[18891] in Kerberos_V5_Development
Re: Possible to retrieve names of groups from PAC data?
daemon@ATHENA.MIT.EDU (Volker Lendecke)
Tue Jul 8 09:47:04 2014
Date: Tue, 8 Jul 2014 13:27:55 +0200
From: Volker Lendecke <Volker.Lendecke@sernet.de>
To: "Zheng, Kai" <kai.zheng@intel.com>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <8D5F7E3237B3ED47B84CF187BB17B666118FB385@SHSMSX103.ccr.corp.intel.com>
Message-Id: <E1X4TYx-004hej-Sn@intern.SerNet.DE>
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Reply-To: Volker.Lendecke@sernet.de
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: krbdev-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On Tue, Jul 08, 2014 at 09:06:20AM +0000, Zheng, Kai wrote:
> Would anyone help confirm that it's possible or not to retrieve the names of groups by inspecting PAC data in service ticket regarding MS-PAC?
> I can only get SIDs. Sure I can query the names via LDAP protocol from AD using the SID, but it involves extra effort. If we can't get the names,
> then how such SIDs are expected to be used in Windows or non-Windows environments? Thanks.
That might be a question equally well posted to
samba-technical@samba.org :-)
You should not use LDAP, but the LsaLookupSids or
DSCrackNames RPC calls an AD provides if you need names.
Samba's winbind provides simple APIs for this.
In the Windows world, SIDs are sufficient for providing
access tokens for local resource access. In Unix world, the
equivalent would be uid's or gid's. Translating SIDs to
those is a world of its own, search the net for "idmapping".
With best regards,
Volker Lendecke
--
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kontakt@sernet.de
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
