[35784] in Kerberos
Re: ACL for Constrained Delegation?
daemon@ATHENA.MIT.EDU (Rick van Rein)
Thu Feb 20 16:36:26 2014
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
From: Rick van Rein <rick@openfortress.nl>
In-Reply-To: <1392905432.22754.212.camel@willson.li.ssimo.org>
Date: Thu, 20 Feb 2014 22:36:07 +0100
Message-Id: <B78CE4FE-45A9-4F0F-A2F5-1F7706E44F25@openfortress.nl>
To: Simo Sorce <simo@redhat.com>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="windows-1252"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Hello Simo,
I had a look at the project page KerberosDelegationACL, and one thing struck me as odd about the specification.
* lack of AllowToImpersonate means ALL clients can be impersonated.
This appears non-intuitive to me; moreover, treating the “zero case” in a special way almost always leads to trouble, exceptions and security hazards. If not in code, then it usually confuses the security admin or surrounding scripts.
I have no idea if this is too late, but the following follows IMHO a more consistent / logical line while retaining expressiveness:
* lack of the Krb5DelegationACL class means that NO access control restrictions are applied
* lack of AllowToImpersonate means NO clients can be impersonated
* to impersonate ALL clients, use a suitable regex memberPrincipal
FWIW :)
Cheers,
-Rick
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
