[OpenAFS] Kerberos 5, AFS, and no krb524d

[Nathan Neulinger]

At one point a while back I wrote code to support krb5 syntax, but didn't get it 
committed at the time since Derrick wanted to hold off.

-- Nathan

On Mon, Jun 09, 2003 at 03:29:28PM -0400, Derek Atkins wrote:
> Oh!  How silly of me.  AFS uses krb4 naming schemes, not krb5 naming
> schemes.  This means that your krb5 principal
> afsadmin/roughneck.liniac.upenn.edu needs to be interted into your
> PTS and BOS UserList as a krb4 name:
> 
>         afsadmin.roughneck.liniac.upenn.edu
> 
> And you need the apprpriate quoting around the embedded periods
> in the name (probably afsadmin.roughneck\.liniac\.upenn\.edu)
> 
> -derek
> 
> Nicholas Henke <henken@seas.upenn.edu> writes:
> 
> > On Mon, 2003-06-09 at 14:19, Douglas E. Engert wrote:
> > > Nicholas Henke wrote:
> > > > 
> > > > On Mon, 2003-06-09 at 11:59, Douglas E. Engert wrote:
> > > > > I think you are asking if the ak5log I have can run with the standard
> > > > > Kerberos krb524 lib and krb524d.
> > > > 
> > > > Sorry for the confusion -- yes that is what I was asking.
> > > > I have gotten ak5log to compile and run -- and it appears to be
> > > > succeeding.
> > > 
> > > Was this with afs/<cell>@<realm> or with afsx/<cell>@<realm>?
> > 
> > afs/roughneck.liniac.upenn.edu@UPENN.EDU -- note that this works for
> > aklog as well as your ak5log. 
> > > 
> > > Is this just an admin problem? 
> > > 
> > > Does it work with an ordinary user?
> > 
> > I am not sure -- I have not been able to even setup the toplevel of the
> > /afs space. So far it is just an admin problem.
> > 
> > > 
> > > You are trying to use a multipart user name, which might be making it harder. 
> > > If you had a principal like henkeadmin@<realm> and gave the AFS user henkeadmin
> > > all privilages and listed it in /usr/afs/etc/UserList, I think that would work.
> > > (Each of our AFS admins has his own account so we dont have a shared afsadmin.)
> > 
> > This would just include the membership in system:administrators and bos
> > adduser ? I have done this for my regular username:
> > 
> > [root@roughneck etc]# bos adduser roughneck.liniac.upenn.edu henken
> > -cell roughneck.liniac.upenn.edu -noauth
> > 
> > [root@roughneck etc]# pts createuser -name henken -cell
> > roughneck.liniac.upenn.edu -noauth
> > User henken has id 2
> > 
> > [root@roughneck etc]# pts adduser henken system:administrators -cell
> > roughneck.liniac.upenn.edu -noauth
> > 
> > [root@roughneck etc]# pts membership henken
> > libprot: a pioctl failed Could not get afs tokens, running
> > unauthenticated.
> > Groups henken (id: 2) is a member of:
> >   system:administrators
> > 
> > After this I stop the running bosserver -noauth, kill it and start afs.
> > 
> > enken@roughneck henken $ klist
> > Ticket cache: FILE:/tmp/krb5cc_27659
> > Default principal: henken@UPENN.EDU
> > 
> > Valid starting     Expires            Service principal
> > 06/09/03 14:26:30  06/10/03 00:26:27  krbtgt/UPENN.EDU@UPENN.EDU
> > 
> > 
> > Kerberos 4 ticket cache: /tmp/tkt27659
> > klist: You have no tickets cached
> > henken@roughneck henken $ aklog -d
> > Authenticating to cell roughneck.liniac.upenn.edu (server
> > roughneck.liniac.upenn.edu).
> > We've deduced that we need to authenticate to realm UPENN.EDU.
> > Getting tickets: afs/roughneck.liniac.upenn.edu@UPENN.EDU
> > About to resolve name henken to id in cell roughneck.liniac.upenn.edu.
> > Id 2
> > Set username to AFS ID 2
> > Setting tokens. AFS ID 2 /  @ UPENN.EDU
> > 
> > 
> > henken@roughneck henken $ bos listusers roughneck.liniac.upenn.edu
> > SUsers are: afsadmin.roughneck.liniac.upenn.edu henken
> > 
> > henken@roughneck henken $ bos listkeys roughneck.liniac.upenn.edu
> > bos: you are not authorized for this operation error encountered while
> > listing keys
> > 
> > > 
> > > If you must use the multpart name, I don't think it gets converted
> > > like you might want. The krb524d appears to eventially call the 
> > > krb5_524_conv_principal routine, and I don't see afsadmin listed. 
> > 
> > What other information can I provide ? It seems like I get the same
> > errors regardless of the use of ak5log over aklog or vice-versa. They
> > seem to be hitting the same problem.
> > 
> > Nic
> > -- 
> > Nicholas Henke
> > Penguin Herder & Linux Cluster System Programmer
> > Liniac Project - Univ. of Pennsylvania
> > 
> > _______________________________________________
> > OpenAFS-info mailing list
> > OpenAFS-info@openafs.org
> > https://lists.openafs.org/mailman/listinfo/openafs-info
> 
> -- 
>        Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
>        Member, MIT Student Information Processing Board  (SIPB)
>        URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
>        warlord@MIT.EDU                        PGP key available
> _______________________________________________
> OpenAFS-info mailing list
> OpenAFS-info@openafs.org
> https://lists.openafs.org/mailman/listinfo/openafs-info

------------------------------------------------------------
Nathan Neulinger                       EMail:  nneul@umr.edu
University of Missouri - Rolla         Phone: (573) 341-4841
Computing Services                       Fax: (573) 341-4216