[22319] in Kerberos
Re: getprinc -terse format
daemon@ATHENA.MIT.EDU (Lukas Kubin)
Tue Aug 31 02:12:03 2004
Message-ID: <413414A9.8010101@opf.slu.cz>
Date: Tue, 31 Aug 2004 08:03:21 +0200
From: Lukas Kubin <kubin@opf.slu.cz>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <Pine.GSO.4.58.0408300911130.27157@ack.Berkeley.EDU>
cc: Mike Friedman <mikef@ack.berkeley.edu>
Content-Type: multipart/mixed; boundary="===============42947804446907734=="
Errors-To: kerberos-bounces@mit.edu
This is a cryptographically signed message in MIME format.
--===============42947804446907734==
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
micalg=sha1; boundary="------------ms060104050605050005020007"
This is a cryptographically signed message in MIME format.
--------------ms060104050605050005020007
Content-Type: multipart/mixed;
boundary="------------060605010605010906080206"
This is a multi-part message in MIME format.
--------------060605010605010906080206
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Thank you for the great help Mike.
Could someone, please, add the "terse" option format description for
both getprinc and getpol commands into the admin's Kerberos documentation?
Thank you.
lukas
Mike Friedman wrote:
> On Mon, 30 Aug 2004 at 10:48 (+0200), Lukas Kubin wrote:
>
>
>>I would like to parse "getprinc -terse" output in our accounts
>>administration scripts. However I can't find the "terse" output format
>>description. E.g. when I need to look for "needchange" option, I don't
>>know, which of the fields stores this value. Is there any description of
>>the "terse" format somewhere (except of source code)?
>
>
> Lukas,
>
> I had the same requirement, so I found the answer in the source code (see
> below for the field layout).
>
> As it happens, a principal's attributes, such as 'needchange', are
> represented as a sequence of bit flags, aggregated into a single byte.
> So after you find the field (1 byte long), you have to parse the bits.
>
> First, here's the layout of the output from 'getprinc -terse':
>
> ======================================================================
> Fields in 'getprinc -terse' output
>
> princ-canonical-name
> princ-exp-time
> last-pw-change
> pw-exp-time
> princ-max-life
> modifying-princ-canonical-name
> princ-mod-date
> princ-attributes <=== This is the field you want
> princ-kvno
> princ-mkvno
> princ-policy (or 'None')
> princ-max-renewable-life
> princ-last-success
> princ-last-failed
> princ-fail-auth-count
> princ-n-key-data
> ver
> kvno
> data-type[0]
> data-type[1]
> ======================================================================
>
> Following is a perl subroutine I use to check for a specific attribute
> value. To see if the 'needchange' option is set, you would do something
> like this:
>
> my $REQUIRES_PWCHANGE = 512;
> if (&attribute($REQUIRES_PWCHANGE)) {
> # needchange attribute is set
> ...
> ...
> }
>
> (The value '512' represents the bit position in the 'attributes' byte
> corresponding to 'needchange').
>
> # ----------------------------------------------------
> sub attribute {
>
> # Check whether a KDC attribute flag is set for a specified
> # principal. Return 1 if it is, 0 if not.
>
> my ($attr_flag) = @_;
>
> my $rc;
> my $xx;
> my ($attribute_string,@attributes,$flags);
>
> $attribute_string = `$kadmin 'getprinc -terse $userID' 2>/dev/null`;
>
> ($xx,$attribute_string) = split(/\n/,$attribute_string);
> @attributes = split (" ",$attribute_string);
> $flags = $attributes[7];
>
> # If attribute is set, return 1, else 0:
> $rc = ($flags & $attr_flag) ? 1 : 0;
>
> return $rc;
> }
> # ----------------------------------------------------
>
>
> I hope this helps.
>
> Mike
>
> ------------------------------------------------------------------------------
> Mike Friedman System and Network Security
> mikef@ack.Berkeley.EDU 2484 Shattuck Avenue
> 1-510-642-1410 University of California at Berkeley
> http://ack.Berkeley.EDU/~mikef http://security.berkeley.edu
> ------------------------------------------------------------------------------
>
--
Lukas Kubin
phone: +420596398275
email: kubin@opf.slu.cz
Information centre
The School of Business Administration in Karvina
Silesian University in Opava
Czech Republic
http://www.opf.slu.cz
--------------060605010605010906080206
Content-Type: text/x-vcard; charset=utf-8;
name="kubin.vcf"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="kubin.vcf"
begin:vcard
fn:Lukas Kubin
n:Kubin;Lukas
org:The School of Business Administration in Karvina;Information centre
adr:;;Univerzitni namesti 1934/3;Karvina;;73340;Czech Republic
email;internet:kubin@opf.slu.cz
title:Network administrator
tel;work:+420596398275
x-mozilla-html:FALSE
url:http://www.opf.slu.cz
version:2.1
end:vcard
--------------060605010605010906080206--
--------------ms060104050605050005020007
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGbDCC
AzIwggIaoAMCAQICAgDmMA0GCSqGSIb3DQEBBAUAMDIxCzAJBgNVBAYTAkNaMQ8wDQYDVQQK
EwZDRVNORVQxEjAQBgNVBAMTCUNFU05FVCBDQTAeFw0wMzExMTkxNDM4NTdaFw0wNDExMTgx
NDM4NTdaMEUxDzANBgNVBAoTBkNFU05FVDEcMBoGA1UEChMTU2lsZXNpYW4gVW5pdmVyc2l0
eTEUMBIGA1UEAxMLbHVrYXMga3ViaW4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7l
zAuBktAjhaVuPR0S2kwnO/xt1fp9D2GdLpxu2NcqUsuyEC00k3VHEijgFzcNt7+QviV1y5nq
P3nmCqk+eNp20Z3qrYZKGh0YTho/qPESyjFZ4P2NmV7W+SewXZ0IEtxD/DaOMQo8kww1ho5y
zaxVgSRItwefSBEMmFYdqrxpAgMBAAGjgcIwgb8wHQYDVR0OBBYEFNBqBwZMDvExebpgW4m8
MCWtsegvMB8GA1UdIwQYMBaAFPhWGtmaeJVttIiEVTUvqgbz1yBaMDUGA1UdHwQuMCwwKqAo
oCaGJGh0dHA6Ly93d3cuY2VzbmV0LmN6L3BraS9jcmwvY2NhLmNybDAOBgNVHQ8BAf8EBAMC
BPAwGwYDVR0RBBQwEoEQa3ViaW5Ab3BmLnNsdS5jejAZBgNVHSAEEjAQMA4GDCsGAQQBvnkB
AgIBATANBgkqhkiG9w0BAQQFAAOCAQEAuI/sMxZZa78h5+Mzo3IhgSxrVMl5Hbm2YgLWLHAx
QG1NxG0W9bkggMmRWrW8Xotr8VPA4IySqBiVwOlVMdZ5GNcUiSCrrFU6zfxAXD6dAJuEHGfb
Vz/dQntptJ9Dz/URteoMleNZjn2gPaLELEax2gaF+2cvbpW521CFJrxxMc2LdScRDBCFapWO
GNbxqSflLqbT8TsrbmS1V6zUicXf2eUurKA36/psbtFdG03vVaD3+V+RMgHr6X5k1NUfDfSI
pmX7irFEn7tMrxq630NTJUrEm1w4ivK/+f+6+F0ozeaamYS/Gm7LUFSgA15ZDtGCKySWQp2V
B+gwUKfc+8R+WjCCAzIwggIaoAMCAQICAgDmMA0GCSqGSIb3DQEBBAUAMDIxCzAJBgNVBAYT
AkNaMQ8wDQYDVQQKEwZDRVNORVQxEjAQBgNVBAMTCUNFU05FVCBDQTAeFw0wMzExMTkxNDM4
NTdaFw0wNDExMTgxNDM4NTdaMEUxDzANBgNVBAoTBkNFU05FVDEcMBoGA1UEChMTU2lsZXNp
YW4gVW5pdmVyc2l0eTEUMBIGA1UEAxMLbHVrYXMga3ViaW4wgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAL7lzAuBktAjhaVuPR0S2kwnO/xt1fp9D2GdLpxu2NcqUsuyEC00k3VHEijg
FzcNt7+QviV1y5nqP3nmCqk+eNp20Z3qrYZKGh0YTho/qPESyjFZ4P2NmV7W+SewXZ0IEtxD
/DaOMQo8kww1ho5yzaxVgSRItwefSBEMmFYdqrxpAgMBAAGjgcIwgb8wHQYDVR0OBBYEFNBq
BwZMDvExebpgW4m8MCWtsegvMB8GA1UdIwQYMBaAFPhWGtmaeJVttIiEVTUvqgbz1yBaMDUG
A1UdHwQuMCwwKqAooCaGJGh0dHA6Ly93d3cuY2VzbmV0LmN6L3BraS9jcmwvY2NhLmNybDAO
BgNVHQ8BAf8EBAMCBPAwGwYDVR0RBBQwEoEQa3ViaW5Ab3BmLnNsdS5jejAZBgNVHSAEEjAQ
MA4GDCsGAQQBvnkBAgIBATANBgkqhkiG9w0BAQQFAAOCAQEAuI/sMxZZa78h5+Mzo3IhgSxr
VMl5Hbm2YgLWLHAxQG1NxG0W9bkggMmRWrW8Xotr8VPA4IySqBiVwOlVMdZ5GNcUiSCrrFU6
zfxAXD6dAJuEHGfbVz/dQntptJ9Dz/URteoMleNZjn2gPaLELEax2gaF+2cvbpW521CFJrxx
Mc2LdScRDBCFapWOGNbxqSflLqbT8TsrbmS1V6zUicXf2eUurKA36/psbtFdG03vVaD3+V+R
MgHr6X5k1NUfDfSIpmX7irFEn7tMrxq630NTJUrEm1w4ivK/+f+6+F0ozeaamYS/Gm7LUFSg
A15ZDtGCKySWQp2VB+gwUKfc+8R+WjGCAicwggIjAgEBMDgwMjELMAkGA1UEBhMCQ1oxDzAN
BgNVBAoTBkNFU05FVDESMBAGA1UEAxMJQ0VTTkVUIENBAgIA5jAJBgUrDgMCGgUAoIIBRTAY
BgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNDA4MzEwNjAzMjFa
MCMGCSqGSIb3DQEJBDEWBBTHTMkjuxN6/KFf9WhavBYS0mDaBzBHBgkrBgEEAYI3EAQxOjA4
MDIxCzAJBgNVBAYTAkNaMQ8wDQYDVQQKEwZDRVNORVQxEjAQBgNVBAMTCUNFU05FVCBDQQIC
AOYwSQYLKoZIhvcNAQkQAgsxOqA4MDIxCzAJBgNVBAYTAkNaMQ8wDQYDVQQKEwZDRVNORVQx
EjAQBgNVBAMTCUNFU05FVCBDQQICAOYwUgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAO
BggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgw
DQYJKoZIhvcNAQEBBQAEgYAyMlUkKT4D7WIzMWiBYiiqBWPupXKQtWGalIyZ3bVbeXdSNi5z
iUAeMh3+dUPK5d/vaXM1mGJ6e0VhJFRgHZzH0rtK92sOATPCeFrHLV98Jba+3WedY93haiDX
4kAoaXTvdbMUyjPrmrpb+ziZN72vODin31yqf8/bOUeFHtrJEwAAAAAAAA==
--------------ms060104050605050005020007--
--===============42947804446907734==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============42947804446907734==--
