On Fri, 2014-06-13 at 14:43 +0000, Xie, Hugh wrote:
Hi,
We are looking at way to forward authenticate from a window client to
a HTTP based middle tier (internal to our organization) to a third
party database. We want the middle tier to impersonate the window
client id and pass the Kerberos authentication to the database. Below
is a webpage on this double hop scheme on window.
http://blogs.technet.com/b/askds/archive/2008/06/13/understanding-kerbero...
If gss-proxy support such scheme, can someone post code snippet (C/C
++) for the middle tier.
Hi Xie,
GSS-Proxy supports impersonation when using a local keytab, but not yet
the full delegation flow.
However GSS-Proxy is not necessary for simple s4u2proxy use.
You can find an example implementation here:
https://github.com/krb5/krb5/blob/master/src/tests/gssapi/t_s4u2proxy_krb5.c
HTH,
Simo.
--
Simo Sorce * Red Hat, Inc * New York