kcpytkt to copy a service ticket for client principal not matching the default principal

Hi,

Our goal is to spawn user sessions that have a service ticket for a third service without having to enter a password nor using unconstrained delegation. Let's assume the users come pre-authenticated and we only have their username. 

We are using protocol transition and contrained delegation on Service A ([email protected]) to obtain a service ticket for Service B (HTTP/[email protected]) for User X (jpetermann).

    # kinit -k -t /etc/httpd/rstudio-server.keytab [email protected]
    # klist
    Ticketzwischenspeicher: FILE:/tmp/krb5cc_0
    Standard-Principal: [email protected]

    Valid starting       Expires              Service principal
    15.06.2020 17:31:08  16.06.2020 03:31:08  krbtgt/[email protected]
	erneuern bis 22.06.2020 17:31:08

    # kvno -k /etc/httpd/rstudio-server.keytab -U jpetermann -P HTTP/[email protected]
    HTTP/[email protected]: KVNO = 3, Schlüsseltabelleneintrag gültig

    # klist
    Ticketzwischenspeicher: FILE:/tmp/krb5cc_0
    Standard-Principal: [email protected]

    Valid starting       Expires              Service principal
    15.06.2020 17:31:08  16.06.2020 03:31:08  krbtgt/[email protected]
	erneuern bis 22.06.2020 17:31:08
    15.06.2020 17:31:43  16.06.2020 03:31:08  [email protected]
	für Client [email protected], erneuern bis 22.06.2020 17:31:08
    15.06.2020 17:31:43  16.06.2020 03:31:08  HTTP/[email protected]

Now we are trying to use kcpytkt to extract the service ticket for Service B for User X from the ccache of Service A. Unfortunately we are unable to extract a service ticket for a user that is not the default principal:

    # kcpytkt -c /tmp/krb5cc_0 /home/jpetermann\@lab.biz/cache42 
    HTTP/[email protected]/[email protected]: Matching credential not found while retrieving credentials

How can we get kcpytkt to match a credential not matching the default principal? Ideally, the solution would involve supplying the client principal as an additional command line argument to kcpytkt.

Is there maybe another way to provide a service ticket to the user's session?

Thanks and Regards,

Josef Petermann



_______________________________________________
krbdev mailing list             [email protected]
https://mailman.mit.edu/mailman/listinfo/krbdev