[33696] in Kerberos
Re: any non-krb5int way to pass a keyblock to get_init_creds?
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Aug 1 11:43:54 2011
From: Greg Hudson <ghudson@mit.edu>
To: Chris Hecker <checker@d6.com>
In-Reply-To: <4E34DD7B.7060104@d6.com>
Date: Mon, 01 Aug 2011 11:43:42 -0400
Message-ID: <1312213422.23877.263.camel@t410>
Mime-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Sun, 2011-07-31 at 00:43 -0400, Chris Hecker wrote:
> It seems there's no exposed way to call krb5_get_init_creds with a key
> directly. If I've got a key that's not stored in a keytab (like it got
> handed to me some other way), it looks like the best/only way to do this
> is to create a MEMORY keytab, manually create a keytab_entry, add the
> entry, and then pass that to get_init_creds_keytab?
That's right for current interfaces.
There used to be a krb5_get_in_tkt_with_skey(), which is still there as
a deprecated interface. When the initial ticket interfaces were revised
in 1997, I think there was a belief that a krb5 app (as opposed to an
RFC 3961 app) shouldn't need to traffic in keyblocks, so that interface
was dropped.
How are you winding up with a key and needing to make an initial ticket
request with it?
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
