<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
bump for review<br>
<br>
<div class="moz-cite-prefix">On 09.12.2015 21:00, Simo Sorce wrote:<br>
</div>
<blockquote
cite="mid:1892639799.26312584.1449691241103.JavaMail.zimbra@redhat.com"
type="cite">
<pre wrap="">Sent the wrong patch, attached the one that actually compiles.
----- Original Message -----
</pre>
<blockquote type="cite">
<pre wrap="">From: "Simo Sorce" <a class="moz-txt-link-rfc2396E" href="mailto:simo@redhat.com"><simo@redhat.com></a>
To: "Alexander Bokovoy" <a class="moz-txt-link-rfc2396E" href="mailto:abokovoy@redhat.com"><abokovoy@redhat.com></a>
Cc: "Simo Sorce" <a class="moz-txt-link-rfc2396E" href="mailto:simo@redhat.com"><simo@redhat.com></a>, "Jan Cholasta" <a class="moz-txt-link-rfc2396E" href="mailto:jcholast@redhat.com"><jcholast@redhat.com></a>, "freeipa-devel" <a class="moz-txt-link-rfc2396E" href="mailto:freeipa-devel@redhat.com"><freeipa-devel@redhat.com></a>
Sent: Wednesday, December 9, 2015 2:18:23 PM
Subject: Re: [Freeipa-devel] [PATCH 560] Allow to set allowed krb authz data type per user
----- Original Message -----
</pre>
<blockquote type="cite">
<pre wrap="">From: "Alexander Bokovoy" <a class="moz-txt-link-rfc2396E" href="mailto:abokovoy@redhat.com"><abokovoy@redhat.com></a>
To: "Simo Sorce" <a class="moz-txt-link-rfc2396E" href="mailto:simo@redhat.com"><simo@redhat.com></a>
Cc: "Jan Cholasta" <a class="moz-txt-link-rfc2396E" href="mailto:jcholast@redhat.com"><jcholast@redhat.com></a>, "freeipa-devel"
<a class="moz-txt-link-rfc2396E" href="mailto:freeipa-devel@redhat.com"><freeipa-devel@redhat.com></a>
Sent: Tuesday, December 1, 2015 3:07:32 AM
Subject: Re: [Freeipa-devel] [PATCH 560] Allow to set allowed krb authz
data type per user
On Wed, 25 Nov 2015, Simo Sorce wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Wed, 2015-11-25 at 08:09 +0100, Jan Cholasta wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 25.11.2015 00:09, Simo Sorce wrote:
</pre>
<blockquote type="cite">
<pre wrap="">This patch is untested and mostly an RFC.
I think it is all we need to allow to specify authz data types per
user
and by setting the attribute to NONE preventing a user from getting
MS-PAC data in their ticket.
Alexander you changed quite a bit the code around here so I'd like to
know if you think the change I made in the KDC will cause any issue
with
the special PACs we generate for master's principals. As far as I can
tell it shouldn't.
Any opinion is welcome.
</pre>
</blockquote>
<pre wrap="">
Before your change, the server entry was checked for AS requests, now
only the client entry is checked for AS requests. I'm not very familiar
with ipa-kdb, but shouldn't the server entry still be checked as a
fallback when there is no authorization data in the client entry?
</pre>
</blockquote>
<pre wrap="">
This is partly why I CCed Alexander, the way the get function works is
that it will get policy on the entry itself and if nothing is there it
will try with the global policy, so in both cases the global policy is
sourced as fallback.
For AS requests though you are generally asking for a TGT so the
"server" is the krbtgt entry that has no policy. It is through though
that a client *can* ask for a ticket directly via an AS request, that is
uncommon and it is unclear to me what we should do in that case if
client and server have incompatible options.
Well this is why it is a RFC after all :)
</pre>
</blockquote>
<pre wrap="">Can we source global policy for the direct AS request as well?
</pre>
</blockquote>
<pre wrap="">
I think I would do this in a separate patch.
</pre>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">The attribute is exposed in the service plugin, shouldn't it be exposed
in the user plugin as well?
</pre>
</blockquote>
<pre wrap="">
I didn't do it on purpose yet but eventually we may want to expose it,
indeed. The reason I didn't is that we may want to use something like
CoS to populate the attribute based on group membership and I am not
sure we want to expose it per user, up top debate.
</pre>
</blockquote>
<pre wrap="">I don't want to expose it in the config too.
</pre>
</blockquote>
<pre wrap="">
Agreed.
attached find an updated patch as I found a crash bug with the older one in
some situations.
Simo.
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
</blockquote>
<br>
</body>
</html>