[22309] in Kerberos
Re: getprinc -terse format
daemon@ATHENA.MIT.EDU (Mike Friedman)
Mon Aug 30 12:26:04 2004
Date: Mon, 30 Aug 2004 09:23:22 -0700 (PDT)
From: Mike Friedman <mikef@ack.berkeley.edu>
To: Lukas Kubin <kubin@opf.slu.cz>
In-Reply-To: <4132E9F9.8050102@opf.slu.cz>
Message-ID: <Pine.GSO.4.58.0408300911130.27157@ack.Berkeley.EDU>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Mon, 30 Aug 2004 at 10:48 (+0200), Lukas Kubin wrote:
> I would like to parse "getprinc -terse" output in our accounts
> administration scripts. However I can't find the "terse" output format
> description. E.g. when I need to look for "needchange" option, I don't
> know, which of the fields stores this value. Is there any description of
> the "terse" format somewhere (except of source code)?
Lukas,
I had the same requirement, so I found the answer in the source code (see
below for the field layout).
As it happens, a principal's attributes, such as 'needchange', are
represented as a sequence of bit flags, aggregated into a single byte.
So after you find the field (1 byte long), you have to parse the bits.
First, here's the layout of the output from 'getprinc -terse':
======================================================================
Fields in 'getprinc -terse' output
princ-canonical-name
princ-exp-time
last-pw-change
pw-exp-time
princ-max-life
modifying-princ-canonical-name
princ-mod-date
princ-attributes <=== This is the field you want
princ-kvno
princ-mkvno
princ-policy (or 'None')
princ-max-renewable-life
princ-last-success
princ-last-failed
princ-fail-auth-count
princ-n-key-data
ver
kvno
data-type[0]
data-type[1]
======================================================================
Following is a perl subroutine I use to check for a specific attribute
value. To see if the 'needchange' option is set, you would do something
like this:
my $REQUIRES_PWCHANGE = 512;
if (&attribute($REQUIRES_PWCHANGE)) {
# needchange attribute is set
...
...
}
(The value '512' represents the bit position in the 'attributes' byte
corresponding to 'needchange').
# ----------------------------------------------------
sub attribute {
# Check whether a KDC attribute flag is set for a specified
# principal. Return 1 if it is, 0 if not.
my ($attr_flag) = @_;
my $rc;
my $xx;
my ($attribute_string,@attributes,$flags);
$attribute_string = `$kadmin 'getprinc -terse $userID' 2>/dev/null`;
($xx,$attribute_string) = split(/\n/,$attribute_string);
@attributes = split (" ",$attribute_string);
$flags = $attributes[7];
# If attribute is set, return 1, else 0:
$rc = ($flags & $attr_flag) ? 1 : 0;
return $rc;
}
# ----------------------------------------------------
I hope this helps.
Mike
------------------------------------------------------------------------------
Mike Friedman System and Network Security
mikef@ack.Berkeley.EDU 2484 Shattuck Avenue
1-510-642-1410 University of California at Berkeley
http://ack.Berkeley.EDU/~mikef http://security.berkeley.edu
------------------------------------------------------------------------------
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
