[EMAIL PROTECTED] (Niels M�ller) writes: > Simon Josefsson <[EMAIL PROTECTED]> writes: > >> Right, what I was looking for was something similar to >> >> connection->user = USER_LOOKUP(self->gssapi->db, authid, authzid); >> >> where authid was the GSS authenticated user (e.g., "jas") and authzid >> the username received from the first USERAUTH_REQUEST (e.g., >> "root"). > > lshd cares only about the username provided in the USERAUTH_REQUEST, > and the passwd-information (uid, loginshell, etc) in the user object > returned by the userauth method. These are generally expected to > match.
One problem is that the GSSAPI document allows the field to be empty, to provide anonymous usage. Fortunately, OpenSSH doesn't support this though. > For the case of a user, "jas", logging in as root (for kerberos, that > means that "jas" is listed in a file in root's home directory, IIRC), > I would expect the USERAUTH_REQUEST to request login for "root", and > the information that you want to use tickets belonging to "jas" should > be somewhere inside the gss-api or kerberos messages, and then I can > view it as an internal detail of the gss-api mechanism. Checking that > "jas" is allowed to login as root should be the resposibility of the > gss-api userauth method. OK. This is almost how it works now. Only Heimdal/MIT support it, via the kuserok function. When GSS is used, one is only allowed to log on as the authenticated username. Thanks, Simon _______________________________________________ lsh-bugs mailing list [EMAIL PROTECTED] http://lists.lysator.liu.se/mailman/listinfo/lsh-bugs
