Re: Alternative proxy-creds API for constrained-delegation
Simo Sorce <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.devel |
|---|---|
| Organization | Red Hat, Inc. |
| Message-ID | <[email protected]> |
On Fri, 2020-06-05 at 12:11 +0200, Isaac Boukris wrote: > Actually, even with the cred_store option for delegation_policy, when > using more than one type, one can't really tell what creds he got at > the end. > > We have GET_CRED_IMPERSONATOR_OID which I think can be used to inquire > for proxy-creds, but how do you tell a tgt-less one? It would be nice > to be able to inquire about it. > gss_inquire_cred) will return a name for the cred, it could do so an add a name attribute that marks the credential as "not a TGT" in some way. Simo. -- Simo Sorce RHEL Crypto Team Red Hat, Inc _______________________________________________ krbdev mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/krbdev