ANAME_DB re-enable with patch.
Roland C. Dowdeswell
elric at imrryr.org
Thu Sep 2 19:26:23 EDT 2010
On Thu, Sep 02, 2010 at 01:48:39PM -0400, Sam Hartman wrote:
>
> I support some interface to do lookups for aname_to_lname that is
> database driven. Like Greg, additional uses of the bdb in the tree
> sholud be avoided.
>
> I'd be happy with any of:
>
> * system db (assuming system DBs can be in the same process with ours on
> at least some common OSes we build for)
>
> * sqlite
> * tdb
> * LDAP
LDAP, we should be a little careful about. Given that currently,
krb5_kuserok() does not cause any network dependent services that
can return transient failures and cannot block [for long] if you
are running on a local file system, this could change the expectations
of callers about how krb5_kuserok() actually works. This is not
to say that it shouldn't be done---but there are gotchas in taking
a function call that returns explicit and correct results and adding
in a network backend such as LDAP without also changing the API to
allow for transient failures to occur in a way that calling
applications can understand and cope with.
Another idea that I've had might be to change krb5_kuserok() to
krb5_kticketok() which would evaluate whether a ticket is allowed
to access a luser's account. This would enable us to use the
authorisation data section of a ticket to provide said authorisation.
(Longer term thought process, though.)
--
Roland Dowdeswell http://Imrryr.ORG/~elric/
More information about the krbdev
mailing list