[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Bug in kinit and afslog
On Aug 1, 2007, at 13:24 , Alf Wachsmann wrote:
> On Wed, 1 Aug 2007, Brandon S. Allbery KF8NH wrote:
>> On Aug 1, 2007, at 12:56 , Alf Wachsmann wrote:
>>> when I obtain an AFS token from my account (alfw; UID 5828) for
>>> an account
>>> with a different Unix UID (vanilla; UID 1820), the resulting AFS
>>> token has
>>> the wrong UID stored in it (my own instead of vanilla's) even
>>> though the credential in that token belongs to the other account.
>>
>> This is expected behavior. OpenAFS's aklog does a round-trip with
>> the AFS ptserver to find the correct PTS id; this isn't necessary
>> to create a token, and heimdal avoids dependencies on AFS
>> libraries (even to the extent of providing its own absolutely
>> minimal AFS syscall wrapper), so it cheats and assumes the current
>> uid is correct.
>
> Maybe it would be better to put the principal name in the token
> instead of the potentially completely wrong UID?
I have this vague recollection of stuff checking that it starts with
"AFS ID ", and I'm not sure there is enough room after that for a
principal name (especially with an instance).
--
brandon s. allbery [solaris,freebsd,perl,pugs,haskell] allbery@kf8nh.com
system administrator [openafs,heimdal,too many hats] allbery@ece.cmu.edu
electrical and computer engineering, carnegie mellon university KF8NH