[OpenAFS] Re: foreign-realm members of system:administrators have weakened powers?

[Adam Megacz]

Jeffrey Hutzelman <jhutz@cmu.edu> writes:
>>>> using my "main" principal -- I executed these commands while holding
>>>> tokens for megacz@megacz.com in cell research.cs.berkeley.edu:
>>>>   $ pts creategroup project.sbp system:administrators -cell
>>>> research.cs.berkeley.edu   pts: Permission denied ; unable to create
>>>> group project.sbp with id 0 owned by 'system:administrators'
>>
>>> Since you've shown that megacz@megacz.com is clearly a member of s:a,
>>> my first guess is that for some reason your request was not really
>>> authenticated as megacz@megacz.com.  I suggest looking at the logs;
>>> there should be a log message corresponding to the attempt which will
>>> tell you the parameters used and who the ptserver actually thought you
>>> were.
>
> No; I think you're just not running with enough debugging.
> The interesting message happens at LogLevel >= 25.

megacz@maxwell:~$kinit megacz@MEGACZ.COM
Please enter the password for megacz@MEGACZ.COM: 
megacz@maxwell:~$aklog -c research.cs.berkeley.edu
megacz@maxwell:~$pts creategroup project.test system:administrators -cell research.cs.berkeley.edu
pts: Permission denied ; unable to create group project.test with id 0 owned by 'system:administrators'

Fri Jan 27 05:58:36 2006 Set Debug On level = 25
Fri Jan 27 05:58:37 2006 recovery running in state 1f
Fri Jan 27 05:58:41 2006 recovery running in state 1f
Fri Jan 27 05:58:45 2006 recovery running in state 1f
Fri Jan 27 05:58:49 2006 recovery running in state 1f
Fri Jan 27 05:58:53 2006 recovery running in state 1f
Fri Jan 27 05:58:57 2006 recovery running in state 1f
Fri Jan 27 05:58:58 2006 allbetter checking
Fri Jan 27 05:58:58 2006 allbetter: returning 1
Fri Jan 27 05:58:58 2006 allbetter checking
Fri Jan 27 05:58:58 2006 allbetter: returning 1
Fri Jan 27 05:58:58 2006 allbetter checking
Fri Jan 27 05:58:58 2006 allbetter: returning 1
Fri Jan 27 05:58:58 2006 allbetter checking
Fri Jan 27 05:58:58 2006 allbetter: returning 1
Fri Jan 27 05:58:58 2006 allbetter checking
Fri Jan 27 05:58:58 2006 allbetter: returning 1
Fri Jan 27 05:58:58 2006 allbetter checking
Fri Jan 27 05:58:58 2006 allbetter: returning 1
Fri Jan 27 05:59:01 2006 recovery running in state 1f
Fri Jan 27 05:59:05 2006 recovery running in state 1f
Fri Jan 27 05:59:09 2006 recovery running in state 1f
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 allbetter checking
Fri Jan 27 05:59:10 2006 allbetter: returning 1
Fri Jan 27 05:59:10 2006 PTS_NewEntry: code 267269 cid -204 aid -1212129404 aname project.test oid -204