[28085] in Kerberos
Re: query kerberos with C?
daemon@ATHENA.MIT.EDU (Russ Allbery)
Sat Jul 21 13:57:19 2007
From: Russ Allbery <rra@stanford.edu>
To: kerberos@mit.edu
In-Reply-To: <46A2224F.5080106@mpe.mpg.de> (Rainer Sigl's message of "Sat, 21
Jul 2007 17:12:15 +0200")
Date: Sat, 21 Jul 2007 10:57:07 -0700
Message-ID: <878x99wsgc.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Rainer Sigl <sigl@mpe.mpg.de> writes:
> I'm rel. new with kerberos beside using it with afs.
> My question: are there easy c-interfaces to ask a kerberos server for
> username, password or setting up new users on keberos?
It's impossible to ask a Kerberos server for someone's username and
password. The Kerberos server doesn't store that information. It only
stores encryption keys generated from the password, and from which one
cannot, in general, recover the initial password.
You can ask the Kerberos server to validate a username and password. You
do this by obtaining a krbtgt ticket (with krb5_get_init_creds_password)
and then verify against a local keytab (with krb5_verify_init_creds).
There is, unfortunately, no C API for setting up new users in MIT
Kerberos. You have to wrap something around the kadmin or kadmin.local
programs. I believe Heimdal does provide a C API to the administrative
functions.
There is a C API for changing passwords.
> In my special case I have user database on postgresql. the stored
> usernames, passwords which are till now used for authorizing by our
> email server. Now I wish to have the same passwords on my postgresql
> database and our afs server. This could work for example by writing
> c-functions on postgresql that fetches the corresponding password for a
> username and can create new user entries on kerberos.
> Is there any way to this?
You would either need to start using Kerberos authentication with
PostgreSQL, if it supports that (I don't know enough about PostgreSQL to
tell you), or you're going to have to write custom software that does
this, probably by wrapping calls to the kadmin program.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
