Re: [OpenAFS] host principal and keytab

[Jeffrey Altman]

You aren't confusing me. A Kerberos v4 principal only has a server name and an instance. When the Kerberos v5 principal is received by the AFS servers it will be translated to the equivalent Kerberos v4 principal. It does that by replacing '/' with '.' and stripping all but the first component of the server name.

Jeffrey Altman


Andrew Bacchi wrote:

You can use the server logs to debug this. I really need to get around to adding the PTS WhoAmI RPC.

It doesn't have permissions as rcmd.server, either.

sorry to confuse you, but the K5 host principal also has the .net in it,
my typo.  Let's just say the principal matches the PTS entry.

Do I need to make a 524 conversion?

Jeffrey Altman wrote:

I said what I said for a reason.

rcmd.server.net != rcmd.server

Andrew Bacchi wrote:

I'm still going around with this one. I can't seem to get the acl right on the directory. I've tried setting the acl with each of the following, but I cannot list files in that directory.

rcmd.server.net rlidw
host/server.net rlidw
host/server.net.rpi.edu rlidw



the PTS entry is rcmd.server.net

What am I doing wrong?

Thanks

Jeffrey Altman wrote:

I do get K5 tickets with kinit -k, and AFS tokens with aklog in the form host/[EMAIL PROTECTED]

Andrew Bacchi wrote:

The PTS entry is the part I missed so far. To clarify, the K4 principal should look like [EMAIL PROTECTED], not [EMAIL PROTECTED], correct?

The PTS entry will be "rcmd.server", the Kerberos v4 principal will be "[EMAIL PROTECTED]", and the Kerberos v5 principal is "host/[EMAIL PROTECTED]"

smime.p7s
Description: S/MIME Cryptographic Signature