Re: Authz on the KDC itself - check_kdcpolicy_tgs can't inspect client?
Alexander Bokovoy <[email protected]> Tue, 17 Dec 2024 11:41:06 +0200
| Newsgroups | gmane.comp.encryption.kerberos.devel |
|---|---|
| Message-ID | <[email protected]> |
T24g0J/QsNC9LCAxNiDRgdC90LUgMjAyNCwgR3JlZyBIdWRzb24gd3JvdGU6Cj5PbiAxMi8xNi8y NCAxNTozNiwgRmVsaXggRnJpZWRsYW5kZXIgdmlhIGtyYmRldiB3cm90ZToKPj5JIHdhcyBob3Bp bmcgdG8gcHJvdG90eXBlIHRoaXMgaW4gYSBrZGNwb2xpY3kgcGx1Z2luOyBob3dldmVyLCAKPj5j aGVja19rZGNwb2xpY3lfdGdzIGRvZXNuJ3QgcmVjZWl2ZSB0aGUgImNsaWVudCIgcGFyYW1ldGVy IHRoYXQgCj4+Y2hlY2tfa2RjcG9saWN5X2FzIGRvZXMsIHNvIGEgcGx1Z2luIChjdXJyZW50bHkp IGNhbid0IGluc3BlY3QgdGhlIAo+PnJlcXVlc3RpbmcgcHJpbmNpcGFsIGF0IHRpY2tldC1ncmFu dGluZyB0aW1lLiBJcyB0aGVyZSBhIHJlYXNvbiB0aGlzIAo+PmluZm9ybWF0aW9uIGlzbid0IGV4 cG9zZWQ/IEFzIGZhciBhcyBJIGNhbiB0ZWxsLCBpdCAvaXMvIGF2YWlsYWJsZSAKPj5hdCB0aGUg cmVsZXZhbnQgbG9jYXRpb24gaW4gcHJvY2Vzc190Z3NfcmVxLgo+Cj5IaXN0b3JpY2FsbHksIHRo ZSBLREMgbmV2ZXIgbG9va2VkIHVwIHRoZSBjbGllbnQgcHJpbmNpcGFsIGVudHJ5IAo+ZHVyaW5n IGEgVEdTIHJlcXVlc3QsIHJlbHlpbmcgb25seSBvbiBpbmZvcm1hdGlvbiBwcmVzZW50IGluIHRo ZSAKPnRpY2tldCBpc3N1ZWQgZHVyaW5nIHRoZSBBUyByZXF1ZXN0LiAgVGhhdCB0aWNrZXQgY29u dGFpbnMgdGhlIGNsaWVudCAKPnByaW5jaXBhbCBuYW1lLCBvZiBjb3Vyc2UsIGJ1dCBub3QgdGhl IGRhdGFiYXNlIGVudHJ5Lgo+Cj5Ub2RheSB3ZSBhbG1vc3QgYWx3YXlzIGxvb2sgaXQgdXAsIGJl Y2F1c2Ugd2Ugd2FudCB0byBwYXNzIGl0IHRvIHRoZSAKPktEQiBtb2R1bGUncyBpc3N1ZV9wYWMo KSBtZXRob2QuICBUaGUgZXhjZXB0aW9ucyBhcmUgY3Jvc3MtcmVhbG0gCj5yZXF1ZXN0cyAod2hl cmUgdGhlIGNsaWVudCBwcmluY2lwYWwgZW50cnkgaXMgaW4gYW5vdGhlciBkYXRhYmFzZSkgYW5k IAo+d2hlbiB0aGUgcHJpbmNpcGFsIGlzIG1hcmtlZCBOT19BVVRIREFUQV9SRVFVSVJFRCAoaW4g d2hpY2ggY2FzZSB0aGUgCj5LREMgZG9lc24ndCBjYWxsIGlzc3VlX3BhYygpKS4KPgo+VGhlIGtk Y3BvbGljeSBpbnRlcmZhY2Ugd2FzIHBhdHRlcm5lZCBhZnRlciB0aGUgS0RCIG1ldGhvZHMgCj5j aGVja19wb2xpY3lfYXMoKSBhbmQgY2hlY2tfcG9saWN5X3RncygpLiAgVGhvc2UgbWV0aG9kcyB3 ZXJlIAo+c3BlY2lmaWVkIGJhY2sgaW4gYW4gZXJhIHdoZW4gdGhlIEtEQyBnZW5lcmFsbHkgZGlk IG5vdCBsb29rIHVwIHRoZSAKPmNsaWVudCBkYXRhYmFzZSBlbnRyeS4gIE5vdGhpbmcgc3RvcHMg YSBrZGNwb2xpY3kgbW9kdWxlIGZyb20gCj5wZXJmb3JtaW5nIGl0cyBvd24gREIgbG9va3VwIG9m IHRoZSBjbGllbnQgcHJpbmNpcGFsIHdpdGggCj5rcmI1X2RiX2dldF9wcmluY2lwYWwoKSwgZXhj ZXB0IGZvciB0aGUgbWlsZCBpbmVmZmljaWVuY3kgdGhhdCB0aGUgS0RDIAo+YWxyZWFkeSBkaWQg aXQgKHVubGVzcyB5b3Ugcm91dGluZWx5IHNldCBOT19BVVRIREFUQV9SRVFVSVJFRCBvbiAKPnNl cnZpY2UgcHJpbmNpcGFscywgd2hpY2ggeW91IGNvdWxkIGRvIGlmIHlvdXIgcmVhbG0gZG9lc24n dCBuZWVkIGFueSAKPlM0VTJTZWxmIG9yIFM0VTJQcm94eSBzdXBwb3J0KS4KCk1heSBiZSB3ZSBj YW4gaGF2ZSBhICdjYWNoZScgb2YgdGhlIERCIGVudHJpZXMgdGllZCB0byBhbiBpbnN0YW5jZSBv ZgprcmI1X2tkY19yZXEgc3RydWN0IGFuZCBhZGQgYSBmdW5jdGlvbiB0aGF0IHJldHVybnMgYW4g ZW50cnkgZnJvbSB0aGlzCidjYWNoZSc/IFRoaXMgd2F5IGFsbCBjb2RlIHdvdWxkIGJlIGFibGUg dG8gcmVmZXJlbmNlIGFueSBlbnRyeSBhbHJlYWR5CnJldHJpZXZlZCBkdXJpbmcgcHJvY2Vzc2lu ZyBvZiB0aGlzIHJlcXVlc3Q/IAoKVGhpcyB3b3VsZG4ndCByZXF1aXJlIGNoYW5nZXMgdG8ga2Rj cG9saWN5IEFQSXMgYXMgYm90aCBmdW5jdGlvbnMKYWxyZWFkeSBnZXQgdGhlIHJlcXVlc3QgaW5z dGFuY2UgYW5kIGNhbiBxdWVyeSB0aGF0ICdjYWNoZScgZm9yIGEgY2xpZW50LgoKQSBwcm9ibGVt IGhlcmUgaXMgdGhhdCBrcmI1X2tkY19yZXEgc3RydWN0IGlzIHB1YmxpYywgc28gaXRzIGNoYW5n ZQp3b3VsZCBzdGlsbCBiZSBhbiBBUEkgY2hhbmdlLi4KCj4+QW55IG90aGVyIHRob3VnaHRzIG9u IHRoZSBjb25jZXB0PyBJJ20gbm90IHRyeWluZyB0byBzYXkgdGhhdCB0aGlzIAo+PmlzIHRoZSBi ZXN0IHdheSB0byBkbyBhdXRob3Jpc2F0aW9uLCBqdXN0IHRoYXQgaXQgc2VlbXMgcG9zc2libGUs IAo+PmFuZCBtaWdodCBiZSB1c2VmdWwgaW4gc29tZSBjb250ZXh0cy4KPgo+WW91J3ZlIGNvdmVy ZWQgc2V2ZXJhbCBvZiB0aGUgY29tbW9uIHdheXMgdG8gZG8gYXV0aG9yaXphdGlvbjogdGhlIAo+ YXBwbGljYXRpb24gc2VydmVyIGtub3dzIHdobyBpcyBhdXRob3JpemVkIChsb2NhbCBBQ0xzKSwg dGhlIHNlcnZlciAKPmFza3Mgc29tZW9uZSBlbHNlIChMREFQKSwgYW5kIHRoZSBLREMgZGVjaWRl cyBhdCBhdXRoZW50aWNhdGlvbiB0aW1lLiAgCj5UaGVyZSBpcyBhbHNvIE1pY3Jvc29mdCdzIFBB QyBhcHByb2FjaCwgd2hpY2ggaXMgdGhhdCB0aGUgdGlja2V0IAo+aW5jbHVkZXMgaW5mb3JtYXRp b24gcmVsZXZhbnQgdG8gYXV0aG9yaXphdGlvbiAoc3VjaCBhcyBncm91cCAKPm1lbWJlcnNoaXAp IGFzIHBhcnQgb2YgdGhlIHRpY2tldC4KPgo+SGlzdG9yaWNhbGx5IHRoZSBLZXJiZXJvcyBwcm90 b2NvbCBjb21tdW5pdHkgaGFzIGJlZW4gbW9kZXJhdGVseSAKPm9wcG9zZWQgdG8gdGhlIEtEQyBw ZXJmb3JtaW5nIGF1dGhvcml6YXRpb24gZGVjaXNpb25zLiAgRmlyc3RseSwgaXQncyAKPmEgcHJl dHR5IGJsdW50IHRvb2wtLWl0IGNhbiBwcmV2ZW50IGF1dGhlbnRpY2F0aW9uIHRvIHRoZSBzZXJ2 aWNlIAo+ZW50aXJlbHksIGJ1dCBpdCBjYW4ndCBwcm92aWRlIGFueSBsZXZlbCBvZiBwYXJ0aWFs IGFjY2Vzcy4gIFNlY29uZCwgCj53aGVuIGEgS0RDIHN0YXJ0cyBtYWtpbmcgYXV0aG9yaXphdGlv biBkZWNpc2lvbnMgaW4gdGhpcyBtYW5uZXIsIGl0IAo+ZW5jb3VyYWdlcyBhcHBsaWNhdGlvbiBz ZXJ2ZXJzIHRvIGlnbm9yZSB0aGlzIGFkdmljZSBmcm9tIFJGQyA0MTIwOgo+Cj4gICBBcHBsaWNh dGlvbnMgc2hvdWxkIG5vdCBhY2NlcHQgdGhlIG1lcmUgaXNzdWFuY2Ugb2YgYSBzZXJ2aWNlIHRp Y2tldAo+ICAgYnkgdGhlIEtlcmJlcm9zIHNlcnZlciAoZXZlbiBieSBhIG1vZGlmaWVkIEtlcmJl cm9zIHNlcnZlcikgYXMKPiAgIGdyYW50aW5nIGF1dGhvcml0eSB0byB1c2UgdGhlIHNlcnZpY2Us IHNpbmNlIHN1Y2ggYXBwbGljYXRpb25zIG1heQo+ICAgYmVjb21lIHZ1bG5lcmFibGUgdG8gdGhl IGJ5cGFzcyBvZiB0aGlzIGF1dGhvcml6YXRpb24gY2hlY2sgaW4gYW4KPiAgIGVudmlyb25tZW50 IHdoZXJlIG90aGVyIG9wdGlvbnMgZm9yIGFwcGxpY2F0aW9uIGF1dGhlbnRpY2F0aW9uIGFyZQo+ ICAgcHJvdmlkZWQsIG9yIGlmIHRoZXkgaW50ZXJvcGVyYXRlIHdpdGggb3RoZXIgS0RDcy4KPgo+ PihJZiBpdCBpcyBzYWZlIHRvIGFkZCwgSSdtIGhhcHB5IHRvIHN1Ym1pdCBhIHBhdGNoIHRvIGFs bG93IGEgbmV3Cj4+bWFqb3IgdmVyc2lvbiBvZiBrZGNwb2xpY3kgLSB3aGljaCBJIHRoaW5rIHdv dWxkIGJlIG5lZWRlZCB0byBjaGFuZ2UKPj5rcmI1X2tkY3BvbGljeV9jaGVja190Z3NfZm4uKQo+ SSBjdXJyZW50bHkgbGVhbiB0b3dhcmRzIHRoaW5raW5nIHRoYXQgdGhlcmUgaXNuJ3QgZW5vdWdo IHJlYXNvbiB0byAKPmFtZW5kIHRoZSBrZGNwb2xpY3kgaW50ZXJmYWNlLiAgQWx0aG91Z2ggd2Ug Y291bGQgZG8gaXQgd2l0aCBvbmx5IGEgCj5taW5vciB2ZXJzaW9uIGJ1bXAgKGxpa2UgaW4gPGh0 dHBzOi8vZ2l0aHViLmNvbS9rcmI1L2tyYjUvY29tbWl0LzI5MjhmNGYxNjgyZWU2MjQ1Y2VjMWYz YzZkOWQ0YjliZjMwZjhlZTE+KSwgCj53ZSdkIHN0aWxsIGJlIGNhcnJ5aW5nIHNvbWUgZXh0cmEg Y29tcGxleGl0eS4KCkkgYWdyZWUuIE9uIHRoZSBvdGhlciBoYW5kLCBpZiB0aGVyZSBpcyBhIHJl cXVlc3QtYXNzb2NpYXRlZCAnY2FjaGUnIG9mCnJldHJpZXZlZCBEQiBlbnRyaWVzLCB3ZSBkb24n dCBuZWVkIGFuIEFQSSBjaGFuZ2UgZm9yIGtkY3BvbGljeSBwbHVnaW4uCgotLSAKLyBBbGV4YW5k ZXIgQm9rb3ZveQpTci4gUHJpbmNpcGFsIFNvZnR3YXJlIEVuZ2luZWVyClNlY3VyaXR5IC8gSWRl bnRpdHkgTWFuYWdlbWVudCBFbmdpbmVlcmluZwpSZWQgSGF0IExpbWl0ZWQsIEZpbmxhbmQKCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmtyYmRldiBtYWls aW5nIGxpc3QgICAgICAgICAgICAga3JiZGV2QG1pdC5lZHUKaHR0cHM6Ly9tYWlsbWFuLm1pdC5l ZHUvbWFpbG1hbi9saXN0aW5mby9rcmJkZXYK