[SSSD] SSSD (another) wish-list

Stephen Gallagher sgallagh at redhat.com
Mon Nov 21 15:18:51 UTC 2011


On Mon, 2011-11-21 at 15:10 +0000, John Hodrien wrote:
> On Mon, 21 Nov 2011, Stephen Gallagher wrote:
> 
> > No, this is the entire point I was making. When you're joining the
> > machine, you're doing so with Administrator credentials, not machine
> > credentials. The privilege to change this value is not given to the
> > machine, so it cannot change them later.
> 
> Nearly, but I wouldn't describe it as Administrator credentials.  You're doing
> it with credentials that can join a machine to the domain which is
> significantly less privileged.
> 
> Question is, what *can* a machine do with its own credential?  For example,
> net ads keytab add works using a machine credential (at least it does on the
> AD domain I'm testing against), so it can make service principals and update
> its own ldap record as a result...

Well, I don't know how much of that is happening due to direct
modification of LDAP versus using RPC to initiate a routine to make the
changes. The latter can at least be validated.

Allowing direct access to LDAP attributes means that you have no control
over what they become.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111121/989cc252/attachment.sig>


More information about the sssd-devel mailing list