Question about excluding the PAC

[Schwartz, John]

Thank you Greg.  I have access to the server but do not have access to the direct source code and am using the standard build.  I had been reading that custom plugins can be created and referenced in the krb5.conf but am a little lost on the what libraries (for instance) need to be included in the source code in order for me to use a certain function.

Thank you for your input.

BTW, do you know how I can validate what exact version I am using?

Thanks,

Anthem, Inc.

John Schwartz,  Exec Advisor, Authentication Services
21555 Oxnard St., Woodland Hills, California 91367
O: (818) 234-6763 |
john.schwartz at anthem.com



-----Original Message-----
From: Greg Hudson [mailto:ghudson at mit.edu]
Sent: Friday, January 25, 2019 2:57 PM
To: Schwartz, John <John.Schwartz at anthem.com>; krbdev at mit.edu
Subject: Re: Question about excluding the PAC

On 1/25/19 4:56 PM, Schwartz, John wrote:
> I see that kinit has the option "--no-request-pac"
>
> Is there a similar way to do it from the krb5.conf or does it need a custom shared object?

There is no krb5.conf variable, but if you have control of the web server C code which invokes krb5_get_init_creds_password(), you can do it via a get_init_creds option.  The relevant functions are:

https://urldefense.proofpoint.com/v2/url?u=https-3A__web.mit.edu_kerberos_krb5-2Dlatest_doc_appdev_refs_api_krb5-5Fget-5Finit-5Fcreds-5Fopt-5Falloc.html&d=DwICaQ&c=A-GX6P9ovB1qTBp7iQve2Q&r=9ggArrKwg0XCMk2h_JcalRiGjZ1d7o1PDuo5y6VpEPI&m=RRh003L56FmOmyBd01FGTDj32JQhUsbqPyDZ8sVmx4g&s=GzC0KwfTszsvNULTUa5vnT5FaP0O5iGanmYf_ww1c58&e=
https://urldefense.proofpoint.com/v2/url?u=https-3A__web.mit.edu_kerberos_krb5-2Dlatest_doc_appdev_refs_api_krb5-5Fget-5Finit-5Fcreds-5Fopt-5Fset-5Fpac-5Frequest.html&d=DwICaQ&c=A-GX6P9ovB1qTBp7iQve2Q&r=9ggArrKwg0XCMk2h_JcalRiGjZ1d7o1PDuo5y6VpEPI&m=RRh003L56FmOmyBd01FGTDj32JQhUsbqPyDZ8sVmx4g&s=ovIfMY5-lifO7uxaCicFYtgr30iAA5CagslsGu9AIvk&e=
https://urldefense.proofpoint.com/v2/url?u=https-3A__web.mit.edu_kerberos_krb5-2Dlatest_doc_appdev_refs_api_krb5-5Fget-5Finit-5Fcreds-5Fopt-5Ffree.html&d=DwICaQ&c=A-GX6P9ovB1qTBp7iQve2Q&r=9ggArrKwg0XCMk2h_JcalRiGjZ1d7o1PDuo5y6VpEPI&m=RRh003L56FmOmyBd01FGTDj32JQhUsbqPyDZ8sVmx4g&s=WfY7aU37kADulO2likAkxKYH4mjT7GIdHBJtmtvo4cc&e=

Note that this option is new in release 1.15.

CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is
for the sole use of the intended recipient(s) and may contain confidential
and privileged information or may otherwise be protected by law. Any
unauthorized review, use, disclosure or distribution is prohibited. If you
are not the intended recipient, please contact the sender by reply e-mail
and destroy all copies of the original message and any attachment thereto.