#
# Temporarily disable anonymity in kadmin (kadmin -n).
#
# This feature currently doesn't work with Solaris rpcsec_gss.
# Fails in gss_acquire_cred, because desired_name
#
# The patch removes -n option from kadmin and its man pages and
# skips kadmin tests in t_pkinit.py.
#
# Support can be added later, if there is demand for it.
# This fix would need to either call gss_acquire_cred with empty desired name
# or disregard realm when matching desired name.
# Either way, rpcsec.so code would need to be adjusted too to accommodate this
# change.
#
# This patch is Solaris specific and not intented for upstream contribution.
# Patch source: in-house
#
@@ -268,7 +268,7 @@ kadmin_startup(int argc, char *argv[], char **request_out, char ***args_out)
}
while ((optchar = getopt(argc, argv,
- "+x:r:p:knq:w:d:s:mc:t:e:ON")) != EOF) {
+ "+x:r:p:kq:w:d:s:mc:t:e:ON")) != EOF) {
switch (optchar) {
case 'x':
db_args_size++;
@@ -37,7 +37,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
[\fB\-r\fP \fIrealm\fP]
[\fB\-p\fP \fIprincipal\fP]
[\fB\-q\fP \fIquery\fP]
-[[\fB\-c\fP \fIcache_name\fP]|[\fB\-k\fP [\fB\-t\fP \fIkeytab\fP]]|\fB\-n\fP]
+[[\fB\-c\fP \fIcache_name\fP]|[\fB\-k\fP [\fB\-t\fP \fIkeytab\fP]]]
[\fB\-w\fP \fIpassword\fP]
[\fB\-s\fP \fIadmin_server\fP[:\fIport\fP]]
[command args...]
@@ -99,21 +99,6 @@ a password. In this case, the default principal will be
Use \fIkeytab\fP to decrypt the KDC response. This can only be used
with the \fB\-k\fP option.
.TP
-.B \fB\-n\fP
-Requests anonymous processing. Two types of anonymous principals
-are supported. For fully anonymous Kerberos, configure PKINIT on
-the KDC and configure \fBpkinit_anchors\fP in the client\(aqs
-\fIkrb5.conf(5)\fP\&. Then use the \fB\-n\fP option with a principal
-of the form \fB@REALM\fP (an empty principal name followed by the
-at\-sign and a realm name). If permitted by the KDC, an anonymous
-ticket will be returned. A second form of anonymous tickets is
-supported; these realm\-exposed tickets hide the identity of the
-client but not the client\(aqs realm. For this mode, use \fBkinit
-\-n\fP with a normal principal name. If supported by the KDC, the
-principal (but not realm) will be replaced by the anonymous
-principal. As of release 1.8, the MIT Kerberos KDC only supports
-fully anonymous operation.
.B \fB\-c\fP \fIcredentials_cache\fP
Use \fIcredentials_cache\fP as the credentials cache. The
cache should contain a service ticket for the \fBkadmin/ADMINHOST\fP
@@ -73,15 +73,16 @@ if '97:' in out:
fail('auth indicators seen in anonymous PKINIT ticket')
# Test anonymous kadmin.
-f = open(os.path.join(realm.testdir, 'acl'), 'a')
-f.write('WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS a *')
-f.close()
-realm.run([kadmin, '-n', 'addprinc', '-pw', 'test', 'testadd'])
-out = realm.run([kadmin, '-n', 'getprinc', 'testadd'], expected_code=1)
-if "Operation requires ``get'' privilege" not in out:
- fail('Anonymous kadmin has too much privilege')
+#f = open(os.path.join(realm.testdir, 'acl'), 'a')
+#f.write('WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS a *')
+#f.close()
+#realm.run([kadmin, '-n', 'addprinc', '-pw', 'test', 'testadd'])
+#out = realm.run([kadmin, '-n', 'getprinc', 'testadd'], expected_code=1)
+#if "Operation requires ``get'' privilege" not in out:
+# fail('Anonymous kadmin has too much privilege')
+sys.stderr.write("Anonymous pkinit support in kadmin disabled, skipping...\n");
# Test with anonymous restricted; FAST should work but kvno should fail.
r_env = realm.special_env('restrict', True, kdc_conf=restrictive_kdc_conf)