[7984] in Kerberos
Re: kpasswd problem
daemon@ATHENA.MIT.EDU (Doug Engert)
Mon Sep 16 18:44:03 1996
Date: Mon, 16 Sep 1996 17:11:18 -0500
From: Doug Engert <DEEngert@anl.gov>
To: "Barry Jaspan" <bjaspan@MIT.EDU>
Cc: Ken Hornstein <kenh@cmf.nrl.navy.mil>, kerberos@MIT.EDU
In-Reply-To: <9609162048.AA06841@DUN-DUN-NOODLES.MIT.EDU>
Barry Jaspan writes:
>
> Personally, I think it's dumb that you have to use krb524init at all for
> aklog. I think Doug Engert's solution of having aklog getting an V5 AFS
> ticket and converting _that_ makes a whole lot more sense; I'm currently
> using a modified version of that and it works very well.
>
> When I wrote krb524 at OV, we (Marc Horowitz and I) discussed this
> very issue. We decided that k524init had to be a separate program
> because we needed a V4 ticket-granting ticket, since we wanted to use
> AFS and also interoperate with several V4 services at MIT (Zephyr and
> Discuss, among others). Since we had k524init anyway, and were
> running it in our dotfiles anyway, it was less effort just to leave
> aklog as a V4 program.
>
> I designed krb524 to make it easy to integrate directly into programs
> like aklog, though. So if you want to make a V5-aware aklog, great.
> But k524init exists for a good reason.
>
> Barry
>
I can see reasons for both versions of aklog. The reason I wanted a
v5-aware version of aklog was to work with K5 forwarded tickets, and
to not have to rely on the KDC supporting K4. We are using the DCE
security server as the KDC.
The ak5log does use the krb524 routines along with mods to the krb524d
which will convert a ticket for afsx/afs.cell.name@k5.realm name into
a k4 ticket for afs@afs.cell.name. (I sent these mods in a few months
ago and it looks straight forward to add to beta 7.) The V4 ticket is
never saved, but rather is converted to a token.
I have also sent in mods to have ak5log called directly from krlogind
and use the forwarded ticket to get the AFS token automaticly. There
are similar mods to get a DCE context at the same time.
It also works with the Transarc DFS/AFS migration package. The heart
of the AFS token for this is a V5 ticket.
The mods to aklog to make it a V5-aware ak5log can be found at
ftp://achilles.ctd.anl.gov/pub/kerberos.v5 I would hope that the
original authors would be interested in integrating these changes.
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444 <New Area Code 8/3/96>
PGP Key fingerprint = 20 2B 0C 78 43 8A 9C A6 29 F7 A3 6D 5E 30 A6 7F
