Re: auth_to_local

I am not sure if I understand the rules. I have two domains which trust each
other and I'd like to avoid the use of a .k5login to allow a user of one
domain to login into a system of the other. Can I do the following ?

On a host server.a.com can I have a config file like:

[libdefaults]
default_realm = A.COM

[realms]
A.COM = {
kdc = kdc.a.com
admin_server = kdc.a.com
auth_to_local = {
RULE:[1:$1](.*@A.COM)s/@.*/-a/
DEFAULT
}
}
B.COM = {
kdc = kdc.b.com
admin_server = kdc.b.com
auth_to_local = {
RULE:[1:$1](.*@B.COM)s/@.*/-b/
DEFAULT
}
}
[domain_realm]
.a.com = A.COM
.b.com = B.COM

which maps a user@xxxxx to user-a and a user@xxxxx to user-b ? I am also
not sure if I login as user@xxxxx on server.a.com will the realm section for
A.COM be used or the section for B.COM ?

Is there a way to debug/test the rules ?

Thank you
Markus


"Russ Allbery" <rra@xxxxxxxxxxxx> wrote in message
news:87veoc71xu.fsf@xxxxxxxxxxxxxxxxxxxxxxxx
Markus Moeller <huaraz@xxxxxxxxxxxxxxxx> writes:

Is there anywhere a documentation of how to use RULES with auth_to_local
?

Yeah, it's in the info documentation, in the krb5-admin doc under
Configuration Files / krb5.conf / realms.

--
Russ Allbery (rra@xxxxxxxxxxxx) <http://www.eyrie.org/~eagle/>


.

Relevant Pages

  • Re: pam_krb5 cant locate my KDC
    ... So you need to have 3 sections in your krb5.conf - libdefaults, realms and domain_realms. ... Normally they do provide a template for the Kerberos config file with the installation for every OS. ... I was just trying pam_krb5 for kicks but it can't find my KDC. ...
    (comp.protocols.kerberos)
  • Re: Seeking KDC Priority/Weight Clarification/Recommendation
    ... I do not have detailed information on the behaviors of each level of our authentication stack, but suspect that we were lucky enough that all the upstream kerb consumers were hitting the downed kdc, only. ... So if you're getting random or rotating ordering of address records returned, then with one server of four unreachable, one quarter of the time you should see a delay of a second. ... libdefault section & a round robin kdc record explicitely defined in the realms section could be problematic - one of our kerb clients doesn't have any kdc entry in their realms section & saw no issues during the hardware failure. ...
    (comp.protocols.kerberos)
  • Re: Problems with authenticating to a Win domain controller
    ... DOMAIN2 is a trusted domain of DOMAIN1 ... Server not found in Kerberos database while getting credentials ... KDC reply did not match expectations while getting credentials ...
    (comp.protocols.kerberos)
  • 5.10 8/05 x86 Samba 3.0.28 AD keytab issues
    ... I do the usual thing that I do on other systems and issue a 'net ads ... kdc = dc01.example.com ...
    (comp.unix.solaris)
  • Kerberos referrals
    ... My understanding is that Kerberos referrals are used to permit cross-realm authentication against remote realms that are not explicitly configured in the client's configuration. ... Of particular interest to me is that the MIT implementation permits referral of requests for unknown realms to a "default" KDC, with the assumption that this other KDC knows what to do with the request. ...
    (comp.protocols.kerberos)