ANAME_DB re-enable with patch.

[Roland C. Dowdeswell]

On Thu, Sep 02, 2010 at 01:48:39PM -0400, Sam Hartman wrote:
>

> I support some interface to do lookups for aname_to_lname that is
> database driven.  Like Greg, additional uses of the bdb in the tree
> sholud be avoided.
> 
> I'd be happy with any of:
> 
> * system db (assuming system DBs can be in the same process with ours on
>   at least some common OSes we build for)
> 
> * sqlite
> * tdb 
> * LDAP

LDAP, we should be a little careful about.  Given that currently,
krb5_kuserok() does not cause any network dependent services that
can return transient failures and cannot block [for long] if you
are running on a local file system, this could change the expectations
of callers about how krb5_kuserok() actually works.  This is not
to say that it shouldn't be done---but there are gotchas in taking
a function call that returns explicit and correct results and adding
in a network backend such as LDAP without also changing the API to
allow for transient failures to occur in a way that calling
applications can understand and cope with.

Another idea that I've had might be to change krb5_kuserok() to
krb5_kticketok() which would evaluate whether a ticket is allowed
to access a luser's account.  This would enable us to use the
authorisation data section of a ticket to provide said authorisation.
(Longer term thought process, though.)

--
    Roland Dowdeswell                      http://Imrryr.ORG/~elric/