From 4ede8212d51ed3fd9c70552f2a13927da8f2ac8d Mon Sep 17 00:00:00 2001
From: Michael Spang <mspang@uwaterloo.ca>
Date: Sat, 25 Jul 2009 05:31:17 -0400
Subject: [PATCH] Require TGT in ldap_init

---
 src/ldap.c       | 4 ----
 src/op-adduser.c | 2 ++
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/ldap.c b/src/ldap.c
index c318489cb..4c269d6d1 100644
--- a/src/ldap.c
+++ b/src/ldap.c
@@ -371,13 +371,9 @@ void ceo_ldap_init() {
     if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &proto) != LDAP_OPT_SUCCESS)
         ldap_fatal("ldap_set_option");
 
-    ceo_krb5_auth(admin_bind_userid);
-
     if (ldap_sasl_interactive_bind_s(ld, NULL, sasl_mech, NULL, NULL,
                 LDAP_SASL_QUIET, &ldap_sasl_interact, NULL) != LDAP_SUCCESS)
         ldap_fatal("Bind failed");
-
-    ceo_krb5_deauth();
 }
 
 void ceo_ldap_cleanup() {
diff --git a/src/op-adduser.c b/src/op-adduser.c
index 0d545083d..c75f8bb0f 100644
--- a/src/op-adduser.c
+++ b/src/op-adduser.c
@@ -270,6 +270,7 @@ int main(int argc, char *argv[]) {
         fatalpe("setenv");
 
     ceo_krb5_init();
+    ceo_krb5_auth(admin_bind_userid);
     ceo_ldap_init();
     ceo_kadm_init();
 
@@ -277,6 +278,7 @@ int main(int argc, char *argv[]) {
 
     ceo_kadm_cleanup();
     ceo_ldap_cleanup();
+    ceo_krb5_deauth();
     ceo_krb5_cleanup();
 
     free_config();