[22253] in Kerberos
Re: UI for Kerberos accounts administration
daemon@ATHENA.MIT.EDU (Sam Hartman)
Fri Aug 20 12:27:18 2004
To: Lukas Kubin <kubin@opf.slu.cz>
From: Sam Hartman <hartmans@mit.edu>
Date: Fri, 20 Aug 2004 12:25:36 -0400
In-Reply-To: <4125F684.7050807@opf.slu.cz> (Lukas Kubin's message of "Fri,
20 Aug 2004 15:03:00 +0200")
Message-ID: <tslsmah22v3.fsf@cz.mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
>>>>> "Lukas" == Lukas Kubin <kubin@opf.slu.cz> writes:
Lukas> I'm planning to build an web interface for administering
Lukas> our Kerberos/OpenAFS/LDAP accounts. How should I pass
Lukas> credentials to the web service? I can use the mod_auth_kerb
Lukas> module for Apache. Then some wrapper script will call
Lukas> kadmin command. When I want kadmin not to ask for password
Lukas> everytime it is called, I'll have to create an
Lukas> administrator's keytab stored on the webserver. That way
Lukas> appear not to be secure.
Why is this not secure? It places your web service in the role as a
privilege delegation service rather than as acting as the user
directly.
You actually tend to want this though. At many sites it is reasonable
for a larger set of users to go through all the steps of creating a
properly configured account all at once than it is to allow a user to
only go through one of the steps of account setup. If only the web
server is authorized to act, it can enforce constraints like this.
--Sam
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
