[23108] in Kerberos
Re: kadmin can't use TGT based?
daemon@ATHENA.MIT.EDU (Chaskiel M Grundman)
Mon Jan 3 17:25:17 2005
From: Chaskiel M Grundman <cg2v@andrew.cmu.edu>
Date: Mon, 03 Jan 2005 17:08:42 -0500
Message-ID: <E98D45E83B83B5C1BC213F4E@sphinx.andrew.cmu.edu>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
--On Monday, January 03, 2005 00:19:47 +0000 Mark Roach
<mrroach@okmaybe.com> wrote:
> Hi, I'm fairly new to Kerberos. I want to verify that I understand this
> item correctly: Is it true that you can not use a TGT based ticket to
> connect to the kadmin server?
If your realm is set up properly, then yes. It is proper practice to set
DISALLOW_TGT_BASED on the kadmin/admin, kadmin/changepw, and
changepw/kerberos service principals. that is however a policy decision,
not anything that is fixed in the protocol.
> This means that
> any application that uses the kadm5clnt library must prompt for a password
> and use kadm5_init_with_password in order to connect successfully, right?
in most circumstances, yes, applications need to be able to prompt for a
password.
> If that is the case, what is the purpose of kadm5_init_with_creds?
it is possible to obtain and store credentials for kadmin/admin in a ccache
(instead of storing krbtgt credentials) with kinit (see -S) or a custom
program if you wanted to invoke a kadm5client-using program more than once
in a short time period and did not want to re-enter the password.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
