weak regex/glob in listprincs in kadmin (on ldap)?

Greg Hudson ghudson at mit.edu
Mon Jul 12 01:55:14 EDT 2021


On 7/11/21 9:23 PM, Chris Hecker wrote:
> From looking at the code in src/lib/kadm5/srv/svr_iters.c 
> <https://github.com/krb5/krb5/blob/f573f7f8ee5269103a0492d6521a3242c5ffb63b/src/lib/kadm5/srv/svr_iters.c#L180> 
> it seems like the listprincs command should support [] patterns like 
> che[ca]* but it doesn't in my version (1.15.1 on centos with ldap 
> backend).  listprincs chec* works of course.

With the LDAP KDB module, the expression is applied at the KDB layer via
an LDAP filter expression, as well as at the libkadm5 layer.  LDAP
filter expressions can only handle '*' globbing.  Possibly the LDAP KDB
module should check if [] or ? is in the glob pattern and return all
results (like the other KDB modules do for all match expressions).

> Is there a recommended way of using the kadm5 interface to iterate 
> through tons of principals? [...] I'm trying figure out which princs
> have passwords that are about to expire.

You might try "kdb5_util tabdump -n princ_tktpolicy" if you can run on a
KDC, or variations of that.


More information about the Kerberos mailing list