[35769] in Kerberos
Re: Windows KDC - Delegation Option
daemon@ATHENA.MIT.EDU (Vipul Mehta)
Tue Feb 11 12:38:46 2014
MIME-Version: 1.0
In-Reply-To: <52F93BE7.6010703@mit.edu>
Date: Tue, 11 Feb 2014 19:00:42 +0530
Message-ID: <CAMeQEL8Qaz8XDAtctn9Dd8NC7+wagsU=fYy_GvGm=PSsYpXKxg@mail.gmail.com>
From: Vipul Mehta <vipulmehta.1989@gmail.com>
To: Greg Hudson <ghudson@mit.edu>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
@Christopher : I know about that option. I don't want to disable delegation
but i want to know the correct behaviour of MIT Kerberos with KDC Option i
specified.
@Greg, now it's clear to me.
Checked the code also. So, if initiator has requested GSS_C_DELEG_FLAG,
then delegation will always be done and value of "ok-as-delegate" flag in
service ticket does not matter in that case. Value of "ok-as-delegate" flag
is important when initiator has not requested GSS_C_DELEG_FLAG but has
requested GSS_C_DELEG_POLICY_FLAG.
On Tue, Feb 11, 2014 at 2:21 AM, Greg Hudson <ghudson@mit.edu> wrote:
> I believe this option affects the ok-as-delegate ticket flag, which was
> added in RFC 4120. Microsoft's Kerberos implementation honors this
> flag, but Unix implementations do not, as doing so would effectively
> disable all ticket forwarding in most Unix environments.
>
> MIT krb5 and Heimdal did add the GSS_C_DELEG_POLICY_FLAG flag so that
> applications can choose to delegate tickets only if the ok-as-delegate
> flag is set on the service ticket. But it's not clear when a Unix
> application would want to use that instead of GSS_C_DELEG_FLAG.
>
--
Regards,
Vipul
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
