[8079] in Kerberos
Re: kadmind4
daemon@ATHENA.MIT.EDU (Dave McGuire)
Sat Sep 21 14:24:23 1996
Date: Sat, 21 Sep 1996 14:05:49 -0400 (EDT)
From: Dave McGuire <mcguire@neurotica.com>
To: "Barry Jaspan" <bjaspan@MIT.EDU>
Cc: Sam Hartman <hartmans@MIT.EDU>, kerberos@MIT.EDU
In-Reply-To: Re: kadmind4 (Barry Jaspan)
On September 20, you wrote:
> Do you think it'd
> be possible for me to build the old beta6 v4kadmind (which worked
> fine) to manipulate the beta7 database?
>
> I don't recommend it. v4kadmind does not know about the new kadm5
> database, nor will it enforce whatever policies are configured via
> kadm5. If v4kadmind deletes a principal that is assigned to a kadm5
> principal, the kadm5 database will become inconsistent.
Ahh, ok. I hadn't thought about that. That policy stuff is cool.
Do the clients actually support that stuff now, i.e. if someone's
password expires in the database, will login.krb5 do something about
it? I haven't really gone through the new sources much yet.
> If you have locally modified v4kadmind, then presumably you have some
> programmers that are familiar with it. kadm5's V4 compat server,
I haven't modified v4kadmind...I've written some v4 kadmin
*clients*, some time ago actually, that deal with things like checking
usernames for availability and setting initial passwords on new
accounts, all from the command line. Over in the shell-account side
of the house here, the billing and account-creation system uses the
stuff from a set of perl scripts.
I could use the new kadmin in command-line mode (with -q) but a lot
of the perl stuff depends on an exit status for things like "this
principal doesn't exist" and stuff like that...and kadmin only sets up
an error code in the exit status if there's an actual kadm5 error.
> which currently only supports password changing, is based on the same
> source code (most of it is just #ifdef'ed out). Why not just finish
> the task of updating it to support the other V4 kadmin requests?
> That's on our to-do list here but we haven't gotten to it. All the
> documentation you need to write kadm5 programs is included in beta 7.
If it's going to come down to writing code, I'll probably want to
reimplement my stuff using the new kadm5 protocol.
-Dave McGuire
