Hi,
> Out of interest, what is it about the UsePrivilegeSeperation option that
> makes or breaks things?
i'm going to guess its to do with the fact that UPS will create a child process
that has the privileges of the authenticated user....but you are logging in with a
user not known to the system - using the moonshot etc stuff to decide which account
to drop into... - and that stuff isnt given to the daemon at the time required. its
a problem - or will be for some people - as this could introduce a vector for attack
(privilege escalation) - if they are having to turn OFF this feature...
alan
|