fix for http://grid.ncsa.uiuc.edu/ssh/implicitlogin.adv vulnerability: - don't return success from userauth if authctxt->valid == 0   as that flag is set after important checks for disabled accounts - proceed with userauth_gssapi() even if authctxt->valid == 0,   because we might set it based on GSSAPI context later, and we   check it before returning success - set authctxt->valid = 1 only if getpwnamallow() checks succeed other: - pass in authctxt to start_pam(), as the signature changed
fix for http://grid.ncsa.uiuc.edu/ssh/implicitlogin.adv vulnerability:
- don't return success from userauth if authctxt->valid == 0
  as that flag is set after important checks for disabled accounts
- proceed with userauth_gssapi() even if authctxt->valid == 0,
  because we might set it based on GSSAPI context later, and we
  check it before returning success
- set authctxt->valid = 1 only if getpwnamallow() checks succeed
other:
- pass in authctxt to start_pam(), as the signature changed

gridcf/gct,globus/globus-toolkit,ellert/globus-toolkit,ellert/globus-toolkit,ellert/globus-toolkit,globus/globus-toolkit,globus/globus-toolkit,globus/globus-toolkit,ellert/globus-toolkit,globus/globus-toolkit,ellert/globus-toolkit,gridcf/gct,globus/globus-toolkit,ellert/globus-toolkit,gridcf/gct,gridcf/gct,gridcf/gct,gridcf/gct,globus/globus-toolkit,globus/globus-toolkit,ellert/globus-toolkit,ellert/globus-toolkit