[35772] in Kerberos
ACL for Constrained Delegation?
daemon@ATHENA.MIT.EDU (Rick van Rein)
Wed Feb 19 07:37:12 2014
From: Rick van Rein <rick@openfortress.nl>
Date: Wed, 19 Feb 2014 09:28:28 +0100
To: Kerberos@mit.edu
Message-Id: <E08F0534-EDE1-468B-90B1-3425FA19CC3D@openfortress.nl>
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
Content-Type: text/plain; charset="windows-1252"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Hello,
I’m trying to understand how to configure Constrained Delegation in the KDC. I think I got the GSSAPI client side part, notably S4U2Proxy, but I can only seem to find proxy / proxiable flags in the KDC setup. And these don’t have undisputably clear semantics, from what I’ve read.
Let’s say I want to setup webmail.example.com with permissions to access LDAP, IMAP and SMTP; however, sendmail.example.com can only access SMTP and contacts.example.com can only access LDAP; schematically:
HTTP/webmail.example.com —> ldap/ldap.example.com
HTTP/webmail.example.com —> imap/imap.example.com
HTTP/webmail.example.com —> smtp/smtp.example.com
HTTP/sendmail.example.com —> smtp/smtp.example.com
HTTP/contacts.example.com —> ldap/ldap.example.com
How would I setup these delegations, and only these delegations, with MIT Kerberos5?
Thanks!
-Rick
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
