0

following setup: I am running a kerberos (MIT) and ldap (OpenLDAP) server for single sign on etc. Everything works fine but i have a question regarding inactive users.

I need to find kerberos principals, where the last successful login is beyond a certain time horizon. So far, i haven't been able to find any kind of "listing option for principal arguments" in kadmin. Of course i can go through every principal by typing:

 > kadmin: get_principal $princ_name.

and see what pops up. However, this can become very cumbersome for me. Does anyone have a trick/option in mind to speed up the process?

The only alternatives, which are ones I would not prefer, are either to script

 > kadmin -p kerb_user -q "get_principal $princ_name",

or to look directly into the log-files on the kerberos server. Maybe somebody has an idea!

2
  • Why not a shell script?
    – schroeder
    Apr 11, 2017 at 9:46
  • What is the backend database for your kdc? Is it OpenLDAP?
    – 84104
    May 30, 2017 at 17:56

1 Answer 1

1

unfortunately, getprinc does not have any options to restrict the output to just the arguments you want.

however, you can try the -terse option to display the output on 1 line (space separated fields) and script it easily, e.g :

getprinc -terse <principal>

and you can do a shell/perl/whatever script you want to parse all principals and get the data you want, but you will have to use an external script to do it i'm afraid.. (and it depends which field you want to filter, expiration date ?)

let me know if you want an example script, i could probably do an example quickly on my kerberos db

You must log in to answer this question.