c++ - Kerberos administrator authorization -
i'm writing linux application integrates ms active directory. purpose i'm using kerberos. i've implemented mechanism authenticates domain user given credentials, want check if user member of administrators group.
so have creds
obtained function.
error = krb5_get_init_creds_password(context, &creds, principals, password.c_str(), null, null, 0, null, null);
and here want implement logic authorizes user/administrator
if(!error) { // admin check }
i'm thinking of using krb5_verify_init_creds
function i'm not sure how can that.
kerberos not authorization, authentication. (i.e. can figure out are, not allowed do).
in general, once have kerberos id, ask authorization service id allowed do. in case, straightforward thing make ldap query find out if user member in group interested in.
ms kerberos violates principle adding group information ad knows kerberos service tickets. however, not aware of standard kerberos api's provide access information.
Comments
Post a Comment