[15565] in Kerberos_V5_Development
Re: Creating GSSAPI initiate credential using keytab entry
daemon@ATHENA.MIT.EDU (Russ Allbery)
Mon Mar 8 12:17:06 2010
From: Russ Allbery <rra@stanford.edu>
To: "Richard Evans" <richard.evans@datanomic.com>
In-Reply-To: <974066EF77EEA44EB8AED6ADA05DBD02019A8675@THHS2EXBE1X.hostedservice2.net>
(Richard Evans's message of "Mon, 8 Mar 2010 17:09:59 -0000")
Date: Mon, 08 Mar 2010 09:16:53 -0800
Message-ID: <87aauika2i.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
"Richard Evans" <richard.evans@datanomic.com> writes:
> Thanks for this. Sort of glad that I had missed anything. I do agree
> that this is a flaw in the GSS API.
> I'll take a look at your code.
Oh, sorry, I didn't pay sufficient attention to your subject line and
think about this. That code obtains credentials from a password. You
want to use a keytab. That's a minor modification, but it's a
modification; replace:
status = krb5_get_init_creds_password(ctx, &creds, princ, NULL,
krb5_prompter_posix, NULL, 0, NULL, opts);
with:
krb5_keytab keytab = NULL;
status = krb5_kt_resolve(ctx, path, &keytab);
if (status != 0)
die_krb5(ctx, status, "error resolving keytab %s", path);
status = krb5_get_init_creds_keytab(ctx, &creds, princ, keytab, 0,
NULL, opts);
where path is the path to your keytab. Otherwise, it's the same.
> Just for interest, is there any reason why the Kerberos version of
> gss_acquire_cred should not get the credentials itself? It should have
> access to all the information it needs.
It does get the credentials that it needs given a ticket cache with a TGT.
If you don't already have an existing ticket cache, it's not clear what
the right thing to do is. In your case, you want to use a keytab
(presumably the default system one), but the right thing to do may be to
use some other keytab or to fail because this is a client program that
should be run by a user with their own credentials acquired with kinit or
PAM.
There isn't any way to communicate through the GSSAPI layer what the right
thing to do is, so it requires an existing ticket cache.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
