[18782] in Kerberos_V5_Development
Re: Dynamic deployment of new preauth plugin for client and kdc
daemon@ATHENA.MIT.EDU (Greg Hudson)
Tue May 27 12:36:51 2014
Message-ID: <5384BF17.7010208@mit.edu>
Date: Tue, 27 May 2014 12:36:39 -0400
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: drankye <kai.zheng@intel.com>, krbdev@mit.edu
In-Reply-To: <1401197198245-40439.post@n3.nabble.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 05/27/2014 09:26 AM, drankye wrote:
> I'm developing a new preauth mechanism like otp based on FAST tunnel, and
> wish it's possible to deploy my new plugin module by just dropping the so
> file into place
This isn't possible with most currently pluggable interfaces;
third-party modules need to be registered in the profile. See:
http://web.mit.edu/kerberos/krb5-latest/doc/admin/host_config.html#plugin-config
(The example there probably shouldn't use "otp", since we now ship an
effectively built-in otp clpreauth module.)
Older pluggable interfaces--the only current public example is the
"locate" interface--did allow modules to simply be dropped into place.
We received feedback from downstream distributors that this was
undesirable; it made it impossible (or at least awkward) to have the
binary package for a module installed but have the module disabled.
See also this thread:
http://mailman.mit.edu/pipermail/krbdev/2010-July/009171.html
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
