[22796] in Kerberos
Re: User instances
daemon@ATHENA.MIT.EDU (Dan Riley)
Mon Nov 1 15:30:32 2004
To: kerberos@mit.edu
From: Dan Riley <dsr@mail.lns.cornell.edu>
Date: 30 Oct 2004 20:32:34 -0400
In-Reply-To: <20041027185633.GX300@yiff.mit.edu>
Message-ID: <sh4qkbpw0t.fsf@lnxcu9.lns.cornell.edu>
Errors-To: kerberos-bounces@mit.edu
red@MIT.EDU (Rachel Elizabeth Dillon) writes:
> On Wed, Oct 27, 2004 at 07:54:45PM +0200, Fredrik Tolf wrote:
> > Is there no way to just add one single general rule to cover all users,
> > analogous to filename matching in Makefiles? That is, something like
> > this:
> >
> > %/admin@REALM.COM x %/*@REALM.COM
> >
> > Where, as in make, `%' would have to match the same thing in both
> > places?
>
> The manpage for kadmind does not suggest that any such rule exists. It
> might be a convenient thing to add in, or it might exist in the source
> but not be documented; I don't know.
The backref syntax for the MIT kadmind is *n, where n is the ordinal
number of the wildcard in the principal to be matched--so, e.g.
host/*@EXAMPLE.EDU ci host/*1@EXAMPLE.EDU
lets a host set a new key for itself, but not for any other host
principal. I have not tried mixing this with target wildcards--I
would expect
*/admin@REALM.COM x *1/*@REALM.COM
to work, but I haven't tried it.
I found this by reading the source. I've been meaning to file a bug
report about the lack of documentation for this feature. It's a very
useful feature, so I'd hate for MIT to feel free to eliminate it as
undocumented.
--
The 10/8 that can be pinged is not the true 10/8.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
