid=1000
 
 =head1 DESCRIPTION
 
 The Kerberos service module for PAM, typically installed at
 F</lib/security/pam_krb5.so>, provides functionality for the four PAM
 operations: authentication, account management, session management, and
 password management.  F<pam_krb5.so> is a shared object that is
 dynamically loaded by the PAM subsystem as necessary, based on the system
 PAM configuration.  PAM is a system for plugging in external
 authentication and session management modules so that each application
 doesn't have to know the best way to check user authentication or create a
 user session on that system.  For details on how to configure PAM on your
 system, see the PAM man page, often pam(7).
 
 Here are the actions of this module when called from each group:
 
 =over 4
 
 =item auth
 
 Provides implementations of pam_authenticate() and pam_setcred().  The
 former takes the username from the PAM session, prompts for the user's
 password (unless configured to use an already-entered password), and then
 performs a Kerberos initial authentication, storing the obtained
 credentials (if successful) in a temporary ticket cache.  The latter,
 depending on the flags it is called with, either takes the contents of the
 temporary ticket cache and writes it out to a persistent ticket cache
 owned by the user or uses the temporary ticket cache to refresh an
 existing user ticket cache.
 
 Passwords as long or longer than PAM_MAX_RESP_SIZE octets (normally 512
 octets) will be rejected, since excessively long passwords can be used as
 a denial of service attack.
 
 After doing the initial authentication, the Kerberos PAM module will
 attempt to obtain tickets for a key in the local system keytab and then
 verify those tickets.  Unless this step is performed, the authentication
 is vulnerable to KDC spoofing, but it requires that the system have a
 local key and that the PAM module be running as a user that can read the
 keytab file (normally F</etc/krb5.keytab>.  You can point the Kerberos PAM
 module at a different keytab with the I<keytab> option.  If that keytab
-cannot be read or if no keys are found in it, the default (potentially
-insecure) behavior is to skip this check.  If you want to instead fail
-authentication if the obtained tickets cannot be checked, set
-C<verify_ap_req_nofail> to true in the [libdefaults] section of
-F</etc/krb5.conf>.  Note that this will affect applications other than
-this PAM module.
+cannot be read or if no keys are found in it, the default behavior is to
+fail authentication. If you want to skip this check, set the
+C<allow_kdc_spoof> option to true either in the [appdefaults] section of
+F</etc/krb5.conf> or in the PAM policy.
 
 By default, whenever the user is authenticated, a basic authorization
 check will also be done using krb5_kuserok().  The default behavior of
 this function is to check the user's account for a F<.k5login> file and,
 if one is present, ensure that the user's principal is listed in that
 file.  If F<.k5login> is not present, the default check is to ensure that
 the user's principal is in the default local realm and the user portion of
 the principal matches the account name (this can be changed by configuring
 a custom aname to localname mapping in F<krb5.conf>; see the Kerberos
 documentation for details).  This can be customized with several
 configuration options; see below.
 
 If the username provided to PAM contains an C<@> and Kerberos can,
 treating the username as a principal, map it to a local account name,
 pam_authenticate() will change the PAM user to that local account name.
 This allows users to log in with their Kerberos principal and let Kerberos
 do the mapping to an account.  This can be disabled with the
 I<no_update_user> option.  Be aware, however, that this facility cannot be
 used with OpenSSH.  OpenSSH will reject usernames that don't match local
 accounts before this remapping can be done and will pass an invalid
 password to the PAM module.  Also be aware that several other common PAM
 modules, such as pam_securetty, expect to be able to look up the user with
 getpwnam() and cannot be called before pam_krb5 when using this feature.
 
 When pam_setcred() is called to initialize a new ticket cache, the
 environment variable KRB5CCNAME is set to the path to that ticket cache.
 By default, the cache will be named F</tmp/krb5cc_UID_RANDOM> where UID is
 the user's UID and RANDOM is six randomly-chosen letters.  This can be
 configured with the I<ccache> and I<ccache_dir> options.
 
 pam-krb5 does not use the default ticket cache location or
 I<default_cc_name> in the C<[libdefaults]> section of F<krb5.conf>.  The
 default cache location would share a cache for all sessions of the same
 user, which causes confusing behavior when the user logs out of one of
 multiple sessions.
 
 If pam_setcred() initializes a new ticket cache, it will also set up that
 ticket cache so that it will be deleted when the PAM session is closed.
 Normally, the calling program (B<login>, B<sshd>, etc.) will run the
 user's shell as a sub-process, wait for it to exit, and then close the PAM
 session, thereby cleaning up the user's session.
 
 =item session
 
 Provides implementations of pam_open_session(), which is equivalent to
 calling pam_setcred() with the PAM_ESTABLISH_CRED flag, and
 pam_close_session(), which destroys the ticket cache created by
 pam_setcred().
 
 =item account
 
 Provides an implementation of pam_acct_mgmt().  All it does is do the same
 authorization check as performed by the pam_authenticate() implementation
 described above.
 
 =item password
 
 Provides an implementation of pam_chauthtok(), which implements password
 changes.  The user is prompted for their existing password (unless
 configured to use an already entered one) and the PAM module then obtains
 credentials for the special Kerberos principal C<kadmin/changepw>.  It
 then prompts the user for a new password, twice to ensure that the user
 entered it properly (again, unless configured to use an already entered
 password), and then does a Kerberos password change.
 
 Passwords as long or longer than PAM_MAX_RESP_SIZE octets (normally 512
 octets) will be rejected, since excessively long passwords can be used as
 a denial of service attack.
 
 Unlike the normal Unix password module, this module will allow any user to
 change any other user's password if they know the old password.  Also,
 unlike the normal Unix password module, root will always be prompted for
 the old password, since root has no special status in Kerberos.  (To
 change passwords in Kerberos without knowing the old password, use
 kadmin(8) instead.)
 
 =back
 
 Both the account and session management calls of the Kerberos PAM module
 will return PAM_IGNORE if called in the context of a PAM session for a
 user who did not authenticate with Kerberos (a return code of C<ignore> in
 the Linux PAM configuration language).
 
 Note that this module assumes the network is available in order to do a
 Kerberos authentication.  If the network is not available, some Kerberos
 libraries have timeouts longer than the timeout imposed by the login
 process.  This means that using this module incautiously can make it
 impossible to log on to console as root.  For this reason, you should
 always use the I<ignore_root> or I<minimum_uid> options, list a local
 authentication module such as B<pam_unix> first with a control field of
 C<sufficient> so that the Kerberos PAM module will be skipped if local
 password authentication was successful.
 
 This is not the same PAM module as the Kerberos PAM module available from
 Sourceforge, or the one included on Red Hat systems.  It supports many of
 the same options, has some additional options, and doesn't support some of
 the options those modules do.
 
 =head1 CONFIGURATION
 
 The Kerberos PAM module takes many options, not all of which are relevant
 to every PAM group; options that are not relevant will be silently
 ignored.  Any of these options can be set in the PAM configuration as
 arguments listed after C<pam_krb5.so>.  Some of the options can also be
 set in the system F<krb5.conf> file; if this is possible, it will be noted
 below in the option description.
 
 To set a boolean option in the PAM configuration file, just give the name
 of the option in the arguments.  To set an option that takes an argument,
 follow the option name with an equal sign (=) and the value, with no
 separating whitespace.  Whitespace in option arguments is not supported in
 the PAM configuration.
 
 To set an option for the PAM module in the system F<krb5.conf> file, put
 that option in the C<[appdefaults]> section.  All options must be followed
 by an equal sign (=) and a value, so for boolean options add C<= true>.
 The Kerberos PAM module will look for options either at the top level of
 the C<[appdefaults]> section or in a subsection named C<pam>, inside or
 outside a section for the realm.  For example, the following fragment of a
 F<krb5.conf> file would set I<forwardable> to true, I<minimum_uid> to
 1000, and set I<ignore_k5login> only if the realm is EXAMPLE.COM.
 
     [appdefaults]
         forwardable = true
         pam = {
             minimum_uid = 1000
             EXAMPLE.COM = {
                 ignore_k5login = true
             }
         }
 
 For more information on the syntax of F<krb5.conf>, see krb5.conf(5).
 Note that options that depend on the realm will be set only on the basis
 of the default realm, either as configured in krb5.conf(5) or as set by
 the I<realm> option described below.  If the user authenticates to an
 account qualified with a realm, that realm will not be used when
 determining which options will apply.
 
 There is no difference to the PAM module whether options are specified at
 the top level or in a C<pam> section; the C<pam> section is supported in
 case there are options that should be set for the PAM module but not for
 other applications.
 
 If the same option is set in F<krb5.conf> and in the PAM configuration,
 the latter takes precedent.  Note, however, that due to the configuration
 syntax, there's no way to turn off a boolean option in the PAM
 configuration that was turned on in F<krb5.conf>.
 
 The start of each option description is annotated with the version of
 pam-krb5 in which that option was added with the current meaning.
 
 =head2 Authorization
 
 =over 4
 
+=item allow_kdc_spoof
+
+Allow authentication to succeed even if there is no host or service
+key available in a keytab to authenticate the Kerberos KDC's ticket.
+
 =item alt_auth_map=<format>
 
 [3.12] This functions similarly to the I<search_k5login> option.  The
 <format> argument is used as the authentication Kerberos principal, with
 any C<%s> in <format> replaced with the username.  If the username
 contains an C<@>, only the part of the username before the realm is used
 to replace C<%s>.  If <format> contains a realm, it will be used;
 otherwise, the realm of the username (if any) will be appended to the
 result.  There is no quote removal.
 
 If this option is present, the default behavior is to try this alternate
 principal first and then fall back to the standard behavior if it fails.
 The primary usage is to allow alternative principals to be used for
 authentication in programs like B<sudo>.  Most examples will look like:
 
     alt_auth_map=%s/root
 
 which attempts authentication as the root instance of the username first
 and then falls back to the regular username (but see I<force_alt_auth> and
 I<only_alt_auth>).
 
 This option also allows a cheap way to attempt authentication in an
 alternative realm first and then fall back to the primary realm.  A
 setting like:
 
     alt_auth_map=%s@EXAMPLE.COM
 
 will attempt authentication in the EXAMPLE.COM realm first and then fall
 back on the local default realm.  This is more convenient than running the
 module multiple times with multiple default realms set with I<realm>, but
 it is very limited: only two realms can be tried, and the alternate realm
 is always tried first.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf>, although
 normally it doesn't make sense to do that; normally it is used in the PAM
 options of configuration for specific programs.  It is only applicable to
 the auth and account groups.  If this option is set for the auth group, be
 sure to set it for the account group as well or account authorization may
 fail.
 
 =item force_alt_auth
 
 [3.12] This option is used with I<alt_auth_map> and forces authentication
 as the mapped principal if that principal exists in the KDC.  Only if the
 KDC returns principal unknown does the Kerberos PAM module fall back to
 normal authentication.  This can be used to force authentication with an
 alternate instance.  If I<alt_auth_map> is not set, it has no effect.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item ignore_k5login
 
 [2.0] Never look for a F<.k5login> file in the user's home directory.
 Instead, only check that the Kerberos principal maps to the local account
 name.  The default check is to ensure the realm matches the local realm
 and the user portion of the principal matches the local account name, but
 this can be customized by setting up an aname to localname mapping in
 F<krb5.conf>.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and account groups.
 
 =item ignore_root
 
 [1.1] Do not do anything if the username is C<root>.  The authentication
 and password calls will silently fail (allowing that status to be ignored
 via a control of C<optional> or C<sufficient>), and the account and
 session calls (including pam_setcred) will return PAM_IGNORE, telling the
 PAM library to proceed as if they weren't mentioned in the PAM
 configuration.  This option is supported and will remain, but normally you
 want to use I<minimum_uid> instead.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf>.
 
 =item minimum_uid=<uid>
 
 [2.0] Do not do anything if the authenticated account name corresponds to
 a local account and that local account has a UID lower than <uid>.  If
 both of those conditions are true, the authentication and password calls
 will silently fail (allowing that status to be ignored via a control of
 C<optional> or C<sufficient>), and the account and session calls
 (including pam_setcred) will return PAM_IGNORE, telling the PAM library to
 proceed as if they weren't mentioned in the PAM configuration.
 
 Using this option is highly recommended if you don't need to use Kerberos
 to authenticate password logins to the root account (which isn't
 recommended since Kerberos requires a network connection).  It provides
 some defense in depth against user principals that happen to match a
 system account incorrectly authenticating as that system account.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf>.
 
 =item only_alt_auth
 
 [3.12] This option is used with I<alt_auth_map> and forces the use of the
 mapped principal for authentication.  It disables fallback to normal
 authentication in all cases and overrides I<search_k5login> and
 I<force_alt_auth>.  If I<alt_auth_map> is not set, it has no effect and
 the standard authentication behavior is used.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item search_k5login
 
 [2.0] Normally, the Kerberos implementation of pam_authenticate attempts
 to obtain tickets for the authenticating username in the local realm.  If
 this option is set and the local user has a F<.k5login> file in their home
 directory, the module will instead open and read that F<.k5login> file,
 attempting to use the supplied password to authenticate as each principal
 listed there in turn.  If any of those authentications succeed, the user
 will be successfully authenticated; otherwise, authentication will fail.
 This option is useful for allowing password authentication (via console or
 B<sshd> without GSS-API support) to shared accounts.  If there is no
 F<.k5login> file, the behavior is the same as normal.  Using this option
 requires that the user's F<.k5login> file be readable at the time of
 authentication.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =back
 
 =head2 Kerberos Behavior
 
 =over 4
 
 =item anon_fast
 
 [4.6] Attempt to use Flexible Authentication Secure Tunneling (FAST) by
 first authenticating as the anonymous user (WELLKNOWN/ANONYMOUS) and using
 its credentials as the FAST armor.  This requires anonymous PKINIT be
 enabled for the local realm, that PKINIT be configured on the local
 system, and that the Kerberos library support FAST and anonymous PKINIT.
 
 FAST is a mechanism to protect Kerberos against password guessing attacks
 and provide other security improvements.  To work, FAST requires that a
 ticket be obtained with a strong key to protect exchanges with potentially
 weaker user passwords.  This option uses anonymous authentication to
 obtain that key and then uses it to protect the subsequent authentication.
 
 If anonymous PKINIT is not available or fails, FAST will not be used and
 the authentication will proceed as normal.
 
 To instead use an existing ticket cache for the FAST credentials, use
 I<fast_ccache> instead of this option.  If both I<fast_ccache> and
 I<anon_fast> are set, the ticket cache named by I<fast_ccache> will be
 tried first, and the Kerberos PAM module will fall back on attempting
 anonymous PKINIT if that cache could not be used.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and password groups.
 
 The operation is the same as if using the I<fast_ccache> option, but the
 cache is created and destroyed automatically.  If both I<fast_ccache> and
 I<anon_fast> options are used, the I<fast_ccache> takes precedent and no
 anonymous authentication is done.
 
 =item fast_ccache=<ccache_name>
 
 [4.3] The same as I<anon_fast>, but use an existing Kerberos ticket cache
 rather than anonymous PKINIT.  This allows use of FAST with a realm that
 doesn't support PKINIT or doesn't support anonymous authentication.
 
 <ccache_name> should be a credential cache containing a ticket obtained
 using a strong key, such as the randomized key for the host principal of
 the local system.  If <ccache_name> names a ticket cache that is readable
 by the authenticating process and has tickets then FAST will be attempted.
 The easiest way to use this option is to use a program like B<k5start> to
 maintain a ticket cache using the host's keytab.  This ticket cache should
 normally only be readable by root, so this option will not be able to
 protect authentications done as non-root users (such as screensavers).
 
 If no credentials are present in the ticket cache, or if the ticket cache
 does not exist or is not readable, FAST will not used and authentication
 will proceed as normal.  However, if the credentials in that ticket cache
 are expired, authentication will fail if the KDC supports FAST.
 
 To use anonymous PKINIT to protect the FAST exchange, use the I<anon_fast>
 option instead.  I<anon_fast> is easier to configure, since no existing
 ticket cache is required, but requires PKINIT be available and configured
 and that the local realm support anonymous authentication.  If both
 I<fast_ccache> and I<anon_fast> are set, the ticket cache named by
 I<fast_ccache> will be tried first, and the Kerberos PAM module will fall
 back on attempting anonymous PKINIT if that cache could not be used.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and password groups.
 
 =item forwardable
 
 [1.0] Obtain forwardable tickets.  If set (to either true or false,
 although it can only be set to false in F<krb5.conf>), this overrides the
 Kerberos library default set in the [libdefaults] section of F<krb5.conf>.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item keytab=<path>
 
 [3.0] Specifies the keytab to use when validating the user's credentials.
 The default is the default system keytab (normally F</etc/krb5.keytab>),
 which is usually only readable by root.  Applications not running as root
 that use this PAM module for authentication may wish to point it to
 another keytab the application can read.  The first principal found in the
 keytab will be used as the principal for credential verification.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item realm=<realm>
 
 [2.2] Set the default Kerberos realm and obtain credentials in that realm,
 rather than in the normal default realm for this system.  If this option
 is used, it should be set for all groups being used for consistent
 results.  This setting will affect authorization decisions since it
 changes the default realm.  This setting will also change the service
 principal used to verify the obtained credentials to be in the specified
 realm.
 
 If you only want to set the realm assumed for user principals without
 changing the realm for authorization decisions or the service principal
 used to verify credentials, see the I<user_realm> option.
 
 =item renew_lifetime=<lifetime>
 
 [2.0] Obtain renewable tickets with a maximum renewable lifetime of
 <lifetime>.  <lifetime> should be a Kerberos lifetime string such as
 C<2d4h10m> or a time in minutes.  If set, this overrides the Kerberos
 library default set in the [libdefaults] section of F<krb5.conf>.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item ticket_lifetime=<lifetime>
 
 [3.0] Obtain tickets with a maximum lifetime of <lifetime>.  <lifetime>
 should be a Kerberos lifetime string such as C<2d4h10m> or a time in
 minutes.  If set, this overrides the Kerberos library default set in the
 [libdefaults] section of F<krb5.conf>.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item user_realm
 
 [4.6] Obtain credentials in the specified realm rather than in the default
 realm for this system.  If this option is used, it should be set for all
 groups being used for consistent results (although the account group
 currently doesn't care about realm).  This will not change authorization
 decisions.  If the obtained credentials are supposed to allow access to a
 shell account, the user will need an appropriate F<.k5login> file entry or
 the system will have to have a custom aname_to_localname mapping.
 
 =back
 
 =head2 PAM Behavior
 
 =over 4
 
 =item clear_on_fail
 
 [3.9] When changing passwords, PAM first does a preliminary check through
 the complete password stack, and then calls each module again to do the
 password change.  After that preliminary check, the order of module
 invocation is fixed.  This means that even if the Kerberos password change
 fails (or if one of the other password changes in the stack fails), other
 password PAM modules in the stack will still be called even if the failing
 module is marked required or requisite.  When using multiple password PAM
 modules to synchronize passwords between multiple systems when they
 change, this behavior can cause unwanted differences between the
 environments.
 
 Setting this option provides a way to work around this behavior.  If this
 option is set and a Kerberos password change is attempted and fails (due
 to network errors or password strength checking on the KDC, for example),
 this module will clear the stored password in the PAM stack.  This will
 force any subsequent modules that have I<use_authtok> set to fail so that
 those environments won't get out of sync with the password in Kerberos.
 The Kerberos PAM module will not meddle with the stored password if it
 skips the user due to configuration such as minimum_uid.
 
 Unfortunately, setting this option interferes with other desirable PAM
 configurations, such as attempting to change the password in Kerberos
 first and falling back on the local Unix password database if that fails.
 It therefore isn't the default.  Turn it on (and list pam_krb5 first after
 pam_cracklib if used) when synchronizing passwords between multiple
 environments.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the password group.
 
 =item debug
 
 [1.0] Log more verbose trace and debugging information to syslog at
 LOG_DEBUG priority, including entry and exit from each of the external PAM
 interfaces (except pam_close_session).
 
 This option can be set in C<[appdefaults]> in F<krb5.conf>.
 
 =item defer_pwchange
 
 [3.11] By default, pam-krb5 lets the Kerberos library handle prompting for
 a password change if an account's password is expired during the auth
 group.  If this fails, pam_authenticate() returns an error.
 
 According to the PAM standard, this is not the correct way to handle
 expired passwords.  Instead, pam_authenticate() should return success
 without attempting a password change, and then pam_acct_mgmt() should
 return PAM_NEW_AUTHTOK_REQD, at which point the calling application is
 responsible for either rejecting the authentication or calling
 pam_chauthtok().  However, following the standard requires that all
 applications call pam_acct_mgmt() and check its return status; otherwise,
 expired accounts may be able to successfully authenticate.  Many
 applications do not do this.
 
 If this option is set, pam-krb5 uses the fully correct PAM mechanism for
 handling expired accounts instead of failing in pam_authenticate().  Due
 to the security risk of widespread broken applications, be very careful
 about enabling this option.  It should normally only be turned on to solve
 a specific problem (such as using Solaris Kerberos libraries that don't
 support prompting for password changes during authentication), and then
 only for specific applications known to call pam_acct_mgmt() and check its
 return status properly.
 
 This option is only supported when pam-krb5 is built with MIT Kerberos.
 If built against Heimdal, this option does nothing and normal expired
 password change handling still happens.  (Heimdal is missing the required
 API to implement this option, at least as of version 1.6.)
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item fail_pwchange
 
 [4.2] By default, pam-krb5 lets the Kerberos library handle prompting for
 a password change if an account's password is expired during the auth
 group.  If this option is set, expired passwords are instead treated as an
 authentication failure identical to an incorrect password.  Also see
 I<defer_pwchange> and I<force_pwchange>.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item force_pwchange
 
 [3.11] If this option is set and authentication fails with a Kerberos
 error indicating the user's password is expired, attempt to immediately
 change their password during the authenticate step.  Under normal
 circumstances, this is unnecessary.  Most Kerberos libraries will do this
 for you, and setting this option will prompt the user twice to change
 their password if the first attempt (done by the Kerberos library) fails.
 However, some system Kerberos libraries (such as Solaris's) have password
 change prompting disabled in the Kerberos library; on those systems, you
 can set this option to simulate the normal library behavior.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item no_update_user
 
 [4.7] Normally, if pam-krb5 is able to canonicalize the principal to a
 local name using krb5_aname_to_localname() or similar calls, it changes
 the PAM_USER variable for this PAM session to the canonicalized local
 name.  Setting this option disables this behavior and leaves PAM_USER set
 to the initial authentication identity.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth group.
 
 =item silent
 
 [1.0] Don't show messages and errors from Kerberos, such as warnings of
 expiring passwords, to the user via the prompter.  This is equivalent to
 the behavior when the application passes in PAM_SILENT, but can be set in
 the PAM configuration.
 
 This option is only applicable to the auth and password groups.
 
 =item trace=<log-file>
 
 [4.6] Enables Kerberos library trace logging to the specified log file if
 it is supported by the Kerberos library.  This is intended for temporary
 debugging.  The specified file will be appended to without further
 security checks, so do not specify a file in a publicly writable directory
 like F</tmp>.
 
 =back
 
 =head2 PKINIT
 
 =over 4
 
 =item pkinit_anchors=<anchors>
 
 [3.0] When doing PKINIT authentication, use <anchors> as the client trust
 anchors.  This is normally a reference to a file containing the trusted
 certificate authorities.  This option is only used if I<try_pkinit> or
 I<use_pkinit> are set.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and password groups.
 
 =item pkinit_prompt
 
 [3.0] Before attempting PKINIT authentication, prompt the user to insert a
 smart card.  You may want to set this option for programs such as
 B<gnome-screensaver> that call PAM as soon as the mouse is touched and
 don't give the user an opportunity to enter the smart card first.  Any
 information entered at the first prompt is ignored.  If I<try_pkinit> is
 set, a user who wishes to use a password instead can just press Enter and
 then enter their password as normal.  This option is only used if
 I<try_pkinit> or I<use_pkinit> are set.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and password groups.
 
 =item pkinit_user=<userid>
 
 [3.0] When doing PKINIT authentication, use <userid> as the user ID.  The
 value of this string is highly dependent on the type of PKINIT
 implementation you're using, but will generally be something like:
 
     PKCS11:/usr/lib/pkcs11/lib/soft-pkcs11.so
 
 to specify the module to use with a smart card.  It may also point to a
 user certificate or to other types of user IDs.  See the Kerberos library
 documentation for more details.  This option is only used if I<try_pkinit>
 or I<use_pkinit> are set.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and password groups.
 
 =item preauth_opt=<option>
 
 [3.3] Sets a preauth option (currently only applicable when built with MIT
 Kerberos).  <option> is either a key/value pair with the key separated
 from the value by C<=> or a boolean option (in which case it's turned on).
 In F<krb5.conf>, multiple options should be separated by whitespace.  In
 the PAM configuration, this option can be given multiple times to set
 multiple options.  In either case, <option> may not contain whitespace.
 
 The primary use of this option, at least in the near future, will be to
 set options for the MIT Kerberos PKINIT support.  For the full list of
 possible options, see the PKINIT plugin documentation.  At the time of
 this writing, C<X509_user_identity> is equivalent to I<pkinit_user> and
 C<X509_anchors> is equivalent to I<pkinit_anchors>.  C<flag_DSA_PROTOCOL>
 can only be set via this option.
 
 Any settings made with this option are applied after the I<pkinit_anchors>
 and I<pkinit_user> options, so if an equivalent setting is made via
 I<preauth_opt>, it will probably override the other setting.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and password groups.  Note that there is no way to
 remove a setting made in F<krb5.conf> using the PAM configuration, but
 options set in the PAM configuration are applied after options set in
 F<krb5.conf> and therefore may override earlier settings.
 
 =item try_pkinit
 
 [3.0] Attempt PKINIT authentication before trying a regular password.  You
 will probably also need to set the I<pkinit_user> configuration option.
 If PKINIT fails, the PAM module will fall back on regular password
 authentication.  This option is currently only supported if pam-krb5 was
 built against Heimdal 0.8rc1 or later or MIT Kerberos 1.6.3 or later.
 
 If this option is set and pam-krb5 is built against MIT Kerberos, and
 PKINIT fails and the module falls back to password authentication, the
 user's password will not be stored in the PAM stack for subsequent
 modules.  This is a bug in the interaction between the module and MIT
 Kerberos that requires some reworking of the PKINIT authentication method
 to fix.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and password groups.
 
 =item use_pkinit
 
 [3.0, 4.9 for MIT Kerberos] Require PKINIT authentication.  You will
 probably also need to set the I<pkinit_user> configuration option.  If
 PKINIT fails, authentication will fail.  This option is only supported if
 pam-krb5 was built against Heimdal 0.8rc1 or later or MIT Kerberos 1.12 or
 later.
 
 Be aware that, with MIT Kerberos, this option is implemented by using a
 responder without a prompter, and thus any informational messages from the
 Kerberos libraries or KDC during authentication will not be displayed.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and password groups.
 
 =back
 
 =head2 Prompting
 
 =over 4
 
 =item banner=<banner>
 
 [3.0] By default, the prompts when a user changes their password are:
 
     Current Kerberos password:
     Enter new Kerberos password:
     Retype new Kerberos password:
 
 The string "Kerberos" is inserted so that users aren't confused about
 which password they're changing.  Setting this option replaces the word
 "Kerberos" with whatever this option is set to.  Setting this option to
 the empty string removes the word before "password:" entirely.
 
 If set in the PAM configuration, <banner> may not contain whitespace.  If
 you want a value containing whitespace, set it in F<krb5.conf>.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the password group.
 
 =item expose_account
 
 [3.0] By default, the Kerberos PAM module password prompt is simply
 "Password:".  This avoids leaking any information about the system realm
 or account to principal conversions.  If this option is set, the string
 "for <principal>" is added before the colon, where <principal> is the
 user's principal.  This string is also added before the colon on prompts
 when changing the user's password.
 
 Enabling this option with ChallengeResponseAuthentication enabled in
 OpenSSH may cause problems for some ssh clients that only recognize
 "Password:" as a prompt.  This option is automatically disabled if
 I<search_k5login> is enabled since the principal displayed would be
 inaccurate.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and password groups.
 
 =item force_first_pass
 
 [4.0] Use the password obtained by a previous authentication or password
 module to authenticate the user without prompting the user again.  If no
 previous module obtained the user's password, fail without prompting the
 user.  Also see I<try_first_pass> and I<use_first_pass> for weaker
 versions of this option.
 
 This option is only applicable to the auth and password groups.  For the
 password group, it applies only to the old password.  See I<use_authtok>
 for a similar setting for the new password.
 
 =item no_prompt
 
 [4.6] Never prompt for the current password.  Instead, pass in a NULL
 password to the Kerberos library and let the Kerberos library do the
 prompting.  This may be needed if, for example, the Kerberos library is
 configured to use other authentication mechanisms than passwords and needs
 full control over the prompting process.
 
 The major disadvantage of this option is that it means the PAM module will
 never see the user's password and therefore cannot save it in the PAM
 module data for any subsequent modules.  In other words, this option
 cannot be used if another module is in the stack behind the Kerberos PAM
 module and wants to use I<use_first_pass>.  The Kerberos library also
 usually includes the principal in the prompt, and therefore this option
 implies behavior similar to I<expose_account>.  Similar to
 I<expose_account>, this can cause problems with OpenSSH if
 ChallengeResponseAuthentication is enabled, since clients may not
 recognize password prompts other than "Password:".
 
 Using this option with I<search_k5login> would result in a password prompt
 for every principal listed in the user's F<.k5login> file.  This is
 probably not desired behavior, although it's not prohibited by the module.
 
 This option is only applicable to the auth and password groups.  For the
 password group, it applies only to the authentication process; the user
 will still be prompted for a new password.
 
 =item prompt_principal
 
 [3.6] Before prompting for the user's password (or using the previously
 entered password, if I<try_first_pass>, I<use_first_pass>, or
 I<force_first_pass> are set), prompt the user for the Kerberos principal
 to use for authentication.  This allows the user to authenticate with a
 different principal than the one corresponding to the local username,
 provided that either a F<.k5login> file or local Kerberos principal to
 account mapping authorize that principal to access the local account.
 
 Be cautious when using this configuration option and don't use it with
 OpenSSH PasswordAuthentication, only ChallengeResponseAuthentication.
 Some PAM-enabled applications expect PAM modules to only prompt for
 passwords and may even blindly give the password to the first prompt, no
 matter what it is.  Such applications, in combination with this option,
 may expose the user's password in log messages and Kerberos requests.
 
 =item try_first_pass
 
 [1.0] If the authentication module isn't the first on the stack, and a
 previous module obtained the user's password, use that password to
 authenticate the user without prompting them again.  If that
 authentication fails, fall back on prompting the user for their password.
 This option has no effect if the authentication module is first in the
 stack or if no previous module obtained the user's password.  Also see
 I<use_first_pass> and I<force_first_pass> for stronger versions of this
 option.
 
 This option is only applicable to the auth and password groups.  For the
 password group, it applies only to the old password.
 
 =item use_authtok
 
 [4.0] Use the new password obtained by a previous password module when
 changing passwords rather than prompting for the new password.  If the new
 password isn't available, fail.  This can be used to require passwords be
 checked by another, prior module, such as B<pam_cracklib>.
 
 This option is only applicable to the password group.
 
 =item use_first_pass
 
 [1.0] Use the password obtained by a previous authentication module to
 authenticate the user without prompting the user again.  If no previous
 module obtained the user's password for either an authentication or
 password change, fall back on prompting the user.  If a previous module
 did obtain the user's password but authentication with that password
 fails, fail without further prompting the user.  Also see
 I<try_first_pass> and I<force_first_pass> for other versions of this
 option.
 
 This option is only applicable to the auth and password groups.  For the
 password group, it applies only to the old password.  See I<use_authtok>
 for a similar setting for the new password.
 
 =back
 
 =head2 Ticket Caches
 
 =over 4
 
 =item ccache=<pattern>
 
 [2.0] Use <pattern> as the pattern for creating credential cache names.
 <pattern> must be in the form <type>:<residual> where <type> and the
 following colon are optional if a file cache should be used.  The special
 token C<%u>, anywhere in <pattern>, is replaced with the user's numeric
 UID.  The special token C<%p>, anywhere in <pattern>, is replaced with the
 current process ID.
 
 If <pattern> ends in the literal string C<XXXXXX> (six X's), that string
 will be replaced by randomly generated characters and the ticket cache
 will be created using mkstemp(3).  This is strongly recommended if
 <pattern> points to a world-writable directory.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and session groups.
 
 =item ccache_dir=<directory>
 
 [1.2] Store both the temporary ticket cache used during authentication and
 user ticket caches in <directory> instead of in F</tmp>.  The algorithm
 for generating the ticket cache name is otherwise unchanged.  <directory>
 may be prefixed with C<FILE:> to make the cache type unambiguous (and this
 may be required on systems that use a cache type other than file as the
 default).
 
 Be aware that pam_krb5 creates and stores a temporary ticket cache file
 owned by root during the login process.  If you set I<ccache> above to
 avoid using the system F</tmp> directory for user ticket caches, you may
 also want to set I<ccache_dir> to move those temporary caches to some
 other location.  This will allow pam_krb5 to continue working even if the
 system F</tmp> directory is full.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and session groups.
 
 =item no_ccache
 
 [1.0] Do not create a ticket cache after authentication.  This option
 shouldn't be set in general, but is useful as part of the PAM
 configuration for a particular service that uses PAM for authentication
 but isn't creating user sessions and doesn't want the overhead of ever
 writing the user credentials to disk.  When using this option, the
 application should only call pam_authenticate(); other functions like
 pam_setcred(), pam_start_session(), and pam_acct_mgmt() don't make sense
 with this option.  Don't use this option if the application needs PAM
 account and session management calls.
 
 This option is only applicable to the auth group.
 
 =item retain_after_close
 
 [2.3] Normally, the user's ticket cache is destroyed when either pam_end()
 or pam_close_session() is called by the authenticating application so that
 ticket caches aren't left behind after the user logs out.  In some cases,
 however, this isn't desirable.  (On Solaris 8, for instance, the default
 behavior means login will destroy the ticket cache before running the
 user's shell.)  If this option is set, the PAM module will never destroy
 the user's ticket cache.  If you set this, you may want to call
 B<kdestroy> in the shell's logout configuration or run a temporary file
 removal program to avoid accumulating hundreds of ticket caches in
 F</tmp>.
 
 This option can be set in C<[appdefaults]> in F<krb5.conf> and is only
 applicable to the auth and session groups.
 
 =back
 
 =head1 ENVIRONMENT
 
 =over 4
 
 =item KRB5CCNAME
 
 Set by pam_setcred() with the PAM_ESTABLISH_CRED option, and therefore
 also by pam_open_session(), to point to the new credential cache for the
 user.  See the I<ccache> and I<ccache_dir> options.  By default, the cache
 name will be prefixed with C<FILE:> to make the cache type unambiguous.
 
 =item PAM_KRB5CCNAME
 
 Set by pam_authenticate() to point to the temporary ticket cache used for
 authentication (unless the I<no_ccache> option was given).  pam_setcred()
 then uses that environment variable to locate the temporary cache even if
 it was not called in the same PAM session as pam_authenticate() (a problem
 with B<sshd> running in some modes).  This environment variable is only
 used internal to the PAM module.
 
 =back
 
 =head1 FILES
 
 =over 4
 
 =item F</tmp/krb5cc_UID_RANDOM>
 
 The default credential cache name.  UID is the decimal UID of the local
 user and RANDOM is a random six-character string.  The pattern may be
 changed with the I<ccache> option and the directory with the I<ccache_dir>
 option.
 
 =item F</tmp/krb5cc_pam_RANDOM>
 
 The credential cache name used for the temporary credential cache created
 by pam_authenticate().  This cache is removed again when the PAM session
 is ended or when pam_setcred() is called and will normally not be
 user-visible.  RANDOM is a random six-character string.
 
 =item F<~/.k5login>
 
 File containing Kerberos principals that are allowed access to that
 account.
 
 =back
 
 =head1 BUGS
 
 If I<try_pkinit> is set and pam-krb5 is built with MIT Kerberos, the
 user's password is not saved in the PAM data if PKINIT fails and the
 module falls back to password authentication.
 
 =head1 CAVEATS
 
 Be sure to list this module in the session group as well as the auth group
 when using it for interactive logins.  Otherwise, some applications (such
 as OpenSSH) will not set up the user's ticket cache correctly.
 
 The Kerberos library, via pam-krb5, will prompt the user to change their
 password if their password is expired, but when using OpenSSH, this will
 only work when ChallengeResponseAuthentication is enabled.  Unless this
 option is enabled, OpenSSH doesn't pass PAM messages to the user and can
 only respond to a simple password prompt.
 
 If you are using MIT Kerberos, be aware that users whose passwords are
 expired will not be prompted to change their password unless the KDC
 configuration for your realm in [realms] in krb5.conf contains a
 master_kdc setting or, if using DNS SRV records, you have a DNS entry for
 _kerberos-master as well as _kerberos.
 
 pam_authenticate() returns failure when called for an ignored account,
 requiring the system administrator to use C<optional> or C<sufficient> to
 ignore the module and move on to the next module.  It's arguably more
 correct to return PAM_IGNORE, which causes the module to be ignored as if
 it weren't in the configuration, but this increases the risk of
 inadvertent security holes when listing pam-krb5 as the only
 authentication module.
 
 This module treats the empty password as an authentication failure
 rather than attempting to use that password to avoid unwanted prompting
 behavior in the Kerberos libraries.  If you have a Kerberos principal that
 intentionally has an empty password, it won't work with this module.
 
 This module will not refresh an existing ticket cache if called with an
 effective UID or GID different than the real UID or GID, since refreshing
 an existing ticket cache requires trusting the KRB5CCNAME environment
 variable and the environment should not be trusted in a setuid context.
 
 Old versions of OpenSSH are known to call pam_authenticate followed by
 pam_setcred(PAM_REINITIALIZE_CRED) without first calling pam_open_session,
 thereby requesting that an existing ticket cache be renewed (similar to
 what a screensaver would want) rather than requesting a new ticket cache
 be created.  Since this behavior is indistinguishable at the PAM level
 from a screensaver, pam-krb5 when used with these old versions of OpenSSH
 will refresh the ticket cache of the OpenSSH daemon rather than setting up
 a new ticket cache for the user.  The resulting ticket cache will have the
 correct permissions, but will not be named correctly or referenced in the
 user's environment and will be overwritten by the next user login.  The
 best solution to this problem is to upgrade OpenSSH.  I'm not sure exactly
 when this problem was fixed, but at the very least OpenSSH 4.3 and later
 do not exhibit it.
 
 =head1 AUTHOR
 
 pam-krb5 was originally written by Frank Cusack.  Andres Salomon made
 extensive modifications, and then Russ Allbery <eagle@eyrie.org> adopted
 it and made even more extensive modifications.  Russ Allbery currently
 maintains the module.
 
 =head1 COPYRIGHT AND LICENSE
 
 Copyright 2005-2010, 2014, 2020 Russ Allbery <eagle@eyrie.org>
 
 Copyright 2008-2014 The Board of Trustees of the Leland Stanford Junior
 University
 
 Copying and distribution of this file, with or without modification, are
 permitted in any medium without royalty provided the copyright notice and
 this notice are preserved.  This file is offered as-is, without any
 warranty.
 
 SPDX-License-Identifier: FSFAP
 
 =head1 SEE ALSO
 
 kadmin(8), kdestroy(1), krb5.conf(5), pam(7), passwd(1), syslog(3)
 
 The current version of this module is available from its web page at
 L<https://www.eyrie.org/~eagle/software/pam-krb5/>.
 
 =cut
diff --git a/contrib/pam-krb5/module/auth.c b/contrib/pam-krb5/module/auth.c
index 065ce97b6596..46f2be791000 100644
--- a/contrib/pam-krb5/module/auth.c
+++ b/contrib/pam-krb5/module/auth.c
@@ -1,1135 +1,1141 @@
 /*
  * Core authentication routines for pam_krb5.
  *
  * The actual authentication work is done here, either via password or via
  * PKINIT.  The only external interface is pamk5_password_auth, which calls
  * the appropriate internal functions.  This interface is used by both the
  * authentication and the password groups.
  *
  * Copyright 2005-2010, 2014-2015, 2017, 2020
  *     Russ Allbery <eagle@eyrie.org>
  * Copyright 2010-2012, 2014
  *     The Board of Trustees of the Leland Stanford Junior University
  * Copyright 2005 Andres Salomon <dilinger@debian.org>
  * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
  *
  * SPDX-License-Identifier: BSD-3-clause or GPL-1+
  */
 
 #include <config.h>
 #include <portable/krb5.h>
 #include <portable/pam.h>
 #include <portable/system.h>
 
 #include <errno.h>
 #ifdef HAVE_HX509_ERR_H
 #    include <hx509_err.h>
 #endif
 #include <pwd.h>
 #include <sys/stat.h>
 
 #include <module/internal.h>
 #include <pam-util/args.h>
 #include <pam-util/logging.h>
 #include <pam-util/vector.h>
 
 /*
  * If the PKINIT smart card error statuses aren't defined, define them to 0.
  * This will cause the right thing to happen with the logic around PKINIT.
  */
 #ifndef HX509_PKCS11_NO_TOKEN
 #    define HX509_PKCS11_NO_TOKEN 0
 #endif
 #ifndef HX509_PKCS11_NO_SLOT
 #    define HX509_PKCS11_NO_SLOT 0
 #endif
 
 
 /*
  * Fill in ctx->princ from the value of ctx->name or (if configured) from
  * prompting.  If we don't prompt and ctx->name contains an @-sign,
  * canonicalize it to a local account name unless no_update_user is set.  If
  * the canonicalization fails, don't worry about it.  It may be that the
  * application doesn't care.
  */
 static krb5_error_code
 parse_name(struct pam_args *args)
 {
     struct context *ctx = args->config->ctx;
     krb5_context c = ctx->context;
     char *user_realm;
     char *user = ctx->name;
     char *newuser = NULL;
     char kuser[65] = ""; /* MAX_USERNAME == 65 (MIT Kerberos 1.4.1). */
     krb5_error_code k5_errno;
     int retval;
 
     /*
      * If configured to prompt for the principal, do that first.  Fall back on
      * using the local username as normal if prompting fails or if the user
      * just presses Enter.
      */
     if (args->config->prompt_principal) {
         retval = pamk5_conv(args, "Principal: ", PAM_PROMPT_ECHO_ON, &user);
         if (retval != PAM_SUCCESS)
             putil_err_pam(args, retval, "error getting principal");
         if (*user == '\0') {
             free(user);
             user = ctx->name;
         }
     }
 
     /*
      * We don't just call krb5_parse_name so that we can work around a bug in
      * MIT Kerberos versions prior to 1.4, which store the realm in a static
      * variable inside the library and don't notice changes.  If no realm is
      * specified and a realm is set in our arguments, append the realm to
      * force krb5_parse_name to do the right thing.
      */
     user_realm = args->realm;
     if (args->config->user_realm)
         user_realm = args->config->user_realm;
     if (user_realm != NULL && strchr(user, '@') == NULL) {
         if (asprintf(&newuser, "%s@%s", user, user_realm) < 0) {
             if (user != ctx->name)
                 free(user);
             return KRB5_CC_NOMEM;
         }
         if (user != ctx->name)
             free(user);
         user = newuser;
     }
     k5_errno = krb5_parse_name(c, user, &ctx->princ);
     if (user != ctx->name)
         free(user);
     if (k5_errno != 0)
         return k5_errno;
 
     /*
      * Now that we have a principal to call krb5_aname_to_localname, we can
      * canonicalize ctx->name to a local name.  We do this even if we were
      * explicitly prompting for a principal, but we use ctx->name to generate
      * the local username, not the principal name.  It's unlikely, and would
      * be rather weird, if the user were to specify a principal name for the
      * username and then enter a different username at the principal prompt,
      * but this behavior seems to make the most sense.
      *
      * Skip canonicalization if no_update_user was set.  In that case,
      * continue to use the initial authentication identity everywhere.
      */
     if (strchr(ctx->name, '@') != NULL && !args->config->no_update_user) {
         if (krb5_aname_to_localname(c, ctx->princ, sizeof(kuser), kuser) != 0)
             return 0;
         user = strdup(kuser);
         if (user == NULL) {
             putil_crit(args, "cannot allocate memory: %s", strerror(errno));
             return 0;
         }
         free(ctx->name);
         ctx->name = user;
         args->user = user;
     }
     return k5_errno;
 }
 
 
 /*
  * Set initial credential options based on our configuration information, and
  * using the Heimdal call to set initial credential options if it's available.
  * This function is used both for regular password authentication and for
  * PKINIT.  It also configures FAST if requested and the Kerberos libraries
  * support it.
  *
  * Takes a flag indicating whether we're getting tickets for a specific
  * service.  If so, we don't try to get forwardable, renewable, or proxiable
  * tickets.
  */
 static void
 set_credential_options(struct pam_args *args, krb5_get_init_creds_opt *opts,
                        int service)
 {
     struct pam_config *config = args->config;
     krb5_context c = config->ctx->context;
 
     krb5_get_init_creds_opt_set_default_flags(c, "pam", args->realm, opts);
     if (!service) {
         if (config->forwardable)
             krb5_get_init_creds_opt_set_forwardable(opts, 1);
         if (config->ticket_lifetime != 0)
             krb5_get_init_creds_opt_set_tkt_life(opts,
                                                  config->ticket_lifetime);
         if (config->renew_lifetime != 0)
             krb5_get_init_creds_opt_set_renew_life(opts,
                                                    config->renew_lifetime);
         krb5_get_init_creds_opt_set_change_password_prompt(
             opts, (config->defer_pwchange || config->fail_pwchange) ? 0 : 1);
     } else {
         krb5_get_init_creds_opt_set_forwardable(opts, 0);
         krb5_get_init_creds_opt_set_proxiable(opts, 0);
         krb5_get_init_creds_opt_set_renew_life(opts, 0);
     }
     pamk5_fast_setup(args, opts);
 
     /*
      * Set options for PKINIT.  Only used with MIT Kerberos; Heimdal's
      * implementation of PKINIT uses a separate API instead of setting
      * get_init_creds options.
      */
 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PA
     if (config->use_pkinit || config->try_pkinit) {
         if (config->pkinit_user != NULL)
             krb5_get_init_creds_opt_set_pa(c, opts, "X509_user_identity",
                                            config->pkinit_user);
         if (config->pkinit_anchors != NULL)
             krb5_get_init_creds_opt_set_pa(c, opts, "X509_anchors",
                                            config->pkinit_anchors);
         if (config->preauth_opt != NULL && config->preauth_opt->count > 0) {
             size_t i;
             char *name, *value;
             char save = '\0';
 
             for (i = 0; i < config->preauth_opt->count; i++) {
                 name = config->preauth_opt->strings[i];
                 if (name == NULL)
                     continue;
                 value = strchr(name, '=');
                 if (value != NULL) {
                     save = *value;
                     *value = '\0';
                     value++;
                 }
                 krb5_get_init_creds_opt_set_pa(
                     c, opts, name, (value != NULL) ? value : "yes");
                 if (value != NULL)
                     value[-1] = save;
             }
         }
     }
 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PA */
 }
 
 
 /*
  * Retrieve the existing password (authtok) stored in the PAM data if
  * appropriate and if available.  We decide whether to retrieve it based on
  * the PAM configuration, and also decied whether failing to retrieve it is a
  * fatal error.  Takes the PAM arguments, the PAM authtok code to retrieve
  * (may be PAM_AUTHTOK or PAM_OLDAUTHTOK depending on whether we're
  * authenticating or changing the password), and the place to store the
  * password.  Returns a PAM status code.
  *
  * If try_first_pass, use_first_pass, or force_first_pass is set, grab the old
  * password (if set).  If force_first_pass is set, fail if the password is not
  * already set.
  *
  * The empty password has to be handled separately, since the Kerberos
  * libraries may treat it as equivalent to no password and prompt when we
  * don't want them to.  We make the assumption here that the empty password is
  * always invalid and is an authentication failure.
  */
 static int
 maybe_retrieve_password(struct pam_args *args, int authtok, const char **pass)
 {
     int status;
     const bool try_first = args->config->try_first_pass;
     const bool use = args->config->use_first_pass;
     const bool force = args->config->force_first_pass;
 
     *pass = NULL;
     if (!try_first && !use && !force)
         return PAM_SUCCESS;
     status = pam_get_item(args->pamh, authtok, (PAM_CONST void **) pass);
     if (*pass != NULL && **pass == '\0') {
         if (use || force) {
             putil_debug(args, "rejecting empty password");
             return PAM_AUTH_ERR;
         }
         *pass = NULL;
     }
     if (*pass != NULL && strlen(*pass) > PAM_MAX_RESP_SIZE - 1) {
         putil_debug(args, "rejecting password longer than %d",
                     PAM_MAX_RESP_SIZE - 1);
         return PAM_AUTH_ERR;
     }
     if (force && (status != PAM_SUCCESS || *pass == NULL)) {
         putil_debug_pam(args, status, "no stored password");
         return PAM_AUTH_ERR;
     }
     return PAM_SUCCESS;
 }
 
 
 /*
  * Prompt for the password.  Takes the PAM arguments, the authtok for which
  * we're prompting (may be PAM_AUTHTOK or PAM_OLDAUTHTOK depending on whether
  * we're authenticating or changing the password), and the place to store the
  * password.  Returns a PAM status code.
  *
  * If we successfully get a password, store it in the PAM data, free it, and
  * then return the password as retrieved from the PAM data so that we don't
  * have to worry about memory allocation later.
  *
  * The empty password has to be handled separately, since the Kerberos
  * libraries may treat it as equivalent to no password and prompt when we
  * don't want them to.  We make the assumption here that the empty password is
  * always invalid and is an authentication failure.
  */
 static int
 prompt_password(struct pam_args *args, int authtok, const char **pass)
 {
     char *password;
     int status;
     const char *prompt = (authtok == PAM_AUTHTOK) ? NULL : "Current";
 
     *pass = NULL;
     status = pamk5_get_password(args, prompt, &password);
     if (status != PAM_SUCCESS) {
         putil_debug_pam(args, status, "error getting password");
         return PAM_AUTH_ERR;
     }
     if (password[0] == '\0') {
         putil_debug(args, "rejecting empty password");
         free(password);
         return PAM_AUTH_ERR;
     }
     if (strlen(password) > PAM_MAX_RESP_SIZE - 1) {
         putil_debug(args, "rejecting password longer than %d",
                     PAM_MAX_RESP_SIZE - 1);
         explicit_bzero(password, strlen(password));
         free(password);
         return PAM_AUTH_ERR;
     }
 
     /* Set this for the next PAM module. */
     status = pam_set_item(args->pamh, authtok, password);
     explicit_bzero(password, strlen(password));
     free(password);
     if (status != PAM_SUCCESS) {
         putil_err_pam(args, status, "error storing password");
         return PAM_AUTH_ERR;
     }
 
     /* Return the password retrieved from PAM. */
     status = pam_get_item(args->pamh, authtok, (PAM_CONST void **) pass);
     if (status != PAM_SUCCESS) {
         putil_err_pam(args, status, "error retrieving password");
         status = PAM_AUTH_ERR;
     }
     return status;
 }
 
 
 /*
  * Authenticate via password.
  *
  * This is our basic authentication function.  Log what principal we're
  * attempting to authenticate with and then attempt password authentication.
  * Returns 0 on success or a Kerberos error on failure.
  */
 static krb5_error_code
 password_auth(struct pam_args *args, krb5_creds *creds,
               krb5_get_init_creds_opt *opts, const char *service,
               const char *pass)
 {
     struct context *ctx = args->config->ctx;
     krb5_error_code retval;
 
     /* Log the principal as which we're attempting authentication. */
     if (args->debug) {
         char *principal;
 
         retval = krb5_unparse_name(ctx->context, ctx->princ, &principal);
         if (retval != 0)
             putil_debug_krb5(args, retval, "krb5_unparse_name failed");
         else {
             if (service == NULL)
                 putil_debug(args, "attempting authentication as %s",
                             principal);
             else
                 putil_debug(args, "attempting authentication as %s for %s",
                             principal, service);
             free(principal);
         }
     }
 
     /* Do the authentication. */
     retval = krb5_get_init_creds_password(ctx->context, creds, ctx->princ,
                                           (char *) pass, pamk5_prompter_krb5,
                                           args, 0, (char *) service, opts);
 
     /*
      * Heimdal may return an expired key error even if the password is
      * incorrect.  To avoid accepting any incorrect password for the user
      * in the fully correct password change case, confirm that we can get
      * a password change ticket for the user using this password, and
      * otherwise change the error to invalid password.
      */
     if (retval == KRB5KDC_ERR_KEY_EXP) {
         krb5_get_init_creds_opt *heimdal_opts = NULL;
 
         retval = krb5_get_init_creds_opt_alloc(ctx->context, &heimdal_opts);
         if (retval == 0) {
             set_credential_options(args, opts, 1);
             retval = krb5_get_init_creds_password(
                 ctx->context, creds, ctx->princ, (char *) pass,
                 pamk5_prompter_krb5, args, 0, (char *) "kadmin/changepw",
                 heimdal_opts);
             krb5_get_init_creds_opt_free(ctx->context, heimdal_opts);
         }
         if (retval == 0) {
             retval = KRB5KDC_ERR_KEY_EXP;
             krb5_free_cred_contents(ctx->context, creds);
             explicit_bzero(creds, sizeof(krb5_creds));
         }
     }
     return retval;
 }
 
 
 /*
  * Authenticate by trying each principal in the .k5login file.
  *
  * Read through each line that parses correctly as a principal and use the
  * provided password to try to authenticate as that user.  If at any point we
  * succeed, fill out creds, set princ to the successful principal in the
  * context, and return 0.  Otherwise, return either a Kerberos error code or
  * errno for a system error.
  */
 static krb5_error_code
 k5login_password_auth(struct pam_args *args, krb5_creds *creds,
                       krb5_get_init_creds_opt *opts, const char *service,
                       const char *pass)
 {
     struct context *ctx = args->config->ctx;
     char *filename = NULL;
     char line[BUFSIZ];
     size_t len;
     FILE *k5login;
     struct passwd *pwd;
     struct stat st;
     krb5_error_code k5_errno, retval;
     krb5_principal princ;
 
     /*
      * C sucks at string manipulation.  Generate the filename for the user's
      * .k5login file.  If the user doesn't exist, the .k5login file doesn't
      * exist, or the .k5login file cannot be read, fall back on the easy way
      * and assume ctx->princ is already set properly.
      */
     pwd = pam_modutil_getpwnam(args->pamh, ctx->name);
     if (pwd != NULL)
         if (asprintf(&filename, "%s/.k5login", pwd->pw_dir) < 0) {
             putil_crit(args, "malloc failure: %s", strerror(errno));
             return errno;
         }
     if (pwd == NULL || filename == NULL || access(filename, R_OK) != 0) {
         free(filename);
         return krb5_get_init_creds_password(ctx->context, creds, ctx->princ,
                                             (char *) pass, pamk5_prompter_krb5,
                                             args, 0, (char *) service, opts);
     }
 
     /*
      * Make sure the ownership on .k5login is okay.  The user must own their
      * own .k5login or it must be owned by root.  If that fails, set the
      * Kerberos error code to errno.
      */
     k5login = fopen(filename, "r");
     if (k5login == NULL) {
         retval = errno;
         free(filename);
         return retval;
     }
     free(filename);
     if (fstat(fileno(k5login), &st) != 0) {
         retval = errno;
         goto fail;
     }
     if (st.st_uid != 0 && (st.st_uid != pwd->pw_uid)) {
         retval = EACCES;
         putil_err(args, "unsafe .k5login ownership (saw %lu, expected %lu)",
                   (unsigned long) st.st_uid, (unsigned long) pwd->pw_uid);
         goto fail;
     }
 
     /*
      * Parse the .k5login file and attempt authentication for each principal.
      * Ignore any lines that are too long or that don't parse into a Kerberos
      * principal.  Assume an invalid password error if there are no valid
      * lines in .k5login.
      */
     retval = KRB5KRB_AP_ERR_BAD_INTEGRITY;
     while (fgets(line, BUFSIZ, k5login) != NULL) {
         len = strlen(line);
         if (line[len - 1] != '\n') {
             while (fgets(line, BUFSIZ, k5login) != NULL) {
                 len = strlen(line);
                 if (line[len - 1] == '\n')
                     break;
             }
             continue;
         }
         line[len - 1] = '\0';
         k5_errno = krb5_parse_name(ctx->context, line, &princ);
         if (k5_errno != 0)
             continue;
 
         /* Now, attempt to authenticate as that user. */
         if (service == NULL)
             putil_debug(args, "attempting authentication as %s", line);
         else
             putil_debug(args, "attempting authentication as %s for %s", line,
                         service);
         retval = krb5_get_init_creds_password(
             ctx->context, creds, princ, (char *) pass, pamk5_prompter_krb5,
             args, 0, (char *) service, opts);
 
         /*
          * If that worked, update ctx->princ and return success.  Otherwise,
          * continue on to the next line.
          */
         if (retval == 0) {
             if (ctx->princ != NULL)
                 krb5_free_principal(ctx->context, ctx->princ);
             ctx->princ = princ;
             fclose(k5login);
             return 0;
         }
         krb5_free_principal(ctx->context, princ);
     }
 
 fail:
     fclose(k5login);
     return retval;
 }
 
 
 #if (defined(HAVE_KRB5_HEIMDAL)                           \
      && defined(HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT)) \
     || defined(HAVE_KRB5_GET_PROMPT_TYPES)
 /*
  * Attempt authentication via PKINIT.  Currently, this uses an API specific to
  * Heimdal.  Once MIT Kerberos supports PKINIT, some of the details may need
  * to move into the compat layer.
  *
  * Some smart card readers require the user to enter the PIN at the keyboard
  * after inserting the smart card.  Others have a pad on the card and no
  * prompting by PAM is required.  The Kerberos library prompting functions
  * should be able to work out which is required.
  *
  * PKINIT is just one of many pre-authentication mechanisms that could be
  * used.  It's handled separately because of possible smart card interactions
  * and the possibility that some users may be authenticated via PKINIT and
  * others may not.
  *
  * Takes the same arguments as pamk5_password_auth and returns a
  * krb5_error_code.  If successful, the credentials will be stored in creds.
  */
 static krb5_error_code
 pkinit_auth(struct pam_args *args, const char *service, krb5_creds **creds)
 {
     struct context *ctx = args->config->ctx;
     krb5_get_init_creds_opt *opts = NULL;
     krb5_error_code retval;
     char *dummy = NULL;
 
     /*
      * We may not be able to dive directly into the PKINIT functions because
      * the user may not have a chance to enter the smart card.  For example,
      * gnome-screensaver jumps into PAM as soon as the mouse is moved and
      * expects to be prompted for a password, which may not happen if the
      * smart card is the type that has a pad for the PIN on the card.
      *
      * Allow the user to set pkinit_prompt as an option.  If set, we tell the
      * user they need to insert the card.
      *
      * We always ignore the input.  If the user wants to use a password
      * instead, they'll be prompted later when the PKINIT code discovers that
      * no smart card is available.
      */
     if (args->config->pkinit_prompt) {
         pamk5_conv(args,
                    args->config->use_pkinit
                        ? "Insert smart card and press Enter: "
                        : "Insert smart card if desired, then press Enter: ",
                    PAM_PROMPT_ECHO_OFF, &dummy);
     }
 
     /*
      * Set credential options.  We have to use the allocated version of the
      * credential option struct to store the PKINIT options.
      */
     *creds = calloc(1, sizeof(krb5_creds));
     if (*creds == NULL)
         return ENOMEM;
     retval = krb5_get_init_creds_opt_alloc(ctx->context, &opts);
     if (retval != 0)
         return retval;
     set_credential_options(args, opts, service != NULL);
 
     /* Finally, do the actual work and return the results. */
 #    ifdef HAVE_KRB5_HEIMDAL
     retval = krb5_get_init_creds_opt_set_pkinit(
         ctx->context, opts, ctx->princ, args->config->pkinit_user,
         args->config->pkinit_anchors, NULL, NULL, 0, pamk5_prompter_krb5, args,
         NULL);
     if (retval == 0)
         retval = krb5_get_init_creds_password(ctx->context, *creds, ctx->princ,
                                               NULL, NULL, args, 0,
                                               (char *) service, opts);
 #    else  /* !HAVE_KRB5_HEIMDAL */
     retval = krb5_get_init_creds_password(
         ctx->context, *creds, ctx->princ, NULL,
         pamk5_prompter_krb5_no_password, args, 0, (char *) service, opts);
 #    endif /* !HAVE_KRB5_HEIMDAL */
 
     krb5_get_init_creds_opt_free(ctx->context, opts);
     if (retval != 0) {
         krb5_free_cred_contents(ctx->context, *creds);
         free(*creds);
         *creds = NULL;
     }
     return retval;
 }
 #endif
 
 
 /*
  * Attempt authentication once with a given password.  This is the core of the
  * authentication loop, and handles alt_auth_map and search_k5login.  It takes
  * the PAM arguments, the service for which to get tickets (NULL for the
  * default TGT), the initial credential options, and the password, and returns
  * a Kerberos status code or errno.  On success (return status 0), it stores
  * the obtained credentials in the provided creds argument.
  */
 static krb5_error_code
 password_auth_attempt(struct pam_args *args, const char *service,
                       krb5_get_init_creds_opt *opts, const char *pass,
                       krb5_creds *creds)
 {
     krb5_error_code retval;
 
     /*
      * First, try authenticating as the alternate principal if one were
      * configured.  If that fails or wasn't configured, continue on to trying
      * search_k5login or a regular authentication unless configuration
      * indicates that regular authentication should not be attempted.
      */
     if (args->config->alt_auth_map != NULL) {
         retval = pamk5_alt_auth(args, service, opts, pass, creds);
         if (retval == 0)
             return retval;
 
         /* If only_alt_auth is set, we cannot continue. */
         if (args->config->only_alt_auth)
             return retval;
 
         /*
          * If force_alt_auth is set, skip attempting normal authentication iff
          * the alternate principal exists.
          */
         if (args->config->force_alt_auth)
             if (retval != KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN)
                 return retval;
     }
 
     /* Attempt regular authentication, via either search_k5login or normal. */
     if (args->config->search_k5login)
         retval = k5login_password_auth(args, creds, opts, service, pass);
     else
         retval = password_auth(args, creds, opts, service, pass);
     if (retval != 0)
         putil_debug_krb5(args, retval, "krb5_get_init_creds_password");
     return retval;
 }
 
 
 /*
  * Try to verify credentials by obtaining and checking a service ticket.  This
  * is required to verify that no one is spoofing the KDC, but requires read
  * access to a keytab with a valid key.  By default, the Kerberos library will
  * silently succeed if no verification keys are available, but the user can
  * change this by setting verify_ap_req_nofail in [libdefaults] in
  * /etc/krb5.conf.
  *
  * The MIT Kerberos implementation of krb5_verify_init_creds hardwires the
  * host key for the local system as the desired principal if no principal is
  * given.  If we have an explicitly configured keytab, instead read that
  * keytab, find the first principal in that keytab, and use that.
  *
  * Returns a Kerberos status code (0 for success).
  */
 static krb5_error_code
 verify_creds(struct pam_args *args, krb5_creds *creds)
 {
     krb5_verify_init_creds_opt opts;
     krb5_keytab keytab = NULL;
     krb5_kt_cursor cursor;
     int cursor_valid = 0;
     krb5_keytab_entry entry;
     krb5_principal princ = NULL;
     krb5_error_code retval;
     krb5_context c = args->config->ctx->context;
 
     memset(&entry, 0, sizeof(entry));
     krb5_verify_init_creds_opt_init(&opts);
     if (args->config->keytab) {
         retval = krb5_kt_resolve(c, args->config->keytab, &keytab);
         if (retval != 0) {
             putil_err_krb5(args, retval, "cannot open keytab %s",
                            args->config->keytab);
             keytab = NULL;
         }
         if (retval == 0)
             retval = krb5_kt_start_seq_get(c, keytab, &cursor);
         if (retval == 0) {
             cursor_valid = 1;
             retval = krb5_kt_next_entry(c, keytab, &entry, &cursor);
         }
         if (retval == 0)
             retval = krb5_copy_principal(c, entry.principal, &princ);
         if (retval != 0)
             putil_err_krb5(args, retval, "error reading keytab %s",
                            args->config->keytab);
         if (entry.principal != NULL)
             krb5_kt_free_entry(c, &entry);
         if (cursor_valid)
             krb5_kt_end_seq_get(c, keytab, &cursor);
     }
+#ifdef __FreeBSD__
+    if (args->config->allow_kdc_spoof)
+	opts.flags &= ~KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL;
+    else
+	opts.flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL;
+#endif /* __FreeBSD__ */
     retval = krb5_verify_init_creds(c, creds, princ, keytab, NULL, &opts);
     if (retval != 0)
         putil_err_krb5(args, retval, "credential verification failed");
     if (princ != NULL)
         krb5_free_principal(c, princ);
     if (keytab != NULL)
         krb5_kt_close(c, keytab);
     return retval;
 }
 
 
 /*
  * Give the user a nicer error message when we've attempted PKINIT without
  * success.  We can only do this if the rich status codes are available.
  * Currently, this only works with Heimdal.
  */
 static void UNUSED
 report_pkinit_error(struct pam_args *args, krb5_error_code retval UNUSED)
 {
     const char *message;
 
 #ifdef HAVE_HX509_ERR_H
     switch (retval) {
 #    ifdef HX509_PKCS11_PIN_LOCKED
     case HX509_PKCS11_PIN_LOCKED:
         message = "PKINIT failed: user PIN locked";
         break;
 #    endif
 #    ifdef HX509_PKCS11_PIN_EXPIRED
     case HX509_PKCS11_PIN_EXPIRED:
         message = "PKINIT failed: user PIN expired";
         break;
 #    endif
 #    ifdef HX509_PKCS11_PIN_INCORRECT
     case HX509_PKCS11_PIN_INCORRECT:
         message = "PKINIT failed: user PIN incorrect";
         break;
 #    endif
 #    ifdef HX509_PKCS11_PIN_NOT_INITIALIZED
     case HX509_PKCS11_PIN_NOT_INITIALIZED:
         message = "PKINIT fialed: user PIN not initialized";
         break;
 #    endif
     default:
         message = "PKINIT failed";
         break;
     }
 #else
     message = "PKINIT failed";
 #endif
     pamk5_conv(args, message, PAM_TEXT_INFO, NULL);
 }
 
 
 /*
  * Prompt the user for a password and authenticate the password with the KDC.
  * If correct, fill in creds with the obtained TGT or ticket.  service, if
  * non-NULL, specifies the service to get tickets for; the only interesting
  * non-null case is kadmin/changepw for changing passwords.  Therefore, if it
  * is non-null, we look for the password in PAM_OLDAUTHOK and save it there
  * instead of using PAM_AUTHTOK.
  */
 int
 pamk5_password_auth(struct pam_args *args, const char *service,
                     krb5_creds **creds)
 {
     struct context *ctx;
     krb5_get_init_creds_opt *opts = NULL;
     krb5_error_code retval = 0;
     int status = PAM_SUCCESS;
     bool retry, prompt;
     bool creds_valid = false;
     const char *pass = NULL;
     int authtok = (service == NULL) ? PAM_AUTHTOK : PAM_OLDAUTHTOK;
 
     /* Sanity check and initialization. */
     if (args->config->ctx == NULL)
         return PAM_SERVICE_ERR;
     ctx = args->config->ctx;
 
     /*
      * Fill in the default principal to authenticate as.  alt_auth_map or
      * search_k5login may change this later.
      */
     if (ctx->princ == NULL) {
         retval = parse_name(args);
         if (retval != 0) {
             putil_err_krb5(args, retval, "parse_name failed");
             return PAM_SERVICE_ERR;
         }
     }
 
     /*
      * If PKINIT is available and we were configured to attempt it, try
      * authenticating with PKINIT first.  Otherwise, fail all authentication
      * if PKINIT is not available and use_pkinit was set.  Fake an error code
      * that gives an approximately correct error message.
      */
 #if defined(HAVE_KRB5_HEIMDAL) \
     && defined(HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT)
     if (args->config->use_pkinit || args->config->try_pkinit) {
         retval = pkinit_auth(args, service, creds);
         if (retval == 0)
             goto verify;
         putil_debug_krb5(args, retval, "PKINIT failed");
         if (retval != HX509_PKCS11_NO_TOKEN && retval != HX509_PKCS11_NO_SLOT)
             goto done;
         if (retval != 0) {
             report_pkinit_error(args, retval);
             if (args->config->use_pkinit)
                 goto done;
         }
     }
 #elif defined(HAVE_KRB5_GET_PROMPT_TYPES)
     if (args->config->use_pkinit) {
         retval = pkinit_auth(args, service, creds);
         if (retval == 0)
             goto verify;
         putil_debug_krb5(args, retval, "PKINIT failed");
         report_pkinit_error(args, retval);
         goto done;
     }
 #endif
 
     /* Allocate cred structure and set credential options. */
     *creds = calloc(1, sizeof(krb5_creds));
     if (*creds == NULL) {
         putil_crit(args, "cannot allocate memory: %s", strerror(errno));
         status = PAM_SERVICE_ERR;
         goto done;
     }
     retval = krb5_get_init_creds_opt_alloc(ctx->context, &opts);
     if (retval != 0) {
         putil_crit_krb5(args, retval, "cannot allocate credential options");
         goto done;
     }
     set_credential_options(args, opts, service != NULL);
 
     /*
      * Obtain the saved password, if appropriate and available, and determine
      * our retry strategy.  If try_first_pass is set, we will prompt for a
      * password and retry the authentication if the stored password didn't
      * work.
      */
     status = maybe_retrieve_password(args, authtok, &pass);
     if (status != PAM_SUCCESS)
         goto done;
 
     /*
      * Main authentication loop.
      *
      * If we had no stored password, we prompt for a password the first time
      * through.  If try_first_pass is set and we had an old password, we try
      * with it.  If the old password doesn't work, we loop once, prompt for a
      * password, and retry.  If use_first_pass is set, we'll prompt once if
      * the password isn't already set but won't retry.
      *
      * If we don't have a password but try_pkinit or no_prompt are true, we
      * don't attempt to prompt for a password and we go into the Kerberos
      * libraries with no password.  We rely on the Kerberos libraries to do
      * the prompting if PKINIT fails.  In this case, make sure we don't retry.
      * Be aware that in this case, we also have no way of saving whatever
      * password or other credentials the user might enter, so subsequent PAM
      * modules will not see a stored authtok.
      *
      * We've already handled empty passwords in our other functions.
      */
     retry = args->config->try_first_pass;
     prompt = !(args->config->try_pkinit || args->config->no_prompt);
     do {
         if (pass == NULL)
             retry = false;
         if (pass == NULL && prompt) {
             status = prompt_password(args, authtok, &pass);
             if (status != PAM_SUCCESS)
                 goto done;
         }
 
         /*
          * Attempt authentication.  If we succeeded, we're done.  Otherwise,
          * clear the password and then see if we should try again after
          * prompting for a password.
          */
         retval = password_auth_attempt(args, service, opts, pass, *creds);
         if (retval == 0) {
             creds_valid = true;
             break;
         }
         pass = NULL;
     } while (retry
              && (retval == KRB5KRB_AP_ERR_BAD_INTEGRITY
                  || retval == KRB5KRB_AP_ERR_MODIFIED
                  || retval == KRB5KDC_ERR_PREAUTH_FAILED
                  || retval == KRB5_GET_IN_TKT_LOOP
                  || retval == KRB5_BAD_ENCTYPE));
 
 verify:
     UNUSED
     /*
      * If we think we succeeded, whether through the regular path or via
      * PKINIT, try to verify the credentials.  Don't do this if we're
      * authenticating for password changes (or any other case where we're not
      * getting a TGT).  We can't get a service ticket from a kadmin/changepw
      * ticket.
      */
     if (retval == 0 && service == NULL)
         retval = verify_creds(args, *creds);
 
 done:
     /*
      * Free resources, including any credentials we have sitting around if we
      * failed, and return the appropriate PAM error code.  If status is
      * already set to something other than PAM_SUCCESS, we encountered a PAM
      * error and will just return that code.  Otherwise, we need to map the
      * Kerberos status code in retval to a PAM error code.
      */
     if (status == PAM_SUCCESS) {
         switch (retval) {
         case 0:
             status = PAM_SUCCESS;
             break;
         case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
             status = PAM_USER_UNKNOWN;
             break;
         case KRB5KDC_ERR_KEY_EXP:
             status = PAM_NEW_AUTHTOK_REQD;
             break;
         case KRB5KDC_ERR_NAME_EXP:
             status = PAM_ACCT_EXPIRED;
             break;
         case KRB5_KDC_UNREACH:
         case KRB5_LIBOS_CANTREADPWD:
         case KRB5_REALM_CANT_RESOLVE:
         case KRB5_REALM_UNKNOWN:
             status = PAM_AUTHINFO_UNAVAIL;
             break;
         default:
             status = PAM_AUTH_ERR;
             break;
         }
     }
     if (status != PAM_SUCCESS && *creds != NULL) {
         if (creds_valid)
             krb5_free_cred_contents(ctx->context, *creds);
         free(*creds);
         *creds = NULL;
     }
     if (opts != NULL)
         krb5_get_init_creds_opt_free(ctx->context, opts);
 
     /* Whatever the results, destroy the anonymous FAST cache. */
     if (ctx->fast_cache != NULL) {
         krb5_cc_destroy(ctx->context, ctx->fast_cache);
         ctx->fast_cache = NULL;
     }
     return status;
 }
 
 
 /*
  * Authenticate a user via Kerberos.
  *
  * It would be nice to be able to save the ticket cache temporarily as a
  * memory cache and then only write it out to disk during the session
  * initialization.  Unfortunately, OpenSSH 4.2 and later do PAM authentication
  * in a subprocess and therefore has no saved module-specific data available
  * once it opens a session, so we have to save the ticket cache to disk and
  * store in the environment where it is.  The alternative is to use something
  * like System V shared memory, which seems like more trouble than it's worth.
  */
 int
 pamk5_authenticate(struct pam_args *args)
 {
     struct context *ctx = NULL;
     krb5_creds *creds = NULL;
     char *pass = NULL;
     char *principal;
     int pamret;
     bool set_context = false;
     krb5_error_code retval;
 
     /* Temporary backward compatibility. */
     if (args->config->use_authtok && !args->config->force_first_pass) {
         putil_err(args, "use_authtok option in authentication group should"
                         " be changed to force_first_pass");
         args->config->force_first_pass = true;
     }
 
     /* Create a context and obtain the user. */
     pamret = pamk5_context_new(args);
     if (pamret != PAM_SUCCESS)
         goto done;
     ctx = args->config->ctx;
 
     /* Check whether we should ignore this user. */
     if (pamk5_should_ignore(args, ctx->name)) {
         pamret = PAM_USER_UNKNOWN;
         goto done;
     }
 
     /*
      * Do the actual authentication.
      *
      * The complexity arises if the password was expired (which means the
      * Kerberos library was also unable to prompt for the password change
      * internally).  In that case, there are three possibilities:
      * fail_pwchange says we treat that as an authentication failure and stop,
      * defer_pwchange says to set a flag that will result in an error at the
      * acct_mgmt step, and force_pwchange says that we should change the
      * password here and now.
      *
      * defer_pwchange is the formally correct behavior.  Set a flag in the
      * context and return success.  That flag will later be checked by
      * pam_sm_acct_mgmt.  We need to set the context as PAM data in the
      * defer_pwchange case, but we don't want to set the PAM data until we've
      * checked .k5login.  If we've stacked multiple pam-krb5 invocations in
      * different realms as optional, we don't want to override a previous
      * successful authentication.
      *
      * Note this means that, if the user can authenticate with multiple realms
      * and authentication succeeds in one realm and is then expired in a later
      * realm, the expiration in the latter realm wins.  This isn't ideal, but
      * avoiding that case is more complicated than it's worth.
      *
      * We would like to set the current password as PAM_OLDAUTHTOK so that
      * when the application subsequently calls pam_chauthtok, the user won't
      * be reprompted.  However, the PAM library clears all the auth tokens
      * when pam_authenticate exits, so this isn't possible.
      *
      * In the force_pwchange case, try to use the password the user just
      * entered to authenticate to the password changing service, but don't
      * throw an error if that doesn't work.  We have to move it from
      * PAM_AUTHTOK to PAM_OLDAUTHTOK to be in the place where password
      * changing expects, and have to unset PAM_AUTHTOK or we'll just change
      * the password to the same thing it was.
      */
     pamret = pamk5_password_auth(args, NULL, &creds);
     if (pamret == PAM_NEW_AUTHTOK_REQD) {
         if (args->config->fail_pwchange)
             pamret = PAM_AUTH_ERR;
         else if (args->config->defer_pwchange) {
             putil_debug(args, "expired account, deferring failure");
             ctx->expired = 1;
             pamret = PAM_SUCCESS;
         } else if (args->config->force_pwchange) {
             pam_syslog(args->pamh, LOG_INFO,
                        "user %s password expired, forcing password change",
                        ctx->name);
             pamk5_conv(args, "Password expired.  You must change it now.",
                        PAM_TEXT_INFO, NULL);
             pamret = pam_get_item(args->pamh, PAM_AUTHTOK,
                                   (PAM_CONST void **) &pass);
             if (pamret == PAM_SUCCESS && pass != NULL)
                 pam_set_item(args->pamh, PAM_OLDAUTHTOK, pass);
             pam_set_item(args->pamh, PAM_AUTHTOK, NULL);
             args->config->use_first_pass = true;
             pamret = pamk5_password_change(args, false);
             if (pamret == PAM_SUCCESS)
                 putil_debug(args, "successfully changed expired password");
         }
     }
     if (pamret != PAM_SUCCESS) {
         putil_log_failure(args, "authentication failure");
         goto done;
     }
 
     /* Check .k5login and alt_auth_map. */
     pamret = pamk5_authorized(args);
     if (pamret != PAM_SUCCESS) {
         putil_log_failure(args, "failed authorization check");
         goto done;
     }
 
     /* Reset PAM_USER in case we canonicalized, but ignore errors. */
     if (!ctx->expired && !args->config->no_update_user) {
         pamret = pam_set_item(args->pamh, PAM_USER, ctx->name);
         if (pamret != PAM_SUCCESS)
             putil_err_pam(args, pamret, "cannot set PAM_USER");
     }
 
     /* Log the successful authentication. */
     retval = krb5_unparse_name(ctx->context, ctx->princ, &principal);
     if (retval != 0) {
         putil_err_krb5(args, retval, "krb5_unparse_name failed");
         pam_syslog(args->pamh, LOG_INFO, "user %s authenticated as UNKNOWN",
                    ctx->name);
     } else {
         pam_syslog(args->pamh, LOG_INFO, "user %s authenticated as %s%s",
                    ctx->name, principal, ctx->expired ? " (expired)" : "");
         krb5_free_unparsed_name(ctx->context, principal);
     }
 
     /* Now that we know we're successful, we can store the context. */
     pamret = pam_set_data(args->pamh, "pam_krb5", ctx, pamk5_context_destroy);
     if (pamret != PAM_SUCCESS) {
         putil_err_pam(args, pamret, "cannot set context data");
         pamk5_context_free(args);
         pamret = PAM_SERVICE_ERR;
         goto done;
     }
     set_context = true;
 
     /*
      * If we have an expired account or if we're not creating a ticket cache,
      * we're done.  Otherwise, store the obtained credentials in a temporary
      * cache.
      */
     if (!args->config->no_ccache && !ctx->expired)
         pamret = pamk5_cache_init_random(args, creds);
 
 done:
     if (creds != NULL && ctx != NULL) {
         krb5_free_cred_contents(ctx->context, creds);
         free(creds);
     }
 
     /*
      * Don't free our Kerberos context if we set a context, since the context
      * will take care of that.
      */
     if (set_context)
         args->ctx = NULL;
 
     /*
      * Clear the context on failure so that the account management module
      * knows that we didn't authenticate with Kerberos.  Only clear the
      * context if we set it.  Otherwise, we may be blowing away the context of
      * a previous successful authentication.
      */
     if (pamret != PAM_SUCCESS) {
         if (set_context)
             pam_set_data(args->pamh, "pam_krb5", NULL, NULL);
         else
             pamk5_context_free(args);
     }
     return pamret;
 }
diff --git a/contrib/pam-krb5/module/internal.h b/contrib/pam-krb5/module/internal.h
index f3ea30139815..c797f7a56cd3 100644
--- a/contrib/pam-krb5/module/internal.h
+++ b/contrib/pam-krb5/module/internal.h
@@ -1,262 +1,265 @@
 /*
  * Internal prototypes and structures for pam-krb5.
  *
  * Copyright 2005-2009, 2014, 2020 Russ Allbery <eagle@eyrie.org>
  * Copyright 2011, 2012
  *     The Board of Trustees of the Leland Stanford Junior University
  * Copyright 2005 Andres Salomon <dilinger@debian.org>
  * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
  *
  * SPDX-License-Identifier: BSD-3-clause or GPL-1+
  */
 
 #ifndef INTERNAL_H
 #define INTERNAL_H 1
 
 #include <config.h>
 #include <portable/krb5.h>
 #include <portable/macros.h>
 #include <portable/pam.h>
 
 #include <stdarg.h>
 #include <syslog.h>
 
 /* Forward declarations to avoid unnecessary includes. */
 struct pam_args;
 struct passwd;
 struct vector;
 
 /* Used for unused parameters to silence gcc warnings. */
 #define UNUSED __attribute__((__unused__))
 
 /*
  * An authentication context, including all the data we want to preserve
  * across calls to the public entry points.  This context is stored in the PAM
  * state and a pointer to it is stored in the pam_args struct that is passed
  * as the first argument to most internal functions.
  */
 struct context {
     char *name;             /* Username being authenticated. */
     krb5_context context;   /* Kerberos context. */
     krb5_ccache cache;      /* Active credential cache, if any. */
     krb5_principal princ;   /* Principal being authenticated. */
     int expired;            /* If set, account was expired. */
     int dont_destroy_cache; /* If set, don't destroy cache on shutdown. */
     int initialized;        /* If set, ticket cache initialized. */
     krb5_creds *creds;      /* Credentials for password changing. */
     krb5_ccache fast_cache; /* Temporary credential cache for FAST. */
 };
 
 /*
  * The global structure holding our arguments, both from krb5.conf and from
  * the PAM configuration.  Filled in by pamk5_init and stored in the pam_args
  * struct passed as a first argument to most internal functions.  Sort by
  * documentation order.
  */
 struct pam_config {
     /* Authorization. */
     char *alt_auth_map;  /* An sprintf pattern to map principals. */
     bool force_alt_auth; /* Alt principal must be used if it exists. */
     bool ignore_k5login; /* Don't check .k5login files. */
     bool ignore_root;    /* Skip authentication for root. */
     long minimum_uid;    /* Ignore users below this UID. */
     bool only_alt_auth;  /* Alt principal must be used. */
     bool search_k5login; /* Try password with each line of .k5login. */
+#ifdef __FreeBSD__
+    bool allow_kdc_spoof;/* Allow auth even if KDC cannot be verified */
+#endif /* __FreeBSD__ */
 
     /* Kerberos behavior. */
     char *fast_ccache;           /* Cache containing armor ticket. */
     bool anon_fast;              /* sets up an anonymous fast armor cache */
     bool forwardable;            /* Obtain forwardable tickets. */
     char *keytab;                /* Keytab for credential validation. */
     char *realm;                 /* Default realm for Kerberos. */
     krb5_deltat renew_lifetime;  /* Renewable lifetime of credentials. */
     krb5_deltat ticket_lifetime; /* Lifetime of credentials. */
     char *user_realm;            /* Default realm for user principals. */
 
     /* PAM behavior. */
     bool clear_on_fail;  /* Delete saved password on change failure. */
     bool debug;          /* Log debugging information. */
     bool defer_pwchange; /* Defer expired account fail to account. */
     bool fail_pwchange;  /* Treat expired password as auth failure. */
     bool force_pwchange; /* Change expired passwords in auth. */
     bool no_update_user; /* Don't update PAM_USER with local name. */
     bool silent;         /* Suppress text and errors (PAM_SILENT). */
     char *trace;         /* File name for trace logging. */
 
     /* PKINIT. */
     char *pkinit_anchors;       /* Trusted certificates, usually per realm. */
     bool pkinit_prompt;         /* Prompt user to insert smart card. */
     char *pkinit_user;          /* User ID to pass to PKINIT. */
     struct vector *preauth_opt; /* Preauth options. */
     bool try_pkinit;            /* Attempt PKINIT, fall back to password. */
     bool use_pkinit;            /* Require PKINIT. */
 
     /* Prompting. */
     char *banner;          /* Addition to password changing prompts. */
     bool expose_account;   /* Display principal in password prompts. */
     bool force_first_pass; /* Require a previous password be stored. */
     bool no_prompt;        /* Let Kerberos handle password prompting. */
     bool prompt_principal; /* Prompt for the Kerberos principal. */
     bool try_first_pass;   /* Try the previously entered password. */
     bool use_authtok;      /* Use the stored new password for changes. */
     bool use_first_pass;   /* Always use the previous password. */
 
     /* Ticket caches. */
     char *ccache;            /* Path to write ticket cache to. */
     char *ccache_dir;        /* Directory for ticket cache. */
     bool no_ccache;          /* Don't create a ticket cache. */
     bool retain_after_close; /* Don't destroy the cache on session end. */
 
     /* The authentication context, which bundles together Kerberos data. */
     struct context *ctx;
     bool no_warn;            /* XXX Dummy argument, remove when Heimdal is removed. */
 };
 
 /* Default to a hidden visibility for all internal functions. */
 #pragma GCC visibility push(hidden)
 
 /* Parse the PAM flags, arguments, and krb5.conf and fill out pam_args. */
 struct pam_args *pamk5_init(pam_handle_t *, int flags, int, const char **);
 
 /* Free the pam_args struct when we're done. */
 void pamk5_free(struct pam_args *);
 
 /*
  * The underlying functions between several of the major PAM interfaces.
  */
 int pamk5_account(struct pam_args *);
 int pamk5_authenticate(struct pam_args *);
 
 /*
  * The underlying function below pam_sm_chauthtok.  If the second argument is
  * true, we're doing the preliminary check and shouldn't actually change the
  * password.
  */
 int pamk5_password(struct pam_args *, bool only_auth);
 
 /*
  * Create or refresh the user's ticket cache.  This is the underlying function
  * beneath pam_sm_setcred and pam_sm_open_session.
  */
 int pamk5_setcred(struct pam_args *, bool refresh);
 
 /*
  * Authenticate the user.  Prompts for the password as needed and obtains
  * tickets for in_tkt_service, krbtgt/<realm> by default.  Stores the initial
  * credentials in the final argument, allocating a new krb5_creds structure.
  * If possible, the initial credentials are verified by checking them against
  * the local system key.
  */
 int pamk5_password_auth(struct pam_args *, const char *service, krb5_creds **);
 
 /*
  * Prompt the user for a new password, twice so that they can confirm.  Sets
  * PAM_AUTHTOK and puts the new password in newly allocated memory in pass if
  * it's not NULL.
  */
 int pamk5_password_prompt(struct pam_args *, char **pass);
 
 /*
  * Change the user's password.  Prompts for the current password as needed and
  * the new password.  If the second argument is true, only obtains the
  * necessary credentials without changing anything.
  */
 int pamk5_password_change(struct pam_args *, bool only_auth);
 
 /*
  * Generic conversation function to display messages or get information from
  * the user.  Takes the message, the message type, and a place to put the
  * result of a prompt.
  */
 int pamk5_conv(struct pam_args *, const char *, int, char **);
 
 /*
  * Function specifically for getting a password.  Takes a prefix (if non-NULL,
  * args->banner will also be prepended) and a pointer into which to store the
  * password.  The password must be freed by the caller.
  */
 int pamk5_get_password(struct pam_args *, const char *, char **);
 
 /* Prompting function for the Kerberos libraries. */
 krb5_error_code pamk5_prompter_krb5(krb5_context, void *data, const char *name,
                                     const char *banner, int, krb5_prompt *);
 
 /* Prompting function that doesn't allow passwords. */
 krb5_error_code pamk5_prompter_krb5_no_password(krb5_context, void *data,
                                                 const char *name,
                                                 const char *banner, int,
                                                 krb5_prompt *);
 
 /* Check the user with krb5_kuserok or the configured equivalent. */
 int pamk5_authorized(struct pam_args *);
 
 /* Returns true if we should ignore this user (root or low UID). */
 int pamk5_should_ignore(struct pam_args *, PAM_CONST char *);
 
 /*
  * alt_auth_map support.
  *
  * pamk5_map_principal attempts to map the user to a Kerberos principal
  * according to alt_auth_map.  Returns 0 on success, storing the mapped
  * principal name in newly allocated memory in principal.  The caller is
  * responsiple for freeing. Returns an errno value on any error.
  *
  * pamk5_alt_auth attempts an authentication to the given service with the
  * given options and password and returns a Kerberos error code.  On success,
  * the new credentials are stored in krb5_creds.
  *
  * pamk5_alt_auth_verify verifies that Kerberos credentials are authorized to
  * access the account given the configured alt_auth_map and is meant to be
  * called from pamk5_authorized.  It returns a PAM status code.
  */
 int pamk5_map_principal(struct pam_args *, const char *username,
                         char **principal);
 krb5_error_code pamk5_alt_auth(struct pam_args *, const char *service,
                                krb5_get_init_creds_opt *, const char *pass,
                                krb5_creds *);
 int pamk5_alt_auth_verify(struct pam_args *);
 
 /* FAST support.  Set up FAST protection of authentication. */
 void pamk5_fast_setup(struct pam_args *, krb5_get_init_creds_opt *);
 
 /* Context management. */
 int pamk5_context_new(struct pam_args *);
 int pamk5_context_fetch(struct pam_args *);
 void pamk5_context_free(struct pam_args *);
 void pamk5_context_destroy(pam_handle_t *, void *data, int pam_end_status);
 
 /* Get and set environment variables for the ticket cache. */
 const char *pamk5_get_krb5ccname(struct pam_args *, const char *key);
 int pamk5_set_krb5ccname(struct pam_args *, const char *, const char *key);
 
 /*
  * Create a ticket cache file securely given a mkstemp template.  Modifies
  * template in place to store the name of the created file.
  */
 int pamk5_cache_mkstemp(struct pam_args *, char *template);
 
 /*
  * Create a ticket cache and initialize it with the provided credentials,
  * returning the new cache in the last argument
  */
 int pamk5_cache_init(struct pam_args *, const char *ccname, krb5_creds *,
                      krb5_ccache *);
 
 /*
  * Create a ticket cache with a random path, initialize it with the provided
  * credentials, store it in the context, and put the path into PAM_KRB5CCNAME.
  */
 int pamk5_cache_init_random(struct pam_args *, krb5_creds *);
 
 /*
  * Compatibility functions.  Depending on whether pam_krb5 is built with MIT
  * Kerberos or Heimdal, appropriate implementations for the Kerberos
  * implementation will be provided.
  */
 krb5_error_code pamk5_compat_set_realm(struct pam_config *, const char *);
 void pamk5_compat_free_realm(struct pam_config *);
 
 /* Undo default visibility change. */
 #pragma GCC visibility pop
 
 #endif /* !INTERNAL_H */
diff --git a/contrib/pam-krb5/module/options.c b/contrib/pam-krb5/module/options.c
index 799b3a33e168..0118fb451af6 100644
--- a/contrib/pam-krb5/module/options.c
+++ b/contrib/pam-krb5/module/options.c
@@ -1,260 +1,263 @@
 /*
  * Option handling for pam-krb5.
  *
  * Responsible for initializing the args struct that's passed to nearly all
  * internal functions.  Retrieves configuration information from krb5.conf and
  * parses the PAM configuration.
  *
  * Copyright 2005-2010, 2014, 2020 Russ Allbery <eagle@eyrie.org>
  * Copyright 2011-2012
  *     The Board of Trustees of the Leland Stanford Junior University
  * Copyright 2005 Andres Salomon <dilinger@debian.org>
  * Copyright 1999-2000 Frank Cusack <fcusack@fcusack.com>
  *
  * SPDX-License-Identifier: BSD-3-clause or GPL-1+
  */
 
 #include <config.h>
 #include <portable/krb5.h>
 #include <portable/system.h>
 
 #include <errno.h>
 
 #include <module/internal.h>
 #include <pam-util/args.h>
 #include <pam-util/logging.h>
 #include <pam-util/options.h>
 #include <pam-util/vector.h>
 
 /* Our option definition.  Must be sorted. */
 #define K(name) (#name), offsetof(struct pam_config, name)
 /* clang-format off */
 static const struct option options[] = {
+#ifdef __FreeBSD__
+    { K(allow_kdc_spoof),    true,  BOOL   (false) },
+#endif /* __FreeBSD__ */
     { K(alt_auth_map),       true,  STRING (NULL)  },
     { K(anon_fast),          true,  BOOL   (false) },
     { K(banner),             true,  STRING ("Kerberos") },
     { K(ccache),             true,  STRING (NULL)  },
     { K(ccache_dir),         true,  STRING ("FILE:/tmp") },
     { K(clear_on_fail),      true,  BOOL   (false) },
     { K(debug),              true,  BOOL   (false) },
     { K(defer_pwchange),     true,  BOOL   (false) },
     { K(expose_account),     true,  BOOL   (false) },
     { K(fail_pwchange),      true,  BOOL   (false) },
     { K(fast_ccache),        true,  STRING (NULL)  },
     { K(force_alt_auth),     true,  BOOL   (false) },
     { K(force_first_pass),   false, BOOL   (false) },
     { K(force_pwchange),     true,  BOOL   (false) },
     { K(forwardable),        true,  BOOL   (false) },
     { K(ignore_k5login),     true,  BOOL   (false) },
     { K(ignore_root),        true,  BOOL   (false) },
     { K(keytab),             true,  STRING (NULL)  },
     { K(minimum_uid),        true,  NUMBER (0)     },
     { K(no_ccache),          false, BOOL   (false) },
     { K(no_prompt),          true,  BOOL   (false) },
     { K(no_update_user),     true,  BOOL   (false) },
     { K(no_warn),	     true,  BOOL   (false) },
     { K(only_alt_auth),      true,  BOOL   (false) },
     { K(pkinit_anchors),     true,  STRING (NULL)  },
     { K(pkinit_prompt),      true,  BOOL   (false) },
     { K(pkinit_user),        true,  STRING (NULL)  },
     { K(preauth_opt),        true,  LIST   (NULL)  },
     { K(prompt_principal),   true,  BOOL   (false) },
     { K(realm),              false, STRING (NULL)  },
     { K(renew_lifetime),     true,  TIME   (0)     },
     { K(retain_after_close), true,  BOOL   (false) },
     { K(search_k5login),     true,  BOOL   (false) },
     { K(silent),             false, BOOL   (false) },
     { K(ticket_lifetime),    true,  TIME   (0)     },
     { K(trace),              false, STRING (NULL)  },
     { K(try_first_pass),     false, BOOL   (false) },
     { K(try_pkinit),         true,  BOOL   (false) },
     { K(use_authtok),        false, BOOL   (false) },
     { K(use_first_pass),     false, BOOL   (false) },
     { K(use_pkinit),         true,  BOOL   (false) },
     { K(user_realm),         true,  STRING (NULL)  },
 };
 /* clang-format on */
 static const size_t optlen = sizeof(options) / sizeof(options[0]);
 
 
 /*
  * Allocate a new struct pam_args and initialize its data members, including
  * parsing the arguments and getting settings from krb5.conf.  Check the
  * resulting options for consistency.
  */
 struct pam_args *
 pamk5_init(pam_handle_t *pamh, int flags, int argc, const char **argv)
 {
     int i;
     struct pam_args *args;
     struct pam_config *config = NULL;
 
     args = putil_args_new(pamh, flags);
     if (args == NULL) {
         return NULL;
     }
     config = calloc(1, sizeof(struct pam_config));
     if (config == NULL) {
         goto nomem;
     }
     args->config = config;
 
     /*
      * Do an initial scan to see if the realm is already set in our options.
      * If so, make sure that's set before we start loading option values,
      * since it affects what comes out of krb5.conf.
      *
      * We will then ignore args->config->realm, set later by option parsing,
      * in favor of using args->realm extracted here.  However, the latter must
      * exist to avoid throwing unknown option errors.
      */
     for (i = 0; i < argc; i++) {
         if (strncmp(argv[i], "realm=", 6) != 0)
             continue;
         free(args->realm);
         args->realm = strdup(&argv[i][strlen("realm=")]);
         if (args->realm == NULL)
             goto nomem;
     }
 
     if (!putil_args_defaults(args, options, optlen)) {
         free(config);
         putil_args_free(args);
         return NULL;
     }
     if (!putil_args_krb5(args, "pam", options, optlen)) {
         goto fail;
     }
     if (!putil_args_parse(args, argc, argv, options, optlen)) {
         goto fail;
     }
     if (config->debug) {
         args->debug = true;
     }
     if (config->silent) {
         args->silent = true;
     }
 
     /* An empty banner should be treated the same as not having one. */
     if (config->banner != NULL && config->banner[0] == '\0') {
         free(config->banner);
         config->banner = NULL;
     }
 
     /* Sanity-check try_first_pass, use_first_pass, and force_first_pass. */
     if (config->force_first_pass && config->try_first_pass) {
         putil_err(args, "force_first_pass set, ignoring try_first_pass");
         config->try_first_pass = 0;
     }
     if (config->force_first_pass && config->use_first_pass) {
         putil_err(args, "force_first_pass set, ignoring use_first_pass");
         config->use_first_pass = 0;
     }
     if (config->use_first_pass && config->try_first_pass) {
         putil_err(args, "use_first_pass set, ignoring try_first_pass");
         config->try_first_pass = 0;
     }
 
     /*
      * Don't set expose_account if we're using search_k5login.  The user will
      * get a principal formed from the account into which they're logging in,
      * which isn't the password they'll use (that's the whole point of
      * search_k5login).
      */
     if (config->search_k5login) {
         config->expose_account = 0;
     }
 
     /* UIDs are unsigned on some systems. */
     if (config->minimum_uid < 0) {
         config->minimum_uid = 0;
     }
 
     /*
      * Warn if PKINIT options were set and PKINIT isn't supported.  The MIT
      * method (krb5_get_init_creds_opt_set_pa) can't support use_pkinit.
      */
 #ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT
 #    ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PA
     if (config->try_pkinit) {
         putil_err(args, "try_pkinit requested but PKINIT not available");
     } else if (config->use_pkinit) {
         putil_err(args, "use_pkinit requested but PKINIT not available");
     }
 #    endif
 #    ifndef HAVE_KRB5_GET_PROMPT_TYPES
     if (config->use_pkinit) {
         putil_err(args, "use_pkinit requested but PKINIT cannot be enforced");
     }
 #    endif
 #endif
 
     /* Warn if the FAST option was set and FAST isn't supported. */
 #ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_FAST_CCACHE_NAME
     if (config->fast_ccache || config->anon_fast) {
         putil_err(args, "fast_ccache or anon_fast requested but FAST not"
                         " supported by Kerberos libraries");
     }
 #endif
 
     /* If tracing was requested enable it if possible. */
 #ifdef HAVE_KRB5_SET_TRACE_FILENAME
     if (config->trace != NULL) {
         krb5_error_code retval;
 
         retval = krb5_set_trace_filename(args->ctx, config->trace);
         if (retval == 0)
             putil_debug(args, "enabled trace logging to %s", config->trace);
         else
             putil_err_krb5(args, retval, "cannot enable trace logging to %s",
                            config->trace);
     }
 #else
     if (config->trace != NULL) {
         putil_err(args, "trace logging requested but not supported");
     }
 #endif
 
     return args;
 
 nomem:
     putil_crit(args, "cannot allocate memory: %s", strerror(errno));
     free(config);
     putil_args_free(args);
     return NULL;
 
 fail:
     pamk5_free(args);
     return NULL;
 }
 
 
 /*
  * Free the allocated args struct and any memory it points to.
  */
 void
 pamk5_free(struct pam_args *args)
 {
     struct pam_config *config;
 
     if (args == NULL)
         return;
     config = args->config;
     if (config != NULL) {
         free(config->alt_auth_map);
         free(config->banner);
         free(config->ccache);
         free(config->ccache_dir);
         free(config->fast_ccache);
         free(config->keytab);
         free(config->pkinit_anchors);
         free(config->pkinit_user);
         vector_free(config->preauth_opt);
         free(config->realm);
         free(config->trace);
         free(config->user_realm);
         free(args->config);
         args->config = NULL;
     }
     putil_args_free(args);
 }