Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

On 10/24/2011 10:08 PM, Nico Williams wrote:
> I'll tell you what I would find acceptable:
>
>   - a patch to add an aname2lname plugin
>      - one or more plugins that implement a deterministic DB and/or
> rule-set plugin
>     (I'm working on this among other things, actually, so if you're
> willing to wait a bit...)
>   - a patch to add a kuserok plugin
>      - one or more plugins that implement LDAP lookups, any sort of DB, ...
>   - a patch to place keytabs for *client* (initiator) usage somewhere
> in /var (which I think was part of your patches)
>
> I'd also be OK with patchs to add a new version of aname2lname that
> takes a DB argument (so that apps that want to have per-share mappings
> or whatever can).
>
> I'd also be OK with a utility that takes a gss_name_t and makes the
> current process' (or thread's, on Windows, for example) credentials
> match whatever process credentials are appropriate for that principal.
>
> Nico
> --
>

I'll let you folk who care about heimdal first and most puzzle that 
out.   I have code that now lets NFS work in the way it did before 
kerberos, except the wire is now protected whereas before it was not.

While you're about it, be sure to take a look at whatever your favorite 
way is of allowing effective user ids access to keytabs owned only by 
that id and readable only by that id without reference to the vague 
world of 'tainted environments' thus relying on krb5.conf-- and across 
platforms.   Certainly a case where the 'real' uid is 'root' and the 
'effective id' is something else should be a 'tis' while anything else 
should be a 'taint'.

I should be clear that I really have no long term desire to shape the 
future of heimdal.   I'm here because I needed to secure my local wire 
and perhaps foolishly started down the road that suggested 
kerberos/freebsd/heimdal was the way to get that done across a 
non-homogenous *nix/*bsd/*is/cupertino/redmond environment.   It came 
close, I came up with unwelcome ugly patches that really don't break 
anything and enable me to move on.   So, move on I will.

Whatever you folks decide to do, try to keep administrative burden in mind.