Re: Fw: SSO with telnet/rlogin/rsh

2008-01-28 Thread Ido Levy
Hello, We are trying to compile nfs-utils-1.0.11 on RHEL 5.1 and get the following error: configure: error: Unable to locate information required to use librpcsecgss. If you have pkgconfig installed, you might try setting environment variable PKG_CONFIG_PATH to /usr/local/lib/pkgconfig We have

Heimdal krb5.conf sections

2008-01-28 Thread Victor Sudakov
Colleagues, According to the man page, some options such as ticket_lifetime, renew_lifetime etc can be used both in the [appdefaults] and [libdefaults] sections. What is the difference between the usages? TIA. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/[EMAIL PROTECTED] http://vas.tomsk.r

Re: support SSO in Windows with Keberos TGT

2008-01-28 Thread Jeffrey Altman
Eswar S wrote: On Vista the MSLSA: cache is read-write provided you do not use the binaries provided by MIT. KFW 3.2.2 was built incorrectly and the MIT distribution treats the Vista MSLSA: cache as read-only. I want to update/add my credentials to Microsoft (windows XP & VISTA &win2k

RE: Kerberos delegation on Windows Vista LSA

2008-01-28 Thread Tim Alsop
Speedo, This is due to a bug in Vista that will be fixed in SP1. There is a hotfix available for pre-SP1. If you turn off UAC or use an account which is not an administrator you don't need any fix. The hotfix is described at http://support.microsoft.com/kb/942219/en-us Thanks, Tim -Original

Re: Kerberos delegation on Windows Vista LSA

2008-01-28 Thread Speedo
Thanks a lot, I'll try it tomorrow. Speedo On Jan 28, 9:59 pm, "Tim Alsop" <[EMAIL PROTECTED]> wrote: > Speedo, > > This is due to a bug in Vista that will be fixed in SP1. There is a > hotfix available for pre-SP1. If you turn off UAC or use an account > which is not an administrator you don't n

Kerberos delegation on Windows Vista LSA

2008-01-28 Thread Speedo
Hi Guys I have a program doing Kerberos on Windows. The program generates all Kerberos packets itself but will sometimes retrieve tickets from the LSA cache so that user needn't type in the windows password. Before WIndows Vista, if I have to go delegation, I need a forwardable TGT to put into a K

Re: Heimdal krb5.conf sections

2008-01-28 Thread Russ Allbery
Victor Sudakov <[EMAIL PROTECTED]> writes: > According to the man page, some options such as ticket_lifetime, > renew_lifetime etc can be used both in the [appdefaults] and > [libdefaults] sections. What is the difference between the usages? At least with MIT, [libdefaults] affects the library de

Re: SSPI API to get tokensize for client and server

2008-01-28 Thread Jeffrey Altman
You are using the correct API. Read the documentation. The API will tell you the size of the memory you need to allocate. Manoj Mohan wrote: Yeah thats true.. so how do I ensure that it works generically. I was hoping to call some API which will help me to do that. Is there one ? Manoj In

SSPI API to get tokensize for client and server

2008-01-28 Thread Manoj Mohan
Hi, Right now I am calling InitializeSecurityContext and AcceptSecurityContext with fixed token size (4096) and things are working. I was wondering if I can call QueryContextAttributes or some other function to get the right value rather than using a fixed value? For example, I am using using Ac

Re: Heimdal krb5.conf sections

2008-01-28 Thread Love Hörnquist Åstrand
28 jan 2008 kl. 19.15 skrev Russ Allbery: > Victor Sudakov <[EMAIL PROTECTED]> writes: > >> According to the man page, some options such as ticket_lifetime, >> renew_lifetime etc can be used both in the [appdefaults] and >> [libdefaults] sections. What is the difference between the usages? > > At

Re: SSPI API to get tokensize for client and server

2008-01-28 Thread Jeffrey Altman
that code will only work if the generated token is 4096 bytes or smaller. Manoj Mohan wrote: Hi, Right now I am calling InitializeSecurityContext and AcceptSecurityContext with fixed token size (4096) and things are working. I was wondering if I can call QueryContextAttributes or some other fun

Re: SSPI API to get tokensize for client and server

2008-01-28 Thread Markus Moeller
Check the global flags. You should be able to set ASC_REQ_ALLOCATE_MEMORY Markus "Manoj Mohan" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > > Hi, > > Right now I am calling InitializeSecurityContext and AcceptSecurityContext > with fixed token size (4096) > and things are workin

wallet 0.6 released

2008-01-28 Thread Russ Allbery
I'm pleased to announce release 0.6 of wallet. This is beta-quality software and should be treated with caution. It is currently being tested for production deployment at Stanford. The wallet is a system for managing secure data, authorization rules to retrieve or change that data, and audit rul

Re: Kerberized authorization service

2008-01-28 Thread Jos Backus
On Sun, Jan 27, 2008 at 11:35:01AM +1300, [EMAIL PROTECTED] wrote: > Hm, yes, I see where you are coming from. > > I think this is an area where the OSS world has the infrastructure, but > not the details to pull off what you want. I am personally a bit loathe to > suggest adding yet another servi

Re: Kerberized authorization service

2008-01-28 Thread Edward Murrell
Howdy... Something like remctl (I personally have not touched it) would be a good start, since it's essentially a remote execution engine. If you did a sandboxed remctl server to get this started, you could (hopefully) replace the remctl server with a C server running on a dedicated port. I harp