[35777] in Kerberos
Re: ACL for Constrained Delegation?
daemon@ATHENA.MIT.EDU (Daniel Kahn Gillmor)
Thu Feb 20 00:42:00 2014
Message-ID: <5305958F.70009@fifthhorseman.net>
Date: Thu, 20 Feb 2014 00:41:35 -0500
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <alpine.GSO.1.10.1402192147000.1213@multics.mit.edu>
Content-Type: multipart/mixed; boundary="===============0110153141=="
Errors-To: kerberos-bounces@mit.edu
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============0110153141==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="MBQhuO4fS0aKENkW6xwfR9nm5iLljCJOd"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--MBQhuO4fS0aKENkW6xwfR9nm5iLljCJOd
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
On 02/19/2014 09:47 PM, Benjamin Kaduk wrote:
> On Wed, 19 Feb 2014, Rick van Rein wrote:
>> I=E2=80=99m trying to understand how to configure Constrained Delegati=
on in
>> the KDC. I think I got the GSSAPI client side part, notably
>> S4U2Proxy, but I can only seem to find proxy / proxiable flags in the
>> KDC setup. And these don=E2=80=99t have undisputably clear semantics,=
from
>> what I=E2=80=99ve read.
>>
>> Let=E2=80=99s say I want to setup webmail.example.com with permissions=
to
>> access LDAP, IMAP and SMTP; however, sendmail.example.com can only
>> access SMTP and contacts.example.com can only access LDAP; schematical=
ly:
>>
>> HTTP/webmail.example.com =E2=80=94> ldap/ldap.example.com
>> HTTP/webmail.example.com =E2=80=94> imap/imap.example.com
>> HTTP/webmail.example.com =E2=80=94> smtp/smtp.example.com
>> HTTP/sendmail.example.com =E2=80=94> smtp/smtp.example.com
>> HTTP/contacts.example.com =E2=80=94> ldap/ldap.example.com
>>
>> How would I setup these delegations, and only these delegations, with
>> MIT Kerberos5?
>=20
> http://k5wiki.kerberos.org/wiki/Projects/ConstrainedDelegation notes
> that there is a krbAllowedToDelegateTo attribute that can be set in LDA=
P
> (manually) to limit delegation.
>=20
> I don't think I have an actual example handy.
This arrangement seems to suggest that the delegation constraint is
something that will be managed for all principals by the KDC explicitly,
rather than the end user being able to decide (or even know?) what
explicit delegations are being offered. Am i understanding this right?
Is there any mechanism for user-controllable delegation? (or perhaps
more fundamentally, does this question even make sense, given the power
held by the KDC already?)
--dkg
--MBQhuO4fS0aKENkW6xwfR9nm5iLljCJOd
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Icedove - http://www.enigmail.net/
iQJ8BAEBCgBmBQJTBZWPXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFQjk2OTEyODdBN0FEREUzNzU3RDkxMUVB
NTI0MDFCMTFCRkRGQTVDAAoJEKUkAbEb/fpc1EYP/AkYGIj84+xjIR5fE5ADQN6U
zW1WknRXGvMVV8OVvcn9Yn+6hKBaltsXa9FMuLJf6V4wysGytWHiDmIvgDbFPUD7
jwsMXuj6ff6g7ohf6cF5z4AON7ZARJ6jqYrYqiM0V0FoWe27aMRRwjE4doeYcoNB
JjHNAevci2mZiycOUgWhN0dHIbWu+bmZVh8Zryhoph+lMNEwrwd008UOzMp/FXJ0
Wzcd19eJuzQrUli+2rcaYJYpPjB+ENRNaIIPWG/xwIzcR7CluBXW3KWjTfJF4Sb7
EdpQXPNQ5lB33qa4V9HVfT+qh7+FwuwrujMZ6J4JWR7EH47bmz5WiRoOkbw+d9DC
zo0qPdSLqmWh4Azjv27JorHIU6d7LUB3PzhOMlcqHX505M5V0lXT8LJ9HRBuP7F+
FedGhEFoZXvgNAubkTlnAP0iXetKZuoPpa0OILKzVVQCwyQxjJfycye8iijgsOuC
TLghG+WA7H8RJ8nM7XPDObKuMyApXEvKzMsk1qfgX5tcHd00fw5YozHjcjCr2isW
79vC5DURUvJrXw5HN3kCySYcbvkYfFSLlTyB8OKseCok5Gnd8FPqZcUoR+eUtXYV
0E/ymEJHDxqF49y5bU6fSbThJq2xxO014ZSdIbXRzXszDY/wldZGK5AAi0agYDf7
El4WKDrcWoWQnf5fg9NA
=9Lfl
-----END PGP SIGNATURE-----
--MBQhuO4fS0aKENkW6xwfR9nm5iLljCJOd--
--===============0110153141==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============0110153141==--
