[35747] in Kerberos
Re: Kind of Tickets Granting Control List
daemon@ATHENA.MIT.EDU (Damien Touraine)
Wed Feb 5 04:14:12 2014
Message-ID: <52F200D5.1020302@limsi.fr>
Date: Wed, 05 Feb 2014 10:13:57 +0100
From: Damien Touraine <damien.touraine@limsi.fr>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <52F1CEB5.7060806@mit.edu>
Content-Type: multipart/mixed; boundary="===============0332446061=="
Errors-To: kerberos-bounces@mit.edu
This is a cryptographically signed message in MIME format.
--===============0332446061==
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
micalg=sha1; boundary="------------ms060903080700000300030103"
This is a cryptographically signed message in MIME format.
--------------ms060903080700000300030103
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable
On 05/02/2014 06:40, Greg Hudson wrote:
> On 02/04/2014 11:39 PM, Damien Touraine wrote:
>> I am looking for a method to filter ticket granting.
>> For instance, I have two NFS servers (nfs/server1@REALM and
>> nfs/server2@REALM) and one computer client (nfs/client@REALM).
>> I want kerberos to grant nfs/client@REALM for nfs/server1@REALM, but
>> forbid nfs/client@REALM for nfs/server2@REALM.
>> Is it possible ?
> The traditional Kerberos viewpoint is that access control takes places
> on the application server, not the KDC, so it is the responsibility of
> nfs/server2 to decide what privileges, if any, to grant to nfs/client.
> There have always been exceptions (such as the unwillingness of the KDC=
> to grant TGS requests for the kadmin service by default), but in genera=
l
> that's been the party line. Because of that, there aren't very many
> administrator-visible policy facilities in the MIT krb5 KDC. I believe=
> there isn't any way to do what you want without editing the KDC source
> code or creating a new KDB module.
>
> We have been considering adding a ticket policy plugin interface in a
> future release, and may do so in the future, but we don't currently hav=
e
> a timeline for it.
>
Hi Greg,
Thank you for your answer.
I'm not completely dummy in C developpement and the kdc source code=20
seems clean. Do you think I can try to investigate the development of=20
such ticket policy plugin interface ? Although I don't guarantee that I=20
will manage to produce something. Do you have specifications on such=20
behaviour ?
Regards,
Damien
--------------ms060903080700000300030103--
--===============0332446061==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============0332446061==--
