#
# Allow PAM conversation for pam_setcred for keyboard-interactive auth
#
# Currently OpenSSH runs pam_setcred with 'fake' conversation function
# sshpam_store_conv. If some PAM module actually tries to converse for
# pam_setcred, sshpam_store_conv fails with PAM_CONV_ERR.
#
# This patch moves calling pam_setcred to the end of actual PAM
# authentication, where there still is a real conversation function
# available. If pam_setcred was already called, doesn't call it the
# second time in do_pam_setcred.
#
# Patch origin: in-house
#
# Reported upstream:
# https://bugzilla.mindrot.org/show_bug.cgi?id=2549
#

diff -pur old/auth-pam.c new/auth-pam.c
--- old/auth-pam.c
+++ new/auth-pam.c
@@ -399,6 +399,10 @@ sshpam_thread(struct pam_ctxt *ctxt)
 				goto auth_fail;
 			sshpam_password_change_required(0);
 		}
+		sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
+		if (sshpam_err != PAM_SUCCESS)
+			goto auth_fail;
+		
 	}
 
 	ctxt->pam_done = 1;
@@ -968,6 +972,8 @@ do_pam_set_tty(const char *tty)
 void
 do_pam_setcred(int init)
 {
+	if (compat20 && (sshpam_authenticated == 1))
+		return;	/* pam_setcred already done */
 	sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 	    (const void *)&store_conv);
 	if (sshpam_err != PAM_SUCCESS)