[19164] in Kerberos_V5_Development
MSLSA and ccconfigs (Re: get_cred starting realm)
daemon@ATHENA.MIT.EDU (Nico Williams)
Wed Apr 29 19:19:51 2015
Date: Wed, 29 Apr 2015 18:19:37 -0500
From: Nico Williams <nico@cryptonector.com>
To: Benjamin Kaduk <kaduk@mit.edu>
Message-ID: <20150429231936.GZ6026@localhost>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <alpine.GSO.1.10.1504291822410.22210@multics.mit.edu>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Wed, Apr 29, 2015 at 06:24:07PM -0400, Benjamin Kaduk wrote:
> On Wed, 29 Apr 2015, Nico Williams wrote:
> > > The LSA itself permits insertion; our MSLSA interface to it may not be
> > > quite so generous, though I don't remember offhand.
> >
> > Does it permit storing of ccconfigs? (That would be handy.)
>
> 2060 if (krb5_is_config_principal(context, creds->server)) {
> 2061 /* mslsa cannot store config creds, so we have to bail.
> 2062 * The 'right' thing to do would be to return an appropriate error,
> 2063 * but that would require modifying the calling code to check
> 2064 * for that error and ignore it.
> 2065 */
> 2066 return KRB5_OK;
> 2067 }
>
> Though, I expect that code was written ten or fifteen years ago and the
> comment may be stale.
[resend]
Unless the LSA blows up (doubtful) or kills the caller (doubtful),
what's the point of stubbing this out? Try it. In the worst case it
will fail.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
