Question about excluding the PAC

[Mark Pröhl]

Hi,

I wonder what kind of Kerberos infrastructure is providing the PAC. In
case of Active Directory you typically can get rid of the pac by
modifying the service account that is associated with the HTTP
principal. This only affects tickets for that particular service.
Maybe your implementation on Linux offers a similar way?

Regards,

Mark Pröhl

On 1/25/19 10:56 PM, Schwartz, John wrote:
> All, I have a Kerberos 5 implementation running on Linux and is integrated with the web server for website SSO access.
> 
> I have a need to exclude the PAC from the request ticket and am looking for the simplest way to do that.
> 
> I see that kinit has the option "--no-request-pac"
> 
> Is there a similar way to do it from the krb5.conf or does it need a custom shared object?
> 
> If it needs a custom shared object, can someone provide sample code?  I am not able to tell from the existing documentation what needs to be done.
> 
> Any assistance is greatly appreciated.
> 
> Thank you,
> 
> Anthem, Inc.
> 
> 
> 
> John Schwartz,  Exec Advisor, Authentication Services
> 21555 Oxnard St., Woodland Hills, California 91367
> O: (818) 234-6763 |
> john.schwartz at anthem.com
> 
> 
> 
> 
> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is
> for the sole use of the intended recipient(s) and may contain confidential
> and privileged information or may otherwise be protected by law. Any
> unauthorized review, use, disclosure or distribution is prohibited. If you
> are not the intended recipient, please contact the sender by reply e-mail
> and destroy all copies of the original message and any attachment thereto.
> _______________________________________________
> krbdev mailing list             krbdev at mit.edu
> https://mailman.mit.edu/mailman/listinfo/krbdev
>