question about princ type assignment in krb5_ldap_get_principal()

[Will Fiveash]

On Thu, Jun 15, 2006 at 11:42:42PM +0530, Praveen Kumar Sahukar wrote:
> On Wed, 2006-06-14 at 11:07 -0400, Sam Hartman wrote:
> > >>>>> "Praveen" == Praveen Kumar Sahukar <psahukar at novell.com> writes:
> > 
> >     Praveen> On Tue, 2006-06-13 at 19:49 -0500, Will Fiveash wrote:
> >     >> In krb5_ldap_get_principal() in
> >     >> src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c I see:
> >     >> 
> >     >> if ((values=ldap_get_values(ld, ent, "objectclass")) != NULL) {
> >     >> for(i=0; values[i] != NULL; ++i) if (strcasecmp(values[i],
> >     >> "krbprincipal") == 0) { ptype = KDB_SERVICE_PRINCIPAL; break;
> >     >> }
> >     >> ldap_value_free(values);
> >     >> }
> >     >> 
> >     >> Why is ptype set to KDB_SERVICE_PRINCIPAL if the objectclass is
> >     >> krbprincipal?
> > 
> >     Praveen> Kerberos principals created on krbprincipal object class
> >     Praveen> (by extending with the krbprincipalaux aux class) are
> >     Praveen> considered as Kerberos service principals. Thus kerberos
> >     Praveen> principals like kadmin/admin, krbtgt/realmname ... are
> >     Praveen> created as krbprincipal object class.
> > 
> >     Praveen> Kerberos principals created by extending other structural
> >     Praveen> object classes with the krbprincipalaux aux class are
> >     Praveen> considered as the user principals.
> > 
> > This seems rather specific to your deployment.
> > 
> > What distinction does the code make based on this type?
> 
> Based on the principal type distinction a couple of eDirectory specific
> features are applied only to kerberos user principals and not to
> kerberos service principals.

Still the logic is suspect.  I just created a user principal and stored
it as a krbPrincipal object and this code sets the ptype to
KDB_SERVICE_PRINCIPAL.  I worry about this being misunderstood and
misused later.

-- 
Will Fiveash
Sun Microsystems Inc.
Austin, TX, USA (TZ=CST6CDT)