[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: krb5_get_init_creds_opt_set_pkinit() API Help
Question for Love at the bottom.
On Jun 18, 2007, at 4:12 AM, Douglas E. Engert wrote:
> Henry B. Hotz wrote:
>> The specific problem I have is how do I prevent the command line
>> prompt generated by this call. I've traced it as far as
>> _krb5_load_id(), but . . .
>> I may not be asking the right list, because the prompt is "PIN
>> code for SCR331 USB Smart Card Reader 0 0:". It may be generated
>> by the OpenSC
>> pkcs11 library
>
> No, it is from Heimdal lib/hx509/ks_p11.c to get the PIN to pass
> to the pkcs11 login.
So, am I interpreting this right: I need to provide a custom
prompter function in order to get the PIN into the pkcs11 interface
code (without actually prompting the user again)?
Thanks for the source pointer. If I break out of the prompt in gdb
the stack trace doesn't show where I really came from.
>> rather than Heimdal, but I still need to suppress it because my
>> login module already has the PIN/password and already knows
>> whether it's a PIN or a password before it enters the Kerberos code.
>> Now I have some other questions about this module:
>> What are the flags? Zero seems to work for me, but why might it
>> be 2 or some other value?
>> Why is the prompter function a required argument, if it's not used?
>
> It should be used, did you pass one?
I passed it the standard posix prompter, since it blows up if you
pass NULL.
> Russ Alberry's pam_krb5 version 3.5 should have an example of using
> this routine with the prompter that worked for GDM to show th "PIN
> code for..."
I also passed it some prompter data. It was ignored, but I never
verified that I gave it the right type.
I'll see if the example answers my questions.
>> Shouldn't there be a config option for the PK ID value (the -C
>> argument to kinit)? In my case it's an interface library for a
>> card reader, it ought to default to some value for a given system.
>
> The pam_krb5 would look in itsargs or for [appdefaults] pkinit_user =
> I don't think kinit has a default.
Love: Do you agree that [appdefaults] kinit = { pkinit_user =
pkcs11:....} is where this should go? Should this be an app default
or a lib default? I'm perfectly willing to code an appdefault check,
but I'd like some guidance that it's the right convention for future
Heimdal releases.
My mind set is based on there being a standard global pkcs11 library
like Solaris 10+ has (and some other OS's may acquire), and that
ought to be the default value for the pkinit library code. I can
understand that you may want a specific user's pkcs12 file, but that
oughtn't be in the system krb5.conf file.
------------------------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu