GSS implementation in ldap_child #6400
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
|
|
||
| static krb5_error_code ldap_child_get_tgt_gss_sync(TALLOC_CTX *memctx, |
Check warning
Code scanning / CodeQL
Poorly documented large function
thalman
force-pushed
the
gss2
branch
4 times, most recently
from
a314a4a to
b56a1e8
Compare
thalman
changed the title
thalman
force-pushed
the
gss2
branch
2 times, most recently
from
3c2a0b4 to
4b28152
Compare
|
Hi @thalman, @sumit-bose. As Tomáš explained, currently 3 variants are supported in "run time" (simultaneously):
Further, Tomáš explained, that difference between (3) and (2) is that (3) can handle a "worst case scenario "*" wildcard for matching principals" (and (2) cant'), but Sumit is working on a patch that will allow to handle this case in (2) as well. I propose:
Besides, I think it would be also great to include required gss proxy configuration snippet ( What would you say? |
With this patch, ldap_child is able to obtain kerberos ticket via GSS API instead of using kerberos library. The patch uses environment variable GSS_USE_PROXY to decide whether to use GSS API or kerberos libraries. If this variable is set to any value, GSS API is used. Note that this variable is used by GSS libraries too. Setting this variable to "yes" causes the GSS library to communicate with GSS proxy and therefore GSS proxy must be configured in advance to accept SSSD requests. By setting this variable to (for example) "no" ldap_child still uses the GSS API to get the kerberos ticket, but it is done directly - without communicating with GSS proxy. In such case ldap_child still needs permission to access keytab (i. e. must run as privileged user). If the variable is unset, ldap_child works the old way.
|
Sumit said we would need changes in 'gss lib' (at the very least, or maybe even in 'gss proxy') to fully support our use case. But nonetheless we need to include into this PR:
|
|
Additionally, could you please also:
|
| goto done; | ||
| } | ||
|
|
||
| major = gss_krb5_copy_ccache(&minor, creds, ccache); |
There was a problem hiding this comment.
Hi,
if I understand it correctly gss_krb5_copy_ccache() cannot be used with gss-proxy because gss-proxy will only return an encrypted blob (01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY: in the klist output) which cannot properly be parsed by libkrb5 calls.
But it should be possible to let gss_acquire_cred_from() write the creds directly into a ccache by adding a "ccache" cstore element.
bye,
Sumit
|
This is not needed any more |
With this patch, ldap_child is able to obtain kerberos
ticket via GSS API instead of using kerberos library.
The patch uses environment variable GSS_USE_PROXY to decide
whether to use GSS API or kerberos libraries. If this variable is
set to any value, GSS API is used. Note that this variable
is used by GSS libraries too.
Setting this variable to "yes" causes the GSS library
to communicate with GSS proxy and therefore GSS proxy must be
configured in advance to accept SSSD requests.
By setting this variable to (for example) "no" ldap_child still
uses the GSS API to get the kerberos ticket, but it is done
directly - without communicating with GSS proxy. In such case
ldap_child still needs permission to access keytab (i. e. must
run as privileged user).
If the variable is unset, ldap_child works the old way.