4:38 a.m.
https://fedorahosted.org/sssd/ticket/1499
Adds log message about not finding appropriate entry in keytab and using
the last keytab entry when validation is enabled.
Adds more information about validation into manpage.
Patch is attached.
O.
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1/5C Brno 1 office
irc: okos @ #brno
4:40 a.m.
On 10/09/2012 11:38 AM, Ondrej Kos wrote:
https://fedorahosted.org/sssd/ticket/1499
Adds log message about not finding appropriate entry in keytab and using
the last keytab entry when validation is enabled.
Adds more information about validation into manpage.
Patch is attached.
O.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
forgot to CC sumit.
O.
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1/5C Brno 1 office
irc: okos @ #brno
5:28 a.m.
On Tue, Oct 09, 2012 at 11:38:57AM +0200, Ondrej Kos wrote:
https://fedorahosted.org/sssd/ticket/1499
Adds log message about not finding appropriate entry in keytab and using
the last keytab entry when validation is enabled.
Adds more information about validation into manpage.
Patch is attached.
O.
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1/5C Brno 1 office
irc: okos @ #brno
diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
index f4fd1cb73941e23d8e39d234bf8fd2ae8ae54554..a67e4215f7e897afb37708695e56459cfa968f25
100644
--- a/src/man/sssd-krb5.5.xml
+++ b/src/man/sssd-krb5.5.xml
@@ -231,7 +231,12 @@
<term>krb5_validate (boolean)</term>
<listitem>
<para>
- Verify with the help of krb5_keytab that the TGT obtained
has not been spoofed.
+ Verify with the help of krb5_keytab that the TGT
+ obtained has not been spoofed. If there's no entry with
+ corresponding realm found in keytab, the last one is used.
+ This can be utilized to achieve validation in enviroments
+ with cross-realm trust by placing appropriate keytab entry
+ as the last one.
For completeness I would add that the first entry with a matching realm
is taken. This might be important to know because pam_krb5 uses a more
elaborate scheme. For a future version we might want to add an option to
switch to the scheme used by pam_krb5.
bye,
Sumit
</para>
<para>
Default: false
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index b2d5bdaeb9d4b1ac8de12055a4d6bb5a7f48a7f1..ff6a30147bb9d7edac7bab364d5d9004451f6ffb
100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -696,6 +696,7 @@ static krb5_error_code validate_tgt(struct krb5_req *kr)
krb5_keytab_entry entry;
krb5_verify_init_creds_opt opt;
krb5_principal validation_princ = NULL;
+ bool entry_found = false;
memset(&keytab, 0, sizeof(keytab));
kerr = krb5_kt_resolve(kr->ctx, kr->keytab, &keytab);
@@ -736,10 +737,17 @@ static krb5_error_code validate_tgt(struct krb5_req *kr)
if (krb5_realm_compare(kr->ctx, validation_princ, kr->princ)) {
DEBUG(SSSDBG_TRACE_INTERNAL,
("Found keytab entry with the realm of the
credential.\n"));
+ entry_found = true;
break;
}
}
+ if (!entry_found) {
+ DEBUG(SSSDBG_TRACE_INTERNAL,
+ ("Keytab entry with the realm of the credential not found "
+ "in keytab. Using the last entry.\n"));
+ }
+
/* Close the keytab here. Even though we're using cursors, the file
* handle is stored in the krb5_keytab structure, and it gets
* overwritten when the verify_init_creds() call below creates its own
just a nitpick. entry_found is a bit misleading, because we always find
an entry, at least the last one. e.g. realm_entry_found would be more
precise.
bye,
Sumit
5:41 a.m.
On 10/09/2012 12:28 PM, Sumit Bose wrote:
On Tue, Oct 09, 2012 at 11:38:57AM +0200, Ondrej Kos wrote:
> https://fedorahosted.org/sssd/ticket/1499
>
> Adds log message about not finding appropriate entry in keytab and using
> the last keytab entry when validation is enabled.
>
> Adds more information about validation into manpage.
>
> Patch is attached.
>
> O.
> --
> Ondrej Kos
> Associate Software Engineer
> Identity Management
> Red Hat Czech
>
> phone: +420-532-294-558
> cell: +420-736-417-909
> ext: 82-62558
> loc: 1/5C Brno 1 office
> irc: okos @ #brno
> diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
> index
f4fd1cb73941e23d8e39d234bf8fd2ae8ae54554..a67e4215f7e897afb37708695e56459cfa968f25 100644
> --- a/src/man/sssd-krb5.5.xml
> +++ b/src/man/sssd-krb5.5.xml
> @@ -231,7 +231,12 @@
> <term>krb5_validate (boolean)</term>
> <listitem>
> <para>
> - Verify with the help of krb5_keytab that the TGT
obtained has not been spoofed.
> + Verify with the help of krb5_keytab that the TGT
> + obtained has not been spoofed. If there's no entry
with
> + corresponding realm found in keytab, the last one is
used.
> + This can be utilized to achieve validation in
enviroments
> + with cross-realm trust by placing appropriate keytab
entry
> + as the last one.
For completeness I would add that the first entry with a matching realm
is taken. This might be important to know because pam_krb5 uses a more
elaborate scheme. For a future version we might want to add an option to
switch to the scheme used by pam_krb5.
bye,
Sumit
I forgot this one. updated.
> </para>
> <para>
> Default: false
> diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
> index
b2d5bdaeb9d4b1ac8de12055a4d6bb5a7f48a7f1..ff6a30147bb9d7edac7bab364d5d9004451f6ffb 100644
> --- a/src/providers/krb5/krb5_child.c
> +++ b/src/providers/krb5/krb5_child.c
> @@ -696,6 +696,7 @@ static krb5_error_code validate_tgt(struct krb5_req *kr)
> krb5_keytab_entry entry;
> krb5_verify_init_creds_opt opt;
> krb5_principal validation_princ = NULL;
> + bool entry_found = false;
>
> memset(&keytab, 0, sizeof(keytab));
> kerr = krb5_kt_resolve(kr->ctx, kr->keytab, &keytab);
> @@ -736,10 +737,17 @@ static krb5_error_code validate_tgt(struct krb5_req *kr)
> if (krb5_realm_compare(kr->ctx, validation_princ, kr->princ)) {
> DEBUG(SSSDBG_TRACE_INTERNAL,
> ("Found keytab entry with the realm of the
credential.\n"));
> + entry_found = true;
> break;
> }
> }
>
> + if (!entry_found) {
> + DEBUG(SSSDBG_TRACE_INTERNAL,
> + ("Keytab entry with the realm of the credential not found
"
> + "in keytab. Using the last entry.\n"));
> + }
> +
> /* Close the keytab here. Even though we're using cursors, the file
> * handle is stored in the krb5_keytab structure, and it gets
> * overwritten when the verify_init_creds() call below creates its own
just a nitpick. entry_found is a bit misleading, because we always find
an entry, at least the last one. e.g. realm_entry_found would be more
precise.
bye,
Sumit
not a problem, didn't cross my mind.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
new patch attached
O.
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1/5C Brno 1 office
irc: okos @ #brno
6:10 a.m.
On Tue, Oct 09, 2012 at 12:41:43PM +0200, Ondrej Kos wrote:
On 10/09/2012 12:28 PM, Sumit Bose wrote:
>On Tue, Oct 09, 2012 at 11:38:57AM +0200, Ondrej Kos wrote:
>>https://fedorahosted.org/sssd/ticket/1499
>>
>
new patch attached
Thank you. ACK
bye,
Sumit
O.
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1/5C Brno 1 office
irc: okos @ #brno
12:27 p.m.
On Tue, Oct 09, 2012 at 12:41:43PM +0200, Ondrej Kos wrote:
diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
index f4fd1cb73941e23d8e39d234bf8fd2ae8ae54554..4d5062ba450203ba6c8722e8b178d7a3a7f5a70b
100644
--- a/src/man/sssd-krb5.5.xml
+++ b/src/man/sssd-krb5.5.xml
@@ -231,7 +231,14 @@
<term>krb5_validate (boolean)</term>
<listitem>
<para>
Some parts of the paragraph don't sound like proper English to me. Can
you check them with some native English speaker before I push them. In
particular:
- Verify with the help of krb5_keytab that
the TGT obtained has not been spoofed.
+ Verify with the help of krb5_keytab that the TGT
+ obtained has not been spoofed. The keytab is checked for
+ entries from top to bottom, and the first entry with
matching
what about "checked for entries sequentially" ?
+ realm is used for validation. If
there's no entry with
+ corresponding realm found in the keytab, the last one is
used.
"If no entry matches, the last one is used" ?
+ This can be utilized to achieve
validation in enviroments
+ with cross-realm trust by placing appropriate keytab entry
+ as the last one or the only one.
</para>
<para>
Default: false
10:16 a.m.
On 10/09/2012 07:27 PM, Jakub Hrozek wrote:
On Tue, Oct 09, 2012 at 12:41:43PM +0200, Ondrej Kos wrote:
> diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
> index
f4fd1cb73941e23d8e39d234bf8fd2ae8ae54554..4d5062ba450203ba6c8722e8b178d7a3a7f5a70b 100644
> --- a/src/man/sssd-krb5.5.xml
> +++ b/src/man/sssd-krb5.5.xml
> @@ -231,7 +231,14 @@
> <term>krb5_validate (boolean)</term>
> <listitem>
> <para>
Some parts of the paragraph don't sound like proper English to me. Can
you check them with some native English speaker before I push them. In
particular:
> - Verify with the help of krb5_keytab that the TGT
obtained has not been spoofed.
> + Verify with the help of krb5_keytab that the TGT
> + obtained has not been spoofed. The keytab is checked
for
> + entries from top to bottom, and the first entry with
matching
what about "checked for entries sequentially" ?
> + realm is used for validation. If there's no entry
with
> + corresponding realm found in the keytab, the last one is
used.
"If no entry matches, the last one is used" ?
> + This can be utilized to achieve validation in
enviroments
> + with cross-realm trust by placing appropriate keytab
entry
> + as the last one or the only one.
> </para>
> <para>
> Default: false
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
new patch reviewed and attached.
O.
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1/5C Brno 1 office
irc: okos @ #brno
11:31 a.m.
On Wed, Oct 10, 2012 at 05:16:29PM +0200, Ondrej Kos wrote:
On 10/09/2012 07:27 PM, Jakub Hrozek wrote:
>On Tue, Oct 09, 2012 at 12:41:43PM +0200, Ondrej Kos wrote:
>>diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
>>index
f4fd1cb73941e23d8e39d234bf8fd2ae8ae54554..4d5062ba450203ba6c8722e8b178d7a3a7f5a70b 100644
>>--- a/src/man/sssd-krb5.5.xml
>>+++ b/src/man/sssd-krb5.5.xml
>>@@ -231,7 +231,14 @@
>> <term>krb5_validate (boolean)</term>
>> <listitem>
>> <para>
>
>Some parts of the paragraph don't sound like proper English to me. Can
>you check them with some native English speaker before I push them. In
>particular:
>
>>- Verify with the help of krb5_keytab that the TGT
obtained has not been spoofed.
>>+ Verify with the help of krb5_keytab that the TGT
>>+ obtained has not been spoofed. The keytab is checked
for
>>+ entries from top to bottom, and the first entry with
matching
>
> what about "checked for entries
sequentially" ?
>
>>+ realm is used for validation. If there's no
entry with
>>+ corresponding realm found in the keytab, the last
one is used.
>
> "If no entry matches, the last one is used" ?
>
>>+ This can be utilized to achieve validation in
enviroments
>>+ with cross-realm trust by placing appropriate keytab
entry
>>+ as the last one or the only one.
>> </para>
>> <para>
>> Default: false
>
>_______________________________________________
>sssd-devel mailing list
>sssd-devel(a)lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
new patch reviewed and attached.
O.
Sounds good to me now, ack
4222
days inactive
4223
days old
sssd-devel@lists.fedorahosted.org
8 comments
3 participants
participants (3)
-
Jakub Hrozek -
Ondrej Kos -
Sumit Bose