Re: [Freeipa-devel] [PATCHES] Implement support for S4U2Proxy delegation in IPA

2011-12-08 Thread Rob Crittenden
Simo Sorce wrote: On Mon, 2011-12-05 at 18:37 -0500, Simo Sorce wrote: On Fri, 2011-12-02 at 10:10 -0500, Simo Sorce wrote: On Fri, 2011-12-02 at 09:27 -0500, Rob Crittenden wrote: Simo Sorce wrote: Hello all, with this set of patches it is possible to allow constrained delegation of

Re: [Freeipa-devel] [PATCHES] Implement support for S4U2Proxy delegation in IPA

2011-12-08 Thread Simo Sorce
On Thu, 2011-12-08 at 16:55 -0500, Rob Crittenden wrote: Simo Sorce wrote: On Mon, 2011-12-05 at 18:37 -0500, Simo Sorce wrote: On Fri, 2011-12-02 at 10:10 -0500, Simo Sorce wrote: On Fri, 2011-12-02 at 09:27 -0500, Rob Crittenden wrote: Simo Sorce wrote: Hello all, with this set of

Re: [Freeipa-devel] [PATCHES] Implement support for S4U2Proxy delegation in IPA

2011-12-06 Thread Simo Sorce
On Mon, 2011-12-05 at 18:37 -0500, Simo Sorce wrote: On Fri, 2011-12-02 at 10:10 -0500, Simo Sorce wrote: On Fri, 2011-12-02 at 09:27 -0500, Rob Crittenden wrote: Simo Sorce wrote: Hello all, with this set of patches it is possible to allow constrained delegation of

Re: [Freeipa-devel] [PATCHES] Implement support for S4U2Proxy delegation in IPA

2011-12-05 Thread Simo Sorce
On Fri, 2011-12-02 at 10:10 -0500, Simo Sorce wrote: On Fri, 2011-12-02 at 09:27 -0500, Rob Crittenden wrote: Simo Sorce wrote: Hello all, with this set of patches it is possible to allow constrained delegation of credentials so that a service can impersonate a user when [..]

Re: [Freeipa-devel] [PATCHES] Implement support for S4U2Proxy delegation in IPA

2011-12-02 Thread Rob Crittenden
Simo Sorce wrote: Hello all, with this set of patches it is possible to allow constrained delegation of credentials so that a service can impersonate a user when communicating with another service w/o requiring the user to actually forward their TGT. This makes for a much better method of

Re: [Freeipa-devel] [PATCHES] Implement support for S4U2Proxy delegation in IPA

2011-12-02 Thread Simo Sorce
On Fri, 2011-12-02 at 09:27 -0500, Rob Crittenden wrote: Simo Sorce wrote: Hello all, with this set of patches it is possible to allow constrained delegation of credentials so that a service can impersonate a user when [..] In the third patch in ipadb_get_delegation_acl() you can just