如何组织Kerberos的keytabs和Ccaches？
我有一些问题，了解如何设计使用Kerberos协议进行通信的系统。让我们想象 - 我有一个应用程序实例，它具有大量需要与不同服务通信的插件。例如，一个插件负责与Postgres合作，另一个插件负责使用“ Windows AD”。但是我需要这些插件不能访问彼此的服务。 IE Postgres插件应该无法转到Windows Ad Service，反之亦然。或者，如果我有多个实例运行的Postgres插件，则每个插件都应为每个实例提供不同的服务访问。 实际问题是什么 - 我如何存储keytabs和/或ccaches，以便每个服务都有自己的限制访问权限。假设PGX库要求与系统的连接已经有一个TGT（CCACHE），只能在整个应用程序的环境变量中进行更改。但是，如果需要在同一应用程序中创建另一个连接，但是使用其他TGT，该怎么办？如果PGX库可以使用Keytab并在每个连接时自动生成TGT，那将是很好的，但是不幸的是，它不知道该怎么做。 我只是不明白，如何从应用程序中组织多个连接，考虑到每个插件必须具有不同的访问权限，并且考虑到几个插件可以连接到同一服务，或者与其他服务连接
I have a bit of a problem understanding how to design a system that communicates using the kerberos protocol. Let's imagine - I have an application instance that has a large number of plugins that need to communicate with different services. For example, one plugin is responsible for working with postgres, another plugin is responsible for working with "windows AD". But I need these plugins not to have access to each other's services. I.e. postgres plugin should not be able to go to windows ad service and vice versa. Or if I have multiple instances of the postgres plugin running, there should be different service accesses for each of them.
What is the actual question - how do I store keytabs and/or ccaches so that each service has its own, restricted accesses from the others. Let's say the pgx library requires that there already be a TGT (ccache) on connection to the system, it can only be changed in the environment variable of the whole application. But what should I do if I need to create another connection in the same application, but with a different TGT? It would be nice if the pgx library could take the keytab and generate the TGT automatically with every connection, but unfortunately it doesn't know how to do this.
I just don't understand, how I could organize multiple connections from my application, taking into account that every plugin must have different accesses, and considering that several plugins can connect either to the same service, or to different ones
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论