[8080] in Kerberos
Re: kadmind4
daemon@ATHENA.MIT.EDU (Sam Hartman)
Sat Sep 21 15:15:32 1996
To: Dave McGuire <mcguire@neurotica.com>
Cc: "Barry Jaspan" <bjaspan@MIT.EDU>, Sam Hartman <hartmans@MIT.EDU>,
kerberos@MIT.EDU
From: Sam Hartman <hartmans@MIT.EDU>
Date: 21 Sep 1996 15:01:12 -0400
In-Reply-To: Dave McGuire's message of Sat, 21 Sep 1996 14:05:49 -0400 (EDT)
>>>>> "Dave" == Dave McGuire <mcguire@neurotica.com> writes:
Dave> Ahh, ok. I hadn't thought about that. That policy stuff
Dave> is cool. Do the clients actually support that stuff now,
Dave> i.e. if someone's password expires in the database, will
Dave> login.krb5 do something about it? I haven't really gone
Dave> through the new sources much yet.
No, but the KDC will. It will refuse to allow them to get any
ticket for a service other than password changing. This is mildly
unfortunate if you use login.krb5 as you can't really log in to run
kpasswd, but we can fix this in a future release. I believe it
returns a useful enough error code that login.krb5 could know to run
kpasswd as the user.
It does keep track of history and enforce other policies.
One thing I would like to see is some notification on
login/kinit that your password is about to expire. I think there is
some way of conveying this information already, but if not, you could
always assign a new authdata type for the purpose and return that with
the initial ticket.
>> If you have locally modified v4kadmind, then presumably you
>> have some programmers that are familiar with it. kadm5's V4
>> compat server,
Dave> I haven't modified v4kadmind...I've written some v4 kadmin
Dave> *clients*, some time ago actually, that deal with things
Dave> like checking usernames for availability and setting initial
Dave> passwords on new accounts, all from the command line. Over
Dave> in the shell-account side of the house here, the billing and
Dave> account-creation system uses the stuff from a set of perl
Dave> scripts.
Dave> I could use the new kadmin in command-line mode (with -q)
Dave> but a lot of the perl stuff depends on an exit status for
Dave> things like "this principal doesn't exist" and stuff like
Dave> that...and kadmin only sets up an error code in the exit
Dave> status if there's an actual kadm5 error.
>> which currently only supports password changing, is based on
>> the same source code (most of it is just #ifdef'ed out). Why
>> not just finish the task of updating it to support the other V4
>> kadmin requests? That's on our to-do list here but we haven't
>> gotten to it. All the documentation you need to write kadm5
>> programs is included in beta 7.
Dave> If it's going to come down to writing code, I'll probably
Dave> want to reimplement my stuff using the new kadm5 protocol.
Dave> -Dave McGuire
