[35793] in Kerberos
Re: Separate in-/out- ccaches.
daemon@ATHENA.MIT.EDU (Peter Mogensen)
Sat Feb 22 15:57:13 2014
Message-ID: <53090EA6.4010809@one.com>
Date: Sat, 22 Feb 2014 21:55:02 +0100
From: Peter Mogensen <apm@one.com>
MIME-Version: 1.0
To: Greg Hudson <ghudson@mit.edu>, kerberos@mit.edu
In-Reply-To: <53090BD4.10705@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 2014-02-22 21:43, Greg Hudson wrote:
> On 02/22/2014 02:57 PM, Peter Mogensen wrote:
>> This works fine with a MEMORY ccache to hold til tickets.
>> But since you can only provide 1 ccache to the libkrb5 API that also
>> means the service1 has to do an AS-REQ for a TGT to put in that MEMORY
>> ccached for every request.
> [...]
>> Is there a way to do what I'm looking for?
>
> Can you make a master ccache with the TGT and then copy it (with
> krb5_cc_copy_creds) to another ccache for each client?
Hmm.. yes... I actually thought of injecting the TGT into the MEMORY
ccache from a persistent source, but I didn't think of copying an entire
ccache.
I would guess the approach you suggest would benefit from some double
checking that there not being other credentials in the master ccache
than the TGT.
But yes... I guess that would kinda work.
Thanks,
/Peter
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
