Storing user-defined attributes in Kerberos5?

Wendy Lin wendlin1974 at gmail.com
Fri Sep 12 11:52:23 EDT 2014


On 27 April 2014 17:53, Greg Hudson <ghudson at mit.edu> wrote:
> On 04/25/2014 09:35 AM, Wendy Lin wrote:
>> Does Kerberos5 have the ability to store user-defined attributes
>> somehere and distribute them to the Kerberos5 clients?
>
> Short answer: not really, and that's more of a job for something like LDAP.
>
> As I don't know the details of your use case, I should note that some
> implementations of Kerberos do convey specific attributes about client
> principals to application servers (not clients) via the authdata field
> in the ticket.  The most well-known instance of this is the Microsoft
> PAC, described at http://msdn.microsoft.com/en-us/library/cc237917.aspx

So it would be possible to include home dir, uid, gid(s), gcos and
choice of unix shell in a ticket? How large can tickets get anyway?

Wendy


More information about the Kerberos mailing list