[19518] in Kerberos_V5_Development
Help pls : KDC w/LDAP backend
daemon@ATHENA.MIT.EDU (Pascal Jakobi)
Sun Jan 1 07:52:29 2017
MIME-Version: 1.0
From: Pascal Jakobi <pascal.jakobi@gmail.com>
Date: Sun, 1 Jan 2017 13:52:19 +0100
Message-ID: <CAFAKxWUiqtfUVeZw3tavT_5B9j8266f5QD95TiDuQodHS7BNBA@mail.gmail.com>
To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Hi there
I am trying to install a KDC with an OpenLDAP backend, following
instructions found on the MIT kerberos site. Installation went fine and I
can see that the default principals have been created (kadmin, krbtgt & so
on...).
However, I cannot add new principals :
kadmin.local -q "addprinc -pw password root"
Authenticating as principal root/admin@JAKOBI.FR with password.
WARNING: no policy specified for root@JAKOBI.FR; defaulting to no policy
*add_principal: Principal add failed: Insufficient access while creating
"root@JAKOBI.FR <root@JAKOBI.FR>".*
Digging a bit further, I could see the following with wireshark (after
binding to the Directory as kadmin) :
147 21.719670222 127.0.0.1 127.0.0.1 LDAP 1028
addRequest(7) "krbprincipalname=root@JAKOBI.FR,cn=JAKOBI.FR,cn=kerberos,dc=jakobi,dc=fr"
148 21.720138441 127.0.0.1 127.0.0.1 LDAP 107
addResponse(7) *insufficientAccessRights (no write access to parent) *
My LDAP ACLs are as follows :
{0}to attrs=userPassword,shadowLastChange by
dn="cn=admin,dc=jakobi,dc=fr" write by anonymous auth by self write by *
none
{1}to dn.base="" by * read
{2}to * by dn="cn=admin,dc=jakobi,dc=fr" write by * read
{3}to dn.subtree="cn=JAKOBI.FR,cn=kerberos,dc=jakobi,dc=fr" by
dn.exact="cn=kdc,ou=People,dc=jakobi,dc=fr" read
* {4}to dn.subtree="cn=kerberos,dc=jakobi,dc=fr" by
dn.exact="cn=kadmin,ou=People,dc=jakobi,dc=fr" write*
if ACL #4 refers to *dn.subtree="**cn=JAKOBI.FR
<http://JAKOBI.FR>,cn=kerberos,dc=jakobi,dc=fr"* (shouldn'it be the parent
of the target principal?), result is the same.
As far as I understand, rule #4 should allow me to to write within the
realm subtree...
Can someone enlighten me ?
Thanks in adv.
--
*Pascal Jakobi*
116 rue de Stalingrad
93100 Montreuil, France
*+33 6 87 47 58 19*Pascal.Jakobi@gmail.com
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
