c++ - Kerberos administrator authorization -


i'm writing linux application integrates ms active directory. purpose i'm using kerberos. i've implemented mechanism authenticates domain user given credentials, want check if user member of administrators group.

so have creds obtained function.

error = krb5_get_init_creds_password(context, &creds, principals,         password.c_str(), null, null, 0, null, null); 

and here want implement logic authorizes user/administrator

if(!error) {     // admin check } 

i'm thinking of using krb5_verify_init_creds function i'm not sure how can that.

kerberos not authorization, authentication. (i.e. can figure out are, not allowed do).

in general, once have kerberos id, ask authorization service id allowed do. in case, straightforward thing make ldap query find out if user member in group interested in.

ms kerberos violates principle adding group information ad knows kerberos service tickets. however, not aware of standard kerberos api's provide access information.


Comments

Popular posts from this blog

javascript - Using jquery append to add option values into a select element not working -

Android soft keyboard reverts to default keyboard on orientation change -

jquery - javascript onscroll fade same class but with different div -