Re: Constrained Delegation with certificate and GSS API
Isaac Boukris <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.devel |
|---|---|
| Message-ID | <CAC-fF8SM_O8G-r3rGv=6hovEnp_wgS_-eyHKzLhk41wPaU5qRw@mail.gmail.com> |
On Sun, Jun 7, 2020 at 4:57 PM Puran Chand <[email protected]> wrote: > > I see gss_import_name() put the name_type to gss_union_name_t->name_type and cert_data in gss_union_name_t->external_name. > However I don't understand how this should pass down from GSS API (gss_add_cred_impersonate_name) to krb5 API(krb5_gss_acquire_cred_impersonate_name). > I see gss_name_t passed down to krb5 API isn't what received in GSS API. Its gss_union_name_t->mech_name and the same is converted into krb5_gss_name_t eventually. > And I believe krb5_gss_name_t is constructed into krb5_gss_import_name/imp_name.c, IDK what would be the right place to store cert_data in krb5_gss_name_t, should the name_type be copied to krb5_gss_name_t->krb5_principal->type and cert data to krb5_gss_name_t->krb5_principal->realm? You're looking at the right places, for a simple start you could add a krb5_data member 'cert' to krb5_gss_name_t struct, copy the certificate data in there at krb5_gss_import_name() and set princ to NULL, then alter in kg_impersonate_name() you check if cert->length != 0 and use the cert instead of princ. _______________________________________________ krbdev mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/krbdev