[19175] in Kerberos_V5_Development
Re: Possible enhancement request for extra krb5.conf parameter support
daemon@ATHENA.MIT.EDU (Neng Xue)
Wed May 13 17:14:47 2015
Message-ID: <5553BEB4.4060505@oracle.com>
Date: Wed, 13 May 2015 14:14:28 -0700
From: Neng Xue <neng.xue@oracle.com>
MIME-Version: 1.0
To: Greg Hudson <ghudson@mit.edu>
In-Reply-To: <555391A2.5070606@mit.edu>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Hi Greg,
Thanks for the comments!
On 05/13/15 11:02 AM, Greg Hudson wrote:
> On 05/12/2015 07:37 PM, Neng Xue wrote:
>> I am Neng Xue who works in Oracle Solaris Security group. Recently when
>> I was working on a kerberos related project I noticed that Solaris
>> kerberos has a quite handy krb5.conf [appdefaults] parameter support for
>> kinit command:
>>
>> forwardable=[true | false]
>> Can forward tickets to a remote server.
>>
>> proxiable=[true | false]
>> Sets the proxiable flag in all tickets.
>>
>> no_addresses=[true | false]
>> Creates tickets with no address bindings.
> We already support forwardable, proxiable, and noaddresses options under
> [libdefaults].
Yes, but we still think this per application parameter support might be
useful in some cases. If we can provide the implementation, do you think
MIT kerberos team will accept the pull request?
>> renewable=[true | false]
>> Creates a TGT that can be renewed (prior to the ticket expiration time).
> We support a renew_lifetime option under [libdefaults]. I don't know
> what it would mean to request a renewable ticket without a specific
> renewable lifetime.
As far as I can tell from Solaris kerberos, if there is no renewable
lifetime specified from kinit command line. It will then take the
maximum renewable lifetime (7 days by default).
Best
--
Neng Xue
Oracle Solaris Software Engineer
Santa Clara, CA, USA
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
