[19458] in Kerberos_V5_Development
Re: any way to get user's ldap dn (or part of it) as part of the
daemon@ATHENA.MIT.EDU (Chris Hecker)
Fri Aug 26 02:16:16 2016
To: krbdev@mit.edu
From: Chris Hecker <checker@d6.com>
Message-ID: <417cbf14-33fc-142d-9901-cfab238f5075@d6.com>
Date: Thu, 25 Aug 2016 23:16:07 -0700
MIME-Version: 1.0
In-Reply-To: <dfd58f2a-d866-bf1e-0393-7ec259087543@d6.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Hmm, it looks like the authdata_plugin might be what I want?
Chris
On 2016-08-25 23:10, Chris Hecker wrote:
>
> I have a kerberized service that gets tickets from clients via
> krb5_rd_req and I get the client name from the ticket using
> krb5_unparse_name_flags. On the KDC, these clients are in the LDAP
> backend. Is there any way to get the dn (which has a UUID) as part of
> the ticket so I get can use it in the service? I know this is a bit of
> a confusion between authn and authz, but I also know Microsoft has a
> bunch of extensions that put a bunch of stuff into tickets that gets
> carried around, and I'm wondering if there's an extension mechanism that
> works for this. I'd like to avoid another round-trip to the backend to
> map from the client name to the UUID. I'm willing to modify my MIT KDC
> if necessary, although it'd be nice if was doable with a plugin in an
> "official" way or something.
>
> Thanks, or let me know if I'm thinking about this in the wrong way...
>
> Thanks,
> Chris
>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
