weak regex/glob in listprincs in kadmin (on ldap)?

[Greg Hudson]

On 7/11/21 9:23 PM, Chris Hecker wrote:
> From looking at the code in src/lib/kadm5/srv/svr_iters.c 
> <https://github.com/krb5/krb5/blob/f573f7f8ee5269103a0492d6521a3242c5ffb63b/src/lib/kadm5/srv/svr_iters.c#L180> 
> it seems like the listprincs command should support [] patterns like 
> che[ca]* but it doesn't in my version (1.15.1 on centos with ldap 
> backend).  listprincs chec* works of course.

With the LDAP KDB module, the expression is applied at the KDB layer via
an LDAP filter expression, as well as at the libkadm5 layer.  LDAP
filter expressions can only handle '*' globbing.  Possibly the LDAP KDB
module should check if [] or ? is in the glob pattern and return all
results (like the other KDB modules do for all match expressions).

> Is there a recommended way of using the kadm5 interface to iterate 
> through tons of principals? [...] I'm trying figure out which princs
> have passwords that are about to expire.

You might try "kdb5_util tabdump -n princ_tktpolicy" if you can run on a
KDC, or variations of that.