From toby@inf.ed.ac.uk Wed Nov 14 09:58:07 2018 Return-Path: Received: from loire.is.ed.ac.uk (loire.is.ed.ac.uk [129.215.16.10]) by krbdev.mit.edu (Postfix) with ESMTP id 5702847BA5 for ; Wed, 14 Nov 2018 09:58:07 -0500 (EST) Received: from lmtp1.ucs.ed.ac.uk (lmtp1.ucs.ed.ac.uk [129.215.149.64]) by loire.is.ed.ac.uk (8.14.7/8.14.6) with ESMTP id wAEEw5dq010322 for ; Wed, 14 Nov 2018 14:58:05 GMT Received: from openvpn-124-137.inf.ed.ac.uk (openvpn-124-137.inf.ed.ac.uk [129.215.124.137]) (authenticated user=toby mech=PLAIN bits=0) by lmtp1.ucs.ed.ac.uk (8.13.8/8.13.7) with ESMTP id wAEEw0xb020831 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Wed, 14 Nov 2018 14:58:05 GMT From: Toby Blake Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Subject: Re: [krbdev.mit.edu #8761] ksu doesn't allow acquisition of non-forwardable tickets Date: Wed, 14 Nov 2018 14:58:00 +0000 References: To: rt-comment@krbdev-prod-app-1.mit.edu In-Reply-To: Message-ID: X-Mailer: Apple Mail (2.3445.9.1) X-Scanned-BY: MIMEDefang 2.84 on 129.215.16.10 X-Scanned-BY: MIMEDefang 2.52 on 129.215.149.64 X-Edinburgh-Scanned: at loire.is.ed.ac.uk with MIMEDefang 2.84, Sophie, Sophos Anti-Virus, Clam AntiVirus X-Spam-Status: hits=0.972 required=5 tests=SPF_SOFTFAIL version=3.4.0 RT-Send-Cc: X-RT-Original-Encoding: us-ascii Content-Length: 793 > On 13 Nov 2018, at 16:57, Greg Hudson via RT wrote: > > A ksu -F option seems reasonable, since it already has a -f option. > Adding a -P option at the same time for symmetry seems appropriate, > although I don't think proxiable tickets are used with any frequency. > > Ticket 7871 would also address this problem on the KDC side. (But the > client changes are still valuable due to existing KDCs and other KDC > implementations.) Thanks Greg. A KDC side option would be preferred by us, as it's a lot easier to patch the KDCs than all the clients, but as you say, fixing ksu in this way would also be desirable. Cheers Toby -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.