>>>>> "Lukas" == Lukas Kubin <[EMAIL PROTECTED]> writes:
Lukas> I'm planning to build an web interface for administering
Lukas> our Kerberos/OpenAFS/LDAP accounts. How should I pass
Lukas> credentials to the web service? I can use the mod_auth_kerb
Lukas> module for Apache. Then some wrapper script will call
Lukas> kadmin command. When I want kadmin not to ask for password
Lukas> everytime it is called, I'll have to create an
Lukas> administrator's keytab stored on the webserver. That way
Lukas> appear not to be secure.
Why is this not secure? It places your web service in the role as a
privilege delegation service rather than as acting as the user
directly.
You actually tend to want this though. At many sites it is reasonable
for a larger set of users to go through all the steps of creating a
properly configured account all at once than it is to allow a user to
only go through one of the steps of account setup. If only the web
server is authorized to act, it can enforce constraints like this.
--Sam
________________________________________________
Kerberos mailing list [EMAIL PROTECTED]
https://mailman.mit.edu/mailman/listinfo/kerberos
