logo_kerberos.gif

Difference between revisions of "Developing a preauth plugin"

From K5Wiki
Jump to: navigation, search
(Debugging Tips)
Line 13: Line 13:
   
 
== Debugging Tips ==
 
== Debugging Tips ==
* <code>#define DEBUG 1</code> in the top of <code>src/kdc/kdc_preauth.c</code> to tickle logging of more info in your KDC log file (proabably <code>krb5kdc.log</code>).
+
* Define <code>DEBUG</code> as part of your build to tickle logging of more info in your KDC log file (proabably <code>krb5kdc.log</code>).
 
* Make liberal use of <code>krb5_klog_syslog</code>
 
* Make liberal use of <code>krb5_klog_syslog</code>

Revision as of 10:20, 28 April 2010

Recommended Reading

  • Read RFC 4210
  • Read draft-ietf-krb-wg-preauth-framework (version 16 current as of 4/27/2010)
  • Read src/include/krb5/preauth_plugin.h
  • Read src/plugins/preauth/encrypted_challenge/* for a (tragically) comment-less implementation of a preauth plugin implemented using FAST
  • ghudson's quick flow overview at http://mailman.mit.edu/pipermail/krbdev/2010-April/008891.html

Pre-authentication Limitations

  • There is no way to require that a certain preauth method is used.
  • Likewise, there is also no way to indicate a preferred preauth flow (method A, then B, then C).

References for above: http://mailman.mit.edu/pipermail/krbdev/2010-April/008902.html

Debugging Tips

  • Define DEBUG as part of your build to tickle logging of more info in your KDC log file (proabably krb5kdc.log).
  • Make liberal use of krb5_klog_syslog