Roland C. Dowdeswell comments

Results 30 comments of


                                            Roland C. Dowdeswell

Improve encoding of krb5_{,un}parse_principal().

I think that we should consider it. We currently don't quote many characters which may spam logs with unprintables, IIRC, which is what we're trying to fix here.

In krb5.conf make underscores and dashes equivalent

I'm looking at it.

In krb5.conf make underscores and dashes equivalent

Yes, understood. What we have at the moment is inconsistency. We're trying to fix it. It appears that MIT Kerberos uses underscores exclusively from their documentation, but we use both....

In krb5.conf make underscores and dashes equivalent

We also have a lot of inconsistencies, i.e. we have "no-addresses" and MIT has "noaddresses".

dyff should return non-zero when differences are found

I would recommend `--no-exit-code` or just nothing to make dyff a drop in replacement for diff in scripts.

Need to log when principal last successfully "used" (AS or TGS)

Strictly speaking, in Kerberos, unless you require preauth, you can't always tell if someone has authenticated successfully. With preauth, you can tell that the AS has been used successfully, but...

Need to log when principal last successfully "used" (AS or TGS)

For progress, please have a look at ongoing work in PR 650. https://github.com/heimdal/heimdal/pull/650

Method to check quickly whether krb5_kuserok or krb5_verify_init_creds could ever pass?

I gave this some thought quite some time ago w.r.t. NetBSD's behaviour vis a vis Kerberos. I have always felt deeply unsatisfied that the presence of `krb5.conf(5)` has been used...

Method to check quickly whether krb5_kuserok or krb5_verify_init_creds could ever pass?

NetBSD's PAM stack also should not be reaching through the layers of abstration. Assuming that `/etc/krb5.conf` has a meaning to Heimdal is not part of the promise that Heimdal makes...