Resent-From: Jeffrey Altman <jaltman@secure-endpoints.com>
Resent-To: krb5-bugs@mit.edu
Resent-Date: Sun, 16 Mar 2008 00:25:57 -0400
Resent-Message-ID: <47DCA155.5010307@secure-endpoints.com>
Resent-User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.12) Gecko/20080213 Thunderbird/2.0.0.12
Received-SPF: pass (www.secure-endpoints.com: domain of kerberos-bounces@mit.edu designates 18.7.21.90 as permitted sender) x-spf-client=MDaemon.PRO.v9.6.4 receiver=www.secure-endpoints.com client-ip=18.7.21.90 envelope-from=<kerberos-bounces@mit.edu> helo=pch.mit.edu
To: kerberos@mit.edu
From: Adam Megacz <megacz@cs.berkeley.edu>
Subject: Re: Reading kerberos-adm from DNS: when will MIT-krb support this?
Date: Sat, 15 Mar 2008 19:36:02 -0700
Organization: Myself
Message-ID: <x34pb7e6p9.fsf@nowhere.com>
References: <200703120511.AAA11265@quince.ifs.umich.edu> <1E393FB5-8557-4BBE-8896-5FCE67A6F41D@mit.edu>
MIME-Version: 1.0
User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux)
Cancel-Lock: sha1:UXKdyfjYOKXfROlgiCpN8m5Zzsw=
Precedence: list
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Reply-To: megacz@cs.berkeley.edu
Sender: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Errors-To: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Content-Length: 2426


Ken Raeburn <raeburn@mit.edu> writes:
>> I believe the future has already arrived.  Current MIT code should
>> be capable of finding and using records like this:
>>
>> 	spam% dig _kerberos-adm._tcp.umich.edu srv
>
> This is used for the password-changing service, but unfortunately the  
> RPC code used for the kadmin program still looks up admin_server, and  
> uses the first IP address found when looking up that hostname.  No  
> DNS, one hostname, one address, no service-location plugin support,  
> no IPv6.  These do need to be fixed....

This should help.

  - a


diff --git a/src/lib/kadm5/alt_prof.c b/src/lib/kadm5/alt_prof.c
index bb87f88..48b1792 100644
--- a/src/lib/kadm5/alt_prof.c
+++ b/src/lib/kadm5/alt_prof.c
@@ -416,10 +416,31 @@ krb5_error_code kadm5_get_config_params(context, kdcprofile, kdcenv,
 	 params.admin_server = strdup(params_in->admin_server);
 	 if (params.admin_server)
 	      params.mask |= KADM5_CONFIG_ADMIN_SERVER;
-    } else if (aprofile &&
-	       !krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) {
-	 params.admin_server = svalue;
-	 params.mask |= KADM5_CONFIG_ADMIN_SERVER;
+    } else if (aprofile) {
+      if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) {
+        params.admin_server = svalue;
+        params.mask |= KADM5_CONFIG_ADMIN_SERVER;
+      } else {
+        struct addrlist addrlist;
+        int i;
+        krb5_data drealm;
+        drealm.data   = (void*)params.realm;
+        drealm.length = strlen(params.realm);
+	if (!krb5int_locate_server(context, &drealm, &addrlist, 0,
+                                   "admin_server", "_kerberos-adm", 1,
+                                   DEFAULT_KPASSWD_PORT, 0, 0)) {
+          for (i=0;i<addrlist.naddrs;i++ ) {
+            struct addrinfo *a = addrlist.addrs[i];
+            if (a->ai_family == AF_INET) {
+              params.admin_server  = strdup(inet_ntoa(sa2sin(a->ai_addr)->sin_addr));
+              params.kadmind_port  = ntohs(sa2sin (a->ai_addr)->sin_port);
+              params.mask |= KADM5_CONFIG_ADMIN_SERVER;
+              params.mask |= KADM5_CONFIG_KADMIND_PORT;
+              break;
+            }
+          }
+        }
+      }
     }
     if (params.mask & KADM5_CONFIG_ADMIN_SERVER) {
 	 char *p;

________________________________________________
Kerberos mailing list           Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos