[16245] in Kerberos_V5_Development
Re: ANAME_DB re-enable with patch.
daemon@ATHENA.MIT.EDU (Roland C. Dowdeswell)
Thu Sep 2 19:25:50 2010
Date: Fri, 3 Sep 2010 00:26:23 +0100
From: "Roland C. Dowdeswell" <elric@imrryr.org>
To: Sam Hartman <hartmans@mit.edu>
Message-ID: <20100902232623.GD15284@mournblade.imrryr.org>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <tslr5hcghoo.fsf@live.mit.edu>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Thu, Sep 02, 2010 at 01:48:39PM -0400, Sam Hartman wrote:
>
> I support some interface to do lookups for aname_to_lname that is
> database driven. Like Greg, additional uses of the bdb in the tree
> sholud be avoided.
>
> I'd be happy with any of:
>
> * system db (assuming system DBs can be in the same process with ours on
> at least some common OSes we build for)
>
> * sqlite
> * tdb
> * LDAP
LDAP, we should be a little careful about. Given that currently,
krb5_kuserok() does not cause any network dependent services that
can return transient failures and cannot block [for long] if you
are running on a local file system, this could change the expectations
of callers about how krb5_kuserok() actually works. This is not
to say that it shouldn't be done---but there are gotchas in taking
a function call that returns explicit and correct results and adding
in a network backend such as LDAP without also changing the API to
allow for transient failures to occur in a way that calling
applications can understand and cope with.
Another idea that I've had might be to change krb5_kuserok() to
krb5_kticketok() which would evaluate whether a ticket is allowed
to access a luser's account. This would enable us to use the
authorisation data section of a ticket to provide said authorisation.
(Longer term thought process, though.)
--
Roland Dowdeswell http://Imrryr.ORG/~elric/
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
