Skip Menu |
 

History Show all quoted text — Show full headers
# Wed Feb 23 11:12:20 2005 <DEEngert@anl.gov> - Ticket created
Date: Wed, 23 Feb 2005 10:09:01 -0600
From: "Douglas E. Engert" <deengert@anl.gov>
To: krb5-bugs@mit.edu
Subject: KDC and kadmin support for TKT_FLG_OK_AS_DELEGATE
Download (untitled) / with headers
text/plain 651B
Please consider adding to the KDC and kadmin support to set
the TKT_FLG_OK_AS_DELEGATE in service tickets.

This can be useful when a MS client using SSPI is asked to
delegate. It firsts checks the service ticket to see if it
is OK to delegate to this service.

Mods to PuTTY are available that can use the SSPI for
ssh gssapi-with-mic. But the SSPI will not delegate to the
host service if the KDC does not set this flag.

You may also want to consider adding this same check
in the gss_init_sec_context.

--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
# Wed Feb 23 11:52:52 2005 <DEEngert@anl.gov> - Comments added
Date: Wed, 23 Feb 2005 10:49:42 -0600
From: "Douglas E. Engert" <deengert@anl.gov>
To: rt-comment@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #2940] KDC and kadmin support for TKT_FLG_OK_AS_DELEGATE
RT-Send-Cc:
Download (untitled) / with headers
text/plain 856B
P.S. Since the Windows XP ksetup has a /setRealmFlags ... Delegate
this is not critical. The client can override the check
for a whole realm.

DEEngert@anl.gov via RT wrote:

Show quoted text
> Please consider adding to the KDC and kadmin support to set
> the TKT_FLG_OK_AS_DELEGATE in service tickets.
>
> This can be useful when a MS client using SSPI is asked to
> delegate. It firsts checks the service ticket to see if it
> is OK to delegate to this service.
>
> Mods to PuTTY are available that can use the SSPI for
> ssh gssapi-with-mic. But the SSPI will not delegate to the
> host service if the KDC does not set this flag.
>
> You may also want to consider adding this same check
> in the gss_init_sec_context.
>

--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
# Wed Mar 25 17:14:54 2009 tlyu (Taylor Yu) - Ticket 2940 RefersTo ticket 5596.
# Tue Apr 21 17:38:39 2009 ghudson@mit.edu (Greg Hudson) - Taken
# Tue Mar 20 11:47:37 2018 ghudson@mit.edu (Greg Hudson) - Status changed from 'new' to 'resolved'
# Tue Mar 20 11:47:37 2018 ghudson@mit.edu (Greg Hudson) - Tags nochange added
# Tue Mar 20 11:47:37 2018 ghudson@mit.edu (Greg Hudson) - Comments added
Download (untitled) / with headers
text/plain 25B
Resolved by ticket #5596.