On Feb 3, 2010, at 21:40, Owen O'Malley wrote:
> We're adding Kerberos security to Apache Hadoop (hadoop.apache.org),
> which is an open source petabyte-scale distributed file system and
> MapReduce implementation. Since MapReduce includes running
> distributed jobs, we need to map the authenticated names to local OS
> names. Within Kerberos this seems to be done by
> krb5_aname_to_localname. Unfortunately, that method doesn't seem to be
> exported via a public API or a CLI tool.
Looking at the 1.7.1 source tarball, I do see krb5_aname_to_localname in the
symbol export list file that should get used to build the library. Are you
unable to link against it on some system?
You are correct that no CLI tool is shipped for examining the mapping. Perhaps
you can do something with the attached, rather hastily written script (assuming
it doesn't get stripped out by the mail server).
Ken
--
Ken Raeburn / [email protected] / no longer at MIT Kerberos Consortium
from ctypes import *
libkrb5 = cdll.LoadLibrary("libkrb5.so.3")
princname = "[email protected]"
def fatal(err, what):
msg = "error " + str(err)
get_msg = libkrb5.krb5_get_error_message
get_msg.argtypes = [c_void_p, c_int]
get_msg.restype = c_char_p
if (ctx):
msg = msg + " (" + get_msg(ctx, err) + ")"
print msg, what
exit(1)
ctx = c_void_p()
init = libkrb5.krb5_init_context
init.argtypes = [POINTER(c_void_p)]
ret = init(byref(ctx))
if ret:
fatal(ret, "initializing")
princ = c_void_p()
parse = libkrb5.krb5_parse_name
parse.argtypes = [c_void_p, c_char_p, POINTER(c_void_p)]
ret = parse(ctx, princname, byref(princ))
if ret:
fatal(ret, "parsing")
local = libkrb5.krb5_aname_to_localname
local.argtypes = [c_void_p, c_void_p, c_int, c_char_p]
buf = create_string_buffer('a' * 300)
ret = local(ctx, princ, 300, buf)
if ret:
fatal(ret, "making local")
print "local name = '" + buf.value + "'"
________________________________________________
Kerberos mailing list [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
