[19688] in Kerberos_V5_Development
Re: principal aliases?
daemon@ATHENA.MIT.EDU (Benjamin Kaduk)
Tue Nov 21 19:40:25 2017
Date: Tue, 21 Nov 2017 18:40:12 -0600
From: Benjamin Kaduk <kaduk@mit.edu>
To: Chris Hecker <checker@d6.com>
Message-ID: <20171122004012.GU82825@kduck.kaduk.org>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <CAOdMLc1nFKQZufvVA-0tNqHmChtqhJJ6iwU5b-AOxw0MStAMgA@mail.gmail.com>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Tue, Nov 21, 2017 at 04:17:23PM -0800, Chris Hecker wrote:
> Are these supported? There's a krbPrincipalAliases in the krb5 ldap schema,
> but I can't find any mention of them in the code, and online docs are
> spotty. I was hoping to use them but it doesn't seem like they do anything
> or are ever queried in the ldap kdb backend?
>
> Oh, hmm, looks like this is a Heimdal thing, bummer.
>
> https://www.openldap.org/lists/openldap-technical/201502/msg00053.html
>
> Any plans for supporting this in MIT?
They are only supported in the ldap backend, and you have to create
them out of band with an ldap editor. But once they are in ldap,
the KDC will use them.
-Ben
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
