Ticket History #8761: ksu doesn't allow acquisition of non-forwardable tickets

Hi,

If a principal has the DISALLOW_FORWARDABLE attribute in the KDC, but
/etc/krb5.conf has forwardable = true, then it is impossible to obtain
a ticket using ksu ("KDC policy rejects request while getting initial
credentials").

Would you be interested in a patch to implement a -F option (in the same
way as kinit) to explicitly request a non-forwardable ticket?

Cheers
Toby Blake
School of Informatics
University of Edinburgh


--
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.

A ksu -F option seems reasonable, since it already has a -f option.
Adding a -P option at the same time for symmetry seems appropriate,
although I don't think proxiable tickets are used with any frequency.

Ticket 7871 would also address this problem on the KDC side. (But the
client changes are still valuable due to existing KDCs and other KDC
implementations.)

Thanks Greg.

A KDC side option would be preferred by us, as it's a lot easier to patch
the KDCs than all the clients, but as you say, fixing ksu in this way
would also be desirable.

Cheers
Toby


--
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.