Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

You might have mail.


devel / comp.protocols.kerberos / Re: Creating a principal using the kadmin C API

SubjectAuthor
o Re: Creating a principal using the kadmin C APITeo Klestrup Röijezon

1
Re: Creating a principal using the kadmin C API

<mailman.43.1649689807.8148.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=238&group=comp.protocols.kerberos#238

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: teo.roij...@stackable.de (Teo Klestrup Röijezon)
Newsgroups: comp.protocols.kerberos
Subject: Re: Creating a principal using the kadmin C API
Date: Mon, 11 Apr 2022 17:09:44 +0200
Organization: Stackable
Lines: 26
Message-ID: <mailman.43.1649689807.8148.kerberos@mit.edu>
References: <CAD-Ua_ifa=vo4PEzy3kx-5FB3J+hhN_2BTuS7O=E+hfudRbV4Q@mail.gmail.com>
<733bbe58-7c13-8abc-f0e6-3cbe979540ed@mit.edu>
<2957453.irdbgypaU6@teo-dator-newarch>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7Bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="28446"; mail-complaints-to="newsmaster@tnetconsulting.net"
Cc: kerberos@mit.edu
To: Greg Hudson <ghudson@mit.edu>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=AS5K0JWObdufNSARSKj/YBpAirB6hhi6h1PMietMXymlH6zntnTbkJ3Q/1kUJGZqfL3DPB+ItDhnWlaZc7KbomXRf+mB5drerEilvx+JLcfcvZCcEh266inXmJJRTaXePLavZ3UxOtwI4QQR0ago8BRd/T99d9KxKWhCYbzMMs1UXvf/4nGhFmydkaVjM36GepqL4GcbkAgr0e+zn4N4VpyxhamCIC8kWbanlD5uU1OCn1JwhhcZlI3SPIiA8hFsy/xgxbt9V26gVUXG/j8KNftPX5kwo1Ytri41F5uqsPOEngENOkoH/k6oyqLQwJ2zdaKSYrpQWvZR0z6EpO/goA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=WL4mvDVwkoVaVmjWGEC7Z9R75FII/lo2SYYo5MxISIk=;
b=Q5SaCU1f36m3U0xSz3/A4r8C/9nM7r7peSRA+t7uXVgSA9PKMWYUTUhkeClbfSpCZSydYj3coAQzADwEzACiU9VqF1wepMiagtlyB0M7aNJL6aqVOhATFdvl1jVoJI0jEBixa/Wh4Jadk/48ReQsSniJPmoeugq26ZdQGyQMf845GeN0bJIGf8xvfCXXcLFivhpQEaJ1xOePJCuI8CiWqKfGKzgGD2q0MGD8IlOGkuMi5s8hyEMVqp6vvNvvftzOd7fXZHAtWGyfCbNAQXHJ/CWeamFmsDtqsClTck4Yh0F26OlbjF74dff1nrUPhgqNwBtQoXHVMysD9cZvSOtTig==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
209.85.167.42) smtp.rcpttodomain=mit.edu smtp.mailfrom=stackable.de;
dmarc=pass (p=reject sp=reject pct=100) action=none header.from=stackable.de;
dkim=pass (signature was verified) header.d=stackable.de; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=WL4mvDVwkoVaVmjWGEC7Z9R75FII/lo2SYYo5MxISIk=;
b=KVCqhm4QQDI6n9pjjH41yiAH9dJJNgc2MeWZ9Wzbu0z3wxGBP6csw1HyCdNNxw1ChEkS+T7L/A2PNegnAUCv5FvI+KsEZ/r1u4nS05R1MUq9ilejBycy7OtzJkp6fuQrvzk+gPE4zejlvonJfhThjILhZy2bedh4i4c9TWbybIM=
Authentication-Results: spf=pass (sender IP is 209.85.167.42)
smtp.mailfrom=stackable.de; dkim=pass (signature was verified)
header.d=stackable.de;dmarc=pass action=none header.from=stackable.de;
Received-SPF: Pass (protection.outlook.com: domain of stackable.de designates
209.85.167.42 as permitted sender)
receiver=protection.outlook.com;
client-ip=209.85.167.42; helo=mail-lf1-f42.google.com;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stackable.de; s=google;
h=from:to:cc:subject:date:message-id:organization:in-reply-to
:references:mime-version:content-transfer-encoding;
bh=WL4mvDVwkoVaVmjWGEC7Z9R75FII/lo2SYYo5MxISIk=;
b=LWslzxrqZrAitDwjcE4zvjgg3MRhViFZoGAEKNskj4Rt7kOGxUxL4Wq67DiKDUSVBV
wWuNb1WABQ3USjEjg5hgHy5P9P/uy9IFOU99xL3H8ufN6FGDqH9s+c4g1XDoTaVSUxKV
vaj5gHvNK/U4dxrkfu2VWB/gj9eXCpqinfZYUPg8gHkHN9hpgQyvQP48CZFHmGLwL3va
k+9jQgCip/uvo5dpWFxR46VZofneuD/hPyeM8hSyipccQFFLF0aoBSbEjLI0+tOf9FcZ
LuqHS0B0DZEWdeE8lxqdj/KXnoavv/okR/QdMQ1DkzkLOoQP9gDNGb5WNIJPimt8G2cD
h7nw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:from:to:cc:subject:date:message-id:organization
:in-reply-to:references:mime-version:content-transfer-encoding;
bh=WL4mvDVwkoVaVmjWGEC7Z9R75FII/lo2SYYo5MxISIk=;
b=I596zTIveEsSaWo7VolrdWzJdXzPp+hQMTnJULbo3k6obTlId2AJ0u/LEsChzNcRW1
cNQTEJ2NPez7uTOEhfa6JqEJ2KZy2VsqbqTc9pbVNh62p105stTJ7paJpY9hIWlaWNyg
d4M7puUtDP3MPHjaT8CY4rVhGxHJukiayA8WWGsgJpBBAB3wbs6eamqesNXtzh0efshr
dK5LXMo0UsPwoMkgtNzKrrRMChGl8KcfTmKsNAMh1Q/89z1pSCljUhkSfe56NNVduEiv
v6PL6Arf4RCeosid4lHPalvYdA3r8ujRiBnV/OWBm66Bc+p6ifaSU8BJZO8mvK9TyWE9
Rk6Q==
X-Gm-Message-State: AOAM5329PaJpJgioZPSUYeizClV87zj8ua7B2D+U8Ecc3JndC+j3kv3Z
H1BqjHzNlXKc9YowG7KV+76hON0bZXI=
X-Google-Smtp-Source: ABdhPJwzDWktG+i5uA2krdC8eKdZ6i5IWg/WoEYfUQlnksey8V9NOnib7moOGL/RukqQufIi9qqjXA==
X-Received: by 2002:a05:6512:a8c:b0:44a:1dd:4cd8 with SMTP id
m12-20020a0565120a8c00b0044a01dd4cd8mr21447402lfu.297.1649689785882;
Mon, 11 Apr 2022 08:09:45 -0700 (PDT)
In-Reply-To: <733bbe58-7c13-8abc-f0e6-3cbe979540ed@mit.edu>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 7b6b0a39-3850-40cc-64e1-08da1bcd513b
X-MS-TrafficTypeDiagnostic: DM5PR01MB2713:EE_
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <DM5PR01MB2713E78135AE5A09982C6E58E1EA9@DM5PR01MB2713.prod.exchangelabs.com>
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: Zk4sIEnfGKPQWBHs4g55T395KeJqCJmGpPTu9OHPUG0gY60epkH61RZNjpaynT2wakiIftyOc9IjnhB1nTihOW6R/F9gdnXi+e97tiV0a4Kh0HTzMVqcnq4TrpgQst63XMNvxgRRHjq3QfM/Me2e5pWU2zsl4jJoW9EXqKX3WXBv2IsOUVp422lGQXa2W7XS0dSSgoyTn4mxXf3yQ2ZePEjJdwlHv8sQVnJo8K7osuK8zxl4E1mqRqiKU1UFwi4p7MFKwu9FPYNUoHUFiyzg3XHPzmBgIBvcH/BNdkG+AdmO26LBQQnP3goGasY1Et8wjvc5GKljHLMytlbAx4ITdn2pPt6NRURE8eMP+j9XfydHl/sTMX7cBOAGsoVpgR9nR/Tks3Vlvdaav+avA7LmcLmTzugAvRGnkJc45f1JVtXBqOsvCQJeEfTUvbcLy+j/abXI5VCX7ew0arXoCBBnERoaKte8ks4nCQrcEVkd7IbNZSlsKuvgzV88Dzg25zAYk1iDzY74sf8K8o/0wPur4Vw0+yTjdQ9nicdNusZmBAup54Q7HMs8/fLTP9v9dQXnx7Vd0nuYODcBQ4053mD9I9WuzMRQTHiwfpMJrzGvU7ttkTpN9SkSkGMJ/KHkMct1eSWzCI9FSacrO6nUUINTuZ+APIaNxebIe8nnXptfHLw=
X-Forefront-Antispam-Report: CIP:209.85.167.42; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mail-lf1-f42.google.com; PTR:mail-lf1-f42.google.com;
CAT:NONE;
SFS:(13230001)(4636009)(4326008)(8676002)(6862004)(70586007)(68406010)(33716001)(7636003)(508600001)(7596003)(2906002)(956004)(36916002)(356005)(5660300002)(86362001)(316002)(786003)(83380400001)(26005)(336012)(9686003)(39026012);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Apr 2022 15:09:47.1439 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 7b6b0a39-3850-40cc-64e1-08da1bcd513b
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT025.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR01MB2713
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <2957453.irdbgypaU6@teo-dator-newarch>
X-Mailman-Original-References: <CAD-Ua_ifa=vo4PEzy3kx-5FB3J+hhN_2BTuS7O=E+hfudRbV4Q@mail.gmail.com>
<733bbe58-7c13-8abc-f0e6-3cbe979540ed@mit.edu>
 by: Teo Klestrup Röijez - Mon, 11 Apr 2022 15:09 UTC

Hey, I'm a coworker of Lars' and working on this project.

On Friday, 8 April 2022 06.35.29 CEST Greg Hudson wrote:
> krb5_init_context_profile() lets you supply a profile object. If this
> is created with profile_init_path(), the application should be able to
> strictly control which file is used.
>
> It is possible to create an in-memory profile with
> profile_init_vtable(). Perhaps it would be nicer if one could create an
> empty in-memory profile object and populate it with
> profile_add_relation(), but that is not currently implemented.

profile_init_vtable() (or building it with profile_add_relation()) would be
ideal, yes. Our current prototype uses krb5_init_context_profile() for the sake
of simplicity (vtables are annoying to build up and maintain across the Rust-C
border, so I didn't want to go there until we could confirm that the rest
works).

However, the kadm5_init_*() family of functions (via init_any()) calls
kadm5_get_config_params(), which in turn always loads its own profile by calling
krb5_aprof_init() with a hard-coded choice of either DEFAULT_PROFILE_PATH or
DEFAULT_KDC_PROFILE. This _is_ possible to override with environment
variables, but that's a pretty big ask when linking to the library in-process.

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor