On Tue, 13 Sep 2011 17:07:28 -0400
Russell Bryant <rbryant(a)redhat.com> wrote:
On 09/13/2011 04:57 PM, Adam Stokes wrote:
> - Verify k5start exists
> - Run k5start and check the top most principal (without
> this we would need to probably do some regexing through the
> klist to attempt to find which principal we want)
> - This will re-initialization *existing* kerberos tickets without
> need for password.
> - Actually show none connection options as a result of more
> kerberos work
>
> Signed-off-by: Adam Stokes<astokes(a)fedoraproject.org>
> ---
> src/lib/mh_agent.cpp | 27 +++++++++++++++++++++++++--
> 1 files changed, 25 insertions(+), 2 deletions(-)
>
> diff --git a/src/lib/mh_agent.cpp b/src/lib/mh_agent.cpp
> index bb1a9b6..00cafda 100644
> --- a/src/lib/mh_agent.cpp
> +++ b/src/lib/mh_agent.cpp
> @@ -232,8 +232,7 @@ int print_help(int code, const char *name,
> const char *arg, void *userdata) printf("\nOptions:\n");
> printf("\t-h | --help print this help
> message.\n"); for (lpc = 0; lpc< DIMOF(matahari_options); lpc++) {
> - if (matahari_options[lpc].callback
> -&& matahari_options[lpc].callback != connection_option) {
> + if (matahari_options[lpc].callback) {
> printf("\t-%c | --%-10s\t%s\n",
> matahari_options[lpc].code, matahari_options[lpc].long_name,
> matahari_options[lpc].description); }
I agree with this change. The old code was obviously very
intentional, but I don't know why.
beekhof: do you remember why the connection options were suppressed
from the help output?
> @@ -249,6 +248,16 @@ mh_connect(OptionsMap mh_options, OptionsMap
> amqp_options, int retry) int backoff = 0;
> GList *srv_records = NULL, *cur_srv_record = NULL;
> struct mh_dnssrv_record *record;
> + GError *error = NULL;
> + gboolean ret;
> + const gchar *k5start_bin[] = {
> + "/usr/bin/k5start",
> + "-f",
> + "/etc/krb5.keytab",
> + "-K",
> + "10",
> + "-U",
> + };
>
I'm pretty sure here has to be a NULL terminator in this array.
Yep, always
forget the damn NULL :\
> if (!mh_options.count("servername") ||
> mh_options.count("dns-srv")) { /*
> @@ -320,6 +329,20 @@ mh_connect(OptionsMap mh_options, OptionsMap
> amqp_options, int retry) }
> }
> }
> + /* Attempt to initiate k5start for credential renewal's
> without prompting for a
> + * password each time an agent is run
> + */
> + if (mh_options.count("sasl-mechanism")) {
Are there any other uses of sasl-mechanism that are not kerberos?
Link to
implementations for cyrus-sasl
http://asg.web.cmu.edu/sasl/sasl-library.html
This is the Cyrus SASL API implentation. It can be used on the client or server side to
provide authentication. See RFC 2222 for more information.
The following "core" mechanisms are included in this distribution:
ANONYMOUS
CRAM-MD5
PLAIN
GSSAPI (MIT Kerberos 5 or Heimdal Kerberos 5)
DIGEST-MD5
The distribution also includes these mechanisms:
LOGIN
SRP
NTLM
OTP
KERBEROS_V4
As far as the core mechanisms go gssapi is really the only major one we
worry about.
> + if (g_file_test(k5start_bin[0],
> G_FILE_TEST_IS_EXECUTABLE)) {
> + mh_info("Running k5start");
mh_trace() ?
Will fix.
> + ret = g_spawn_async(NULL, (gchar **) k5start_bin,
> NULL, G_SPAWN_SEARCH_PATH,
> + NULL, NULL, NULL,&error);
Just make the array non-const so you don't have to cast.
Then I get string warning in c++ :\
Also, this will result in every agent running k5start. Is that a
problem?
Shouldn't be.