[16383] in Kerberos_V5_Development
Re: Review of Projects/Kadmin hook interface
daemon@ATHENA.MIT.EDU (Russ Allbery)
Mon Sep 27 15:46:16 2010
From: Russ Allbery <rra@stanford.edu>
To: Nicolas Williams <Nicolas.Williams@oracle.com>
In-Reply-To: <20100927192958.GK9501@oracle.com> (Nicolas Williams's message of
"Mon, 27 Sep 2010 14:29:59 -0500")
Date: Mon, 27 Sep 2010 12:45:56 -0700
Message-ID: <87hbhbug0b.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: lha@h5l.org, Sam Hartman <hartmans@mit.edu>, krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Nicolas Williams <Nicolas.Williams@oracle.com> writes:
> On Mon, Sep 27, 2010 at 11:32:30AM -0700, Russ Allbery wrote:
>> I would also document how this module is called if the key is being
>> randomized (if at all). It would probably be best to add a separate
>> interface that gets all of the keys, although in my specific use case
>> (propagation to Active Directory), there isn't anything one can really
>> do about a randomized key other than randomizing the password in Active
>> Directory (to something unrelated to the new randomized key).
> Why not just do password change with randomized password, so that way
> you have a password you can synchronize? This is basically what AD
> does too.
That of course is fine and for that you can just use the chpass
interface. But that's not the operation performed by cpw -randkey. A
generic plugin interface should, at least eventually, have hooks for all
the actions that kadmin may perform.
>> For a complete interface, you probably also want to add rename and
>> chpass_with_key. I didn't have those in my Heimdal hooks for the same
>> reason I didn't have remove: I didn't need them for my immediate
>> problem and hadn't had time to work on the broader issue.
> What is chpass_with_key?
Rather than getting the new password as an argument, you get a key
instead, possibly because that's what the client sent you. I think the
MIT API equivalent is kadm5_setkey_principal_3.
> Does renaming principals work nowadays?
I don't know. There's an API for it in both MIT and Heimdal, though.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
