[15577] in Kerberos_V5_Development
Re: Creating GSSAPI initiate credential using keytab
daemon@ATHENA.MIT.EDU (Nicolas Williams)
Wed Mar 10 14:22:08 2010
Date: Wed, 10 Mar 2010 13:14:32 -0600
From: Nicolas Williams <Nicolas.Williams@sun.com>
To: Greg Hudson <ghudson@mit.edu>
Message-ID: <20100310191432.GO24640@Sun.COM>
Mime-Version: 1.0
Content-Disposition: inline
In-Reply-To: <1268247844.18898.445.camel@ray>
Cc: Sam Hartman <hartmans@mit.edu>, "krbdev@MIT.EDU" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Wed, Mar 10, 2010 at 02:04:04PM -0500, Greg Hudson wrote:
> On Wed, 2010-03-10 at 12:36 -0500, Sam Hartman wrote:
> > Would it be a good idea to wrap all this logic into
> > gss_acquire_credential so that if you have a keytab you can just use it
> > as an initiator?
> > I.E. would that be a good improvement for the future?
>
> Possibly. Or we could do the credentials-cache-backed-by-a-keytab idea.
Solaris already does acquire a TGT using a keytab, but only when
getuid() == 0. This could/should be generalized.
The main issue is: how to find the correct keytab. Using an environment
variable will do, but I'd rather have well-known locations for user
keytabs, such as:
/var/run/krb5/keytabs/<user>/keytab
/var/krb5/keytabs/<user>/keytab
The /var/run paths would be nice for system-managed temporary keytabs
(think of a PAM module stashing away your keys for subsequent use; I'm
not promoting this, but I'd like it to be possible). The /var/krb5
paths would be nice for persistent user keytabs.
> I think it requires at least some thought, though. Currently our GSSAPI
> library only does TGS requests, not AS requests. If it start doing AS
> requests, then it becomes a consumer of the gic_opt framework and the
> preauth framework, and there are some (probably manageable) implications
> there.
That's not been a problem for Solaris.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
