3

I have multiple Linux servers all configured to allow kerberos authentication with active directory. All other user and group attributes reside in a separate directory server (389). I am able to log in and fetch user information (getent passwd, id, getent group, etc...)

Now, each of these servers hosts a kerberized application (one per server) which users may access. Some of these applications do not use PAM. Is there a way by which I can restrict certain users to only access some of the applications/servers depending on whether they are members of a particular group?

My idea was to somehow find a way to restrict AD so that service tickets are only issued if the user is a member of a particular AD group. Alternatively there could be some configuration from the Linux side (example within krb5.conf) that allows me to perform authorisation checks or some how trigger the PAM session and account checks.

Thanks

1 Answer 1

1

Kerberos is meant for authentication, i.e. proving who someone is. It is not intended for authorization, i.e. figuring out what someone should be allowed to do. You'll need to use something else. To paraphrase, the application should say "Yes, I believe you are who you say you are, but you can't access what you're trying to access."

For sshd AllowGroups is a good choice. For applications that allow the use of LDAP filters, those would be ideal. It all depends on the authorization features of the application in question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .