Projects/Keytab initiation - Revision history

Ghudson: /* Code changes */

2014-07-30T14:05:55Z

‎Code changes

Ghudson: /* Default client keytab */

2012-08-02T05:31:40Z

‎Default client keytab

Ghudson at 12:36, 6 July 2012

2012-07-06T12:36:52Z

Ghudson at 12:36, 6 July 2012

2012-07-06T12:36:00Z

Ghudson: /* Mailing list discussions */

2012-06-27T20:41:17Z

‎Mailing list discussions

Ghudson at 20:40, 27 June 2012

2012-06-27T20:40:21Z

Ghudson at 20:27, 27 June 2012

2012-06-27T20:27:40Z

Ghudson: /* Default client keytab */

2012-06-27T20:25:21Z

‎Default client keytab

Ghudson: /* Documentation */

2012-06-27T20:19:47Z

‎Documentation

Ghudson: /* Release notes */

2012-06-26T13:51:47Z

‎Release notes

@@ Line 59: / Line 59: @@
 * Give up and return an error
-If it necessary to choose a ccache based on the client principal, the following methods are used in order of preference.  An uninitialized ccache is only chosen if we detect that we can acquire initial credentials for the client principal, either with a caller-supplied password or with the client keytab.
+If it is necessary to choose a ccache based on the client principal, the following methods are used in order of preference.  An uninitialized ccache is only chosen if we detect that we can acquire initial credentials for the client principal, either with a caller-supplied password or with the client keytab.
 * An existing ccache in the collection for the client principal.
 * The uninitialized default cache, if it is not collection-enabled or if credentials are to be obtained by password.

@@ Line 29: / Line 29: @@
 * The KRB5_CLIENT_KTNAME environment variable (analgous to KRB5_KTNAME)
 * The default_client_keytab_name profile relation in libdefaults (analagous to default_keytab_name).
 The following discovery mechanisms will not be provided until we determine a need for them:

← Older revision		Revision as of 12:36, 6 July 2012
Line 1:		Line 1:
−	{{project-~~complete~~\|1.11}}	+	{{project-rel\|1.11}}

	This project is to add support for automatically getting credentials for gss-krb5 security context initiation using a keytab.		This project is to add support for automatically getting credentials for gss-krb5 security context initiation using a keytab.

← Older revision		Revision as of 12:36, 6 July 2012
Line 1:		Line 1:
−	{{project-~~review~~\|~~2012-07-06~~}}	+	{{project-complete\|1.11}}
−	{{project-target\|1.11}}

	This project is to add support for automatically getting credentials for gss-krb5 security context initiation using a keytab.		This project is to add support for automatically getting credentials for gss-krb5 security context initiation using a keytab.

@@ Line 116: / Line 116: @@
 Here is the primary design discussion thread, which was broken into four pieces in the archives:
-http://mailman.mit.edu/pipermail/krbdev/2012-May/010871.html
+* http://mailman.mit.edu/pipermail/krbdev/2012-May/010871.html
-http://mailman.mit.edu/pipermail/krbdev/2012-June/010885.html
+* http://mailman.mit.edu/pipermail/krbdev/2012-June/010885.html
-http://mailman.mit.edu/pipermail/krbdev/2012-June/010901.html
+* http://mailman.mit.edu/pipermail/krbdev/2012-June/010901.html
-http://mailman.mit.edu/pipermail/krbdev/2012-June/010948.html
+* http://mailman.mit.edu/pipermail/krbdev/2012-June/010948.html
 == Release notes ==

← Older revision		Revision as of 20:40, 27 June 2012
Line 111:		Line 111:

	The behavior of acquiring initiator credentials will be documented in a new section of gssapi.rst named "Initiator credentials".		The behavior of acquiring initiator credentials will be documented in a new section of gssapi.rst named "Initiator credentials".
		+
		+	== Mailing list discussions ==
		+
		+	Here is the primary design discussion thread, which was broken into four pieces in the archives:
		+
		+	http://mailman.mit.edu/pipermail/krbdev/2012-May/010871.html
		+	http://mailman.mit.edu/pipermail/krbdev/2012-June/010885.html
		+	http://mailman.mit.edu/pipermail/krbdev/2012-June/010901.html
		+	http://mailman.mit.edu/pipermail/krbdev/2012-June/010948.html

	== Release notes ==		== Release notes ==

← Older revision		Revision as of 20:27, 27 June 2012
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-review\|2012-07-06}}
		+	{{project-target\|1.11}}

	This project is to add support for automatically getting credentials for gss-krb5 security context initiation using a keytab.		This project is to add support for automatically getting credentials for gss-krb5 security context initiation using a keytab.

← Older revision		Revision as of 20:25, 27 June 2012
Line 25:		Line 25:
	Automated keytab initiation will not make use of this keytab. Instead, there will be a new complementary "default client keytab", obtained with krb5_kt_client_default(), with its own set of underlying discovery mechanisms. Unless an administrator sets up a client keytab, automated keytab initiation will not take place, thus minimizing surprise.		Automated keytab initiation will not make use of this keytab. Instead, there will be a new complementary "default client keytab", obtained with krb5_kt_client_default(), with its own set of underlying discovery mechanisms. Unless an administrator sets up a client keytab, automated keytab initiation will not take place, thus minimizing surprise.

−	(TBD: what discovery mechanisms do we need? Candidates include a revised version of gss_krb5_import_cred with a client keytab argument, a GSS extension parallel to krb5_gss_register_acceptor_identity, a URN for [[Projects/Credential_Store_extensions]], an environment variable parallel to KRB5_KTNAME, a profile relation parallel to default_keytab_name, and a hardcoded default.)
		+	Initially, the default client keytab will have the following discovery mechanisms, in decreasing priority order:
		+
		+	* The KRB5_CLIENT_KTNAME environment variable (analgous to KRB5_KTNAME)
		+	* The default_client_keytab_name profile relation in libdefaults (analagous to default_keytab_name).
		+	* A hardcoded default, initially /etc/krb5.client-keytab. This is a placeholder default and will likely change before 1.11 as part of a follow-on project.
		+
		+	The following discovery mechanisms will not be provided until we determine a need for them:
		+
		+	* A revision of gss_krb5_import_cred with a client keytab argument
		+	* A GSS extension similar to krb5_gss_register_acceptor_identity
		+
		+	After [[Projects/Credential_Store_extensions]] is complete, we will likely add a cred store URN for the client keytab.

	=== Caching and refreshing ===		=== Caching and refreshing ===

← Older revision		Revision as of 20:19, 27 June 2012
Line 95:		Line 95:

	The new environment variable KRB5_CLIENT_KTNAME will be documented in env_variables.rst.		The new environment variable KRB5_CLIENT_KTNAME will be documented in env_variables.rst.
		+
		+	The new profile relation default_client_keytab_name will be documented in krb5_conf.rst.

	The behavior of acquiring initiator credentials will be documented in a new section of gssapi.rst named "Initiator credentials".		The behavior of acquiring initiator credentials will be documented in a new section of gssapi.rst named "Initiator credentials".

← Older revision		Revision as of 13:51, 26 June 2012
Line 100:		Line 100:
	== Release notes ==		== Release notes ==

−	TBD
		+	Administrator experience:
		+	* Add support for a "default client keytab". Its location is determined by the KRB5_CLIENT_KTNAME environment variable, the default_client_keytab profile relation, or a hardcoded path (TBD).
		+	* GSSAPI initiator applications can now acquire credentials automatically from the default client keytab, if one is available.
		+
		+	Developer experience:
		+	* Add a new API krb5_kt_client_default() to resolve the default client keytab.