[35761] in Kerberos
Windows KDC - Delegation Option
daemon@ATHENA.MIT.EDU (Vipul Mehta)
Mon Feb 10 14:25:16 2014
MIME-Version: 1.0
Date: Mon, 10 Feb 2014 12:20:12 +0530
Message-ID: <CAMeQEL9XMAeo8s2pfUOBxABK9y4ctQMSMVimO+C9wr8pqus93w@mail.gmail.com>
From: Vipul Mehta <vipulmehta.1989@gmail.com>
To: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi,
Scenario : User A forwards his credentials to User B. User B uses the
forwarded credentials to interact with User C on behalf of user A.
[Delegation]
In windows KDC there is delegation option associated with user properties.
I've set it to "Do not trust this user for delegation" for User B i.e. User
B will not be able to use delegated credentials.
In Windows SSPI API, it works fine and User B is not able to use delegated
credentials.
But the option doesn't seem to be having any impact in MIT Kerberos API in
C++. User B is able to use A's forwarded credentials to establish security
context with User C.
Is this a problem from KDC side ? Any solution for this ?
--
Regards,
Vipul
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
