Review of Projects/Kadmin hook interface

[Russ Allbery]

Nicolas Williams <Nicolas.Williams at oracle.com> writes:
> On Mon, Sep 27, 2010 at 11:32:30AM -0700, Russ Allbery wrote:

>> I would also document how this module is called if the key is being
>> randomized (if at all).  It would probably be best to add a separate
>> interface that gets all of the keys, although in my specific use case
>> (propagation to Active Directory), there isn't anything one can really
>> do about a randomized key other than randomizing the password in Active
>> Directory (to something unrelated to the new randomized key).

> Why not just do password change with randomized password, so that way
> you have a password you can synchronize?  This is basically what AD
> does too.

That of course is fine and for that you can just use the chpass
interface.  But that's not the operation performed by cpw -randkey.  A
generic plugin interface should, at least eventually, have hooks for all
the actions that kadmin may perform.

>> For a complete interface, you probably also want to add rename and
>> chpass_with_key.  I didn't have those in my Heimdal hooks for the same
>> reason I didn't have remove: I didn't need them for my immediate
>> problem and hadn't had time to work on the broader issue.

> What is chpass_with_key?

Rather than getting the new password as an argument, you get a key
instead, possibly because that's what the client sent you.  I think the
MIT API equivalent is kadm5_setkey_principal_3.

> Does renaming principals work nowadays?

I don't know.  There's an API for it in both MIT and Heimdal, though.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>