[35774] in Kerberos
Re: ACL for Constrained Delegation?
daemon@ATHENA.MIT.EDU (Benjamin Kaduk)
Wed Feb 19 21:48:17 2014
Date: Wed, 19 Feb 2014 21:47:59 -0500 (EST)
From: Benjamin Kaduk <kaduk@mit.edu>
To: Rick van Rein <rick@openfortress.nl>
In-Reply-To: <E08F0534-EDE1-468B-90B1-3425FA19CC3D@openfortress.nl>
Message-ID: <alpine.GSO.1.10.1402192147000.1213@multics.mit.edu>
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED;
BOUNDARY="-559023410-1259186795-1392864479=:1213"
Cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
---559023410-1259186795-1392864479=:1213
Content-Type: TEXT/PLAIN; charset=windows-1252; format=flowed
Content-Transfer-Encoding: QUOTED-PRINTABLE
On Wed, 19 Feb 2014, Rick van Rein wrote:
> Hello,
>
> I=92m trying to understand how to configure Constrained Delegation in the=
KDC. I think I got the GSSAPI client side part, notably S4U2Proxy, but I =
can only seem to find proxy / proxiable flags in the KDC setup. And these =
don=92t have undisputably clear semantics, from what I=92ve read.
>
> Let=92s say I want to setup webmail.example.com with permissions to acces=
s LDAP, IMAP and SMTP; however, sendmail.example.com can only access SMTP a=
nd contacts.example.com can only access LDAP; schematically:
>
> HTTP/webmail.example.com =97> ldap/ldap.example.com
> HTTP/webmail.example.com =97> imap/imap.example.com
> HTTP/webmail.example.com =97> smtp/smtp.example.com
> HTTP/sendmail.example.com =97> smtp/smtp.example.com
> HTTP/contacts.example.com =97> ldap/ldap.example.com
>
> How would I setup these delegations, and only these delegations, with MIT=
Kerberos5?
http://k5wiki.kerberos.org/wiki/Projects/ConstrainedDelegation notes that=
=20
there is a krbAllowedToDelegateTo attribute that can be set in LDAP=20
(manually) to limit delegation.
I don't think I have an actual example handy.
-Ben Kaduk
---559023410-1259186795-1392864479=:1213
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
---559023410-1259186795-1392864479=:1213--
