[22082] in Kerberos
Re: ACLs question
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Wed Jul 28 11:46:21 2004
Message-ID: <4107C8E3.E5E65050@anl.gov>
Date: Wed, 28 Jul 2004 10:40:19 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Bob Dowling <rjd4@cam.ac.uk>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Bob Dowling wrote:
>
> I'm running a KCD/kadmind on a Fedora box using Fedora's packages (1.3.1
> release 6) and am having problems with my wildcarded ACLs.
>
> My situation is that I have a DNS domain with a very large number of
> subdomains (and subsubdomains etc. ad nauseam) whose computers may require
> host principals. I would like to be able to delegate control of these to
> the people responsible for the computers in each subdomain (departmental
> computing staff, conscripted PhD students, etc.).
>
> I have been able to get wildcard ACLs working of the form
>
> rjd4/manager@TEST.CAM.AC.UK * host/*@TEST.CAM.AC.UK
>
> but not of the form
>
> rjd4/manager@TEST.CAM.AC.UK * host/*.foo.cam.ac.uk@TEST.CAM.AC.UK
>
> though there are no parse errors reported to the kadmind logs.
>
> Am I doing something wrong or is this a genuine limitation in the parsing
> of the ACLs file? If the latter could I propose that kadmind logs
> something about not being able to parse a line in kadm5.acl?
FNAL (fnal.gov) has a mod to src/lib/kadm5/srv/server_acl.c:
/*
* acl_match_data_sub() See if two data entries match
*
* But compare as a domain name, which allows wildcarding
* for domain components. We will pass each component to
* acl_match_data
*/
You may want to ask someone there for the modification.
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
