Difference between revisions of "Projects/Keytab ccache name parameters"

Latest revision as of 13:00, 29 November 2012

This project is to make it possible for a build or configuration of krb5 to change the location of the default keytab, client keytab, and ccache using a parameterized string.

Background

libkrb5 provides the concepts of the default ccache, default keytab, and default client keytab for a library context. (The default client keytab is new in 1.11; see Projects/Keytab_initiation.) The user-visible discovery mechanisms for these concepts at the moment are:

• The KRB5CCNAME, KRB5_KTNAME, and KRB5_CLIENT_KTNAME environment variables
• The default_keytab_name and default_client_keytab_name profile relations (there is no equivalent for the default ccache)
• On Windows, registry settings for the default ccache
• On Windows, the hardcoded default %TEMP%\krb5cc or %TMP%\krb5cc or {windir}\krb5cc for the default ccache, {windir}\krb5kt for the default keytab, and {windir}\krb5clientkt for the default client keytab.
• On Unix, the hardcoded default /tmp/krb5cc_{uid} for the default ccache, /etc/krb5.keytab for the default keytab, and /etc/krb5.client-keytab for the default client keytab

Problems with this state of affairs include:

• If a collection of daemon processes are running as different uids and need to use different keytabs or client keytabs, they must currently use environment variables in order to do so, which is unwieldy on some operating systems.
• The use of a shared temporary area for the default ccache on Unix systems carries inherent security risks relative to using a per-user temporary area (if the operating system supplies one). Although the login system can override this default by setting KRB5CCNAME, tickets obtained using kinit on a system without Kerberos login integration will use the per-uid default in /tmp.
• If an operating system vendor changes the hardcoded default (as Solaris did by moving the default keytab to /etc/krb5/krb5.keytab), then a build from source on that operating system will use different defaults from the vendor build.

Requirements

• It must be possible for a group of processes, each running under a different UID, to use distinct keytabs and distinct client keytabs without each setting the KRB5_KTNAME or KRB5_CLIENT_KTNAME environment variables.
• It should be possible for a host or operating system to stop using /tmp for the default ccache.
• It should be possible to determine the default locations used by a build of krb5 from within a shell script.
• By default, a build of krb5 should use the same default ccache and keytab locations as the current system installation of krb5, if the system installation is new enough to report that information.

Design

The design has three parts:

• Make the default keytab and default client keytab names subject to parameter expansion.
• Add a new profile variable for the default ccache name, also subject to parameter expansion.
• Add support for overriding the default ccache and keytab names

We will make the default keytab names subject to parameter expansion, and will add a new profile variable for the default ccache name.

Parameter expansion

We will adapt the Heimdal expand_path.c facility for our code. This facility supports the following parameter expansions:

•  %{APPDATA} -- Windows roaming application data directory for current user
•  %{COMMON_APPDATA} -- Windows application data directory for all users
•  %{LOCAL_APPDATA} -- Windows local application data directory for current user
•  %{SYSTEM} -- Windows system folder
•  %{WINDOWS} -- Windows folder
•  %{USERCONFIG} -- Windows per-user MIT krb5 config file dir
•  %{COMMONCONFIG} -- Windows all-users MIT krb5 config file dir
•  %{LIBDIR} -- Package library install directory
•  %{BINDIR} -- Package binary install directory
•  %{SBINDIR} -- Package root binary install directory
•  %{TEMP} -- Temporary directory (e.g. /tmp)
•  %{USERID} or %{uid} -- Current uid (or string representation of Windows SID)
•  %{null} -- Empty string

Not all of these parameters are needed for the current use, but it makes sense to support them for consistency with Heimdal.

Profile changes

default_keytab_name and default_client_keytab_name will be modified to perform parameter expansion on their values.

A new variable default_ccache_name will be added, also subject to parameter expansion. It will be used if there is no KRB5CCNAME environment variable setting, and in preference to the build-time default.

Build configuration additions

configure will support the DEFCCNAME, DEFKTNAME, and DEFCKTNAME variables (e.g. "./configure DEFCCNAME=DIR:/var/run/user/%{uid}/ccache"). Setting these variables will set the built-in defaults.

The krb5-config script will be augmented to support --defccname, --defktname, and --defcktname options.

configure will support --with-krb5-config=PATH and --without-krb5-config. If a path is specified, or if a krb5-config program is in the path and no option is specified, the new krb5-config options will be used to set the built-in defaults (unless the defaults are set explicitly with variable assignments). If krb5-config does not support the new options, the usual defaults will be used.

These changes are for Unix systems only. The Windows built-in defaults for ccache and keytabs will not change.

Testing

A simple test program will be used to exercise the path token expansion function.

Python script test cases will be added to test parameter expansion in the profile variables.

The build configuration changes will be tested by hand.

Documentation

Parameter expansion and the new profile variables will be documented in krb5_conf.rst.

New configure options will be documented in options2configure.rst.

New krb5-config options will be documented in the krb5-config man page.

Mailing list discussions

http://mailman.mit.edu/pipermail/krbdev/2012-June/010907.html http://mailman.mit.edu/pipermail/krbdev/2012-June/010959.html

Release notes

Administrator experience:

• Add parameter expansion for default_keytab_name and default_client_keytab_name profile variables.
• Add new default_ccache_name profile variable to override the built-in default credential cache name.
• Add configure-time support for changing the built-in ccache and keytab names.
• Add krb5-config options for displaying the built-in ccache and keytab names.
• In the default build, use the system's built-in ccache and keytab names if they can be discovered using krb5-config.