Ross Smith <[email protected]> writes:
> We would like to restrict certain acls to only reload certain hosts. I
> have a local patch to allow ldap-group acls. An example of what I'd
> like to setup is have members of the group foo-reloaders only be able to
> autocreate acls for hosts with fqdn matching ^bar*.engin.umich.edu. Is
> there an easy way to do this with wallet as is? or how much work would
> it be to implement something like this?
The intent is for you to be able to do that with the default_owner
callback in the wallet configuration file. Something basically like this:
sub default_owner {
my ($type, $name) = @_;
if ($type eq 'keytab' and $name =~ /^bar.*\.engin\.umich\.edu/) {
# or whatever the syntax for your ldap-group ACL scheme is
return ('foo-reloaders', [ 'ldap-group', 'foo-reloaders' ]);
} else {
return;
}
}
For more information see the DEFAULT OWNERS section of Wallet::Config.
--
Russ Allbery ([email protected]) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
