[38398] in Kerberos
Re: Need help: How to use different caches for TGT and TGS.
daemon@ATHENA.MIT.EDU (Greg Hudson)
Thu Dec 13 15:29:42 2018
To: Santosh Kumar <santoshjeergi@gmail.com>, kerberos@mit.edu
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <22a2d9a8-9284-0dda-1f9e-c08dc7b54415@mit.edu>
Date: Thu, 13 Dec 2018 15:29:28 -0500
MIME-Version: 1.0
In-Reply-To: <CAFnsFFd7pM2Np=ssz-UwtP0e3ZjOhRSj+nZeCTx2z=eszRwU2g@mail.gmail.com>
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 12/13/2018 12:00 AM, Santosh Kumar wrote:
> Have default TGT in default cache location /tmp/krb5cc_36073 .
>
> How to get TGS and store in different cache , but use TGT from default
> cache location?
MIT krb5 doesn't have an option for this in kvno. You could of course
copy the ccache containing the TGT and point kvno at the copy, but if
the goal is to produce a ccache that doesn't contain the TGT, that's not
helpful. You could alternatively use "kinit -S servicename" to bypass
getting a TGT entirely.
From a code perspective, you can do what you want by passing
KRB5_GC_NO_STORE to krb5_get_credentials(), then explicitly resolving
the target ccache (krb5_cc_resolve()), initializing it with the client
principal (krb5_cc_initialize()), and storing the cred returned by
krb5_get_credentials(). That's what Heimdal's kgetcred does in
essence--it uses a fancier krb5_get_creds_opt interface to pass
KRB5_GC_NO_STORE, and MIT krb5 doesn't have that, but the option can
simply be passed in the flags parameter.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos