Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: 66e7c5c5091fb392dbcd61d25ee2363f8b718403 https://github.com/gssapi/gssproxy/commit/66e7c5c5091fb392dbcd61d25ee2363f8b... Author: Steinar H. Gunderson sesse@samfundet.no Date: 2025-02-11 (Tue, 11 Feb 2025)
Changed paths: M src/gp_creds.c
Log Message: ----------- Respect krb5_principal when impersonating
When doing impersonation, we need to get initial credentials using some service principal from the given keytab. However, since keytabs have no default principals, libgss just chooses the first one in the file, which generally does not work well when in Active Directory.
In particular, in AD, the only valid principal for authenticating is SERVER$@EXAMPLE.ORG, whereas e.g. host/server.example.org@EXAMPLE.ORG is just an SPN connected to SERVER$ and not valid for authenticating in its own right. gssd will try SERVER$ first for its own purposes (at least according to the man page), but when impersonating, it will naturally ask for a ticket for a user (e.g. user@EXAMPLE.ORG) and not the service principal itself.
This patch doesn't really make us choose the right principal for AD purposes, but it makes us respect the krb5_principal configuration option when getting a service principal for this purpose, so that an administrator can at least manually select which one to use without having to somehow reorder entries in the keytab (which appears to be hard). Thus, the admin can set "krb5_principal = SERVER$@EXAMPLE.ORG" in the service definition in gssproxy.conf, and it will work.
Signed-off-by: Steinar H. Gunderson sesse@samfundet.no
To unsubscribe from these emails, change your notification settings at https://github.com/gssapi/gssproxy/settings/notifications
gss-proxy@lists.fedorahosted.org
-
Simo Sorce