                           pam-krb5 To-Do List

PAM API:

 * PAMKRB-5: Support PAM_CHANGE_EXPIRED_AUTHTOK properly in pam_chauthtok.
   This will require prompting for the current password (if it's not
   already available in the PAM data) and trying a regular authentication
   first to see if the account is expired.

 * PAMKRB-6: Tighter verification that all of our flags are valid might be
   a good idea.

 * PAMKRB-16: For informational messages followed by a prompt, find a way
   to combine these into one PAM conversation call for better GUI
   presentation behavior.

Functionality:

 * PAMKRB-2: Find a way to do only PKINIT authentication with no password
   fallback with MIT Kerberos and then change the authentication flow so
   that both Heimdal and MIT use the same logic for attempting PKINIT
   first and then falling back to password.  This will fix failure to
   store passwords in the PAM data with try_pkinit and MIT Kerberos on
   password fallback and will allow implementation of use_pkinit for MIT.

 * PAMKRB-10: Add a daemon that can be used to verify TGTs that can be
   used when pam-krb5 is run as a non-root user and hence doesn't have
   access to the system keytab.  Jeff Hutzelman has a daemon and protocol
   for doing this developed for a different PAM authentication module, and
   it would be good to stay consistent with that protocol if possible.
   (Debian Bug#399001)

 * PAMKRB-23: The alt_auth_map parsing to find realms doesn't take into
   account escaped @-signs and doesn't do proper principal parsing.

 * PAMKRB-24: Fix password expiration handling for the search_k5login and
   alt_auth_map cases.  Right now, we may return expired password errors
   that would trigger password expiration handling, which probably isn't
   correct.

Code Cleanup:

 * PAMKRB-11: The PKINIT code for Heimdal involves too many #ifdefs right
   now for my taste.  Find a way to restructure it to only wrap the main
   PKINIT function for Heimdal.

 * PAMKRB-12: The current handling of error return codes is a mess.  We
   need to find a way to return a rich set of error codes from the
   underlying functions and then map error codes appropriately in the
   interface functions.  Helpful for this would be improved documentation
   of what error codes are permitted and where.

Documentation:

 * PAMKRB-13: Document PKINIT configuration with MIT in krb5.conf.  It
   looks like the library supports configuration in [realms] with similar
   names to the PAM module configuration.

 * PAMKRB-14: Note the version number when options were added.  It helps
   people looking at the documentation on-line and writing portable
   configurations.

Portability:

 * PAMKRB-15: If pam_modutil_getpwnam is not available but getpwnam_r is,
   roll our own using getpwnam_r.

Logging:

 * PAMKRB-17: Log the information that the Kerberos library asks us to
   display, or at least the info and error messages.

 * PAMKRB-18: Log unknown PAM flags on module entry.  Currently, only the
   symbolic flags we know about will be logged.

Test suite:

 * PAMKRB-19: Add tests for PKINIT.

 * PAMKRB-20: Ensure that the test suite covers all possible PAM options.

 * PAMKRB-22: Integrate and automate valgrind testing.  There is currently
   a check-valgrind option with the beginnings of an exclusion list, but
   it needs better integration with the rest of the test suite.
