[22168] in Kerberos
Question: want different default_realm for service and user
daemon@ATHENA.MIT.EDU (Dirk Pape)
Thu Aug 12 02:47:49 2004
From: Dirk Pape <pape@inf.fu-berlin.de>
Date: Thu, 12 Aug 2004 08:37:54 +0200
Message-ID: <pape-8223F5.08375412082004@news.fu-berlin.de>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Hello,
I want to do the following with two kerberos realms which trust each
other:
first realm "FOO.ORG" holds only user principles, it is based on a
Windows 2003 Server AD.
second realm "BAR.FOO.ORG" hold service principles for unix services,
such as "host/domain@BAR.FOO.ORG" for all unix hosts running ssh.
We want to hold these principals in a MIT-kerb. based KDC, because we
like to use the well known and well documented kadmin tool to remotely
create service principles in that domain.
As I understand it will be possible to authenticate as "user@FOO.ORG" to
a service running with a keytab for a service principle
"service/domain@BAR.FOO.ORG" if both realms trust each other.
First question: is this correct and a reasonable scenario? (we could not
yet test it because we did not yet set up the BAR.FOO.ORG domain).
If this works and is a reasonable approach, then we see the following
problem from our tests.
let the [libdefaults] section in /etc/krb5.conf on the unix host running
the kerberized ssh service contain "default_realm = BAR.FOO.ORG", then
obtaining user tgts on login (via pam) or by "kinit user" on this host
will fail, because it will try to get it from realm BAR.FOO.ORG.
on the other hand, if "default_realm = FOO.ORG" the ssh service and
other service would not find the correct keytab entry because they look
for "service/domain@FOO.ORG" instead of "service/domain@BAR.FOO.ORG".
For what I see, I need to specify somehow that SPNs and user PNs come
from different realms in default.
Is this doable with some configuraton options on the unix host? (I
already tried many things with the sections [domain_realm] and
[appdefaults] but I could ot find a way)
I would appreciate every hint.
The other approach for our problem would be to find or implement an RPC
on the windows server running AD, which like kadmin/kadmind enables
admins to create SPNs remotely and transfer keytab securely to the
service host.
last question: does anybody know such a daemon for windows 2003 server?
Thanks,
Dirk.
--
Dr. Dirk Pape (Leiter des Rechnerbetriebs)
FB Mathematik und Informatik der FU-Berlin
Takustr. 9, 14195 Berlin
Tel. +49 (30) 838 75143, Fax. +49 (30) 838 75190
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
