Re: Constrained Delegation with certificate and GSS API
Puran Chand <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.devel |
|---|---|
| Message-ID | <CAKnEmR+mKp8o+jOkTJQOOM5-X-gjKkgK2ObahHLS5C07ngv3aw@mail.gmail.com> |
I don't see a name type for certificate as per https://web.mit.edu/kerberos/krb5-devel/doc/appdev/gssapi.html#name-types Also as I understand, I need to get rid of gss_acquire_cred_impersonate_cert and instead invoke relevant code from gss_acquire_impersonate_name based on name type. LMK your thoughts. -Puran On Wed, May 6, 2020 at 1:26 PM Isaac Boukris <[email protected]> wrote: > On Wed, May 6, 2020 at 6:46 AM Greg Hudson <[email protected]> wrote: > > > > https://github.com/krb5/krb5/pull/1063 > > > > There may be alternative designs for the API; for instance, we could > > perhaps instead define a new name type and use > > gss_acquire_cred_impersonate_name(). > > Yes, that would solve the authdata problem and we can skip the name+cert > case. > > @Puran, feel free to develop it on top PR 1063 if you like, it already > got some tests. > _______________________________________________ krbdev mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/krbdev