[18889] in Kerberos_V5_Development
RE: Possible to retrieve names of groups from PAC data?
daemon@ATHENA.MIT.EDU (Zheng, Kai)
Tue Jul 8 07:43:28 2014
From: "Zheng, Kai" <kai.zheng@intel.com>
To: "Volker.Lendecke@SerNet.DE" <Volker.Lendecke@SerNet.DE>
Date: Tue, 8 Jul 2014 11:42:57 +0000
Message-ID: <8D5F7E3237B3ED47B84CF187BB17B666118FB44A@SHSMSX103.ccr.corp.intel.com>
In-Reply-To: <E1X4TYx-004hej-Sn@intern.SerNet.DE>
Content-Language: en-US
MIME-Version: 1.0
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: krbdev-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Thank you Volker, great answer!
Regards,
Kai
-----Original Message-----
From: Volker Lendecke [mailto:Volker.Lendecke@SerNet.DE]
Sent: Tuesday, July 08, 2014 7:28 PM
To: Zheng, Kai
Cc: krbdev@mit.edu
Subject: Re: Possible to retrieve names of groups from PAC data?
On Tue, Jul 08, 2014 at 09:06:20AM +0000, Zheng, Kai wrote:
> Would anyone help confirm that it's possible or not to retrieve the names of groups by inspecting PAC data in service ticket regarding MS-PAC?
> I can only get SIDs. Sure I can query the names via LDAP protocol from
> AD using the SID, but it involves extra effort. If we can't get the names, then how such SIDs are expected to be used in Windows or non-Windows environments? Thanks.
That might be a question equally well posted to samba-technical@samba.org :-)
You should not use LDAP, but the LsaLookupSids or DSCrackNames RPC calls an AD provides if you need names.
Samba's winbind provides simple APIs for this.
In the Windows world, SIDs are sufficient for providing access tokens for local resource access. In Unix world, the equivalent would be uid's or gid's. Translating SIDs to those is a world of its own, search the net for "idmapping".
With best regards,
Volker Lendecke
--
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9 AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen http://www.sernet.de, mailto:kontakt@sernet.de
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
